feat(dex): integrate Noble testnet for USDC cross-chain operations

This commit integrates the Noble testnet (grand-1) with Sonr's x/dex module,
enabling native USDC trading and liquidity operations across IBC-enabled chains.

Changes:
- Add default params configuration with Noble testnet in allowed connections
- Create Noble-specific helper types and functions for USDC operations
- Implement USDC conversion utilities (base units <-> USDC decimals)
- Add NobleSwapParams and NobleLiquidityParams for structured operations
- Update genesis state to use default params with validation
- Add comprehensive Noble integration documentation
- Create unit tests for params and Noble helpers

Noble Configuration:
- Chain ID: noble-grand-1 (testnet)
- USDC Denom: uusdc (6 decimals)
- RPC: https://noble-testnet-rpc.polkachu.com:443
- gRPC: noble-testnet-grpc.polkachu.com:21590

Module Parameters:
- Max accounts per DID: 5
- Default ICA timeout: 600 seconds
- Min swap amount: 1000 base units
- Max daily volume: 1T base units
- Rate limits: 10 ops/block, 100 ops/DID/day
- Fees: 0.3% swap, 0.2% liquidity, 0.1% orders

This integration enables Sonr users to:
- Register ICA accounts on Noble testnet
- Execute cross-chain swaps with USDC
- Provide/remove liquidity in USDC pairs
- Trade with slippage protection
- Route multi-hop swaps through USDC

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.cz.toml

@@ -1,7 +1,18 @@
 [tool.commitizen]
-name = "cz_conventional_commits"
-tag_format = "v$version"
+name = "cz_customize"
+tag_format = "snrd/v$version"
+ignored_tag_formats = ["*/v${version}", "v${version}"]
 version_scheme = "semver"
-version = "0.5.20"
+version_provider = "scm"
 update_changelog_on_bump = true
+changelog_file = "CHANGELOG.md"
 major_version_zero = true
+annotated_tag = true
+pre_bump_hooks = ["bash scripts/hook-bump-pre.sh"]
+post_bump_hooks = ["goreleaser release --clean -f cmd/snrd/.goreleaser.yml"]
+
+[tool.commitizen.customize]
+bump_pattern = "^(feat|fix|refactor|perf|BREAKING CHANGE)"
+bump_map = { "BREAKING CHANGE" = "MAJOR", "feat" = "MINOR", "fix" = "PATCH", "refactor" = "PATCH", "perf" = "PATCH" }
+default_bump = "PATCH"
+changelog_pattern = "^(feat|fix|refactor|docs|build)\\(core\\)(!)?:"

.devcontainer/Dockerfile

@@ -5,13 +5,11 @@ WORKDIR /code
 USER root:root
 RUN mkdir -p /code && chown ${DEVBOX_USER}:${DEVBOX_USER} /code
 USER ${DEVBOX_USER}:${DEVBOX_USER}
-
-# Copy devbox configuration files
 COPY --chown=${DEVBOX_USER}:${DEVBOX_USER} devbox.json devbox.json
 COPY --chown=${DEVBOX_USER}:${DEVBOX_USER} devbox.lock devbox.lock
 
-RUN devbox run -- echo "Installed Packages."
+
+
+RUN devbox run -- echo "Installed Packages." && nix-store --gc && nix-store --optimise
+
 RUN devbox shellenv --init-hook >> ~/.profile
-
-
-

.devcontainer/devcontainer.json

@@ -7,83 +7,8 @@
   "customizations": {
     "vscode": {
       "settings": {},
-      "extensions": [
-        "jetpack-io.devbox"
-      ]
+      "extensions": ["jetpack-io.devbox"]
     }
   },
-  "remoteUser": "devbox",
-  "forwardPorts": [
-    1317,
-    26657,
-    9090,
-    3000,
-    80,
-    5000
-  ],
-  "portsAttributes": {
-    "1317": {
-      "label": "sonr-api",
-      "onAutoForward": "notify"
-    },
-    "26657": {
-      "label": "sonr-rpc",
-      "onAutoForward": "notify"
-    },
-    "9090": {
-      "label": "sonr-grpc",
-      "onAutoForward": "silent"
-    },
-    "3000": {
-      "label": "hway-frontend",
-      "onAutoForward": "silent"
-    },
-    "80": {
-      "label": "ipfs-gateway",
-      "onAutoForward": "silent"
-    },
-    "5000": {
-      "label": "ipfs-api",
-      "onAutoForward": "silent"
-    }
-  },
-  "features": {
-    "ghcr.io/michidk/devcontainers-features/bun:1": {
-      "version": "latest"
-    },
-    "ghcr.io/cirolosapio/devcontainers-features/alpine-ohmyzsh:0": {
-      "version": "latest"
-    },
-    "ghcr.io/guiyomh/features/golangci-lint:0": {
-      "version": "latest"
-    },
-    "ghcr.io/meaningful-ooo/devcontainer-features/homebrew:2": {
-      "version": "latest"
-    },
-    "ghcr.io/devcontainers/features/docker-in-docker:2": {
-      "version": "latest"
-    },
-    "ghcr.io/devcontainers/features/github-cli:1": {
-      "version": "latest"
-    },
-    "ghcr.io/devcontainers/features/go:1": {
-      "version": "latest",
-      "go": "1.23"
-    },
-    "ghcr.io/devcontainers/features/rust:1": {
-      "version": "latest",
-      "rust": "1.73"
-    },
-    "ghcr.io/jpawlowski/devcontainer-features/codespaces-dotfiles:1": {
-      "version": "latest"
-    },
-    "ghcr.io/duduribeiro/devcontainer-features/neovim:1": {
-      "version": "latest"
-    },
-    "ghcr.io/dlouwers/devcontainer-features/devbox:1": {
-      "version": "latest"
-    },
-    "ghcr.io/devcontainers/features/sshd:1": {
-      "version": "latest"
-    }
-  }
+  "remoteUser": "devbox"
+}

.dockerignore

@@ -0,0 +1,6 @@
+etc
+web
+packages
+build
+dist
+test

.github/CI.md

@@ -0,0 +1,119 @@
+# CI/CD Workflows
+
+## Overview
+
+Our CI/CD pipeline is optimized for speed and automation using:
+- Self-hosted `builder` runner for better performance
+- Smart scope detection via `github-env.sh`
+- Automated versioning and releases via `devbox` commands
+
+## Workflows
+
+### PR CI (`pr.yml`)
+**Trigger**: Pull requests
+**Purpose**: Validate, test, and build changed components
+**Features**:
+- Only tests/builds affected scopes
+- Runs linting first for fast feedback
+- Cleans up artifacts after run
+
+### Post-Merge Release (`merge.yml`)
+**Trigger**: Push to master/main
+**Purpose**: Automated version bumping and releases
+**Features**:
+- Auto-detects version increment from milestones
+- Bumps versions, creates tags, and releases
+- Publishes to package registries
+
+### Nightly Snapshot (`nightly.yml`)
+**Trigger**: Daily at 2 AM UTC or manual
+**Purpose**: Build development snapshots
+**Features**:
+- Creates snapshot builds without version bumps
+- Useful for testing bleeding-edge changes
+
+### Manual Release (`manual-release.yml`)
+**Trigger**: Manual workflow dispatch
+**Purpose**: Override for emergency releases
+**Features**:
+- Select specific scope to release
+- Choose version increment (patch/minor/major)
+- Bypasses automatic detection
+
+### CI Status (`ci-status.yml`)
+**Trigger**: Other workflow completions
+**Purpose**: Monitor CI health and report failures
+
+## Key Commands
+
+All workflows use these devbox commands that automatically detect changes:
+
+```bash
+devbox run test       # Tests only affected scopes
+devbox run build      # Builds only affected scopes
+devbox run bump       # Bumps versions for affected scopes
+devbox run release    # Releases affected scopes
+devbox run publish    # Publishes affected scopes
+devbox run snapshot   # Creates snapshots for affected scopes
+```
+
+## Performance Optimizations
+
+1. **Self-hosted Runner**: All workflows run on `builder` for:
+   - Local dependency caching
+   - No cold starts
+   - Unlimited build time
+
+2. **Smart Caching**: 
+   - Go modules cached at `~/go/pkg/mod`
+   - pnpm store cached at `~/.local/share/pnpm/store`
+   - Devbox packages cached at `~/.devbox`
+
+3. **Scope Detection**: Only test/build what changed using `github-env.sh`
+
+4. **Cleanup Steps**: Prevent disk fill on self-hosted runner
+
+## Adding New Components
+
+1. Add scope to `.github/scopes.json`:
+```json
+{
+  "name": "new-component",
+  "include": ["path/to/component/**"]
+}
+```
+
+2. Add scripts to `devbox.json`:
+```json
+"test:new-component": "make test-new-component",
+"build:new-component": "make build-new-component",
+"bump:new-component": "make -C path/to/component bump",
+"release:new-component": "make -C path/to/component release"
+```
+
+3. That's it! CI automatically picks up the new scope.
+
+## Secrets Required
+
+- `GH_PAT_TOKEN`: GitHub Personal Access Token for pushing tags
+- `GORELEASER_KEY`: GoReleaser Pro license key
+- `NPM_TOKEN`: NPM registry authentication
+- `CLOUDFLARE_API_TOKEN`: For deploying web apps
+- `AWS_ACCESS_KEY_ID` & `AWS_SECRET_ACCESS_KEY`: For S3 uploads
+
+## Troubleshooting
+
+### Workflow not detecting changes?
+- Check `.github/scopes.json` includes the correct paths
+- Verify `github-env.sh` is executable
+- Ensure full git history with `fetch-depth: 0`
+
+### Self-hosted runner issues?
+- Check runner has required dependencies
+- Verify disk space for builds
+- Check runner is online in Settings > Actions > Runners
+
+### Release not triggering?
+- Verify component has `bump:*` and `release:*` scripts
+- Check git permissions with PAT token
+- Ensure commitizen config exists for component

.github/CODEOWNERS

@@ -0,0 +1 @@
+@prnk28

.github/DISCUSSION_TEMPLATE/milestone.yml

@@ -1,30 +0,0 @@
-title: "[Milestone] "
-labels: ["#OKR", "#PLANNING"]
-body:
-  - type: input
-    id: has-version
-    attributes:
-      label: Version
-      description: A tag for the associated milestone.
-      placeholder: v0.6.0
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Objective
-      description: Explain the objective of the OKR in less than 100 characters.
-      placeholder: Ethereum IBC integration with Sonr.
-      render: markdown
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Task List
-      description: |
-        Break down the objective into a list of tasks to be completed.
-      value: |
-        - [ ] #
-        - [ ] #
-        - [ ] #
-    validations:
-      required: true

.github/ISSUE_TEMPLATE/bug.yml

@@ -1,38 +0,0 @@
-name: Bug Report
-description: File a bug report.
-title: "ERROR: "
-labels: ["#BUG", "#HELP"]
-projects: ["onsonr/39"]
-body:
-  - type: textarea
-    attributes:
-      label: Operating System
-      description: What operating system are you using?
-      placeholder: "Example: macOS Big Sur"
-      value: operating system
-    validations:
-      required: true
-  - type: dropdown
-    attributes:
-      label: Network
-      description: What network are you using?
-      multiple: false
-      options:
-        - LocalNet
-        - TestNet
-        - MainNet
-      default: 0
-    validations:
-      required: true
-  - type: checkboxes
-    attributes:
-      label: Code of Conduct
-      description:
-        The Code of Conduct helps create a safe space for everyone. We require
-        that everyone agrees to it.
-      options:
-        - label: I agree to follow this project's [Code of Conduct](link/to/coc)
-          required: true
-  - type: markdown
-    attributes:
-      value: "Thanks for completing our form!"

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +0,0 @@
-blank_issues_enabled: false
-contact_links:
-  - name: Community Discussions
-    url: https://github.com/orgs/onsonr/discussions
-    about: Please submit ideas and suggestions here.

.github/ISSUE_TEMPLATE/to-do.md

@@ -1,22 +0,0 @@
----
-name: Default Todo
-about: Break down feature requirements into tasks.
-title: "Name of the new task"
-labels:
-  - "#TODO"
-  - "#OKR"
-assignees: "prnk28"
-projects: "onsonr/37"
----
-
-### Description
-
-The expected deliverable of the task.
-
-### Associated Files
-
-These files will be modified by this task.
-
-### References
-
-Use these documents to help you complete the task.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,25 +0,0 @@
-<!--- Provide a general summary of your changes in the Title above -->
-
-## Description
-
-<!--- Describe your changes in detail -->
-
-## Related Issue(s)
-
-<!--- This project only accepts pull requests related to open issues -->
-<!--- If suggesting a new feature or change, please discuss it in an issue first -->
-<!--- If fixing a bug, there should be an issue describing it with steps to reproduce -->
-<!--- Please link to the issue here: -->
-
-## Motivation and Context
-
-<!--- Why is this change required? What problem does it solve? -->
-<!--- If it fixes an open issue, please link to the issue here. -->
-
-## How Has This Been Tested?
-
-<!--- Please describe in detail how you tested your changes. -->
-<!--- Include details of your testing environment, and the tests you ran to -->
-<!--- see how your change affects other areas of the code, etc. -->
-
-## Screenshots (if appropriate):

.github/README.md

@@ -0,0 +1,317 @@
+
+[![Go Reference](https://pkg.go.dev/badge/github.com/sonr-io/sonr.svg)](https://pkg.go.dev/github.com/sonr-io/sonr)
+![GitHub commit activity](https://img.shields.io/github/commit-activity/w/sonr-io/sonr)
+[![Static Badge](https://img.shields.io/badge/homepage-sonr.io-blue?style=flat-square)](https://sonr.io)
+[![Go Report Card](https://goreportcard.com/badge/github.com/sonr-io/sonr)](https://goreportcard.com/report/github.com/sonr-io/sonr)
+
+[![Sonr](./banner.png)](https://sonr.io)
+
+> **Sonr is a blockchain ecosystem combining decentralized identity, secure data storage, and multi-chain interoperability. Built on Cosmos SDK v0.50.14, it provides users with self-sovereign identity through W3C DIDs, WebAuthn authentication, and personal data vaults—all without requiring cryptocurrency for onboarding.**
+
+## 💡 Key Features
+
+### 🔐 Gasless Onboarding
+
+Create your first decentralized identity without owning cryptocurrency:
+
+```bash
+# Register with WebAuthn (no tokens required!)
+snrd auth register --username alice
+
+# Register with automatic vault creation
+snrd auth register --username bob --auto-vault
+```
+
+### 🌐 Multi-Chain Support
+
+- **Cosmos SDK**: Native integration with IBC ecosystem
+- **EVM Compatibility**: Ethereum smart contract support
+- **External Wallets**: MetaMask, Keplr, and more
+
+### 🔑 Advanced Authentication
+
+- **WebAuthn/Passkeys**: Biometric authentication
+- **Hardware Security Keys**: YubiKey, Titan Key support
+- **Multi-Signature**: Multiple verification methods per DID
+
+### 📦 Decentralized Storage
+
+- **IPFS Integration**: Distributed file storage
+- **Encrypted Vaults**: Hardware-backed encryption
+- **Protocol Schemas**: Structured data validation
+
+## 📚 Technical Specifications
+
+- **Cosmos SDK**: v0.50.14
+- **CometBFT**: v0.38.17
+- **IBC**: v8.7.0
+- **Go**: 1.24.1 (toolchain 1.24.4)
+- **WebAssembly**: CosmWasm v1.5.8
+- **Task Queue**: Asynq (Redis-based)
+- **Actor System**: Proto.Actor
+- **Storage**: IPFS, LevelDB
+
+## 🔒 Security
+
+### Gasless Transaction Security
+
+- Limited to WebAuthn registration only
+- Full cryptographic validation required
+- Credential uniqueness enforcement
+- Anti-replay protection
+
+### WebAuthn Security
+
+- Origin validation
+- Challenge-response authentication
+- Device binding
+- Attestation verification
+
+### Multi-Algorithm Support
+
+- Ed25519 (quantum-resistant)
+- ECDSA (secp256k1, P-256)
+- RSA (2048, 3072, 4096 bits)
+- WebAuthn (ES256, RS256)
+
+## 🚀 Quick Start
+
+### Installation
+
+```bash
+# Clone the repository
+git clone https://github.com/sonr-io/sonr
+cd sonr
+
+# Install the binary
+make install
+
+# Verify installation
+snrd version
+```
+
+### Running a Local Node
+
+```bash
+# Start single-node testnet (quick iteration)
+make localnet
+
+# Start multi-node testnet with Starship
+make testnet-start
+
+# Stop testnet
+make testnet-stop
+```
+
+### Building from Source
+
+```bash
+# Build snrd blockchain node
+make build
+
+# Build Docker image
+make docker
+
+# Generate code from proto files
+make proto-gen
+```
+
+### Local Development Network
+
+```bash
+# Standard localnet (auto-detects best method for your system)
+make localnet     # Works on Arch Linux, Ubuntu, macOS, etc.
+
+# Docker-based localnet (requires Docker)
+make dockernet    # Runs in detached mode
+
+# One-time setup for your system (optional)
+./scripts/setup_localnet.sh  # Installs dependencies and configures environment
+```
+
+### Testing
+
+```bash
+# Run all tests
+make test-all
+
+# Module-specific tests
+make test-did     # DID module tests
+make test-dwn     # DWN module tests
+make test-svc     # Service module tests
+
+# E2E tests
+make ictest-basic # Basic chain functionality
+make ictest-ibc   # IBC transfers
+make ictest-wasm  # CosmWasm integration
+
+# Test with coverage
+make test-cover
+```
+
+### Infrastructure
+
+```bash
+# IPFS for vault operations
+make ipfs-up      # Start IPFS infrastructure
+make ipfs-down    # Stop IPFS infrastructure
+make ipfs-status  # Check IPFS connectivity
+```
+
+## 🏗️ Architecture
+
+Sonr is a Cosmos SDK-based blockchain with integrated IPFS storage and three custom modules:
+
+### Core Components
+
+#### **Blockchain Node (`snrd`)**
+
+The main blockchain daemon built with Cosmos SDK v0.50.14, providing:
+
+- AutoCLI for command generation
+- EVM compatibility via Evmos integration
+- IBC for cross-chain communication
+- CosmWasm smart contract support
+- IPFS integration for decentralized storage
+
+## 📖 Module Documentation
+
+### DID Module
+
+W3C DID specification implementation with:
+
+- **Gasless WebAuthn Registration**: Create DIDs without cryptocurrency
+- **Multi-Algorithm Signatures**: Ed25519, ECDSA, RSA, WebAuthn
+- **External Wallet Linking**: MetaMask, Keplr integration
+- **Verifiable Credentials**: W3C-compliant credential issuance
+
+```bash
+# Create a DID
+snrd tx did create-did did:sonr:alice '{"id":"did:sonr:alice",...}' --from alice
+
+# Link external wallet
+snrd tx did link-external-wallet did:sonr:alice \
+  --wallet-address 0x742d35Cc6635C0532925a3b8c17C6e583F4d6A42 \
+  --wallet-type ethereum \
+  --from alice
+
+# Query DID
+snrd query did resolve did:sonr:alice
+```
+
+[Full DID Module Documentation](x/did/README.md)
+
+### DWN Module
+
+Personal data stores with:
+
+- **Structured Data Records**: Hierarchical data organization
+- **Protocol-Based Interactions**: Enforceable data schemas
+- **Secure Vaults**: Enclave-based key management
+- **Multi-Chain Support**: Cosmos SDK and EVM transaction building
+
+```bash
+# Create a vault
+snrd tx dwn create-vault --from alice
+
+# Store a record
+snrd tx dwn write-record '{"data":"...", "protocol":"example.com"}' --from alice
+
+# Query records
+snrd query dwn records --owner alice
+```
+
+[Full DWN Module Documentation](x/dwn/README.md)
+
+### Service Module
+
+Decentralized service registry featuring:
+
+- **Domain Verification**: DNS-based ownership proof
+- **Service Registration**: Verified service endpoints
+- **Permission Management**: UCAN capability integration
+
+```bash
+# Verify domain ownership
+snrd tx svc initiate-domain-verification example.com --from alice
+snrd tx svc verify-domain example.com --from alice
+
+# Register service
+snrd tx svc register-service my-service example.com \
+  --permissions "read,write" --from alice
+```
+
+[Full Service Module Documentation](x/svc/README.md)
+
+## 🔧 Configuration
+
+### Environment Variables
+
+Environment variables can be configured for local development:
+
+```bash
+# Chain configuration
+export CHAIN_ID="localchain_9000-1"
+export BLOCK_TIME="1000ms"
+
+# Network selection for Starship
+export NETWORK="devnet"  # or "testnet"
+
+# IPFS configuration
+IPFS_API_URL=http://127.0.0.1:5001
+```
+
+Environment variables can be set directly or via a `.env` file in the project root.
+
+### Starship Configuration
+
+Edit `starship.yml` to configure multi-node testnets:
+
+```yaml
+chains:
+  - id: sonrtest_1-1
+    name: custom
+    numValidators: 3
+    image: onsonr/snrd:latest
+    # ... additional configuration
+```
+
+## 🏗️ Project Structure
+
+```
+sonr/
+├── app/              # Application setup and module wiring
+├── cmd/              # Binary entry points
+│   └── snrd/        # Blockchain node
+├── x/               # Custom chain modules
+│   ├── did/         # W3C DID implementation
+│   ├── dwn/         # Decentralized Web Nodes
+│   └── svc/         # Service management
+├── types/           # Internal packages
+│   ├── coins/       # Coin utilities
+│   └── ipfs/        # IPFS integration
+├── proto/           # Protobuf definitions
+├── scripts/         # Utility scripts
+├── test/            # Integration tests
+└── docs/            # Documentation site
+```
+
+## 🤝 Community & Support
+
+- [GitHub Discussions](https://github.com/sonr-io/sonr/discussions) - Community forum
+- [GitHub Issues](https://github.com/sonr-io/sonr/issues) - Bug reports and feature requests
+- [Twitter](https://sonr.io/twitter) - Latest updates
+- [Documentation Wiki](https://github.com/sonr-io/sonr/wiki) - Detailed guides
+
+
+## 📄 License
+
+Copyright © 2024 Sonr, Inc.
+
+Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) for details.
+
+---
+
+<p align="center">
+  Built with ❤️ by the Sonr team
+</p>

.github/aider/guides/cosmos-proto.md

@@ -1,569 +0,0 @@
-# Protocol Buffers in Cosmos SDK
-
-## Overview
-
-The Cosmos SDK uses Protocol Buffers for serialization and API definitions. Generation is handled via a Docker image: `ghcr.io/cosmos/proto-builder:0.15.x`.
-
-## Generation Tools
-
-- **Buf**: Primary tool for protobuf management
-- **protocgen.sh**: Core generation script in `scripts/` 
-- **Makefile Commands**: Standard commands for generate, lint, format
-
-## Key Components
-
-### Buf Configuration
-
-1. **Workspace Setup**
-   - Root level buf workspace configuration
-   - Manages multiple protobuf directories
-
-2. **Directory Structure**
-   ```
-   proto/
-   ├── buf.gen.gogo.yaml    # GoGo Protobuf generation
-   ├── buf.gen.pulsar.yaml  # Pulsar API generation  
-   ├── buf.gen.swagger.yaml # OpenAPI/Swagger docs
-   ├── buf.lock            # Dependencies
-   ├── buf.yaml            # Core configuration
-   ├── cosmos/            # Core protos
-   └── tendermint/        # Consensus protos
-   ```
-
-3. **Module Protos**
-   - Located in `x/{moduleName}/proto`
-   - Module-specific message definitions
-
-#### `buf.gen.gogo.yaml`
-
-`buf.gen.gogo.yaml` defines how the protobuf files should be generated for use with in the module. This file uses [gogoproto](https://github.com/gogo/protobuf), a separate generator from the google go-proto generator that makes working with various objects more ergonomic, and it has more performant encode and decode steps
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/main/proto/buf.gen.gogo.yaml#L1-L9
-```
-
-#### `buf.gen.pulsar.yaml`
-
-`buf.gen.pulsar.yaml` defines how protobuf files should be generated using the [new golang apiv2 of protobuf](https://go.dev/blog/protobuf-apiv2). This generator is used instead of the google go-proto generator because it has some extra helpers for Cosmos SDK applications and will have more performant encode and decode than the google go-proto generator. You can follow the development of this generator [here](https://github.com/cosmos/cosmos-proto).
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/main/proto/buf.gen.pulsar.yaml#L1-L18
-```
-
-#### `buf.gen.swagger.yaml`
-
-`buf.gen.swagger.yaml` generates the swagger documentation for the query and messages of the chain. This will only define the REST API end points that were defined in the query and msg servers. You can find examples of this [here](https://github.com/cosmos/cosmos-sdk/blob/main/x/bank/proto/cosmos/bank/v1beta1/query.proto)
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/main/proto/buf.gen.swagger.yaml#L1-L6
-```
-
-#### `buf.lock`
-
-This is an autogenerated file based off the dependencies required by the `.gen` files. There is no need to copy the current one. If you depend on cosmos-sdk proto definitions a new entry for the Cosmos SDK will need to be provided. The dependency you will need to use is `buf.build/cosmos/cosmos-sdk`.
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/main/proto/buf.lock#L1-L16
-```
-
-#### `buf.yaml`
-
-`buf.yaml` defines the [name of your package](https://github.com/cosmos/cosmos-sdk/blob/main/proto/buf.yaml#L3), which [breakage checker](https://buf.build/docs/tutorials/getting-started-with-buf-cli#detect-breaking-changes) to use and how to [lint your protobuf files](https://buf.build/docs/tutorials/getting-started-with-buf-cli#lint-your-api).
-
-It is advised to use a tagged version of the buf modules corresponding to the version of the Cosmos SDK being are used.
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/main/proto/buf.yaml#L1-L24
-```
-
-We use a variety of linters for the Cosmos SDK protobuf files. The repo also checks this in ci.
-A reference to the github actions can be found [here](https://github.com/cosmos/cosmos-sdk/blob/main/.github/workflows/proto.yml#L1-L32)
-
-# ORM
-
-The Cosmos SDK ORM is a state management library that provides a rich, but opinionated set of tools for managing a
-module's state. It provides support for:
-
-- type safe management of state
-- multipart keys
-- secondary indexes
-- unique indexes
-- easy prefix and range queries
-- automatic genesis import/export
-- automatic query services for clients, including support for light client proofs (still in development)
-- indexing state data in external databases (still in development)
-
-## Design and Philosophy
-
-The ORM's data model is inspired by the relational data model found in SQL databases. The core abstraction is a table
-with a primary key and optional secondary indexes.
-
-Because the Cosmos SDK uses protobuf as its encoding layer, ORM tables are defined directly in .proto files using
-protobuf options. Each table is defined by a single protobuf `message` type and a schema of multiple tables is
-represented by a single .proto file.
-
-Table structure is specified in the same file where messages are defined in order to make it easy to focus on better
-design of the state layer. Because blockchain state layout is part of the public API for clients (TODO: link to docs on
-light client proofs), it is important to think about the state layout as being part of the public API of a module.
-Changing the state layout actually breaks clients, so it is ideal to think through it carefully up front and to aim for
-a design that will eliminate or minimize breaking changes down the road. Also, good design of state enables building
-more performant and sophisticated applications. Providing users with a set of tools inspired by relational databases
-which have a long history of database design best practices and allowing schema to be specified declaratively in a
-single place are design choices the ORM makes to enable better design and more durable APIs.
-
-Also, by only supporting the table abstraction as opposed to key-value pair maps, it is easy to add to new
-columns/fields to any data structure without causing a breaking change and the data structures can easily be indexed in
-any off-the-shelf SQL database for more sophisticated queries.
-
-The encoding of fields in keys is designed to support ordered iteration for all protobuf primitive field types
-except for `bytes` as well as the well-known types `google.protobuf.Timestamp` and `google.protobuf.Duration`. Encodings
-are optimized for storage space when it makes sense (see the documentation in `cosmos/orm/v1/orm.proto` for more details)
-and table rows do not use extra storage space to store key fields in the value.
-
-We recommend that users of the ORM attempt to follow database design best practices such as
-[normalization](https://en.wikipedia.org/wiki/Database_normalization) (at least 1NF).
-For instance, defining `repeated` fields in a table is considered an anti-pattern because breaks first normal form (1NF).
-Although we support `repeated` fields in tables, they cannot be used as key fields for this reason. This may seem
-restrictive but years of best practice (and also experience in the SDK) have shown that following this pattern
-leads to easier to maintain schemas.
-
-To illustrate the motivation for these principles with an example from the SDK, historically balances were stored
-as a mapping from account -> map of denom to amount. This did not scale well because an account with 100 token balances
-needed to be encoded/decoded every time a single coin balance changed. Now balances are stored as account,denom -> amount
-as in the example above. With the ORM's data model, if we wanted to add a new field to `Balance` such as
-`unlocked_balance` (if vesting accounts were redesigned in this way), it would be easy to add it to this table without
-requiring a data migration. Because of the ORM's optimizations, the account and denom are only stored in the key part
-of storage and not in the value leading to both a flexible data model and efficient usage of storage.
-
-## Defining Tables
-
-To define a table:
-
-1. create a .proto file to describe the module's state (naming it `state.proto` is recommended for consistency),
-   and import "cosmos/orm/v1/orm.proto", ex:
-
-```protobuf
-syntax = "proto3";
-package bank_example;
-
-import "cosmos/orm/v1/orm.proto";
-```
-
-2. define a `message` for the table, ex:
-
-```protobuf
-message Balance {
-  bytes account = 1;
-  string denom = 2;
-  uint64 balance = 3;
-}
-```
-
-3. add the `cosmos.orm.v1.table` option to the table and give the table an `id` unique within this .proto file:
-
-```protobuf
-message Balance {
-  option (cosmos.orm.v1.table) = {
-    id: 1
-  };
-
-  bytes account = 1;
-  string denom = 2;
-  uint64 balance = 3;
-}
-```
-
-4. define the primary key field or fields, as a comma-separated list of the fields from the message which should make
-   up the primary key:
-
-```protobuf
-message Balance {
-  option (cosmos.orm.v1.table) = {
-    id: 1
-    primary_key: { fields: "account,denom" }
-  };
-
-  bytes account = 1;
-  string denom = 2;
-  uint64 balance = 3;
-}
-```
-
-5. add any desired secondary indexes by specifying an `id` unique within the table and a comma-separate list of the
-   index fields:
-
-```protobuf
-message Balance {
-  option (cosmos.orm.v1.table) = {
-    id: 1;
-    primary_key: { fields: "account,denom" }
-    index: { id: 1 fields: "denom" } // this allows querying for the accounts which own a denom
-  };
-
-  bytes account = 1;
-  string denom   = 2;
-  uint64 amount  = 3;
-}
-```
-
-### Auto-incrementing Primary Keys
-
-A common pattern in SDK modules and in database design is to define tables with a single integer `id` field with an
-automatically generated primary key. In the ORM we can do this by setting the `auto_increment` option to `true` on the
-primary key, ex:
-
-```protobuf
-message Account {
-  option (cosmos.orm.v1.table) = {
-    id: 2;
-    primary_key: { fields: "id", auto_increment: true }
-  };
-
-  uint64 id = 1;
-  bytes address = 2;
-}
-```
-
-### Unique Indexes
-
-A unique index can be added by setting the `unique` option to `true` on an index, ex:
-
-```protobuf
-message Account {
-  option (cosmos.orm.v1.table) = {
-    id: 2;
-    primary_key: { fields: "id", auto_increment: true }
-    index: {id: 1, fields: "address", unique: true}
-  };
-
-  uint64 id = 1;
-  bytes address = 2;
-}
-```
-
-### Singletons
-
-The ORM also supports a special type of table with only one row called a `singleton`. This can be used for storing
-module parameters. Singletons only need to define a unique `id` and that cannot conflict with the id of other
-tables or singletons in the same .proto file. Ex:
-
-```protobuf
-message Params {
-  option (cosmos.orm.v1.singleton) = {
-    id: 3;
-  };
-
-  google.protobuf.Duration voting_period = 1;
-  uint64 min_threshold = 2;
-}
-```
-
-## Running Codegen
-
-NOTE: the ORM will only work with protobuf code that implements the [google.golang.org/protobuf](https://pkg.go.dev/google.golang.org/protobuf)
-API. That means it will not work with code generated using gogo-proto.
-
-To install the ORM's code generator, run:
-
-```shell
-go install cosmossdk.io/orm/cmd/protoc-gen-go-cosmos-orm@latest
-```
-
-The recommended way to run the code generator is to use [buf build](https://docs.buf.build/build/usage).
-This is an example `buf.gen.yaml` that runs `protoc-gen-go`, `protoc-gen-go-grpc` and `protoc-gen-go-cosmos-orm`
-using buf managed mode:
-
-```yaml
-version: v1
-managed:
-  enabled: true
-  go_package_prefix:
-    default: foo.bar/api # the go package prefix of your package
-    override:
-      buf.build/cosmos/cosmos-sdk: cosmossdk.io/api # required to import the Cosmos SDK api module
-plugins:
-  - name: go
-    out: .
-    opt: paths=source_relative
-  - name: go-grpc
-    out: .
-    opt: paths=source_relative
-  - name: go-cosmos-orm
-    out: .
-    opt: paths=source_relative
-```
-
-## Using the ORM in a module
-
-### Initialization
-
-To use the ORM in a module, first create a `ModuleSchemaDescriptor`. This tells the ORM which .proto files have defined
-an ORM schema and assigns them all a unique non-zero id. Ex:
-
-```go
-var MyModuleSchema = &ormv1alpha1.ModuleSchemaDescriptor{
-    SchemaFile: []*ormv1alpha1.ModuleSchemaDescriptor_FileEntry{
-        {
-            Id:            1,
-            ProtoFileName: mymodule.File_my_module_state_proto.Path(),
-        },
-    },
-}
-```
-
-In the ORM generated code for a file named `state.proto`, there should be an interface `StateStore` that got generated
-with a constructor `NewStateStore` that takes a parameter of type `ormdb.ModuleDB`. Add a reference to `StateStore`
-to your module's keeper struct. Ex:
-
-```go
-type Keeper struct {
-    db StateStore
-}
-```
-
-Then instantiate the `StateStore` instance via an `ormdb.ModuleDB` that is instantiated from the `SchemaDescriptor`
-above and one or more store services from `cosmossdk.io/core/store`. Ex:
-
-```go
-func NewKeeper(storeService store.KVStoreService) (*Keeper, error) {
-    modDb, err := ormdb.NewModuleDB(MyModuleSchema, ormdb.ModuleDBOptions{KVStoreService: storeService})
-    if err != nil {
-        return nil, err
-    }
-    db, err := NewStateStore(modDb)
-    if err != nil {
-        return nil, err
-    }
-    return Keeper{db: db}, nil
-}
-```
-
-### Using the generated code
-
-The generated code for the ORM contains methods for inserting, updating, deleting and querying table entries.
-For each table in a .proto file, there is a type-safe table interface implemented in generated code. For instance,
-for a table named `Balance` there should be a `BalanceTable` interface that looks like this:
-
-```go
-type BalanceTable interface {
-    Insert(ctx context.Context, balance *Balance) error
-    Update(ctx context.Context, balance *Balance) error
-    Save(ctx context.Context, balance *Balance) error
-    Delete(ctx context.Context, balance *Balance) error
-    Has(ctx context.Context, account []byte, denom string) (found bool, err error)
-    // Get returns nil and an error which responds true to ormerrors.IsNotFound() if the record was not found.
-    Get(ctx context.Context, account []byte, denom string) (*Balance, error)
-    List(ctx context.Context, prefixKey BalanceIndexKey, opts ...ormlist.Option) (BalanceIterator, error)
-    ListRange(ctx context.Context, from, to BalanceIndexKey, opts ...ormlist.Option) (BalanceIterator, error)
-    DeleteBy(ctx context.Context, prefixKey BalanceIndexKey) error
-    DeleteRange(ctx context.Context, from, to BalanceIndexKey) error
-
-    doNotImplement()
-}
-```
-
-This `BalanceTable` should be accessible from the `StateStore` interface (assuming our file is named `state.proto`)
-via a `BalanceTable()` accessor method. If all the above example tables/singletons were in the same `state.proto`,
-then `StateStore` would get generated like this:
-
-```go
-type BankStore interface {
-    BalanceTable() BalanceTable
-    AccountTable() AccountTable
-    ParamsTable() ParamsTable
-
-    doNotImplement()
-}
-```
-
-So to work with the `BalanceTable` in a keeper method we could use code like this:
-
-```go
-func (k keeper) AddBalance(ctx context.Context, acct []byte, denom string, amount uint64) error {
-    balance, err := k.db.BalanceTable().Get(ctx, acct, denom)
-    if err != nil && !ormerrors.IsNotFound(err) {
-        return err
-    }
-
-    if balance == nil {
-        balance = &Balance{
-            Account: acct,
-            Denom:   denom,
-            Amount:  amount,
-        }
-    } else {
-        balance.Amount = balance.Amount + amount
-    }
-
-    return k.db.BalanceTable().Save(ctx, balance)
-}
-```
-
-`List` methods take `IndexKey` parameters. For instance, `BalanceTable.List` takes `BalanceIndexKey`. `BalanceIndexKey`
-let's represent index keys for the different indexes (primary and secondary) on the `Balance` table. The primary key
-in the `Balance` table gets a struct `BalanceAccountDenomIndexKey` and the first index gets an index key `BalanceDenomIndexKey`.
-If we wanted to list all the denoms and amounts that an account holds, we would use `BalanceAccountDenomIndexKey`
-with a `List` query just on the account prefix. Ex:
-
-```go
-it, err := keeper.db.BalanceTable().List(ctx, BalanceAccountDenomIndexKey{}.WithAccount(acct))
-```
-
----
-
-## sidebar_position: 1
-
-# ProtocolBuffer Annotations
-
-This document explains the various protobuf scalars that have been added to make working with protobuf easier for Cosmos SDK application developers
-
-## Signer
-
-Signer specifies which field should be used to determine the signer of a message for the Cosmos SDK. This field can be used for clients as well to infer which field should be used to determine the signer of a message.
-
-Read more about the signer field [here](./02-messages-and-queries.md).
-
-```protobuf reference
-https://github.com/cosmos/cosmos-sdk/blob/e6848d99b55a65d014375b295bdd7f9641aac95e/proto/cosmos/bank/v1beta1/tx.proto#L40
-```
-
-```proto
-option (cosmos.msg.v1.signer) = "from_address";
-```
-
-## Scalar
-
-The scalar type defines a way for clients to understand how to construct protobuf messages according to what is expected by the module and sdk.
-
-```proto
-(cosmos_proto.scalar) = "cosmos.AddressString"
-```
-
-Example of account address string scalar:
-
-```proto reference
-https://github.com/cosmos/cosmos-sdk/blob/e6848d99b55a65d014375b295bdd7f9641aac95e/proto/cosmos/bank/v1beta1/tx.proto#L46
-```
-
-Example of validator address string scalar:
-
-```proto reference
-https://github.com/cosmos/cosmos-sdk/blob/e8f28bf5db18b8d6b7e0d94b542ce4cf48fed9d6/proto/cosmos/distribution/v1beta1/query.proto#L87
-```
-
-Example of pubkey scalar:
-
-```proto reference
-https://github.com/cosmos/cosmos-sdk/blob/11068bfbcd44a7db8af63b6a8aa079b1718f6040/proto/cosmos/staking/v1beta1/tx.proto#L94
-```
-
-Example of Decimals scalar:
-
-```proto reference
-https://github.com/cosmos/cosmos-sdk/blob/e8f28bf5db18b8d6b7e0d94b542ce4cf48fed9d6/proto/cosmos/distribution/v1beta1/distribution.proto#L26
-```
-
-Example of Int scalar:
-
-```proto reference
-https://github.com/cosmos/cosmos-sdk/blob/e8f28bf5db18b8d6b7e0d94b542ce4cf48fed9d6/proto/cosmos/gov/v1/gov.proto#L137
-```
-
-There are a few options for what can be provided as a scalar: `cosmos.AddressString`, `cosmos.ValidatorAddressString`, `cosmos.ConsensusAddressString`, `cosmos.Int`, `cosmos.Dec`.
-
-## Implements_Interface
-
-Implement interface is used to provide information to client tooling like [telescope](https://github.com/cosmology-tech/telescope) on how to encode and decode protobuf messages.
-
-```proto
-option (cosmos_proto.implements_interface) = "cosmos.auth.v1beta1.AccountI";
-```
-
-## Method,Field,Message Added In
-
-`method_added_in`, `field_added_in` and `message_added_in` are annotations to denotate to clients that a field has been supported in a later version. This is useful when new methods or fields are added in later versions and that the client needs to be aware of what it can call.
-
-The annotation should be worded as follow:
-
-```proto
-option (cosmos_proto.method_added_in) = "cosmos-sdk v0.50.1";
-option (cosmos_proto.method_added_in) = "x/epochs v1.0.0";
-option (cosmos_proto.method_added_in) = "simapp v24.0.0";
-```
-
-## Amino
-
-The amino codec was removed in `v0.50+`, this means there is not a need register `legacyAminoCodec`. To replace the amino codec, Amino protobuf annotations are used to provide information to the amino codec on how to encode and decode protobuf messages.
-
-:::note
-Amino annotations are only used for backwards compatibility with amino. New modules are not required use amino annotations.
-:::
-
-The below annotations are used to provide information to the amino codec on how to encode and decode protobuf messages in a backwards compatible manner.
-
-### Name
-
-Name specifies the amino name that would show up for the user in order for them see which message they are signing.
-
-```proto
-option (amino.name) = "cosmos-sdk/BaseAccount";
-```
-
-```proto reference
-https://github.com/cosmos/cosmos-sdk/blob/e8f28bf5db18b8d6b7e0d94b542ce4cf48fed9d6/proto/cosmos/bank/v1beta1/tx.proto#L41
-```
-
-### Field_Name
-
-Field name specifies the amino name that would show up for the user in order for them see which field they are signing.
-
-```proto
-uint64 height = 1 [(amino.field_name) = "public_key"];
-```
-
-```proto reference
-https://github.com/cosmos/cosmos-sdk/blob/e8f28bf5db18b8d6b7e0d94b542ce4cf48fed9d6/proto/cosmos/distribution/v1beta1/distribution.proto#L166
-```
-
-### Dont_OmitEmpty
-
-Dont omitempty specifies that the field should not be omitted when encoding to amino.
-
-```proto
-repeated cosmos.base.v1beta1.Coin amount = 3 [(amino.dont_omitempty)   = true];
-```
-
-```proto reference
-https://github.com/cosmos/cosmos-sdk/blob/e8f28bf5db18b8d6b7e0d94b542ce4cf48fed9d6/proto/cosmos/bank/v1beta1/bank.proto#L56
-```
-
-### Encoding
-
-Encoding instructs the amino json marshaler how to encode certain fields that may differ from the standard encoding behaviour. The most common example of this is how `repeated cosmos.base.v1beta1.Coin` is encoded when using the amino json encoding format. The `legacy_coins` option tells the json marshaler [how to encode a null slice](https://github.com/cosmos/cosmos-sdk/blob/e8f28bf5db18b8d6b7e0d94b542ce4cf48fed9d6/x/tx/signing/aminojson/json_marshal.go#L65) of `cosmos.base.v1beta1.Coin`.
-
-```proto
-(amino.encoding)         = "legacy_coins",
-```
-
-```proto reference
-https://github.com/cosmos/cosmos-sdk/blob/e8f28bf5db18b8d6b7e0d94b542ce4cf48fed9d6/proto/cosmos/bank/v1beta1/genesis.proto#L23
-```
-
-Another example is a protobuf `bytes` that contains a valid JSON document.
-The `inline_json` option tells the json marshaler to embed the JSON bytes into the wrapping document without escaping.
-
-```proto
-(amino.encoding)         = "inline_json",
-```
-
-E.g. the bytes containing `{"foo":123}` in the `envelope` field would lead to the following JSON:
-
-```json
-{
-  "envelope": {
-    "foo": 123
-  }
-}
-```
-
-If the bytes are not valid JSON, this leads to JSON broken documents. Thus a JSON validity check needs to be in place at some point of the process.

.github/aider/guides/cosmos-rfc.md

@@ -1,627 +0,0 @@
-# RFC 004: Account System Refactor
-
-## Status
-- Draft v2 (May 2023)
-
-## Current Limitations
-
-1. **Account Representation**: Limited by `google.Protobuf.Any` encapsulation and basic authentication methods
-2. **Interface Constraints**: Lacks support for advanced functionalities like vesting and complex auth systems
-3. **Implementation Rigidity**: Poor differentiation between account types (e.g., `ModuleAccount`)
-4. **Authorization System**: Basic `x/auth` module with limited scope beyond `x/bank` functionality
-5. **Dependency Issues**: Cyclic dependencies between modules (e.g., `x/auth` ↔ `x/bank` for vesting)
-
-## Proposal
-
-This proposal aims to transform the way accounts are managed within the Cosmos SDK by introducing significant changes to
-their structure and functionality.
-
-### Rethinking Account Representation and Business Logic
-
-Instead of representing accounts as simple `google.Protobuf.Any` structures stored in state with no business logic
-attached, this proposal suggests a more sophisticated account representation that is closer to module entities.
-In fact, accounts should be able to receive messages and process them in the same way modules do, and be capable of storing
-state in a isolated (prefixed) portion of state belonging only to them, in the same way as modules do.
-
-### Account Message Reception
-
-We propose that accounts should be able to receive messages in the same way modules can, allowing them to manage their
-own state modifications without relying on other modules. This change would enable more advanced account functionality, such as the
-`VestingAccount` example, where the x/bank module previously needed to change the vestingState by casting the abstracted
-account to `VestingAccount` and triggering the `TrackDelegation` call. Accounts are already capable of sending messages when
-a state transition, originating from a transaction, is executed.
-
-When accounts receive messages, they will be able to identify the sender of the message and decide how to process the
-state transition, if at all.
-
-### Consequences
-
-These changes would have significant implications for the Cosmos SDK, resulting in a system of actors that are equal from
-the runtime perspective. The runtime would only be responsible for propagating messages between actors and would not
-manage the authorization system. Instead, actors would manage their own authorizations. For instance, there would be no
-need for the `x/auth` module to manage minting or burning of coins permissions, as it would fall within the scope of the
-`x/bank` module.
-
-The key difference between accounts and modules would lie in the origin of the message (state transition). Accounts
-(ExternallyOwnedAccount), which have credentials (e.g., a public/private key pairing), originate state transitions from
-transactions. In contrast, module state transitions do not have authentication credentials backing them and can be
-caused by two factors: either as a consequence of a state transition coming from a transaction or triggered by a scheduler
-(e.g., the runtime's Begin/EndBlock).
-
-By implementing these proposed changes, the Cosmos SDK will benefit from a more extensible, versatile, and efficient account
-management system that is better suited to address the requirements of the Cosmos ecosystem.
-
-#### Standardization
-
-With `x/accounts` allowing a modular api there becomes a need for standardization of accounts or the interfaces wallets and other clients should expect to use. For this reason we will be using the [`CIP` repo](https://github.com/cosmos/cips) in order to standardize interfaces in order for wallets to know what to expect when interacting with accounts.
-
-## Implementation
-
-### Account Definition
-
-We define the new `Account` type, which is what an account needs to implement to be treated as such.
-An `Account` type is defined at APP level, so it cannot be dynamically loaded as the chain is running without upgrading the
-node code, unless we create something like a `CosmWasmAccount` which is an account backed by an `x/wasm` contract.
-
-```go
-// Account is what the developer implements to define an account.
-type Account[InitMsg proto.Message] interface {
-	// Init is the function that initialises an account instance of a given kind.
-	// InitMsg is used to initialise the initial state of an account.
-	Init(ctx *Context, msg InitMsg) error
-	// RegisterExecuteHandlers registers an account's execution messages.
-	RegisterExecuteHandlers(executeRouter *ExecuteRouter)
-	// RegisterQueryHandlers registers an account's query messages.
-	RegisterQueryHandlers(queryRouter *QueryRouter)
-	// RegisterMigrationHandlers registers an account's migration messages.
-	RegisterMigrationHandlers(migrationRouter *MigrationRouter)
-}
-```
-
-### The InternalAccount definition
-
-The public `Account` interface implementation is then converted by the runtime into an `InternalAccount` implementation,
-which contains all the information and business logic needed to operate the account.
-
-```go
-type Schema struct {
-	state StateSchema // represents the state of an account
-	init InitSchema // represents the init msg schema
-	exec ExecSchema // represents the multiple execution msg schemas, containing also responses
-	query QuerySchema // represents the multiple query msg schemas, containing also responses
-	migrate *MigrateSchema // represents the multiple migrate msg schemas, containing also responses, it's optional
-}
-
-type InternalAccount struct {
-	init    func(ctx *Context, msg proto.Message) (*InitResponse, error)
-	execute func(ctx *Context, msg proto.Message) (*ExecuteResponse, error)
-	query   func(ctx *Context, msg proto.Message) (proto.Message, error)
-    schema  func() *Schema
-    migrate func(ctx *Context, msg proto.Message) (*MigrateResponse, error)
-}
-```
-
-This is an internal view of the account as intended by the system. It is not meant to be what developers implement. An
-example implementation of the `InternalAccount` type can be found in [this](https://github.com/testinginprod/accounts-poc/blob/main/examples/recover/recover.go)
-example of account whose credentials can be recovered. In fact, even if the `Internal` implementation is untyped (with
-respect to `proto.Message`), the concrete implementation is fully typed.
-
-During any of the execution methods of `InternalAccount`, `schema` excluded, the account is given a `Context` which provides:
-
-- A namespaced `KVStore` for the account, which isolates the account state from others (NOTE: no `store keys` needed,
-  the account address serves as `store key`).
-- Information regarding itself (its address)
-- Information regarding the sender.
-- ...
-
-#### Init
-
-Init defines the entrypoint that allows for a new account instance of a given kind to be initialised.
-The account is passed some opaque protobuf message which is then interpreted and contains the instructions that
-constitute the initial state of an account once it is deployed.
-
-An `Account` code can be deployed multiple times through the `Init` function, similar to how a `CosmWasm` contract code
-can be deployed (Instantiated) multiple times.
-
-#### Execute
-
-Execute defines the entrypoint that allows an `Account` to process a state transition, the account can decide then how to
-process the state transition based on the message provided and the sender of the transition.
-
-#### Query
-
-Query defines a read-only entrypoint that provides a stable interface that links an account with its state. The reason for
-which `Query` is still being preferred as an addition to raw state reflection is to:
-
-- Provide a stable interface for querying (state can be optimised and change more frequently than a query)
-- Provide a way to define an account `Interface` with respect to its `Read/Write` paths.
-- Provide a way to query information that cannot be processed from raw state reflection, ex: compute information from lazy
-  state that has not been yet concretely processed (eg: balances with respect to lazy inputs/outputs)
-
-#### Schema
-
-Schema provides the definition of an account from `API` perspective, and it's the only thing that should be taken into account
-when interacting with an account from another account or module, for example: an account is an `authz-interface` account if
-it has the following message in its execution messages `MsgProxyStateTransition{ state_transition: google.Protobuf.Any }`.
-
-### Migrate
-
-Migrate defines the entrypoint that allows an `Account` to migrate its state from a previous version to a new one. Migrations
-can be initiated only by the account itself, concretely this means that the migrate action sender can only be the account address
-itself, if the account wants to allow another address to migrate it on its behalf then it could create an execution message
-that makes the account migrate itself.
-
-### x/accounts module
-
-In order to create accounts we define a new module `x/accounts`, note that `x/accounts` deploys account with no authentication
-credentials attached to it which means no action of an account can be incepted from a TX, we will later explore how the
-`x/authn` module uses `x/accounts` to deploy authenticated accounts.
-
-This also has another important implication for which account addresses are now fully decoupled from the authentication mechanism
-which makes in turn off-chain operations a little more complex, as the chain becomes the real link between account identifier
-and credentials.
-
-We could also introduce a way to deterministically compute the account address.
-
-Note, from the transaction point of view, the `init_message` and `execute_message` are opaque `google.Protobuf.Any`.
-
-The module protobuf definition for `x/accounts` are the following:
-
-```protobuf
-// Msg defines the Msg service.
-service Msg {
-  rpc Deploy(MsgDeploy) returns (MsgDeployResponse);
-  rpc Execute(MsgExecute) returns (MsgExecuteResponse);
-  rpc Migrate(MsgMigrate) returns (MsgMigrateResponse);
-}
-
-message MsgDeploy {
-  string sender = 1;
-  string kind = 2;
-  google.Protobuf.Any init_message = 3;
-  repeated google.Protobuf.Any authorize_messages = 4 [(gogoproto.nullable) = false];
-}
-
-message MsgDeployResponse {
-  string address = 1;
-  uint64 id = 2;
-  google.Protobuf.Any data = 3;
-}
-
-message MsgExecute {
-  string sender = 1;
-  string address = 2;
-  google.Protobuf.Any message = 3;
-  repeated google.Protobuf.Any authorize_messages = 4 [(gogoproto.nullable) = false];
-}
-
-message MsgExecuteResponse {
-  google.Protobuf.Any data = 1;
-}
-
-message MsgMigrate {
-  string sender = 1;
-  string new_account_kind = 2;
-  google.Protobuf.Any migrate_message = 3;
-}
-
-message MsgMigrateResponse {
-  google.Protobuf.Any data = 1;
-}
-
-```
-
-#### MsgDeploy
-
-Deploys a new instance of the given account `kind` with initial settings represented by the `init_message` which is a `google.Protobuf.Any`.
-Of course the `init_message` can be empty. A response is returned containing the account ID and humanised address, alongside some response
-that the account instantiation might produce.
-
-#### Address derivation
-
-In order to decouple public keys from account addresses, we introduce a new address derivation mechanism which is
-
-#### MsgExecute
-
-Sends a `StateTransition` execution request, where the state transition is represented by the `message` which is a `google.Protobuf.Any`.
-The account can then decide if to process it or not based on the `sender`.
-
-### MsgMigrate
-
-Migrates an account to a new version of itself, the new version is represented by the `new_account_kind`. The state transition
-can only be incepted by the account itself, which means that the `sender` must be the account address itself. During the migration
-the account current state is given to the new version of the account, which then executes the migration logic using the `migrate_message`,
-it might change state or not, it's up to the account to decide. The response contains possible data that the account might produce
-after the migration.
-
-#### Authorize Messages
-
-The `Deploy` and `Execute` messages have a field in common called `authorize_messages`, these messages are messages that the account
-can execute on behalf of the sender. For example, in case an account is expecting some funds to be sent from the sender,
-the sender can attach a `MsgSend` that the account can execute on the sender's behalf. These authorizations are short-lived,
-they live only for the duration of the `Deploy` or `Execute` message execution, or until they are consumed.
-
-An alternative would have been to add a `funds` field, like it happens in cosmwasm, which guarantees the called contract that
-the funds are available and sent in the context of the message execution. This would have been a simpler approach, but it would
-have been limited to the context of `MsgSend` only, where the asset is `sdk.Coins`. The proposed generic way, instead, allows
-the account to execute any message on behalf of the sender, which is more flexible, it could include NFT send execution, or
-more complex things like `MsgMultiSend` or `MsgDelegate`, etc.
-
-### Further discussion
-
-#### Sub-accounts
-
-We could provide a way to link accounts to other accounts. Maybe during deployment the sender could decide to link the
-newly created to its own account, although there might be use-cases for which the deployer is different from the account
-that needs to be linked, in this case a handshake protocol on linking would need to be defined.
-
-#### Predictable address creation
-
-We need to provide a way to create an account with a predictable address, this might serve a lot of purposes, like accounts
-wanting to generate an address that:
-
-- nobody else can claim besides the account used to generate the new account
-- is predictable
-
-For example:
-
-```protobuf
-
-message MsgDeployPredictable {
-  string sender = 1;
-  uint32 nonce = 2;
-  ...
-}
-```
-
-And then the address becomes `bechify(concat(sender, nonce))`
-
-`x/accounts` would still use the monotonically increasing sequence as account number.
-
-#### Joining Multiple Accounts
-
-As developers are building new kinds of accounts, it becomes necessary to provide a default way to combine the
-functionalities of different account types. This allows developers to avoid duplicating code and enables end-users to
-create or migrate to accounts with multiple functionalities without requiring custom development.
-
-To address this need, we propose the inclusion of a default account type called "MultiAccount". The MultiAccount type is
-designed to merge the functionalities of other accounts by combining their execution, query, and migration APIs.
-The account joining process would only fail in the case of API (intended as non-state Schema APIs) conflicts, ensuring
-compatibility and consistency.
-
-With the introduction of the MultiAccount type, users would have the option to either migrate their existing accounts to
-a MultiAccount type or extend an existing MultiAccount with newer APIs. This flexibility empowers users to leverage
-various account functionalities without compromising compatibility or resorting to manual code duplication.
-
-The MultiAccount type serves as a standardized solution for combining different account functionalities within the
-cosmos-sdk ecosystem. By adopting this approach, developers can streamline the development process and users can benefit
-from a modular and extensible account system.
-
-# ADR 071: Cryptography v2- Multi-curve support
-
-## Change log
-
-- May 7th 2024: Initial Draft (Zondax AG: @raynaudoe @juliantoledano @jleni @educlerici-zondax @lucaslopezf)
-- June 13th 2024: Add CometBFT implementation proposal (Zondax AG: @raynaudoe @juliantoledano @jleni @educlerici-zondax @lucaslopezf)
-- July 2nd 2024: Split ADR proposal, add link to ADR in cosmos/crypto (Zondax AG: @raynaudoe @juliantoledano @jleni @educlerici-zondax @lucaslopezf)
-
-## Status
-
-DRAFT
-
-## Abstract
-
-This ADR proposes the refactoring of the existing `Keyring` and `cosmos-sdk/crypto` code to implement [ADR-001-CryptoProviders](https://github.com/cosmos/crypto/blob/main/docs/architecture/adr-001-crypto-provider.md).
-
-For in-depth details of the `CryptoProviders` and their design please refer to ADR mentioned above.
-
-## Introduction
-
-The introduction of multi-curve support in the cosmos-sdk cryptographic package offers significant advantages. By not being restricted to a single cryptographic curve, developers can choose the most appropriate curve based on security, performance, and compatibility requirements. This flexibility enhances the application's ability to adapt to evolving security standards and optimizes performance for specific use cases, helping to future-proofing the sdk's cryptographic capabilities.
-
-The enhancements in this proposal not only render the ["Keyring ADR"](https://github.com/cosmos/cosmos-sdk/issues/14940) obsolete, but also encompass its key aspects, replacing it with a more flexible and comprehensive approach. Furthermore, the gRPC service proposed in the mentioned ADR can be easily implemented as a specialized `CryptoProvider`.
-
-### Glossary
-
-1. **Interface**: In the context of this document, "interface" refers to Go's interface.
-
-2. **Module**: In this document, "module" refers to a Go module.
-
-3. **Package**: In the context of Go, a "package" refers to a unit of code organization.
-
-## Context
-
-In order to fully understand the need for changes and the proposed improvements, it's crucial to consider the current state of affairs:
-
-- The Cosmos SDK currently lacks a comprehensive ADR for the cryptographic package.
-
-- If a blockchain project requires a cryptographic curve that is not supported by the current SDK, the most likely scenario is that they will need to fork the SDK repository and make modifications. These modifications could potentially make the fork incompatible with future updates from the upstream SDK, complicating maintenance and integration.
-
-- Type leakage of specific crypto data types expose backward compatibility and extensibility challenges.
-
-- The demand for a more flexible and extensible approach to cryptography and address management is high.
-
-- Architectural changes are necessary to resolve many of the currently open issues related to new curves support.
-
-- There is a current trend towards modularity in the Interchain stack (e.g., runtime modules).
-
-- Security implications are a critical consideration during the redesign work.
-
-## Objectives
-
-The key objectives for this proposal are:
-
-- Leverage `CryptoProviders`: Utilize them as APIs for cryptographic tools, ensuring modularity, flexibility, and ease of integration.
-
-Developer-Centric Approach
-
-- Prioritize clear, intuitive interfaces and best-practice design principles.
-
-Quality Assurance
-
-- Enhanced Test Coverage: Improve testing methodologies to ensure the robustness and reliability of the module.
-
-## Technical Goals
-
-New Keyring:
-
-- Design a new `Keyring` interface with modular backends injection system to support hardware devices and cloud-based HSMs. This feature is optional and tied to complexity; if it proves too complex, it will be deferred to a future release as an enhancement.
-
-## Proposed architecture
-
-### Components
-
-The main components to be used will be the same as those found in the [ADR-001](https://github.com/cosmos/crypto/blob/main/docs/architecture/adr-001-crypto-provider.md#components).
-
-#### Storage and persistence
-
-The storage and persistence layer is tasked with storing a `CryptoProvider`s. Specifically, this layer must:
-
-- Securely store the crypto provider's associated private key (only if stored locally, otherwise a reference to the private key will be stored instead).
-- Store the [`ProviderMetadata`](https://github.com/cosmos/crypto/blob/main/docs/architecture/adr-001-crypto-provider.md#metadata) struct which contains the data that distinguishes that provider.
-
-The purpose of this layer is to ensure that upon retrieval of the persisted data, we can access the provider's type, version, and specific configuration (which varies based on the provider type). This information will subsequently be utilized to initialize the appropriate factory, as detailed in the following section on the factory pattern.
-
-The storage proposal involves using a modified version of the [Record](https://github.com/cosmos/cosmos-sdk/blob/main/proto/cosmos/crypto/keyring/v1/record.proto) struct, which is already defined in **Keyring/v1**. Additionally, we propose utilizing the existing keyring backends (keychain, filesystem, memory, etc.) to store these `Record`s in the same manner as the current **Keyring/v1**.
-
-_Note: This approach will facilitate a smoother migration path from the current Keyring/v1 to the proposed architecture._
-
-Below is the proposed protobuf message to be included in the modified `Record.proto` file
-
-##### Protobuf message structure
-
-The [record.proto](https://github.com/cosmos/cosmos-sdk/blob/main/proto/cosmos/crypto/keyring/v1/record.proto) file will be modified to include the `CryptoProvider` message as an optional field as follows.
-
-```protobuf
-
-// record.proto
-
-message Record {
-  string name = 1;
-  google.protobuf.Any pub_key = 2;
-
-  oneof item {
-    Local local = 3;
-    Ledger ledger = 4;
-    Multi multi = 5;
-    Offline offline = 6;
-    CryptoProvider crypto_provider = 7; // <- New
-  }
-
-  message Local {
-    google.protobuf.Any priv_key = 1;
-  }
-
-  message Ledger {
-    hd.v1.BIP44Params path = 1;
-  }
-
-  message Multi {}
-
-  message Offline {}
-}
-```
-
-##### Creating and loading a `CryptoProvider`
-
-For creating providers, we propose a _factory pattern_ and a _registry_ for these builders. Examples of these
-patterns can be found [here](https://github.com/cosmos/crypto/blob/main/docs/architecture/adr-001-crypto-provider.md#illustrative-code-snippets)
-
-##### Keyring
-
-The new `Keyring` interface will serve as a central hub for managing and fetching `CryptoProviders`. To ensure a smoother migration path, the new Keyring will be backward compatible with the previous version. Since this will be the main API from which applications will obtain their `CryptoProvider` instances, the proposal is to extend the Keyring interface to include the methods:
-
-```go
-type KeyringV2 interface {
-  // methods from Keyring/v1
-
-  // ListCryptoProviders returns a list of all the stored CryptoProvider metadata.
-  ListCryptoProviders() ([]ProviderMetadata, error)
-
-  // GetCryptoProvider retrieves a specific CryptoProvider by its id.
-  GetCryptoProvider(id string) (CryptoProvider, error)
-}
-```
-
-_Note_: Methods to obtain a provider from a public key or other means that make it easier to load the desired provider can be added.
-
-##### Especial use case: remote signers
-
-It's important to note that the `CryptoProvider` interface is versatile enough to be implemented as a remote signer. This capability allows for the integration of remote cryptographic operations, which can be particularly useful in distributed or cloud-based environments where local cryptographic resources are limited or need to be managed centrally.
-
-## Alternatives
-
-It is important to note that all the code presented in this document is not in its final form and could be subject to changes at the time of implementation. The examples and implementations discussed should be interpreted as alternatives, providing a conceptual framework rather than definitive solutions. This flexibility allows for adjustments based on further insights, technical evaluations, or changing requirements as development progresses.
-
-## Decision
-
-We will:
-
-- Leverage crypto providers
-- Refactor the module structure as described above.
-- Define types and interfaces as the code attached.
-- Refactor existing code into new structure and interfaces.
-- Implement Unit Tests to ensure no backward compatibility issues.
-
-## Consequences
-
-### Impact on the SDK codebase
-
-We can divide the impact of this ADR into two main categories: state machine code and client related code.
-
-#### Client
-
-The major impact will be on the client side, where the current `Keyring` interface will be replaced by the new `KeyringV2` interface. At first, the impact will be low since `CryptoProvider` is an optional field in the `Record` message, so there's no mandatory requirement for migrating to this new concept right away. This allows a progressive transition where the risks of breaking changes or regressions are minimized.
-
-#### State Machine
-
-The impact on the state machine code will be minimal, the modules affected (at the time of writing this ADR)
-are the `x/accounts` module, specifically the `Authenticate` function and the `x/auth/ante` module. This function will need to be adapted to use a `CryptoProvider` service to make use of the `Verifier` instance.
-
-Worth mentioning that there's also the alternative of using `Verifier` instances in a standalone fashion (see note below).
-
-The specific way to adapt these modules will be deeply analyzed and decided at implementation time of this ADR.
-
-_Note_: All cryptographic tools (hashers, verifiers, signers, etc.) will continue to be available as standalone packages that can be imported and utilized directly without the need for a `CryptoProvider` instance. However, the `CryptoProvider` is the recommended method for using these tools as it offers a more secure way to handle sensitive data, enhanced modularity, and the ability to store configurations and metadata within the `CryptoProvider` definition.
-
-### Backwards Compatibility
-
-The proposed migration path is similar to what the cosmos-sdk has done in the past. To ensure a smooth transition, the following steps will be taken:
-
-Once ADR-001 is implemented with a stable release:
-
-- Deprecate the old crypto package. The old crypto package will still be usable, but it will be marked as deprecated and users can opt to use the new package.
-- Migrate the codebase to use the new cosmos/crypto package and remove the old crypto one.
-
-### Positive
-
-- Single place of truth
-- Easier to use interfaces
-- Easier to extend
-- Unit test for each crypto package
-- Greater maintainability
-- Incentivize addition of implementations instead of forks
-- Decoupling behavior from implementation
-- Sanitization of code
-
-### Negative
-
-- It will involve an effort to adapt existing code.
-- It will require attention to detail and audition.
-
-### Neutral
-
-- It will involve extensive testing.
-
-## Test Cases
-
-- The code will be unit tested to ensure a high code coverage
-- There should be integration tests around Keyring and CryptoProviders.
-
-> While an ADR is in the DRAFT or PROPOSED stage, this section should contain a
-> summary of issues to be solved in future iterations (usually referencing comments
-> from a pull-request discussion).
->
-> Later, this section can optionally list ideas or improvements the author or
-> reviewers found during the analysis of this ADR.
-
-# ADR-71 Bank V2
-
-## Status
-
-DRAFT
-
-## Changelog
-
-- 2024-05-08: Initial Draft (@samricotta, @julienrbrt)
-
-## Abstract
-
-The primary objective of refactoring the bank module is to simplify and enhance the functionality of the Cosmos SDK. Over time the bank module has been burdened with numerous responsibilities including transaction handling, account restrictions, delegation counting, and the minting and burning of coins.
-
-In addition to the above, the bank module is currently too rigid and handles too many tasks, so this proposal aims to streamline the module by focusing on core functions `Send`, `Mint`, and `Burn`.
-
-Currently, the module is split across different keepers with scattered and duplicates functionalities (with 4 send functions for instance).
-
-Additionally, the integration of the token factory into the bank module allows for standardization, and better integration within the core modules.
-
-This rewrite will reduce complexity and enhance the efficiency and UX of the bank module.
-
-## Context
-
-The current implementation of the bank module is characterised by its handling of a broad array of functions, leading to significant complexity in using and extending the bank module.
-
-These issues have underscored the need for a refactoring strategy that simplifies the module’s architecture and focuses on its most essential operations.
-
-Additionally, there is an overlap in functionality with a Token Factory module, which could be integrated to streamline oper.
-
-## Decision
-
-**Permission Tightening**: Access to the module can be restricted to selected denominations only, ensuring that it operates within designated boundaries and does not exceed its intended scope. Currently, the permissions allow all denoms, so this should be changed. Send restrictions functionality will be maintained.
-
-**Simplification of Logic**: The bank module will focus on core functionalities `Send`, `Mint`, and `Burn`. This refinement aims to streamline the architecture, enhancing both maintainability and performance.
-
-**Integration of Token Factory**: The Token Factory will be merged into the bank module. This consolidation of related functionalities aims to reduce redundancy and enhance coherence within the system. Migrations functions will be provided for migrating from Osmosis' Token Factory module to bank/v2.
-
-**Legacy Support**: A legacy wrapper will be implemented to ensure compatibility with about 90% of existing functions. This measure will facilitate a smooth transition while keeping older systems functional.
-
-**Denom Implementation**: A asset interface will be added to standardise interactions such as transfers, balance inquiries, minting, and burning across different tokens. This will allow the bank module to support arbitrary asset types, enabling developers to implement custom, ERC20-like denominations.
-
-For example, currently if a team would like to extend the transfer method the changes would apply universally, affecting all denom’s. With the proposed Asset Interface, it allows teams to customise or extend the transfer method specifically for their own tokens without impacting others.
-
-These improvements are expected to enhance the flexibility of the bank module, allowing for the creation of custom tokens similar to ERC20 standards and assets backed by CosmWasm (CW) contracts. The integration efforts will also aim to unify CW20 with bank coins across the Cosmos chains.
-
-Example of denom interface:
-
-```go
-type AssetInterface interface {
-    Transfer(ctx sdk.Context, from sdk.AccAddress, to sdk.AccAddress, amount sdk.Coin) error
-    Mint(ctx sdk.Context, to sdk.AccAddress, amount sdk.Coin) error
-    Burn(ctx sdk.Context, from sdk.AccAddress, amount sdk.Coin) error
-    QueryBalance(ctx sdk.Context, account sdk.AccAddress) (sdk.Coin, error)
-}
-```
-
-Overview of flow:
-
-1. Alice initiates a transfer by entering Bob's address and the amount (100 ATOM)
-2. The Bank module verifies that the ATOM token implements the `AssetInterface` by querying the `ATOM_Denom_Account`, which is an `x/account` denom account.
-3. The Bank module executes the transfer by subtracting 100 ATOM from Alice’s balance and adding 100 ATOM to Bob’s balance.
-4. The Bank module calls the Transfer method on the `ATOM_Denom_Account`. The Transfer method, defined in the `AssetInterface`, handles the logic to subtract 100 ATOM from Alice’s balance and add 100 ATOM to Bob’s balance.
-5. The Bank module updates the chain and returns the new balances.
-6. Both Alice and Bob successfully receive the updated balances.
-
-## Migration Plans
-
-Bank is a widely used module, so getting a v2 needs to be thought thoroughly. In order to not force all dependencies to immediately migrate to bank/v2, the same _upgrading_ path will be taken as for the `gov` module.
-
-This means `cosmossdk.io/bank` will stay one module and there won't be a new `cosmossdk.io/bank/v2` go module. Instead the bank protos will be versioned from `v1beta1` (current bank) to `v2`.
-
-Bank `v1beta1` endpoints will use the new bank v2 implementation for maximum backward compatibility.
-
-The bank `v1beta1` keepers will be deprecated and potentially eventually removed, but its proto and messages definitions will remain.
-
-Additionally, as bank plans to integrate token factory, migrations functions will be provided to migrate from Osmosis token factory implementation (most widely used implementation) to the new bank/v2 token factory.
-
-## Consequences
-
-### Positive
-
-- Simplified interaction with bank APIs
-- Backward compatible changes (no contracts or apis broken)
-- Optional migration (note: bank `v1beta1` won't get any new feature after bank `v2` release)
-
-### Neutral
-
-- Asset implementation not available cross-chain (IBC-ed custom asset should possibly fallback to the default implementation)
-- Many assets may slow down bank balances requests
-
-### Negative
-
-- Temporarily duplicate functionalities as bank `v1beta1` are `v2` are living alongside
-- Difficultity to ever completely remove bank `v1beta1`
-
-### References
-
-- Current bank module implementation: https://github.com/cosmos/cosmos-sdk/blob/v0.50.6/x/bank/keeper/keeper.go#L22-L53
-- Osmosis token factory: https://github.com/osmosis-labs/osmosis/tree/v25.0.0/x/tokenfactory/keeper

.github/aider/guides/cosmos-sdk.md

@@ -1,685 +0,0 @@
-# Cosmos SDK Core Components
-
-## Overview
-
-The Cosmos SDK is a framework for building secure blockchain applications on CometBFT. It provides:
-
-- ABCI implementation in Go
-- Multi-store persistence layer  
-- Transaction routing system
-
-## Transaction Flow
-
-1. CometBFT consensus delivers transaction bytes
-2. SDK decodes transactions and extracts messages
-3. Messages routed to appropriate modules
-4. State changes committed to stores
-
-```mermaid
-graph TD
-    A[CometBFT] -->|Tx Bytes| B[SDK Decode]
-    B -->|Messages| C[Module Router] 
-    C -->|State Changes| D[Multi-store]
-```
-
-## `baseapp`
-
-`baseapp` is the boilerplate implementation of a Cosmos SDK application. It comes with an implementation of the ABCI to handle the connection with the underlying consensus engine. Typically, a Cosmos SDK application extends `baseapp` by embedding it in [`app.go`](../beginner/00-app-anatomy.md#core-application-file).
-
-Here is an example of this from `simapp`, the Cosmos SDK demonstration app:
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/v0.52.0-beta.1/simapp/app.go#L145-L186
-```
-
-The goal of `baseapp` is to provide a secure interface between the store and the extensible state machine while defining as little about the state machine as possible (staying true to the ABCI).
-
-For more on `baseapp`, please click [here](../advanced/00-baseapp.md).
-
-## Multistore
-
-The Cosmos SDK provides a [`multistore`](../advanced/04-store.md#multistore) for persisting state. The multistore allows developers to declare any number of [`KVStores`](../advanced/04-store.md#base-layer-kvstores). These `KVStores` only accept the `[]byte` type as value and therefore any custom structure needs to be marshalled using [a codec](../advanced/05-encoding.md) before being stored.
-
-The multistore abstraction is used to divide the state in distinct compartments, each managed by its own module. For more on the multistore, click [here](../advanced/04-store.md#multistore).
-
-## Modules
-
-The power of the Cosmos SDK lies in its modularity. Cosmos SDK applications are built by aggregating a collection of interoperable modules. Each module defines a subset of the state and contains its own message/transaction processor, while the Cosmos SDK is responsible for routing each message to its respective module.
-
-Here is a simplified view of how a transaction is processed by the application of each full-node when it is received in a valid block:
-
-```mermaid
- flowchart TD
-    A[Transaction relayed from the full-node's CometBFT engine to the node's application via DeliverTx] --> B[APPLICATION]
-    B -->|"Using baseapp's methods: Decode the Tx, extract and route the message(s)"| C[Message routed to the correct module to be processed]
-    C --> D1[AUTH MODULE]
-    C --> D2[BANK MODULE]
-    C --> D3[STAKING MODULE]
-    C --> D4[GOV MODULE]
-    D1 -->|Handle message, Update state| E["Return result to CometBFT (0=Ok, 1=Err)"]
-    D2 -->|Handle message, Update state| E["Return result to CometBFT (0=Ok, 1=Err)"]
-    D3 -->|Handle message, Update state| E["Return result to CometBFT (0=Ok, 1=Err)"]
-    D4 -->|Handle message, Update state| E["Return result to CometBFT (0=Ok, 1=Err)"]
-```
-
-Each module can be seen as a little state-machine. Developers need to define the subset of the state handled by the module, as well as custom message types that modify the state (_Note:_ `messages` are extracted from `transactions` by `baseapp`). In general, each module declares its own `KVStore` in the `multistore` to persist the subset of the state it defines. Most developers will need to access other 3rd party modules when building their own modules. Given that the Cosmos SDK is an open framework, some of the modules may be malicious, which means there is a need for security principles to reason about inter-module interactions. These principles are based on [object-capabilities](../advanced/10-ocap.md). In practice, this means that instead of having each module keep an access control list for other modules, each module implements special objects called `keepers` that can be passed to other modules to grant a pre-defined set of capabilities.
-
-Cosmos SDK modules are defined in the `x/` folder of the Cosmos SDK. Some core modules include:
-
-- `x/auth`: Used to manage accounts and signatures.
-- `x/bank`: Used to enable tokens and token transfers.
-- `x/staking` + `x/slashing`: Used to build Proof-of-Stake blockchains.
-
-In addition to the already existing modules in `x/`, which anyone can use in their app, the Cosmos SDK lets you build your own custom modules. You can check an [example of that in the tutorial](https://tutorials.cosmos.network/).# Keepers
-
-:::note Synopsis
-`Keeper`s refer to a Cosmos SDK abstraction whose role is to manage access to the subset of the state defined by various modules. `Keeper`s are module-specific, i.e. the subset of state defined by a module can only be accessed by a `keeper` defined in said module. If a module needs to access the subset of state defined by another module, a reference to the second module's internal `keeper` needs to be passed to the first one. This is done in `app.go` during the instantiation of module keepers.
-:::
-
-:::note Pre-requisite Readings
-
-- [Introduction to Cosmos SDK Modules](./00-intro.md)
-
-:::
-
-## Motivation
-
-The Cosmos SDK is a framework that makes it easy for developers to build complex decentralized applications from scratch, mainly by composing modules together. As the ecosystem of open-source modules for the Cosmos SDK expands, it will become increasingly likely that some of these modules contain vulnerabilities, as a result of the negligence or malice of their developer.
-
-The Cosmos SDK adopts an [object-capabilities-based approach](https://docs.cosmos.network/main/learn/advanced/ocap#ocaps-in-practice) to help developers better protect their application from unwanted inter-module interactions, and `keeper`s are at the core of this approach. A `keeper` can be considered quite literally to be the gatekeeper of a module's store(s). Each store (typically an [`IAVL` Store](../../learn/advanced/04-store.md#iavl-store)) defined within a module comes with a `storeKey`, which grants unlimited access to it. The module's `keeper` holds this `storeKey` (which should otherwise remain unexposed), and defines [methods](#implementing-methods) for reading and writing to the store(s).
-
-The core idea behind the object-capabilities approach is to only reveal what is necessary to get the work done. In practice, this means that instead of handling permissions of modules through access-control lists, module `keeper`s are passed a reference to the specific instance of the other modules' `keeper`s that they need to access (this is done in the [application's constructor function](../../learn/beginner/00-app-anatomy.md#constructor-function)). As a consequence, a module can only interact with the subset of state defined in another module via the methods exposed by the instance of the other module's `keeper`. This is a great way for developers to control the interactions that their own module can have with modules developed by external developers.
-
-## Type Definition
-
-`keeper`s are generally implemented in a `/keeper/keeper.go` file located in the module's folder. By convention, the type `keeper` of a module is simply named `Keeper` and usually follows the following structure:
-
-```go
-type Keeper struct {
-    // External keepers, if any
-
-    // Store key(s)
-
-    // codec
-
-    // authority
-}
-```
-
-For example, here is the type definition of the `keeper` from the `staking` module:
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/v0.52.0-beta.1/x/staking/keeper/keeper.go#L54-L115
-```
-
-Let us go through the different parameters:
-
-- An expected `keeper` is a `keeper` external to a module that is required by the internal `keeper` of said module. External `keeper`s are listed in the internal `keeper`'s type definition as interfaces. These interfaces are themselves defined in an `expected_keepers.go` file in the root of the module's folder. In this context, interfaces are used to reduce the number of dependencies, as well as to facilitate the maintenance of the module itself.
-- `KVStoreService`s grant access to the store(s) of the [multistore](../../learn/advanced/04-store.md) managed by the module. They should always remain unexposed to external modules.
-- `cdc` is the [codec](../../learn/advanced/05-encoding.md) used to marshal and unmarshal structs to/from `[]byte`. The `cdc` can be any of `codec.BinaryCodec`, `codec.JSONCodec` or `codec.Codec` based on your requirements. It can be either a proto or amino codec as long as they implement these interfaces.
-- The authority listed is a module account or user account that has the right to change module level parameters. Previously this was handled by the param module, which has been deprecated.
-
-Of course, it is possible to define different types of internal `keeper`s for the same module (e.g. a read-only `keeper`). Each type of `keeper` comes with its own constructor function, which is called from the [application's constructor function](../../learn/beginner/00-app-anatomy.md). This is where `keeper`s are instantiated, and where developers make sure to pass correct instances of modules' `keeper`s to other modules that require them.
-
-## Implementing Methods
-
-`Keeper`s primarily expose methods for business logic, as validity checks should have already been performed by the [`Msg` server](./03-msg-services.md) when `keeper`s' methods are called.
-
-<!-- markdown-link-check-disable -->
-
-State management is recommended to be done via [Collections](../packages/collections)
-
-<!-- The above link is created via the script to generate docs  -->
-
-## State Management
-
-In the Cosmos SDK, it is crucial to be methodical and selective when managing state within a module, as improper state management can lead to inefficiency, security risks, and scalability issues. Not all data belongs in the on-chain state; it's important to store only essential blockchain data that needs to be verified by consensus. Storing unnecessary information, especially client-side data, can bloat the state and slow down performance. Instead, developers should focus on using an off-chain database to handle supplementary data, extending the API as needed. This approach minimizes on-chain complexity, optimizes resource usage, and keeps the blockchain state lean and efficient, ensuring scalability and smooth operations.
-
-The Cosmos SDK leverages Protocol Buffers (protobuf) for efficient state management, providing a well-structured, binary encoding format that ensures compatibility and performance across different modules. The SDK’s recommended approach for managing state is through the [collections package](../pacakges/02-collections.md), which simplifies state handling by offering predefined data structures like maps and indexed sets, reducing the complexity of managing raw state data. While users can opt for custom encoding schemes if they need more flexibility or have specialized requirements, they should be aware that such custom implementations may not integrate seamlessly with indexers that decode state data on the fly. This could lead to challenges in data retrieval, querying, and interoperability, making protobuf a safer and more future-proof choice for most use cases.
-
-# Folder Structure
-
-:::note Synopsis
-This document outlines the structure of Cosmos SDK modules. These ideas are meant to be applied as suggestions. Application developers are encouraged to improve upon and contribute to module structure and development design.
-
-The required interface for a module is located in the module.go. Everything beyond this is suggestive.
-:::
-
-## Structure
-
-A typical Cosmos SDK module can be structured as follows:
-
-```shell
-proto
-└── {project_name}
-    └── {module_name}
-        └── {proto_version}
-            ├── {module_name}.proto
-            ├── genesis.proto
-            ├── query.proto
-            └── tx.proto
-```
-
-- `{module_name}.proto`: The module's common message type definitions.
-- `genesis.proto`: The module's message type definitions related to genesis state.
-- `query.proto`: The module's Query service and related message type definitions.
-- `tx.proto`: The module's Msg service and related message type definitions.
-
-```shell
-x/{module_name}
-├── client
-│   ├── cli
-│   │   ├── query.go
-│   │   └── tx.go
-│   └── testutil
-│       ├── cli_test.go
-│       └── suite.go
-├── exported
-│   └── exported.go
-├── keeper
-│   ├── genesis.go
-│   ├── grpc_query.go
-│   ├── hooks.go
-│   ├── invariants.go
-│   ├── keeper.go
-│   ├── keys.go
-│   ├── msg_server.go
-│   └── querier.go
-├── simulation
-│   ├── decoder.go
-│   ├── genesis.go
-│   ├── operations.go
-│   └── params.go
-├── types
-│   ├── {module_name}.pb.go
-│   ├── codec.go
-│   ├── errors.go
-│   ├── events.go
-│   ├── events.pb.go
-│   ├── expected_keepers.go
-│   ├── genesis.go
-│   ├── genesis.pb.go
-│   ├── keys.go
-│   ├── msgs.go
-│   ├── params.go
-│   ├── query.pb.go
-│   └── tx.pb.go
-├── module.go
-├── abci.go
-├── autocli.go
-├── depinject.go
-└── README.md
-```
-
-- `client/`: The module's CLI client functionality implementation and the module's CLI testing suite.
-- `exported/`: The module's exported types - typically interface types. If a module relies on keepers from another module, it is expected to receive the keepers as interface contracts through the `expected_keepers.go` file (see below) in order to avoid a direct dependency on the module implementing the keepers. However, these interface contracts can define methods that operate on and/or return types that are specific to the module that is implementing the keepers and this is where `exported/` comes into play. The interface types that are defined in `exported/` use canonical types, allowing for the module to receive the keepers as interface contracts through the `expected_keepers.go` file. This pattern allows for code to remain DRY and also alleviates import cycle chaos.
-- `keeper/`: The module's `Keeper` and `MsgServer` implementation.
-  - `abci.go`: The module's `BeginBlocker` and `EndBlocker` implementations (this file is only required if `BeginBlocker` and/or `EndBlocker` need to be defined).
-- `simulation/`: The module's [simulation](./14-simulator.md) package defines functions used by the blockchain simulator application (`simapp`).
-- `README.md`: The module's specification documents outlining important concepts, state storage structure, and message and event type definitions. Learn more how to write module specs in the [spec guidelines](../spec/SPEC_MODULE.md).
-- `types/`: includes type definitions for messages, events, and genesis state, including the type definitions generated by Protocol Buffers.
-  - `codec.go`: The module's registry methods for interface types.
-  - `errors.go`: The module's sentinel errors.
-  - `events.go`: The module's event types and constructors.
-  - `expected_keepers.go`: The module's [expected keeper](./06-keeper.md#type-definition) interfaces.
-  - `genesis.go`: The module's genesis state methods and helper functions.
-  - `keys.go`: The module's store keys and associated helper functions.
-  - `msgs.go`: The module's message type definitions and associated methods.
-  - `params.go`: The module's parameter type definitions and associated methods.
-  - `*.pb.go`: The module's type definitions generated by Protocol Buffers (as defined in the respective `*.proto` files above).
-- The root directory includes the module's `AppModule` implementation.
-  - `autocli.go`: The module [autocli](https://docs.cosmos.network/main/core/autocli) options.
-  - `depinject.go`: The module [depinject](./15-depinject.md#type-definition) options.
-
-> Note: although the above pattern is followed by most of the Cosmos SDK modules, there are some modules that don't follow this pattern. E.g `x/group` and `x/nft` dont have a `types` folder, instead all of the type definitions for messages, events, and genesis state are live in the root directory and the module's `AppModule` implementation lives in the `module` folder.
-
----
-
-## sidebar_position: 1
-
-# `Msg` Services
-
-:::note Synopsis
-A Protobuf `Msg` service processes [messages](./02-messages-and-queries.md#messages). Protobuf `Msg` services are specific to the module in which they are defined, and only process messages defined within the said module. They are called from `BaseApp` during [`FinalizeBlock`](../../learn/advanced/00-baseapp.md#finalizeblock).
-:::
-
-:::note Pre-requisite Readings
-
-- [Module Manager](./01-module-manager.md)
-- [Messages and Queries](./02-messages-and-queries.md)
-
-:::
-
-## Implementation of a module `Msg` service
-
-Each module should define a Protobuf `Msg` service, which will be responsible for processing requests (implementing `sdk.Msg`) and returning responses.
-
-As further described in [ADR 031](../architecture/adr-031-msg-service.md), this approach has the advantage of clearly specifying return types and generating server and client code.
-
-Protobuf generates a `MsgServer` interface based on the definition of `Msg` service. It is the role of the module developer to implement this interface, by implementing the state transition logic that should happen upon receival of each `transaction.Msg`. As an example, here is the generated `MsgServer` interface for `x/bank`, which exposes two `transaction.Msg`s:
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/28fa3b8/x/bank/types/tx.pb.go#L564-L579
-```
-
-When possible, the existing module's [`Keeper`](./06-keeper.md) should implement `MsgServer`, otherwise a `msgServer` struct that embeds the `Keeper` can be created, typically in `./keeper/msg_server.go`:
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/28fa3b8/x/bank/keeper/msg_server.go#L16-L19
-```
-
-`msgServer` methods can retrieve the auxiliary information or services using the environment variable, it is always located in the keeper:
-
-Environment:
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/07151304e2ec6a185243d083f59a2d543253cb15/core/appmodule/v2/environment.go#L14-L29
-```
-
-Keeper Example:
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/07151304e2ec6a185243d083f59a2d543253cb15/x/bank/keeper/keeper.go#L56-L58
-```
-
-`transaction.Msg` processing usually follows these 3 steps:
-
-### Validation
-
-The message server must perform all validation required (both _stateful_ and _stateless_) to make sure the `message` is valid.
-The `signer` is charged for the gas cost of this validation.
-
-For example, a `msgServer` method for a `transfer` message should check that the sending account has enough funds to actually perform the transfer.
-
-It is recommended to implement all validation checks in a separate function that passes state values as arguments. This implementation simplifies testing. As expected, expensive validation functions charge additional gas. Example:
-
-```go
-ValidateMsgA(msg MsgA, now Time, gm GasMeter) error {
-	if now.Before(msg.Expire) {
-		return sdkerrors.ErrInvalidRequest.Wrap("msg expired")
-	}
-	gm.ConsumeGas(1000, "signature verification")
-	return signatureVerificaton(msg.Prover, msg.Data)
-}
-```
-
-:::warning
-Previously, the `ValidateBasic` method was used to perform simple and stateless validation checks.
-This way of validating is deprecated, this means the `msgServer` must perform all validation checks.
-:::
-
-### State Transition
-
-After the validation is successful, the `msgServer` method uses the [`keeper`](./06-keeper.md) functions to access the state and perform a state transition.
-
-### Events
-
-Before returning, `msgServer` methods generally emit one or more [events](../../learn/advanced/08-events.md) by using the `EventManager` held in `environment`.
-
-There are two ways to emit events, typed events using protobuf or arbitrary key & values.
-
-Typed Events:
-
-```go
-ctx.EventManager().EmitTypedEvent(
-	&group.EventABC{Key1: Value1,  Key2, Value2})
-```
-
-Arbitrary Events:
-
-```go
-ctx.EventManager().EmitEvent(
-	sdk.NewEvent(
-		eventType,  // e.g. sdk.EventTypeMessage for a message, types.CustomEventType for a custom event defined in the module
-		sdk.NewAttribute(key1, value1),
-		sdk.NewAttribute(key2, value2),
-	),
-)
-```
-
-These events are relayed back to the underlying consensus engine and can be used by service providers to implement services around the application. Click [here](../../learn/advanced/08-events.md) to learn more about events.
-
-The invoked `msgServer` method returns a `proto.Message` response and an `error`. These return values are then wrapped into an `*sdk.Result` or an `error`:
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/v0.50.0-alpha.0/baseapp/msg_service_router.go#L160
-```
-
-This method takes care of marshaling the `res` parameter to protobuf and attaching any events on the `EventManager()` to the `sdk.Result`.
-
-```protobuf reference
-https://github.com/cosmos/cosmos-sdk/blob/v0.50.0-alpha.0/proto/cosmos/base/abci/v1beta1/abci.proto#L93-L113
-```
-
-This diagram shows a typical structure of a Protobuf `Msg` service, and how the message propagates through the module.
-
-```mermaid
-sequenceDiagram
-    participant User
-    participant baseApp
-    participant router
-    participant handler
-    participant msgServer
-    participant keeper
-    participant EventManager
-
-    User->>baseApp: Transaction Type<Tx>
-    baseApp->>router: Route(ctx, msgRoute)
-    router->>handler: handler
-    handler->>msgServer: Msg<Tx>(Context, Msg(..))
-
-    alt addresses invalid, denominations wrong, etc.
-        msgServer->>handler: error
-        handler->>router: error
-        router->>baseApp: result, error code
-    else
-        msgServer->>keeper: perform action, update context
-        keeper->>msgServer: results, error code
-        msgServer->>EventManager: Emit relevant events
-        msgServer->>msgServer: maybe wrap results in more structure
-        msgServer->>handler: result, error code
-        handler->>router: result, error code
-        router->>baseApp: result, error code
-    end
-
-    baseApp->>User: result, error code
-```
-
-## Telemetry
-
-New [telemetry metrics](../../learn/advanced/09-telemetry.md) can be created from `msgServer` methods when handling messages.
-
-This is an example from the `x/auth/vesting` module:
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/v0.50.0-alpha.0/x/auth/vesting/msg_server.go#L76-L88
-```
-
-:::Warning
-Telemetry adds a performance overhead to the chain. It is recommended to only use this in critical paths
-:::
-
----
-
-## sidebar_position: 1
-
-# Query Services
-
-:::note Synopsis
-A Protobuf Query service processes [`queries`](./02-messages-and-queries.md#queries). Query services are specific to the module in which they are defined, and only process `queries` defined within said module. They are called from `BaseApp`'s [`Query` method](../../learn/advanced/00-baseapp.md#query).
-:::
-
-:::note Pre-requisite Readings
-
-- [Module Manager](./01-module-manager.md)
-- [Messages and Queries](./02-messages-and-queries.md)
-
-:::
-
-## Implementation of a module query service
-
-### gRPC Service
-
-When defining a Protobuf `Query` service, a `QueryServer` interface is generated for each module with all the service methods:
-
-```go
-type QueryServer interface {
-	QueryBalance(context.Context, *QueryBalanceParams) (*types.Coin, error)
-	QueryAllBalances(context.Context, *QueryAllBalancesParams) (*QueryAllBalancesResponse, error)
-}
-```
-
-These custom queries methods should be implemented by a module's keeper, typically in `./keeper/grpc_query.go`. The first parameter of these methods is a generic `context.Context`. Therefore, the Cosmos SDK provides a function `sdk.UnwrapSDKContext` to retrieve the `context.Context` from the provided
-`context.Context`.
-
-Here's an example implementation for the bank module:
-
-```go reference
-https://github.com/cosmos/cosmos-sdk/blob/v0.50.0-alpha.0/x/bank/keeper/grpc_query.go
-```
-
-### Calling queries from the State Machine
-
-The Cosmos SDK v0.47 introduces a new `cosmos.query.v1.module_query_safe` Protobuf annotation which is used to state that a query that is safe to be called from within the state machine, for example:
-
-- a Keeper's query function can be called from another module's Keeper,
-- ADR-033 intermodule query calls,
-- CosmWasm contracts can also directly interact with these queries.
-
-If the `module_query_safe` annotation set to `true`, it means:
-
-- The query is deterministic: given a block height it will return the same response upon multiple calls, and doesn't introduce any state-machine breaking changes across SDK patch versions.
-- Gas consumption never fluctuates across calls and across patch versions.
-
-If you are a module developer and want to use `module_query_safe` annotation for your own query, you have to ensure the following things:
-
-- the query is deterministic and won't introduce state-machine-breaking changes without coordinated upgrades
-- it has its gas tracked, to avoid the attack vector where no gas is accounted for
-  on potentially high-computation queries.
-
-  ***
-
-  sidebar_position: 1
-
----
-
-# Blockchain Architecture
-
-## Introduction
-
-Blockchain architecture is a complex topic that involves many different components. In this section, we will cover the main layers of a blockchain application built with the Cosmos SDK.
-
-At its core, a blockchain is a replicated deterministic state machine. This document explores the various layers of blockchain architecture, focusing on the execution, settlement, consensus, data availability, and interoperability layers.
-
-```mermaid
-graph TD
-    A[Modular SDK Blockchain Architecture]
-    A --> B[Execution Layer]
-    A --> C[Settlement Layer]
-    A --> D[Consensus Layer]
-    D --> E[Data Availability Layer]
-    A --> F[Interoperability Layer]
-```
-
-## Layered Architecture
-
-Understanding blockchain architecture through the lens of different layers helps in comprehending its complex functionalities. We will give a high-level overview of the execution layer, settlement layer, consensus layer, data availability layer, and interoperability layer.
-
-## Execution Layer
-
-The Execution Layer is where the blockchain processes and executes transactions. The state machine within the blockchain handles the execution of transaction logic. This is done by the blockchain itself, ensuring that every transaction follows the predefined rules and state transitions. When a transaction is submitted, the execution layer processes it, updates the state, and ensures that the output is deterministic and consistent across all nodes. In the context of the Cosmos SDK, this typically involves predefined modules and transaction types rather than general-purpose smart contracts, which are used in chains with CosmWasm.
-
-### State machine
-
-At its core, a blockchain is a [replicated deterministic state machine](https://en.wikipedia.org/wiki/State_machine_replication).
-
-A state machine is a computer science concept whereby a machine can have multiple states, but only one at any given time. There is a `state`, which describes the current state of the system, and `transactions`, that trigger state transitions.
-
-Given a state S and a transaction T, the state machine will return a new state S'.
-
-```mermaid
-flowchart LR
-    A[S]
-    B[S']
-    A -->|"apply(T)"| B
-```
-
-In practice, the transactions are bundled in blocks to make the process more efficient. Given a state S and a block of transactions B, the state machine will return a new state S'.
-
-```mermaid
-flowchart LR
-    A[S]
-    B[S']
-    A -->|"For each T in B: apply(T)"| B
-```
-
-In a blockchain context, the state machine is [deterministic](https://en.wikipedia.org/wiki/Deterministic_system). This means that if a node is started at a given state and replays the same sequence of transactions, it will always end up with the same final state.
-
-The Cosmos SDK gives developers maximum flexibility to define the state of their application, transaction types and state transition functions. The process of building state machines with the Cosmos SDK will be described more in-depth in the following sections. But first, let us see how the state machine is replicated using various consensus engines, such as CometBFT.
-
-## Settlement Layer
-
-The Settlement Layer is responsible for finalising and recording transactions on the blockchain. This layer ensures that all transactions are accurately settled and immutable, providing a verifiable record of all activities on the blockchain. It is critical for maintaining the integrity and trustworthiness of the blockchain.
-
-The settlement layer can be performed on the chain itself or it can be externalised, allowing for the possibility of plugging in a different settlement layer as needed. For example if we were to use Rollkit and celestia for our Data Availability and Consensus, we could separate our settlement layer by introducing fraud or validity proofs. From there the settlement layer can create trust-minimised light clients, further enhancing security and efficiency. This process ensures that all transactions are accurately finalized and immutable, providing a verifiable record of all activities.
-
-## Consensus Layer
-
-The Consensus Layer ensures that all nodes in the network agree on the order and validity of transactions. This layer uses consensus algorithms like Byzantine Fault Tolerance (BFT) or Proof of Stake (PoS) to achieve agreement, even in the presence of malicious nodes. Consensus is crucial for maintaining the security and reliability of the blockchain.
-
-What has been a default consensus engine in the Cosmos SDK has been CometBFT. In the most recent releases we have been moving away from this and allowing users to plug and play their own consensus engines. This is a big step forward for the Cosmos SDK as it allows for more flexibility and customisation. Other consensus engine options for example can be Rollkit with Celestias Data Availability Layer.
-
-Here is an example of how the consensus layer works with CometBFT in the context of the Cosmos SDK:
-
-### CometBFT
-
-Thanks to the Cosmos SDK, developers just have to define the state machine, and [_CometBFT_](https://docs.cometbft.com/v1.0/explanation/introduction/) will handle replication over the network for them.
-
-```mermaid
-flowchart TD
-    subgraph Blockchain_Node[Blockchain Node]
-        subgraph SM[State-machine]
-            direction TB
-            SM1[Cosmos SDK]
-        end
-        subgraph CometBFT[CometBFT]
-            direction TB
-            Consensus
-            Networking
-        end
-    end
-
-    SM <--> CometBFT
-
-
-    Blockchain_Node -->|Includes| SM
-    Blockchain_Node -->|Includes| CometBFT
-```
-
-[CometBFT](https://docs.cometbft.com/v1.0/explanation/introduction/) is an application-agnostic engine that is responsible for handling the _networking_ and _consensus_ layers of a blockchain. In practice, this means that CometBFT is responsible for propagating and ordering transaction bytes. CometBFT relies on an eponymous Byzantine-Fault-Tolerant (BFT) algorithm to reach consensus on the order of transactions.
-
-The [consensus algorithm adopted by CometBFT](https://docs.cometbft.com/v1.0/explanation/introduction/#consensus-overview) works with a set of special nodes called _Validators_. Validators are responsible for adding blocks of transactions to the blockchain. At any given block, there is a validator set V. A validator in V is chosen by the algorithm to be the proposer of the next block. This block is considered valid if more than two thirds of V signed a `prevote` and a `precommit` on it, and if all the transactions that it contains are valid. The validator set can be changed by rules written in the state-machine.
-
-## ABCI
-
-CometBFT passes transactions to the application through an interface called the [ABCI](https://docs.cometbft.com/v1.0/spec/abci/), which the application must implement.
-
-```mermaid
-graph TD
-    A[Application]
-    B[CometBFT]
-    A <-->|ABCI| B
-
-```
-
-Note that **CometBFT only handles transaction bytes**. It has no knowledge of what these bytes mean. All CometBFT does is order these transaction bytes deterministically. CometBFT passes the bytes to the application via the ABCI, and expects a return code to inform it if the messages contained in the transactions were successfully processed or not.
-
-Here are the most important messages of the ABCI:
-
-- `CheckTx`: When a transaction is received by CometBFT, it is passed to the application to check if a few basic requirements are met. `CheckTx` is used to protect the mempool of full-nodes against spam transactions. A special handler called the [`AnteHandler`](../beginner/04-gas-fees.md#antehandler) is used to execute a series of validation steps such as checking for sufficient fees and validating the signatures. If the checks are valid, the transaction is added to the [mempool](https://docs.cometbft.com/v1.0/explanation/core/mempool) and relayed to peer nodes. Note that transactions are not processed (i.e. no modification of the state occurs) with `CheckTx` since they have not been included in a block yet.
-- `DeliverTx`: When a [valid block](https://docs.cometbft.com/v1.0/spec/core/data_structures#block) is received by CometBFT, each transaction in the block is passed to the application via `DeliverTx` in order to be processed. It is during this stage that the state transitions occur. The `AnteHandler` executes again, along with the actual [`Msg` service](../../build/building-modules/03-msg-services.md) RPC for each message in the transaction.
-- `BeginBlock`/`EndBlock`: These messages are executed at the beginning and the end of each block, whether the block contains transactions or not. It is useful to trigger automatic execution of logic. Proceed with caution though, as computationally expensive loops could slow down your blockchain, or even freeze it if the loop is infinite.
-
-Find a more detailed view of the ABCI methods from the [CometBFT docs](https://docs.cometbft.com/v1.0/spec/abci/).
-
-Any application built on CometBFT needs to implement the ABCI interface in order to communicate with the underlying local CometBFT engine. Fortunately, you do not have to implement the ABCI interface. The Cosmos SDK provides a boilerplate implementation of it in the form of [baseapp](./03-sdk-design.md#baseapp).
-
-## Data Availability Layer
-
-The Data Availability (DA) Layer is a critical component of within the umbrella of the consensus layer that ensures all necessary data for transactions is available to all network participants. This layer is essential for preventing data withholding attacks, where some nodes might attempt to disrupt the network by not sharing critical transaction data.
-
-If we use the example of Rollkit, a user initiates a transaction, which is then propagated through the rollup network by a light node. The transaction is validated by full nodes and aggregated into a block by the sequencer. This block is posted to a data availability layer like Celestia, ensuring the data is accessible and correctly ordered. The rollup light node verifies data availability from the DA layer. Full nodes then validate the block and generate necessary proofs, such as fraud proofs for optimistic rollups or zk-SNARKs/zk-STARKs for zk-rollups. These proofs are shared across the network and verified by other nodes, ensuring the rollup's integrity. Once all validations are complete, the rollup's state is updated, finalising the transaction
-
-## Interoperability Layer
-
-The Interoperability Layer enables communication and interaction between different blockchains. This layer facilitates cross-chain transactions and data sharing, allowing various blockchain networks to interoperate seamlessly. Interoperability is key for building a connected ecosystem of blockchains, enhancing their functionality and reach.
-
-In this case we have separated the layers even further to really illustrate the components that make-up the blockchain architecture and it is important to note that the Cosmos SDK is designed to be interoperable with other blockchains. This is achieved through the use of the [Inter-Blockchain Communication (IBC) protocol](https://www.ibcprotocol.dev/), which allows different blockchains to communicate and transfer assets between each other.
-
----
-
-## sidebar_position: 1
-
-# Application-Specific Blockchains
-
-:::note Synopsis
-This document explains what application-specific blockchains are, and why developers would want to build one as opposed to writing Smart Contracts.
-:::
-
-## What are application-specific blockchains
-
-Application-specific blockchains are blockchains customized to operate a single application. Instead of building a decentralized application on top of an underlying blockchain like Ethereum, developers build their own blockchain from the ground up. This means building a full-node client, a light-client, and all the necessary interfaces (CLI, REST, ...) to interact with the nodes.
-
-```mermaid
-flowchart TD
-    subgraph Blockchain_Node[Blockchain Node]
-        subgraph SM[State-machine]
-            direction TB
-            SM1[Cosmos SDK]
-        end
-        subgraph Consensus[Consensus]
-            direction TB
-        end
-        subgraph Networking[Networking]
-            direction TB
-        end
-    end
-
-    SM <--> Consensus
-    Consensus <--> Networking
-
-
-    Blockchain_Node -->|Includes| SM
-    Blockchain_Node -->|Includes| Consensus
-    Blockchain_Node -->|Includes| Networking
-```
-
-## What are the shortcomings of Smart Contracts
-
-Virtual-machine blockchains like Ethereum addressed the demand for more programmability back in 2014. At the time, the options available for building decentralized applications were quite limited. Most developers would build on top of the complex and limited Bitcoin scripting language, or fork the Bitcoin codebase which was hard to work with and customize.
-
-Virtual-machine blockchains came in with a new value proposition. Their state-machine incorporates a virtual-machine that is able to interpret turing-complete programs called Smart Contracts. These Smart Contracts are very good for use cases like one-time events (e.g. ICOs), but they can fall short for building complex decentralized platforms. Here is why:
-
-- Smart Contracts are generally developed with specific programming languages that can be interpreted by the underlying virtual-machine. These programming languages are often immature and inherently limited by the constraints of the virtual-machine itself. For example, the Ethereum Virtual Machine does not allow developers to implement automatic execution of code. Developers are also limited to the account-based system of the EVM, and they can only choose from a limited set of functions for their cryptographic operations. These are examples, but they hint at the lack of **flexibility** that a smart contract environment often entails.
-- Smart Contracts are all run by the same virtual machine. This means that they compete for resources, which can severely restrain **performance**. And even if the state-machine were to be split in multiple subsets (e.g. via sharding), Smart Contracts would still need to be interpreted by a virtual machine, which would limit performance compared to a native application implemented at state-machine level (our benchmarks show an improvement on the order of 10x in performance when the virtual-machine is removed).
-- Another issue with the fact that Smart Contracts share the same underlying environment is the resulting limitation in **sovereignty**. A decentralized application is an ecosystem that involves multiple players. If the application is built on a general-purpose virtual-machine blockchain, stakeholders have very limited sovereignty over their application, and are ultimately superseded by the governance of the underlying blockchain. If there is a bug in the application, very little can be done about it.
-
-Application-Specific Blockchains are designed to address these shortcomings.
-
-## Application-Specific Blockchains Benefits
-
-### Flexibility
-
-Application-specific blockchains give maximum flexibility to developers:
-
-- In Cosmos blockchains, the state-machine is typically connected to the underlying consensus engine via an interface called the [ABCI](https://docs.cometbft.com/v1.0/spec/abci/) (Application Blockchain Interface). This interface can be wrapped in any programming language, meaning developers can build their state-machine in the programming language of their choice.
-
-- Developers can choose among multiple frameworks to build their state-machine. The most widely used today is the Cosmos SDK, but others exist (e.g. [Lotion](https://github.com/nomic-io/lotion), [Weave](https://github.com/iov-one/weave), ...). Typically the choice will be made based on the programming language they want to use (Cosmos SDK and Weave are in Golang, Lotion is in Javascript, ...).
-- The ABCI also allows developers to swap the consensus engine of their application-specific blockchain. Today, only CometBFT is production-ready, but in the future other consensus engines are expected to emerge.
-- Even when they settle for a framework and consensus engine, developers still have the freedom to tweak them if they don't perfectly match their requirements in their pristine forms.
-- Developers are free to explore the full spectrum of tradeoffs (e.g. number of validators vs transaction throughput, safety vs availability in asynchrony, ...) and design choices (DB or IAVL tree for storage, UTXO or account model, ...).
-- Developers can implement automatic execution of code. In the Cosmos SDK, logic can be automatically triggered at the beginning and the end of each block. They are also free to choose the cryptographic library used in their application, as opposed to being constrained by what is made available by the underlying environment in the case of virtual-machine blockchains.
-
-The list above contains a few examples that show how much flexibility application-specific blockchains give to developers. The goal of Cosmos and the Cosmos SDK is to make developer tooling as generic and composable as possible, so that each part of the stack can be forked, tweaked and improved without losing compatibility. As the community grows, more alternatives for each of the core building blocks will emerge, giving more options to developers.
-
-### Performance
-
-Decentralized applications built with Smart Contracts are inherently capped in performance by the underlying environment. For a decentralized application to optimise performance, it needs to be built as an application-specific blockchain. Next are some of the benefits an application-specific blockchain brings in terms of performance:
-
-- Developers of application-specific blockchains can choose to operate with a novel consensus engine such as CometBFT.
-- An application-specific blockchain only operates a single application, so that the application does not compete with others for computation and storage. This is the opposite of most non-sharded virtual-machine blockchains today, where smart contracts all compete for computation and storage.
-- Even if a virtual-machine blockchain offered application-based sharding coupled with an efficient consensus algorithm, performance would still be limited by the virtual-machine itself. The real throughput bottleneck is the state-machine, and requiring transactions to be interpreted by a virtual-machine significantly increases the computational complexity of processing them.
-
-### Security
-
-Security is hard to quantify, and greatly varies from platform to platform. That said here are some important benefits an application-specific blockchain can bring in terms of security:
-
-- Developers can choose proven programming languages like Go when building their application-specific blockchains, as opposed to smart contract programming languages that are often more immature.
-- Developers are not constrained by the cryptographic functions made available by the underlying virtual-machines. They can use their own custom cryptography, and rely on well-audited crypto libraries.
-- Developers do not have to worry about potential bugs or exploitable mechanisms in the underlying virtual-machine, making it easier to reason about the security of the application.
-
-### Sovereignty
-
-One of the major benefits of application-specific blockchains is sovereignty. A decentralized application is an ecosystem that involves many actors: users, developers, third-party services, and more. When developers build on virtual-machine blockchain where many decentralized applications coexist, the community of the application is different than the community of the underlying blockchain, and the latter supersedes the former in the governance process. If there is a bug or if a new feature is needed, stakeholders of the application have very little leeway to upgrade the code. If the community of the underlying blockchain refuses to act, nothing can happen.
-
-The fundamental issue here is that the governance of the application and the governance of the network are not aligned. This issue is solved by application-specific blockchains. Because application-specific blockchains specialize to operate a single application, stakeholders of the application have full control over the entire chain. This ensures that the community will not be stuck if a bug is discovered, and that it has the freedom to choose how it is going to evolve.

.github/aider/guides/sonr-did.md

@@ -1,141 +0,0 @@
-# `x/did`
-
-The Decentralized Identity module is responsible for managing native Sonr Accounts, their derived wallets, and associated user identification information.
-
-## State
-
-The DID module maintains several key state structures:
-
-### Controller State
-
-The Controller state represents a Sonr DWN Vault. It includes:
-- Unique identifier (number)
-- DID
-- Sonr address
-- Ethereum address
-- Bitcoin address
-- Public key
-- Keyshares pointer
-- Claimed block
-- Creation block
-
-### Assertion State
-
-The Assertion state includes:
-- DID
-- Controller
-- Subject
-- Public key
-- Assertion type
-- Accumulator (metadata)
-- Creation block
-
-### Authentication State
-
-The Authentication state includes:
-- DID
-- Controller
-- Subject
-- Public key
-- Credential ID
-- Metadata
-- Creation block
-
-### Verification State
-
-The Verification state includes:
-- DID
-- Controller
-- DID method
-- Issuer
-- Subject
-- Public key
-- Verification type
-- Metadata
-- Creation block
-
-## State Transitions
-
-State transitions are triggered by the following messages:
-- LinkAssertion
-- LinkAuthentication
-- UnlinkAssertion
-- UnlinkAuthentication
-- ExecuteTx
-- UpdateParams
-
-## Messages
-
-The DID module defines the following messages:
-
-1. MsgLinkAuthentication
-2. MsgLinkAssertion
-3. MsgExecuteTx
-4. MsgUnlinkAssertion
-5. MsgUnlinkAuthentication
-6. MsgUpdateParams
-
-Each message triggers specific state machine behaviors related to managing DIDs, authentications, assertions, and module parameters.
-
-## Query
-
-The DID module provides the following query endpoints:
-
-1. Params: Query all parameters of the module
-2. Resolve: Query the DID document by its ID
-3. Sign: Sign a message with the DID document
-4. Verify: Verify a message with the DID document
-
-## Params
-
-The module parameters include:
-- Allowed public keys (map of KeyInfo)
-- Conveyance preference
-- Attestation formats
-
-## Client
-
-The module provides gRPC and REST endpoints for all defined messages and queries.
-
-## Future Improvements
-
-Potential future improvements could include:
-1. Enhanced privacy features for DID operations
-2. Integration with more blockchain networks
-3. Support for additional key types and cryptographic algorithms
-4. Improved revocation mechanisms for credentials and assertions
-
-## Tests
-
-Acceptance tests should cover all major functionality, including:
-- Creating and managing DIDs
-- Linking and unlinking assertions and authentications
-- Executing transactions with DIDs
-- Querying and resolving DIDs
-- Parameter updates
-
-## Appendix
-
-### Account
-
-An Account represents a user's identity within the Sonr ecosystem. It includes information such as the user's public key, associated wallets, and other identification details.
-
-### Decentralized Identifier (DID)
-
-A Decentralized Identifier (DID) is a unique identifier that is created, owned, and controlled by the user. It is used to establish a secure and verifiable digital identity.
-
-### Verifiable Credential (VC)
-
-A Verifiable Credential (VC) is a digital statement that can be cryptographically verified. It contains claims about a subject (e.g., a user) and is issued by a trusted authority.
-
-### Key Types
-
-The module supports various key types, including:
-- Role
-- Algorithm (e.g., ES256, EdDSA, ES256K)
-- Encoding (e.g., hex, base64, multibase)
-- Curve (e.g., P256, P384, P521, X25519, X448, Ed25519, Ed448, secp256k1)
-
-### JSON Web Key (JWK)
-
-The module supports JSON Web Keys (JWK) for representing cryptographic keys, including properties such as key type (kty), curve (crv), and coordinates (x, y) for EC and OKP keys, as well as modulus (n) and exponent (e) for RSA keys.

.github/aider/guides/sonr-dwn.md

@@ -1,145 +0,0 @@
-# `x/dwn`
-
-The DWN module is responsible for the management of IPFS deployed Decentralized Web Nodes (DWNs) and their associated data.
-
-## Concepts
-
-The DWN module introduces several key concepts:
-
-1. Decentralized Web Node (DWN): A distributed network for storing and sharing data.
-2. Schema: A structure defining the format of various data types in the dwn.
-3. IPFS Integration: The module can interact with IPFS for decentralized data storage.
-
-## State
-
-The DWN module maintains the following state:
-
-### DWN State
-
-The DWN state is stored using the following structure:
-
-```protobuf
-message DWN {
-  uint64 id = 1;
-  string alias = 2;
-  string cid = 3;
-  string resolver = 4;
-}
-```
-
-This state is indexed by ID, alias, and CID for efficient querying.
-
-### Params State
-
-The module parameters are stored in the following structure:
-
-```protobuf
-message Params {
-  bool ipfs_active = 1;
-  bool local_registration_enabled = 2;
-  Schema schema = 4;
-}
-```
-
-### Schema State
-
-The Schema state defines the structure for various data types:
-
-```protobuf
-message Schema {
-  int32 version = 1;
-  string account = 2;
-  string asset = 3;
-  string chain = 4;
-  string credential = 5;
-  string did = 6;
-  string jwk = 7;
-  string grant = 8;
-  string keyshare = 9;
-  string profile = 10;
-}
-```
-
-## State Transitions
-
-State transitions in the DWN module are primarily triggered by:
-
-1. Updating module parameters
-2. Allocating new dwns
-3. Syncing DID documents
-
-## Messages
-
-The DWN module defines the following message:
-
-1. `MsgUpdateParams`: Used to update the module parameters.
-
-```protobuf
-message MsgUpdateParams {
-  string authority = 1;
-  Params params = 2;
-}
-```
-
-## Begin Block
-
-No specific begin-block operations are defined for this module.
-
-## End Block
-
-No specific end-block operations are defined for this module.
-
-## Hooks
-
-The DWN module does not define any hooks.
-
-## Events
-
-The DWN module does not explicitly define any events. However, standard Cosmos SDK events may be emitted during state transitions.
-
-## Client
-
-The DWN module provides the following gRPC query endpoints:
-
-1. `Params`: Queries all parameters of the module.
-2. `Schema`: Queries the DID document schema.
-3. `Allocate`: Initializes a Target DWN available for claims.
-4. `Sync`: Queries the DID document by its ID and returns required information.
-
-## Params
-
-The module parameters include:
-
-- `ipfs_active` (bool): Indicates if IPFS integration is active.
-- `local_registration_enabled` (bool): Indicates if local registration is enabled.
-- `schema` (Schema): Defines the structure for various data types in the dwn.
-
-## Future Improvements
-
-Potential future improvements could include:
-
-1. Enhanced IPFS integration features.
-2. Additional authentication mechanisms beyond WebAuthn.
-3. Improved DID document management and querying capabilities.
-
-## Tests
-
-Acceptance tests should cover:
-
-1. Parameter updates
-2. DWN state management
-3. Schema queries
-4. DWN allocation process
-5. DID document syncing
-
-## Appendix
-
-| Concept                                     | Description                                                                                                                                                                           |
-| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Decentralized Web Node (DWN)                | A decentralized, distributed, and secure network of nodes that store and share data. It is a decentralized alternative to traditional web hosting services.                           |
-| Decentralized Identifier (DID)              | A unique identifier that is created, owned, and controlled by the user. It is used to establish a secure and verifiable digital identity.                                             |
-| HTMX (Hypertext Markup Language eXtensions) | A set of extensions to HTML that allow for the creation of interactive web pages. It is used to enhance the user experience and provide additional functionality to web applications. |
-| IPFS (InterPlanetary File System)           | A decentralized, peer-to-peer network for storing and sharing data. It is a distributed file system that allows for the creation and sharing of content across a network of nodes.    |
-| WebAuthn (Web Authentication)               | A set of APIs that allow websites to request user authentication using biometric or non-biometric factors.                                                                            |
-| WebAssembly (Web Assembly)                  | A binary instruction format for a stack-based virtual machine.                                                                                                                        |
-| Verifiable Credential (VC)                  | A digital statement that can be cryptographically verified.                                                                                                                           |

.github/aider/guides/sonr-service.md

@@ -1,91 +0,0 @@
-# `x/svc`
-
-The svc module is responsible for managing the registration and authorization of services within the Sonr ecosystem. It provides a secure and verifiable mechanism for registering and authorizing services using Decentralized Identifiers (DIDs).
-
-## Concepts
-
-- **Service**: A decentralized svc on the Sonr Blockchain with properties such as ID, authority, origin, name, description, category, tags, and expiry height.
-- **Profile**: Represents a DID alias with properties like ID, subject, origin, and controller.
-- **Metadata**: Contains information about a svc, including name, description, category, icon, and tags.
-
-### Dependencies
-
-- [x/did](https://github.com/onsonr/sonr/tree/master/x/did)
-- [x/group](https://github.com/onsonr/sonr/tree/master/x/group)
-- [x/nft](https://github.com/onsonr/sonr/tree/master/x/nft)
-
-## State
-
-The module uses the following state structures:
-
-### Metadata
-
-Stores information about services:
-
-- Primary key: `id` (auto-increment)
-- Unique index: `origin`
-- Fields: id, origin, name, description, category, icon (URI), tags
-
-### Profile
-
-Stores DID alias information:
-
-- Primary key: `id`
-- Unique index: `subject,origin`
-- Fields: id, subject, origin, controller
-
-## Messages
-
-### MsgUpdateParams
-
-Updates the module parameters. Can only be executed by the governance account.
-
-### MsgRegisterService
-
-Registers a new svc on the blockchain. Requires a valid TXT record in DNS for the origin.
-
-## Params
-
-The module has the following parameters:
-
-- `categories`: List of allowed svc categories
-- `types`: List of allowed svc types
-
-## Query
-
-The module provides the following query:
-
-### Params
-
-Retrieves all parameters of the module.
-
-## Client
-
-### gRPC
-
-The module provides a gRPC Query svc with the following RPC:
-
-- `Params`: Get all parameters of the module
-
-### CLI
-
-(TODO: Add CLI commands for interacting with the module)
-
-## Events
-
-(TODO: List and describe event tags used by the module)
-
-## Future Improvements
-
-- Implement svc discovery mechanisms
-- Add support for svc reputation and rating systems
-- Enhance svc metadata with more detailed information
-- Implement svc update and deactivation functionality
-
-## Tests
-
-(TODO: Add acceptance tests for the module)
-
-## Appendix
-
-This module is part of the Sonr blockchain project and interacts with other modules such as DID and NFT modules to provide a comprehensive decentralized svc ecosystem.

.github/aider/guides/ucan-spec.md

@@ -1,873 +0,0 @@
-# User Controlled Authorization Network (UCAN) Specification
-
-# Abstract
-
-User-Controlled Authorization Network (UCAN) is a [trustless], secure, [local-first], user-originated, distributed authorization scheme. This document provides a high level overview of the components of the system, concepts, and motivation. Exact formats are given in [sub-specifications].
-
-# Introduction
-
-User-Controlled Authorization Network (UCAN) is a [trustless], secure, [local-first], user-originated, distributed authorization scheme. It provides public-key verifiable, delegable, expressive, openly extensible [capabilities]. UCANs achieve public verifiability with late-bound certificate chains and principals represented by [decentralized identifiers (DIDs)][DID].
-
-UCAN improves the familiarity and adoptability of schemes like [SPKI/SDSI][SPKI] for web and native application contexts. UCAN allows for the creation, delegation, and invocation of authority by any agent with a DID, including traditional systems and peer-to-peer architectures beyond traditional cloud computing.
-
-## Motivation
-
-> If we practice our principles, we could have both security and functionality. Treating security as a separate concern has not succeeded in bridging the gap between principle and practice, because it operates without knowledge of what constitutes least authority.
->
-> — [Miller][Mark Miller] et al, [The Structure of Authority]
-
-Since at least [Multics], access control lists ([ACL]s) have been the most popular form of digital authorization, where a list of what each user is allowed to do is maintained on the resource. ACLs (and later [RBAC]) have been a successful model suited to architectures where persistent access to a single list is viable. ACLs require that rules are sufficiently well specified, such as in a centralized database with rules covering all possible permutations of scenario. This both imposes a very high maintenance burden on programmers as a systems grows in complexity, and is a key vector for [confused deputies][confused deputy problem].
-
-With increasing interconnectivity between machines becoming commonplace, authorization needs to scale to meet the load demands of distributed systems while providing partition tolerance. However, it is not always practical to maintain a single central authorization source. Even when copies of the authorization list are distributed to the relevant servers, latency and partitions introduce troublesome challenges with conflicting updates, to say nothing of storage requirements.
-
-A large portion of personal information now also moves through connected systems. As a result, data privacy is a prominent theme when considering the design of modern applications, to the point of being legislated in parts of the world.
-
-Ahead-of-time coordination is often a barrier to development in many projects. Flexibility to define specialized authorization semantics for resources and the ability to integrate with external systems trustlessly are essential as the number of autonomous, specialized, and coordinated applications increases.
-
-Many high-value applications run in hostile environments. In recognition of this, many vendors now include public key functionality, such as [non-extractable keys in browsers][browser api crypto key], [certificate systems for external keys][fido], [platform keys][passkey], and [secure hardware enclaves] in widespread consumer devices.
-
-Two related models that work exceptionally well in the above context are Simple Public Key Infrastructure ([SPKI][spki rfc]) and object capabilities ([OCAP]). Since offline operation and self-verifiability are two requirements, UCAN adopts a [certificate capability model] related to [SPKI].
-
-## Intuition for Auth System Differences
-
-The following analogies illustrate several significant trade-offs between these systems but are only accurate enough to build intuition. A good resource for a more thorough presentation of these trade-offs is [Capability Myths Demolished]. In this framework, UCAN approximates SPKI with some dynamic features.
-
-### Access Control Lists
-
-By analogy, ACLs are like a bouncer at an exclusive event. This bouncer has a list attendees allowed in and which of those are VIPs that get extra access. People trying to get in show their government-issued ID and are accepted or rejected. In addition, they may get a lanyard to identify that they have previously been allowed in. If someone is disruptive, they can simply be crossed off the list and denied further entry.
-
-If there are many such events at many venues, the organizers need to coordinate ahead of time, denials need to be synchronized, and attendees need to show their ID cards to many bouncers. The likelihood of the bouncer letting in the wrong person due to synchronization lag or confusion by someone sharing a name is nonzero.
-
-### Certificate Capabilities
-
-UCANs work more like [movie tickets][caps as keys] or a festival pass. No one needs to check your ID; who you are is irrelevant. For example, if you have a ticket issued by the theater to see Citizen Kane, you are admitted to Theater 3. If you cannot attend an event, you can hand this ticket to a friend who wants to see the film instead, and there is no coordination required with the theater ahead of time. However, if the theater needs to cancel tickets for some reason, they need a way of uniquely identifying them and sharing this information between them.
-
-### Object Capabilities
-
-Object capability ("ocap") systems use a combination of references, encapsulated state, and proxy forwarding. As the name implies, this is fairly close to object-oriented or actor-based systems. Object capabilities are [robust][Robust Composition], flexible, and expressive.
-
-To achieve these properties, object capabilities have two requirements: [fail-safe], and locality preservation. The emphasis on consistency rules out partition tolerance[^pcec].
-
-## Security Considerations
-
-Each UCAN includes an assertions of what it is allowed to do. "Proofs" are positive evidence (elsewhere called "witnesses") of the possession of rights. They are cryptographically verifiable chains showing that the UCAN issuer either claims to directly own a resource, or that it was delegated to them by some claimed owner. In the most common case, the root owner's ID is the only globally unique identity for the resource.
-
-Root capability issuers function as verifiable, distributed roots of trust. The delegation chain is by definition a provenance log. Private keys themselves SHOULD NOT move from one context to another. Keeping keys unique to each physical device and unique per use case is RECOMMENDED to reduce opportunity for keys to leak, and limit blast radius in the case of compromises. "Sharing authority without sharing keys" is provided by capabilities, so there is no reason to share keys directly.
-
-Note that a structurally and cryptographically valid UCAN chain can be semantically invalid. The executor MUST verify the ownership of any external resources at execution time. While not possible for all use cases (e.g. replicated state machines and eventually consistent data), having the Executor be the resource itself is RECOMMENDED.
-
-While certificate chains go a long way toward improving security, they do not provide [confinement] on their own. The principle of least authority SHOULD be used when delegating a UCAN: minimizing the amount of time that a UCAN is valid for and reducing authority to the bare minimum required for the delegate to complete their task. This delegate should be trusted as little as is practical since they can further sub-delegate their authority to others without alerting their delegator. UCANs do not offer confinement (as that would require all processes to be online), so it is impossible to guarantee knowledge of all of the sub-delegations that exist. The ability to revoke some or all downstream UCANs exists as a last resort.
-
-## Inversion of Control
-
-[Inversion of control] is achieved due to two properties: self-certifying delegation and reference passing. There is no Authorization Server (AS) that sits between requestors and resources. In traditional terms, the owner of a UCAN resource is the resource server (RS) directly.
-
-This inverts the usual relationship between resources and users: the resource grants some (or all) authority over itself to agents, as opposed to an Authorization Server managing the relationship between them. This has several major advantages:
-
-- Fully distributed and scalable
-- Self-contained request without intermediary
-- Partition tolerance, [support for replicated data and machines][overcoming SSI]
-- Flexible granularity
-- Compositionality: no distinction between resources residing together or apart
-
-```
-┌─────────────┐   ┌─────────────┐   ┌─────────────┐
-│             │   │             │   │             │
-│             │   │ ┌─────────┐ │   │             │
-│             │   │ │  Bob's  │ │   │             │
-│             │   │ │  Photo  │ │   │             │
-│             │   │ │ Gallery │ │   │             │
-│             │   │ └─────────┘ │   │             │
-│             │   │             │   │             │
-│   Alice's   │   │    Bob's    │   │   Carol's   │
-│    Stuff    │   │    Stuff    │   │    Stuff    │
-│             │   │             │   │             │
-│     ┌───────┼───┼─────────────┼───┼──┐          │
-│     │       │   │             │   │  │          │
-│     │       │   │         ┌───┼───┼──┼────────┐ │
-│     │       │   │ Alice's │   │   │  │        │ │
-│     │       │   │  Music  │   │   │  │Carol's │ │
-│     │       │   │ Player  │   │   │  │  Game  │ │
-│     │       │   │         │   │   │  │        │ │
-│     │       │   │         └───┼───┼──┼────────┘ │
-│     │       │   │             │   │  │          │
-│     └───────┼───┼─────────────┼───┼──┘          │
-│             │   │             │   │             │
-└─────────────┘   └─────────────┘   └─────────────┘
-```
-
-This additionally allows UCAN to model auth for [eventually consistent and replicated state][overcoming SSI].
-
-# Roles
-
-There are several roles that an agent MAY assume:
-
-| Name      | Description                                                                                      |
-| --------- | ------------------------------------------------------------------------------------------------ |
-| Agent     | The general class of entities and principals that interact with a UCAN                           |
-| Audience  | The Principal delegated to in the current UCAN. Listed in the `aud` field                        |
-| Executor  | The Agent that actually performs the action described in an invocation                           |
-| Invoker   | A Principal that requests an Executor perform some action that uses the Invoker's authority      |
-| Issuer    | The Principal of the current UCAN. Listed in the `iss` field                                     |
-| Owner     | A Subject that controls some external resource                                                   |
-| Principal | An agent identified by DID (listed in a UCAN's `iss` or `aud` field)                             |
-| Revoker   | The Issuer listed in a proof chain that revokes a UCAN                                           |
-| Subject   | The Principal who's authority is delegated or invoked                                            |
-| Validator | Any Agent that interprets a UCAN to determine that it is valid, and which capabilities it grants |
-
-```mermaid
-flowchart TD
-    subgraph Agent
-        subgraph Principal
-            direction TB
-
-            subgraph Issuer
-                direction TB
-
-                subgraph Subject
-                    direction TB
-
-                    Executor
-                    Owner
-                end
-
-                Revoker
-            end
-
-            subgraph Audience
-                Invoker
-            end
-        end
-
-        Validator
-    end
-```
-
-## Subject
-
-> At the very least every object should have a URL
->
-> — [Alan Kay], [The computer revolution hasn't happened yet]
-
-> Every Erlang process in the universe should be addressable and introspective
->
-> — [Joe Armstrong], [Code Mesh 2016]
-
-A [Subject] represents the Agent that a capability is for. A Subject MUST be referenced by [DID]. This behaves much like a [GUID], with the addition of public key verifiability. This unforgeability prevents malicious namespace collisions which can lead to [confused deputies][confused deputy problem].
-
-### Resource
-
-A resource is some data or process that can be uniquely identified by a [URI]. It can be anything from a row in a database, a user account, storage quota, email address, etc. Resource MAY be as coarse or fine grained as desired. Finer-grained is RECOMMENDED where possible, as it is easier to model the principle of least authority ([PoLA]).
-
-A resource describes the noun of a capability. The resource pointer MUST be provided in [URI] format. Arbitrary and custom URIs MAY be used, provided that the intended recipient can decode the URI. The URI is merely a unique identifier to describe the pointer to — and within — a resource.
-
-Having a unique agent represent a resource (and act as its manager) is RECOMMENDED. However, to help traditional ACL-based systems transition to certificate capabilities, an agent MAY manage multiple resources, and [act as the registrant in the ACL system][wrapping existing systems].
-
-Unless explicitly stated, the Resource of a UCAN MUST be the Subject.
-
-## Issuer & Audience
-
-The Issuer (`iss`) and Audience (`aud`) can be conceptualized as the sender and receiver (respectively) of a postal letter. Every UCAN MUST be signed with the private key associated with the DID in the `iss` field.
-
-For example:
-
-```js
-"aud": "did:key:z6MkiTBz1ymuepAQ4HEHYSF1H8quG5GLVVQR3djdX3mDooWp",
-"iss": "did:key:zDnaerDaTF5BXEavCrfRZEk316dpbLsfPDZ3WJ5hRTPFU2169",
-```
-
-Please see the [Cryptosuite] section for more detail on DIDs.
-
-# Lifecycle
-
-The UCAN lifecycle has four components:
-
-| Spec         | Description                                                              | Requirement Level |
-| ------------ | ------------------------------------------------------------------------ | ----------------- |
-| [Delegation] | Pass, attenuate, and secure authority in a partition-tolerant way        | REQUIRED          |
-| [Invocation] | Exercise authority that has been delegated through one or more delegates | REQUIRED          |
-| [Promise]    | Await the result of an Invocation inside another Invocation              | RECOMMENDED       |
-| [Revocation] | Undo a delegation, breaking a delegation chain for malicious users       | RECOMMENDED       |
-
-```mermaid
-flowchart TD
-    prm(Promise)
-    inv(Invocation)
-    del(Delegation)
-    rev(Revocation)
-
-    prm -->|awaits| inv
-    del -->|proves| inv
-    rev -.->|kind of| inv
-    rev -->|invalidates| del
-
-    click del href "https://github.com/ucan-wg/delegation" "UCAN Delegation Spec"
-    click inv href "https://github.com/ucan-wg/invocation" "UCAN Invocation Spec"
-    click rev href "https://github.com/ucan-wg/revocation" "UCAN Revocation Spec"
-```
-
-## Time
-
-It is often useful to talk about a UCAN in the context of some action. For example, a UCAN delegation may be valid when it was created, but expired when invoked.
-
-```mermaid
-sequenceDiagram
-    Alice -->> Bob: Delegate
-    Bob ->> Bob: Validate
-    Bob -->> Carol: Delegate
-    Carol ->> Carol: Validate
-    Carol ->> Alice: Invoke
-    Alice ->> Alice: Validate
-    Alice ->> Alice: Execute
-```
-
-### Validity Interval
-
-The period of time that a capability is valid from and until. This is the range from the latest "not before" to the earliest expiry in the UCAN delegation chain.
-
-### Delegation-Time
-
-The moment at which a delegation is asserted. This MAY be captured by an `iat` field, but is generally superfluous to capture in the token.
-
-### Invocation-Time
-
-The moment a UCAN Invocation is created. It must be within the Validity Interval.
-
-### Validation-Time
-
-Validation MAY occur at multiple points during a UCAN's lifecycle. The main two are:
-
-- On receipt of a delegation
-- When executing an invocation
-
-### Execution-Time
-
-To avoid the overloaded word "runtime", UCAN adopts the term "execution-time" to express the moment that the executor attempts to use the authority captured in an invocation and associated delegation chain. Validation MUST occur at this time.
-
-## Time Bounds
-
-`nbf` and `exp` stand for "not before" and "expires at," respectively. These MUST be expressed as seconds since the Unix epoch in UTC, without time zone or other offset. Taken together, they represent the time bounds for a token. These timestamps MUST be represented as the number of integer seconds since the Unix epoch. Due to limitations[^js-num-size] in numerics for certain common languages, timestamps outside of the range from $-2^{53} – 1$ to $2^{53} – 1$ MUST be rejected as invalid.
-
-The `nbf` field is OPTIONAL. When omitted, the token MUST be treated as valid beginning from the Unix epoch. Setting the `nbf` field to a time in the future MUST delay invoking a UCAN. For example, pre-provisioning access to conference materials ahead of time but not allowing access until the day it starts is achievable with judicious use of `nbf`.
-
-The `exp` field is RECOMMENDED. Following the [principle of least authority][PoLA], it is RECOMMENDED to give a timestamp expiry for UCANs. If the token explicitly never expires, the `exp` field MUST be set to `null`. If the time is in the past at validation time, the token MUST be treated as expired and invalid.
-
-Keeping the window of validity as short as possible is RECOMMENDED. Limiting the time range can mitigate the risk of a malicious user abusing a UCAN. However, this is situationally dependent. It may be desirable to limit the frequency of forced reauthorizations for trusted devices. Due to clock drift, time bounds SHOULD NOT be considered exact. A buffer of ±60 seconds is RECOMMENDED.
-
-Several named points of time in the UCAN lifecycle can be found in the [high level spec][UCAN].
-
-Below are a couple examples:
-
-```js
-{
-  // ...
-  "nbf": 1529496683,
-  "exp": 1575606941
-}
-```
-
-```js
-{
-  // ...
-  "exp": 1575606941
-}
-```
-
-```js
-{
-  // ...
-  "nbf": 1529496683,
-  "exp": null
-}
-```
-
-## Lifecycle Example
-
-Here is a concrete example of all stages of the UCAN lifecycle for database write access.
-
-```mermaid
-sequenceDiagram
-    participant Database
-
-    actor DBAgent
-    actor Alice
-    actor Bob
-
-    Note over Database, DBAgent: Set Up Agent-Owned Resource
-    DBAgent ->> Database: createDB()
-
-    autonumber 1
-
-    Note over DBAgent, Bob: Delegation
-    DBAgent -->> Alice: delegate(DBAgent, write)
-    Alice -->> Bob: delegate(DBAgent, write)
-
-    Note over Database, Bob: Invocation
-    Bob ->> DBAgent: invoke(DBAgent, [write, [key, value]], proof: [➊,➋])
-    DBAgent ->> Database: write(key, value)
-    DBAgent ->> Bob: ACK
-
-    Note over DBAgent, Bob: Revocation
-    Alice ->> DBAgent: revoke(➋, proof: [➊,➋])
-    Bob ->> DBAgent: invoke(DBAgent, [write, [key, newValue]], proof: [➊,➋])
-    DBAgent -X Bob: NAK(➏) [rejected]
-```
-
-## Capability
-
-A capability is the association of an ability to a subject: `subject x command x policy`.
-
-The Subject and Command fields are REQUIRED. Any non-normative extensions are OPTIONAL.
-
-For example, a capability may used to represent the ability to send email from a certain address to others at `@example.com`.
-
-| Field   | Example                                                                                      |
-| ------- | -------------------------------------------------------------------------------------------- |
-| Subject | `did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK`                                   |
-| Command | `/msg/send`                                                                                  |
-| Policy  | `["or", ["==", ".from", "mailto:me@example.com"], ["match", ".cc", "mailto:*@example.com"]]` |
-
-For a more complete treatment, please see the [UCAN Delegation][delegation] spec.
-
-## Authority
-
-> Whether to enable cooperation or to limit vulnerability, we care about _authority_ rather than _permissions._ Permissions determine what actions an individual program may perform on objects it can directly access. Authority describes the effects that a program may cause on objects it can access, either directly by permission, or indirectly by permitted interactions with other programs.
->
-> —[Mark Miller], [Robust Composition]
-
-The set of capabilities delegated by a UCAN is called its "authority." To frame it another way, it's the set of effects that a principal can cause, and acts as a declarative description of delegated abilities.
-
-Merging capability authorities MUST follow set semantics, where the result includes all capabilities from the input authorities. Since broader capabilities automatically include narrower ones, this process is always additive. Capability authorities can be combined in any order, with the result always being at least as broad as each of the original authorities.
-
-```plaintext
-                   ┌───────────────────────┐  ┐
-                   │                       │  │
-                   │                       │  │
-                   │                       │  │
-                   │                       │  │
-                   │       Subject B       │  │
-┌──────────────────┼ ─ ─       x           │  │
-│                       │  Ability Z       │  ├──    BxZ
-│                  │                       │  │  Capability
-│                       │                  │  │
-│                  │                       │  │
-│       Subject A       │                  │  │
-│           x      │                       │  │
-│       Ability Y   ─  ─┼──────────────────┘  ┘
-│                       │
-│                       │
-│                       │
-│                       │
-│                       │
-└───────────────────────┘
-
-└─────────────────────┬────────────────────┘
-                      │
-                  AxY U BxZ
-                  Capability
-```
-
-The capability authority is the total rights of the authorization space down to the relevant volume of authorizations. Individual capabilities MAY overlap; the authority is the union. Every unique delegated capability MUST have equal or narrower capabilities from their delegator. Inside this content space, you can draw a boundary around some resource(s) (their type, identifiers, and paths or children) and their capabilities.
-
-## Command
-
-Commands are concrete messages ("verbs") that MUST be unambiguously interpretable by the Subject of a UCAN. Commands are REQUIRED in invocations. Some examples include `/msg/send`, `/crud/read`, and `/ucan/revoke`.
-
-Much like other message-passing systems, the specific resource MUST define the behavior for a particular message. For instance, `/crud/update` MAY be used to destructively update a database row, or append to a append-only log. Specific messages MAY be created at will; the only restriction is that the Executor understand how to interpret that message in the context of a specific resource.
-
-While arbitrary semantics MAY be described, they MUST apply to the target resource. For instance, it does not make sense to apply `/msg/send` to a typical file system.
-
-### Segment Structure
-
-Commands MUST be lowercase, and begin with a slash (`/`). Segments MUST be separated by a slash. A trailing slash MUST NOT be present. All of the following are syntactically valid Commands:
-
-- `/`
-- `/crud`
-- `/crud/create`
-- `/stack/pop`
-- `/crypto/sign`
-- `/foo/bar/baz/qux/quux`
-- `/ほげ/ふが`
-
-Segment structure is important since shorter Commands prove longer paths. For example, `/` can be used as a proof of _any_ other Command. For example, `/crypto` MAY be used to prove `/crypto/sign` but MUST NOT prove `/stack/pop` or `/cryptocurrency`.
-
-### `/` AKA "Top"
-
-_"Top" (`/`) is the most powerful ability, and as such it SHOULD be handled with care and used sparingly._
-
-The "top" (or "any", or "wildcard") ability MUST be denoted `/`. This can be thought of as something akin to a super user permission in RBAC.
-
-The wildcard ability grants access to all other capabilities for the specified resource, across all possible namespaces. The wildcard ability is useful when "linking" agents by delegating all access to another device controlled by the same user, and that should behave as the same agent. It is extremely powerful, and should be used with care. Among other things, it permits the delegate to update a Subject's mutable DID document (change their private keys), revoke UCAN delegations, and use any resources delegated to the Subject by others.
-
-```mermaid
-%%{ init: { 'flowchart': { 'curve': 'linear' } } }%%
-
-flowchart BT
-  /
-
-  /msg --> /
-  subgraph msgGraph [ ]
-    /msg/send --> /msg
-    /msg/receive --> /msg
-  end
-
-  /crud --> /
-  subgraph crudGraph [ ]
-    /crud/read --> /crud
-    /crud/mutate --> /crud
-
-    subgraph mutationGraph [ ]
-        /crud/mutate/create --> /crud/mutate
-        /crud/mutate/update --> /crud/mutate
-        /crud/mutate/destroy --> /crud/mutate
-    end
-  end
-
-  ... --> /
-```
-
-### Reserved Commands
-
-#### `/ucan` Namespace
-
-The `/ucan` Command namespace MUST be reserved. This MUST include any ability string matching the regex `^ucan\/.*`. This is important for keeping a space for community-blessed Commands in the future, such as standard library Commands, such as [Revocation].
-
-## Attenuation
-
-Attenuation is the process of constraining the capabilities in a delegation chain. Each direct delegation MUST either directly restate or attenuate (diminish) its capabilities.
-
-# Token Resolution
-
-Token resolution is transport specific. The exact format is left to the relevant UCAN transport specification. At minimum, such a specification MUST define at least the following:
-
-1. Request protocol
-2. Response protocol
-3. Collections format
-
-Note that if an instance cannot dereference a CID at runtime, the UCAN MUST fail validation. This is consistent with the [constructive semantics] of UCAN.
-
-# Nonce
-
-The REQUIRED nonce parameter `nonce` MAY be any value. A randomly generated string is RECOMMENDED to provide a unique UCAN, though it MAY also be a monotonically increasing count of the number of links in the hash chain. This field helps prevent replay attacks and ensures a unique CID per delegation. The `iss`, `aud`, and `exp` fields together will often ensure that UCANs are unique, but adding the nonce ensures uniqueness.
-
-The recommended size of the nonce differs by key type. In many cases, a random 12-byte nonce is sufficient. If uncertain, check the nonce in your DID's crypto suite.
-
-This field SHOULD NOT be used to sign arbitrary data, such as signature challenges. See the [`meta`][Metadata] field for more.
-
-Here is a simple example.
-
-```js
-{
-  // ...
-  "nonce": {"/": {"bytes": "bGlnaHQgd29yay4"}}
-}
-```
-
-# Metadata
-
-The OPTIONAL `meta` field contains a map of arbitrary metadata, facts, and proofs of knowledge. The enclosed data MUST be self-evident and externally verifiable. It MAY include information such as hash preimages, server challenges, a Merkle proof, dictionary data, etc.
-
-The data contained in this map MUST NOT be semantically meaningful to delegation chains.
-
-Below is an example:
-
-```js
-{
-  // ...
-  "meta": {
-    "challenges": {
-      "example.com": "abcdef",
-      "another.example.net": "12345"
-    },
-    "sha3_256": {
-      "B94D27B9934D3E08A52E52D7DA7DABFAC484EFE37A5380EE9088F7ACE2EFCDE9": "hello world"
-    }
-  }
-}
-```
-
-# Canonicalization
-
-## Cryptosuite
-
-Across all UCAN specifications, the following cryptosuite MUST be supported:
-
-| Role      | REQUIRED Algorithms               | Notes                                |
-| --------- | --------------------------------- | ------------------------------------ |
-| Hash      | [SHA-256]                         |                                      |
-| Signature | [Ed25519], [P-256], [`secp256k1`] | Preference of Ed25519 is RECOMMENDED |
-| [DID]     | [`did:key`]                       |                                      |
-
-## Encoding
-
-All UCANs MUST be canonically encoded with [DAG-CBOR] for signing. A UCAN MAY be presented or stored in other [IPLD] formats (such as [DAG-JSON]), but converted to DAG-CBOR for signature validation.
-
-## Content Identifiers
-
-A UCAN token MUST be configured as follows:
-
-| Parameter    | REQUIRED Configuration |
-| ------------ | ---------------------- |
-| Version      | [CIDv1]                |
-| [Multibase]  | [`base58btc`]          |
-| [Multihash]  | [SHA-256]              |
-| [Multicodec] | [DAG-CBOR]             |
-
-> [!NOTE]
-> All CIDs encoded as above start with the characters `zdpu`.
-
-The resolution of these addresses is left to the implementation and end-user, and MAY (non-exclusively) include the following: local store, a distributed hash table (DHT), gossip network, or RESTful service.
-
-## Envelope
-
-All UCAN formats MUST use the following envelope format:
-
-| Field                             | Type           | Description                                                    |
-| --------------------------------- | -------------- | -------------------------------------------------------------- |
-| `.0`                              | `Bytes`        | A signature by the Payload's `iss` over the `SigPayload` field |
-| `.1`                              | `SigPayload`   | The content that was signed                                    |
-| `.1.h`                            | `VarsigHeader` | The [Varsig] v1 header                                         |
-| `.1.ucan/<subspec-tag>@<version>` | `TokenPayload` | The UCAN token payload                                         |
-
-```mermaid
-flowchart TD
-    subgraph Ucan ["UCAN Envelope"]
-        SignatureBytes["Signature (raw bytes)"]
-
-        subgraph SigPayload ["Signature Payload"]
-            VarsigHeader["Varsig Header"]
-
-            subgraph UcanPayload ["Token Payload"]
-                fields["..."]
-            end
-        end
-    end
-```
-
-For example:
-
-```js
-[
-  {
-    "/": {
-      bytes:
-        "7aEDQLYvb3lygk9yvAbk0OZD0q+iF9c3+wpZC4YlFThkiNShcVriobPFr/wl3akjM18VvIv/Zw2LtA4uUmB5m8PWEAU",
-    },
-  },
-  {
-    h: { "/": { bytes: "NBIFEgEAcQ" } },
-    "ucan/example@1.0.0-rc.1": {
-      hello: "world",
-    },
-  },
-];
-```
-
-### Payload
-
-A UCAN's Payload MUST contain at least the following fields:
-
-| Field   | Type                                      | Required | Description                                                 |
-| ------- | ----------------------------------------- | -------- | ----------------------------------------------------------- |
-| `iss`   | `DID`                                     | Yes      | Issuer DID (sender)                                         |
-| `aud`   | `DID`                                     | Yes      | Audience DID (receiver)                                     |
-| `sub`   | `DID`                                     | Yes      | Principal that the chain is about (the [Subject])           |
-| `cmd`   | `String`                                  | Yes      | The [Command] to eventually invoke                          |
-| `args`  | `{String : Any}`                          | Yes      | Any [Arguments] that MUST be present in the Invocation      |
-| `nonce` | `Bytes`                                   | Yes      | Nonce                                                       |
-| `meta`  | `{String : Any}`                          | No       | [Meta] (asserted, signed data) — is not delegated authority |
-| `nbf`   | `Integer` (53-bits[^js-num-size])         | No       | "Not before" UTC Unix Timestamp in seconds (valid from)     |
-| `exp`   | `Integer \| Null` (53-bits[^js-num-size]) | Yes      | Expiration UTC Unix Timestamp in seconds (valid until)      |
-
-# Implementation Recommendations
-
-## Delegation Store
-
-A validator MAY keep a local store of UCANs that it has received. UCANs are immutable but also time-bound so that this store MAY evict expired or revoked UCANs.
-
-This store SHOULD be indexed by CID (content addressing). Multiple indices built on top of this store MAY be used to improve capability search or selection performance.
-
-## Memoized Validation
-
-Aside from revocation, capability validation is idempotent. Marking a CID (or capability index inside that CID) as valid acts as memoization, obviating the need to check the entire structure on every validation. This extends to distinct UCANs that share a proof: if the proof was previously reviewed and is not revoked, it is RECOMMENDED to consider it valid immediately.
-
-Revocation is irreversible. Suppose the validator learns of revocation by UCAN CID. In that case, the UCAN and all of its derivatives in such a cache MUST be marked as invalid, and all validations immediately fail without needing to walk the entire structure.
-
-## Replay Attack Prevention
-
-Replay attack prevention is REQUIRED. Every UCAN token MUST hash to a unique [CIDv1]. Some simple strategies for implementing uniqueness tracking include maintaining a set of previously seen CIDs, or requiring that nonces be monotonically increasing per principal. This MAY be the same structure as a validated UCAN memoization table (if one is implemented).
-
-Maintaining a secondary token expiry index is RECOMMENDED. This enables garbage collection and more efficient search. In cases of very large stores, normal cache performance techniques MAY be used, such as Bloom filters, multi-level caches, and so on.
-
-## Beyond Single System Image
-
-> As we continue to increase the number of globally connected devices, we must embrace a design that considers every single member in the system as the primary site for the data that it is generates. It is completely impractical that we can look at a single, or a small number, of globally distributed data centers as the primary site for all global information that we desire to perform computations with.
->
-> —[Meiklejohn], [A Certain Tendency Of The Database Community]
-
-Unlike many authorization systems where a service controls access to resources in their care, location-independent, offline, and leaderless resources require control to live with the user. Therefore, the same data MAY be used across many applications, data stores, and users. Since they don't have a single location, applying UCAN to [RSM]s and [CRDT]s MAY be modelled by lifting the requirement that the Executor be the Subject.
-
-Ultimately this comes down to a question of push vs pull. In push, the subject MUST be the specific site being pushed to ("I command you to apply the following updates to your state").
-
-Pull is the broad class of situations where an Invoker doesn't require that a particular replica apply its state. Applying a change to a local CRDT replica and maintaining a UCAN invocation log is a valid update to "the CRDT": a version of the CRDT Subject exists locally even if the Subject's private key is not present. Gossiping these changes among agents allows each to apply changes that it becomes aware of. Thanks to the invocation log (or equivalent integrated directly into the CRDT), provenance of authority is made transparent.
-
-```mermaid
-sequenceDiagram
-    participant CRDT as Initial Grow-Only Set (CRDT)
-
-    actor Alice
-    actor Bob
-    actor Carol
-
-    autonumber
-
-    Note over CRDT, Bob: Setup
-    CRDT -->> Alice: delegate(CRDT_ID, merge)
-    CRDT -->> Bob: delegate(CRDT_ID, merge)
-
-    Note over Bob, Carol: Bob Invites Carol
-    Bob -->> Carol: delegate(CRDT_ID, merge)
-
-    Note over Alice, Carol: Direct P2P Gossip
-    Carol ->> Bob: invoke(CRDT_ID, merge, {"Carrot"}, proof: [➋,❸])
-    Alice ->> Carol: invoke(CRDT_ID, merge, {"Apple"}}, proof: [➊])
-    Bob ->> Alice: invoke(CRDT_ID, merge, {"Banana", "Carrot"}, proof: [➋])
-```
-
-## Wrapping Existing Systems
-
-In the RECOMMENDED scenario, the agent controlling a resource has a unique reference to it. This is always possible in a system that has adopted capabilities end-to-end.
-
-Interacting with existing systems MAY require relying on ambient authority contained in an ACL, non-unique reference, or other authorization logic. These cases are still compatible with UCAN, but the security guarantees are weaker since 1. the surface area is larger, and 2. part of the auth system lives outside UCAN.
-
-```mermaid
-sequenceDiagram
-    participant Database
-    participant ACL as External Auth System
-
-    actor DBAgent
-    actor Alice
-    actor Bob
-
-    Note over ACL, DBAgent: Setup
-    DBAgent ->> ACL: signup(DBAgent)
-    ACL ->> ACL: register(DBAgent)
-
-    autonumber 1
-
-    Note over DBAgent, Bob: Delegation
-    DBAgent -->> Alice: delegate(DBAgent, write)
-    Alice -->> Bob: delegate(DBAgent, write)
-
-    Note over Database, Bob: Invocation
-    Bob ->>+ DBAgent: invoke(DBAgent, [write, key, value], proof: [➊,➋])
-
-    critical External System
-        DBAgent ->> ACL: getToken(write, key, AuthGrant)
-        ACL ->> DBAgent: AccessToken
-
-        DBAgent ->> Database: request(write, value, AccessToken)
-        Database ->> DBAgent: ACK
-    end
-
-    DBAgent ->>- Bob: ACK
-```
-
-# FAQ
-
-## What prevents an unauthorized party from using an intercepted UCAN?
-
-UCANs always contain information about the sender and receiver. A UCAN is signed by the sender (the `iss` field DID) and can only be created by an agent in possession of the relevant private key. The recipient (the `aud` field DID) is required to check that the field matches their DID. These two checks together secure the certificate against use by an unauthorized party. [UCAN Invocations][invocation] prevent use by an unauthorized party by signing over a request to use the capability granted in a delegation chain.
-
-## What prevents replay attacks on the invocation use case?
-
-All UCAN Invocations MUST have a unique CID. The executing agent MUST check this validation uniqueness against a local store of unexpired UCAN hashes.
-
-This is not a concern when simply delegating since receiving a delegation is idempotent.
-
-## Is UCAN secure against person-in-the-middle attacks?
-
-_UCAN does not have any special protection against person-in-the-middle (PITM) attacks._
-
-If a PITM attack was successfully performed on a UCAN delegation, the proof chain would contain the attacker's DID(s). It is possible to detect this scenario and revoke the relevant UCAN but this does require special inspection of the topmost `iss` field to check if it is the expected DID. Therefore, it is strongly RECOMMENDED to only delegate UCANs to agents that are both trusted and authenticated and over secure channels.
-
-## Can my implementation support more cryptographic algorithms?
-
-It is possible to use other algorithms, but doing so limits interoperability with the broader UCAN ecosystem. This is thus considered "off spec" (i.e. non-interoperable). If you choose to extend UCAN with additional algorithms, you MUST include this metadata in the (self-describing) [Varsig] header.
-
-# Related Work and Prior Art
-
-[SPKI/SDSI] is closely related to UCAN. A different encoding format is used, and some details vary (such as a delegation-locking bit), but the core idea and general usage pattern are very close. UCAN can be seen as making these ideas more palatable to a modern audience and adding a few features such as content IDs that were less widespread at the time SPKI/SDSI were written.
-
-[ZCAP-LD] is closely related to UCAN. The primary differences are in formatting, addressing by URL instead of CID, the mechanism of separating invocation from authorization, and single versus multiple proofs.
-
-[CACAO] is a translation of many of these ideas to a cross-blockchain delegated bearer token model. It contains the same basic concepts as UCAN delegation, but is aimed at small messages and identities that are rooted in mutable documents rooted on a blockchain and lacks the ability to subdelegate capabilities.
-
-[Local-First Auth] is a non-certificate-based approach, instead relying on a CRDT to build up a list of group members, devices, and roles. It has a friendly invitation mechanism based on a [Seitan token exchange]. It is also straightforward to see which users have access to what, avoiding the confinement problem seen in many decentralized auth systems.
-
-[Macaroon] is a MAC-based capability and cookie system aimed at distributing authority across services in a trusted network (typically in the context of a Cloud). By not relying on asymmetric signatures, Macaroons achieve excellent space savings and performance, given that the MAC can be checked against the relevant services during discharge. The authority is rooted in an originating server rather than with an end-user.
-
-[Biscuit] uses Datalog to describe capabilities. It has a specialized format but is otherwise in line with UCAN.
-
-[Verifiable credentials] are a solution for data about people or organizations. However, they are aimed at a related-but-distinct problem: asserting attributes about the holder of a DID, including things like work history, age, and membership.
-
-# Acknowledgments
-
-Thank you to [Brendan O'Brien] for real-world feedback, technical collaboration, and implementing the first Golang UCAN library.
-
-Thank you [Blaine Cook] for the real-world feedback, ideas on future features, and lessons from other auth standards.
-
-Many thanks to [Hugo Dias], [Mikael Rogers], and the entire DAG House team for the real world feedback, and finding inventive new use cases.
-
-Thank to [Hannah Howard] and [Alan Shaw] at [Storacha] for their team's feedback from real world use cases.
-
-Many thanks to [Brian Ginsburg] and [Steven Vandevelde] for their many copy edits, feedback from real world usage, maintenance of the TypeScript implementation, and tools such as [ucan.xyz].
-
-Many thanks to [Christopher Joel] for his real-world feedback, raising many pragmatic considerations, and the Rust implementation and related crates.
-
-Many thanks to [Christine Lemmer-Webber] for her handwritten(!) feedback on the design of UCAN, spearheading the [OCapN] initiative, and her related work on [ZCAP-LD].
-
-Many thanks to [Alan Karp] for sharing his vast experience with capability-based authorization, patterns, and many right words for us to search for.
-
-Thanks to [Benjamin Goering] for the many community threads and connections to [W3C] standards.
-
-Thanks to [Juan Caballero] for the numerous questions, clarifications, and general advice on putting together a comprehensible spec.
-
-Thank you [Dan Finlay] for being sufficiently passionate about [OCAP] that we realized that capability systems had a real chance of adoption in an ACL-dominated world.
-
-Thanks to [Peter van Hardenberg][PvH] and [Martin Kleppmann] of [Ink & Switch] for conversations exploring options for access control on CRDTs and [local-first] applications.
-
-Thanks to the entire [SPKI WG][SPKI/SDSI] for their closely related pioneering work.
-
-We want to especially recognize [Mark Miller] for his numerous contributions to the field of distributed auth, programming languages, and networked security writ large.
-
-<!-- Footnotes -->
-
-[^js-num-size]: JavaScript has a single numeric type ([`Number`][JS Number]) for both integers and floats. This representation is defined as a [IEEE-754] double-precision floating point number, which has a 53-bit significand.
-
-[^pcec]: To be precise, this is a [PC/EC][PACELC] system, which is a critical trade-off for many systems. UCAN can be used to model both PC/EC and PA/EL, but is most typically PC/EL.
-
-<!-- Internal Links -->
-
-[Command]: #command
-[Cryptosuite]: #cryptosuite
-[overcoming SSI]: #beyond-single-system-image
-[sub-specifications]: #sub-specifications
-[wrapping existing systems]: #wrapping-existing-systems
-
-<!-- External Links -->
-
-[IEEE-754]: https://ieeexplore.ieee.org/document/8766229
-[A Certain Tendency Of The Database Community]: https://arxiv.org/pdf/1510.08473.pdf
-[ACL]: https://en.wikipedia.org/wiki/Access-control_list
-[Alan Karp]: https://github.com/alanhkarp
-[Alan Kay]: https://en.wikipedia.org/wiki/Alan_Kay
-[Alan Shaw]: https://github.com/alanshaw
-[BCP 14]: https://www.rfc-editor.org/info/bcp14
-[BLAKE3]: https://github.com/BLAKE3-team/BLAKE3
-[Benjamin Goering]: https://github.com/gobengo
-[Biscuit]: https://github.com/biscuit-auth/biscuit/
-[Blaine Cook]: https://github.com/blaine
-[Bluesky]: https://blueskyweb.xyz/
-[Brendan O'Brien]: https://github.com/b5
-[Brian Ginsburg]: https://github.com/bgins
-[Brooklyn Zelenka]: https://github.com/expede
-[CACAO]: https://blog.ceramic.network/capability-based-data-security-on-ceramic/
-[CIDv1]: https://docs.ipfs.io/concepts/content-addressing/#identifier-formats
-[CIDv1]: https://github.com/multiformats/cid
-[CRDT]: https://en.wikipedia.org/wiki/Conflict-free_replicated_data_type
-[Capability Myths Demolished]: https://srl.cs.jhu.edu/pubs/SRL2003-02.pdf
-[Christine Lemmer-Webber]: https://github.com/cwebber
-[Christopher Joel]: https://github.com/cdata
-[Code Mesh 2016]: https://www.codemesh.io/codemesh2016
-[DAG-CBOR]: https://ipld.io/specs/codecs/dag-cbor/spec/
-[DAG-JSON]: https://ipld.io/specs/codecs/dag-json/spec/
-[DID fragment]: https://www.w3.org/TR/did-core/#fragment
-[DID path]: https://www.w3.org/TR/did-core/#path
-[DID subject]: https://www.w3.org/TR/did-core/#dfn-did-subjects
-[DID]: https://www.w3.org/TR/did-core/
-[Dan Finlay]: https://github.com/danfinlay
-[Daniel Holmgren]: https://github.com/dholms
-[ECDSA security]: https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm#Security
-[Ed25519]: https://en.wikipedia.org/wiki/EdDSA#Ed25519
-[EdDSA]: https://datatracker.ietf.org/doc/html/rfc8032#section-5.1
-[Email about SPKI]: https://web.archive.org/web/20140724054706/http://wiki.erights.org/wiki/Capability-based_Active_Invocation_Certificates
-[FIDO]: https://fidoalliance.org/what-is-fido/
-[Fission]: https://fission.codes
-[GUID]: https://en.wikipedia.org/wiki/Universally_unique_identifier
-[Hannah Howard]: https://github.com/hannahhoward
-[Hugo Dias]: https://github.com/hugomrdias
-[IPLD]: https://ipld.io/
-[Ink & Switch]: https://www.inkandswitch.com/
-[Inversion of control]: https://en.wikipedia.org/wiki/Inversion_of_control
-[Irakli Gozalishvili]: https://github.com/Gozala
-[JWT]: https://www.rfc-editor.org/rfc/rfc7519
-[Joe Armstrong]: https://en.wikipedia.org/wiki/Joe_Armstrong_(programmer)
-[Juan Caballero]: https://github.com/bumblefudge
-[Local-First Auth]: https://github.com/local-first-web/auth
-[Macaroon]: https://storage.googleapis.com/pub-tools-public-publication-data/pdf/41892.pdf
-[Mark Miller]: https://github.com/erights
-[Martin Kleppmann]: https://martin.kleppmann.com/
-[Meiklejohn]: https://christophermeiklejohn.com/
-[Mikael Rogers]: https://github.com/mikeal/
-[Multibase]: https://github.com/multiformats/multibase
-[Multicodec]: https://github.com/multiformats/multicodec
-[Multics]: https://en.wikipedia.org/wiki/Multics
-[Multihash]: https://www.multiformats.io/multihash/
-[OCAP]: http://erights.org/elib/capability/index.html
-[OCapN]: https://github.com/ocapn/ocapn
-[P-256]: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf#page=111
-[PACELC]: https://en.wikipedia.org/wiki/PACELC_theorem
-[Philipp Krüger]: https://github.com/matheus23
-[PoLA]: https://en.wikipedia.org/wiki/Principle_of_least_privilege
-[Protocol Labs]: https://protocol.ai/
-[PvH]: https://www.pvh.ca
-[RBAC]: https://en.wikipedia.org/wiki/Role-based_access_control
-[RFC 2119]: https://datatracker.ietf.org/doc/html/rfc2119
-[RFC 3339]: https://www.rfc-editor.org/rfc/rfc3339
-[RFC 8037]: https://datatracker.ietf.org/doc/html/rfc8037
-[RSM]: https://en.wikipedia.org/wiki/State_machine_replication
-[Robust Composition]: http://www.erights.org/talks/thesis/markm-thesis.pdf
-[SHA-256]: https://en.wikipedia.org/wiki/SHA-2
-[SPKI/SDSI]: https://datatracker.ietf.org/wg/spki/about/
-[SPKI]: https://theworld.com/~cme/html/spki.html
-[Seitan token exchange]: https://book.keybase.io/docs/teams/seitan
-[Steven Vandevelde]: https://github.com/icidasset
-[Storacha]: https://storacha.network/
-[The Structure of Authority]: http://erights.org/talks/no-sep/secnotsep.pdf
-[The computer revolution hasn't happened yet]: https://www.youtube.com/watch?v=oKg1hTOQXoY
-[UCAN Promise]: https://github.com/ucan-wg/promise
-[URI]: https://www.rfc-editor.org/rfc/rfc3986
-[Varsig]: https://github.com/ChainAgnostic/varsig
-[Verifiable credentials]: https://www.w3.org/2017/vc/WG/
-[W3C]: https://www.w3.org/
-[WebCrypto API]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API
-[Witchcraft Software]: https://github.com/expede
-[ZCAP-LD]: https://w3c-ccg.github.io/zcap-spec/
-[`base58btc`]: https://github.com/multiformats/multibase/blob/master/multibase.csv#L21
-[`did:key`]: https://w3c-ccg.github.io/did-method-key/
-[`secp256k1`]: https://en.bitcoin.it/wiki/Secp256k1
-[browser api crypto key]: https://developer.mozilla.org/en-US/docs/Web/API/CryptoKey
-[capabilities]: https://en.wikipedia.org/wiki/Object-capability_model
-[caps as keys]: http://www.erights.org/elib/capability/duals/myths.html#caps-as-keys
-[certificate capability model]: https://web.archive.org/web/20140724054706/http://wiki.erights.org/wiki/Capability-based_Active_Invocation_Certificates
-[confinement]: http://www.erights.org/elib/capability/dist-confine.html
-[confused deputy problem]: https://en.wikipedia.org/wiki/Confused_deputy_problem
-[constructive semantics]: https://en.wikipedia.org/wiki/Intuitionistic_logic
-[content addressable storage]: https://en.wikipedia.org/wiki/Content-addressable_storage
-[content addressing]: https://en.wikipedia.org/wiki/Content-addressable_storage
-[dag-json multicodec]: https://github.com/multiformats/multicodec/blob/master/table.csv#L104
-[delegation]: https://github.com/ucan-wg/delegation
-[fail-safe]: https://en.wikipedia.org/wiki/Fail-safe
-[invocation]: https://github.com/ucan-wg/invocation
-[local-first]: https://www.inkandswitch.com/local-first/
-[number zero]: https://n0.computer/
-[passkey]: https://www.passkeys.com/
-[promise]: https://github.com/ucan-wg/promise
-[raw data multicodec]: https://github.com/multiformats/multicodec/blob/a03169371c0a4aec0083febc996c38c3846a0914/table.csv?plain=1#L41
-[revocation]: https://github.com/ucan-wg/revocation
-[secure hardware enclave]: https://support.apple.com/en-ca/guide/security/sec59b0b31ff
-[spki rfc]: https://www.rfc-editor.org/rfc/rfc2693.html
-[time definition]: https://en.wikipedia.org/wiki/Temporal_database
-[trustless]: https://blueskyweb.xyz/blog/3-6-2022-a-self-authenticating-social-protocol
-[ucan.xyz]: https://ucan.xyz

.github/aider/prompts/data-modeler-cosmos.md

@@ -1,105 +0,0 @@
-You are an expert in Cosmos SDK data modeling and state management, specializing in building efficient and scalable data models using the Cosmos SDK ORM system with Protocol Buffers.
-
-Key Principles:
-
-- Design type-safe state management systems
-- Create efficient protobuf-based data models
-- Implement proper table structures and indexes
-- Follow Cosmos SDK state management best practices
-- Design for light client compatibility
-- Implement proper genesis import/export
-- Follow protobuf naming conventions
-
-Data Modeling Best Practices:
-
-- Define clear table structures in .proto files
-- Use appropriate primary key strategies
-- Implement proper secondary indexes
-- Follow database normalization principles (1NF+)
-- Avoid repeated fields in tables
-- Design for future extensibility
-- Consider state layout impact on clients
-
-Schema Design Patterns:
-
-- Use unique table IDs within .proto files
-- Implement proper field numbering
-- Design efficient multipart keys
-- Use appropriate field types
-- Consider index performance implications
-- Implement proper singleton patterns
-- Design for automatic query services
-
-State Management:
-
-- Follow Cosmos SDK store patterns
-- Implement proper prefix handling
-- Design efficient range queries
-- Use appropriate encoding strategies
-- Handle state migrations properly
-- Implement proper genesis handling
-- Consider light client proof requirements
-
-Error Handling and Validation:
-
-- Implement proper input validation
-- Use appropriate error types
-- Handle state errors appropriately
-- Implement proper debugging
-- Use context appropriately
-- Implement proper logging
-- Handle concurrent access
-
-Performance Optimization:
-
-- Design efficient key encodings
-- Optimize storage space usage
-- Implement efficient queries
-- Use appropriate index strategies
-- Consider state growth implications
-- Monitor performance metrics
-- Design for scalability
-
-Dependencies:
-
-- cosmos/orm/v1/orm.proto
-- [google.golang.org/protobuf](http://google.golang.org/protobuf)
-- cosmos-sdk/store
-- cosmos-sdk/types
-- tendermint/types
-- proper logging framework
-
-Key Conventions:
-
-1. Use consistent protobuf naming
-2. Implement proper documentation
-3. Follow schema versioning practices
-4. Use proper table ID management
-5. Implement proper testing strategies
-
-Example Table Structure:
-
-```protobuf
-message Balance {
-    option (cosmos.orm.v1.table) = {
-        id: 1
-        primary_key: { fields: "account,denom" }
-        index: { id: 1, fields: "denom" }
-    };
-
-    bytes account = 1;
-    string denom = 2;
-    uint64 amount = 3;
-}
-
-message Params {
-    option (cosmos.orm.v1.singleton) = {
-        id: 2
-    };
-
-    google.protobuf.Duration voting_period = 1;
-    uint64 min_threshold = 2;
-}
-```
-
-Refer to the official Cosmos SDK documentation and ORM specifications for best practices and up-to-date APIs.

.github/aider/prompts/data-modeler.md

@@ -1,88 +0,0 @@
-    You are an expert in Go data modeling and PostgreSQL database design, specializing in building efficient and scalable data models using modern ORMs like GORM and SQLBoiler.
-
-    Key Principles:
-    - Write idiomatic Go code following standard Go conventions
-    - Design clean and maintainable database schemas
-    - Implement proper relationships and constraints
-    - Use appropriate indexes for query optimization
-    - Follow database normalization principles
-    - Implement proper error handling and validation
-    - Use meaningful struct tags for ORM mapping
-
-    Data Modeling Best Practices:
-    - Use appropriate Go types for database columns
-    - Implement proper foreign key relationships
-    - Design for data integrity and consistency
-    - Consider soft deletes where appropriate
-    - Use composite indexes strategically
-    - Implement proper timestamps for auditing
-    - Handle NULL values appropriately with pointers
-
-    ORM Patterns:
-    - Use GORM hooks for complex operations
-    - Implement proper model validation
-    - Use transactions for atomic operations
-    - Implement proper eager loading
-    - Use batch operations for better performance
-    - Handle migrations systematically
-    - Implement proper model scopes
-
-    Database Design:
-    - Follow PostgreSQL best practices
-    - Use appropriate column types
-    - Implement proper constraints
-    - Design efficient indexes
-    - Use JSONB for flexible data when needed
-    - Implement proper partitioning strategies
-    - Consider materialized views for complex queries
-
-    Error Handling and Validation:
-    - Implement proper input validation
-    - Use custom error types
-    - Handle database errors appropriately
-    - Implement retry mechanisms
-    - Use context for timeouts
-    - Implement proper logging
-    - Handle concurrent access
-
-    Performance Optimization:
-    - Use appropriate batch sizes
-    - Implement connection pooling
-    - Use prepared statements
-    - Optimize query patterns
-    - Use appropriate caching strategies
-    - Monitor query performance
-    - Use explain analyze for optimization
-
-    Dependencies:
-    - GORM or SQLBoiler
-    - pq (PostgreSQL driver)
-    - validator
-    - migrate
-    - sqlx (for raw SQL when needed)
-    - zap or logrus for logging
-
-    Key Conventions:
-    1. Use consistent naming conventions
-    2. Implement proper documentation
-    3. Follow database migration best practices
-    4. Use version control for schema changes
-    5. Implement proper testing strategies
-
-    Example Model Structure:
-    ```go
-    type User struct {
-        ID        uint      `gorm:"primarykey"`
-        CreatedAt time.Time
-        UpdatedAt time.Time
-        DeletedAt gorm.DeletedAt `gorm:"index"`
-        
-        Name     string `gorm:"type:varchar(100);not null"`
-        Email    string `gorm:"type:varchar(100);uniqueIndex;not null"`
-        Profile  Profile
-        Orders   []Order
-    }
-    ```
-
-    Refer to the official documentation of GORM, PostgreSQL, and Go for best practices and up-to-date APIs.
-      

.github/aider/prompts/sonr-tech-lead.md

@@ -1,132 +0,0 @@
-You are a technical lead specializing in decentralized identity systems and security architecture, with expertise in W3C standards, Cosmos SDK, and blockchain security patterns.
-
-Core Responsibilities:
-- Ensure compliance with W3C DID and VC specifications
-- Implement secure cryptographic practices
-- Design robust authentication flows
-- Maintain data privacy and protection
-- Guide secure state management
-- Enforce access control patterns
-- Oversee security testing
-
-Security Standards:
-- W3C DID Core 1.0
-- W3C Verifiable Credentials
-- W3C WebAuthn Level 2
-- OAuth 2.0 and OpenID Connect
-- JSON Web Signatures (JWS)
-- JSON Web Encryption (JWE)
-- Decentralized Key Management (DKMS)
-
-Architecture Patterns:
-- Secure DID Resolution
-- Verifiable Credential Issuance
-- DWN Access Control
-- Service Authentication
-- State Validation
-- Key Management
-- Privacy-Preserving Protocols
-
-Implementation Guidelines:
-- Use standardized cryptographic libraries
-- Implement proper key derivation
-- Follow secure encoding practices
-- Validate all inputs thoroughly
-- Handle errors securely
-- Log security events properly
-- Implement rate limiting
-
-State Management Security:
-- Validate state transitions
-- Implement proper access control
-- Use secure storage patterns
-- Handle sensitive data properly
-- Implement proper backup strategies
-- Maintain state integrity
-- Monitor state changes
-
-Authentication & Authorization:
-- Implement proper DID authentication
-- Use secure credential validation
-- Follow OAuth 2.0 best practices
-- Implement proper session management
-- Use secure token handling
-- Implement proper key rotation
-- Monitor authentication attempts
-
-Data Protection:
-- Encrypt sensitive data
-- Implement proper key management
-- Use secure storage solutions
-- Follow data minimization principles
-- Implement proper backup strategies
-- Handle data deletion securely
-- Monitor data access
-
-Security Testing:
-- Implement security unit tests
-- Perform integration testing
-- Conduct penetration testing
-- Monitor security metrics
-- Review security logs
-- Conduct threat modeling
-- Maintain security documentation
-
-Example Security Patterns:
-
-```go
-// Secure DID Resolution
-func ResolveDID(did string) (*DIDDocument, error) {
-    // Validate DID format
-    if !ValidateDIDFormat(did) {
-        return nil, ErrInvalidDID
-    }
-
-    // Resolve with retry and timeout
-    ctx, cancel := context.WithTimeout(context.Background(), resolveTimeout)
-    defer cancel()
-
-    doc, err := resolver.ResolveWithContext(ctx, did)
-    if err != nil {
-        return nil, fmt.Errorf("resolution failed: %w", err)
-    }
-
-    // Validate document structure
-    if err := ValidateDIDDocument(doc); err != nil {
-        return nil, fmt.Errorf("invalid document: %w", err)
-    }
-
-    return doc, nil
-}
-
-// Secure Credential Verification
-func VerifyCredential(vc *VerifiableCredential) error {
-    // Check expiration
-    if vc.IsExpired() {
-        return ErrCredentialExpired
-    }
-
-    // Verify proof
-    if err := vc.VerifyProof(trustRegistry); err != nil {
-        return fmt.Errorf("invalid proof: %w", err)
-    }
-
-    // Verify status
-    if err := vc.CheckRevocationStatus(); err != nil {
-        return fmt.Errorf("revocation check failed: %w", err)
-    }
-
-    return nil
-}
-```
-
-Security Checklist:
-1. All DIDs follow W3C specification
-2. Credentials implement proper proofs
-3. Keys use proper derivation/rotation
-4. State changes are validated
-5. Access control is enforced
-6. Data is properly encrypted
-7. Logging captures security events
-
-Refer to W3C specifications, Cosmos SDK security documentation, and blockchain security best practices for detailed implementation guidance.

.github/dependabot.yml

@@ -1,11 +1,28 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-
 version: 2
 updates:
-  - package-ecosystem: "gomod" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  # Go modules (main)
+  - package-ecosystem: gomod
+    directory: "/"
     schedule:
-      interval: "weekly"
+      interval: weekly
+      day: monday
+      time: "02:00"
+    labels:
+      - dependencies
+      - go
+    commit-message:
+      prefix: chore
+      include: scope
+
+  # GitHub Actions
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "03:00"
+    labels:
+      - dependencies
+      - ci
+    commit-message:
+      prefix: "chore(ci)"

.github/pr-labeler.yml

@@ -1,5 +0,0 @@
-"@pr/feature": ["feature/*", "feat/*"]
-"@pr/fix": fix/*
-"@pr/chore": chore/*
-"@pr/docs": docs/*
-"@pr/refactor": refactor/*

.github/scopes.json

@@ -1,189 +1,150 @@
 [
   {
-    "name": "cosmos/sdk",
-    "path": "app",
-    "docs": [
-      "https://docs.cosmos.network/v0.50/build/building-modules/module-manager",
-      "https://docs.cosmos.network/v0.50/build/building-modules/messages-and-queries",
-      "https://docs.cosmos.network/v0.50/build/building-modules/msg-services",
-      "https://docs.cosmos.network/v0.50/build/building-modules/query-services",
-      "https://docs.cosmos.network/v0.50/build/building-modules/depinject"
-    ]
+    "scope": "deps",
+    "path": "go.sum"
   },
   {
-    "name": "cosmos/ibc",
-    "path": "app",
-    "docs": [
-      "https://ibc.cosmos.network/v8/apps/interchain-accounts/overview/",
-      "https://ibc.cosmos.network/v8/apps/transfer/overview/",
-      "https://docs.osmosis.zone/osmosis-core/asset-info/",
-      "https://docs.osmosis.zone/osmosis-core/modules/tokenfactory",
-      "https://docs.noble.xyz/cctp/mint",
-      "https://docs.noble.xyz/cctp/mint_forward",
-      "https://docs.evmos.org/protocol/modules/erc20",
-      "https://docs.nomic.io/nbtc"
-    ]
+    "scope": "deps",
+    "path": "go.mod"
   },
   {
-    "name": "crypto/mpc",
-    "path": "crypto/mpc",
-    "docs": [
-      "https://csrc.nist.gov/CSRC/media/Events/NTCW19/papers/paper-DKLS.pdf"
-    ]
+    "scope": "api",
+    "path": "api/dex"
   },
   {
-    "name": "crypto/ucan",
-    "path": "crypto/ucan",
-    "docs": [
-      "https://raw.githubusercontent.com/ucan-wg/spec/refs/heads/main/README.md"
-    ]
+    "scope": "api",
+    "path": "api/did"
   },
   {
-    "name": "crypto/zkp",
-    "path": "crypto/accumulator",
-    "docs": [
-      "https://eprint.iacr.org/2021/1672.pdf"
-    ]
+    "scope": "api",
+    "path": "api/dwn"
   },
   {
-    "name": "gateway/handlers",
-    "path": "pkg/gateway/handlers",
-    "docs": [
-      "https://echo.labstack.com/docs/cookbook/sse",
-      "https://echo.labstack.com/docs/cookbook/websocket",
-      "https://echo.labstack.com/docs/cookbook/subdomain"
-    ]
+    "scope": "api",
+    "path": "api/svc"
   },
   {
-    "name": "gateway/database",
-    "path": "pkg/gateway/internal/database",
-    "docs": [
-      "https://docs.tigerbeetle.com/coding/data-modeling",
-      "https://docs.tigerbeetle.com/coding/two-phase-transfers",
-      "https://docs.tigerbeetle.com/coding/reliable-transaction-submission",
-      "https://docs.tigerbeetle.com/coding/recipes/currency-exchange",
-      "https://docs.tigerbeetle.com/coding/recipes/balance-conditional-transfers",
-      "https://docs.tigerbeetle.com/reference/account",
-      "https://docs.tigerbeetle.com/reference/transfer",
-      "https://docs.substreams.dev/documentation/consume/packages",
-      "https://docs.substreams.dev/documentation/consume/sql/deployable-services/local-service",
-      "https://docs.substreams.dev/tutorials/cosmos/injective/foundational"
-    ]
+    "scope": "api",
+    "path": "api"
   },
   {
-    "name": "vault/handlers",
-    "path": "pkg/vault/handlers",
-    "docs": [
-      "https://echo.labstack.com/docs/cookbook/jwt",
-      "https://echo.labstack.com/docs/middleware/secure",
-      "https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API"
-    ]
+    "scope": "ante",
+    "path": "app/ante"
   },
   {
-    "name": "vault/database",
-    "path": "pkg/vault/internal/database",
-    "docs": [
-      "https://dexie.org/docs/ExportImport/dexie-export-import",
-      "https://dexie.org/docs/API-Reference#quick-reference",
-      "https://templ.guide/syntax-and-usage/script-templates"
-    ]
+    "scope": "cli",
+    "path": "app/commands"
   },
   {
-    "name": "pkl/ipfs",
-    "path": "pkl/ipfs.net",
-    "docs": [
-      "https://github.com/ipfs/kubo/blob/master/docs/config.md",
-      "https://pkl-lang.org/main/current/language-reference/index.html"
-    ]
+    "scope": "app",
+    "path": "app/context"
   },
   {
-    "name": "pkl/matrix",
-    "path": "pkl/matrix.net",
-    "docs": [
-      "https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html",
-      "https://pkl-lang.org/main/current/language-reference/index.html"
-    ]
+    "scope": "app",
+    "path": "app/decorators"
   },
   {
-    "name": "pkl/chain",
-    "path": "pkl/sonr.chain",
-    "docs": [
-      "https://tutorials.cosmos.network/tutorials/9-path-to-prod/5-network.html",
-      "https://tutorials.cosmos.network/tutorials/9-path-to-prod/4-genesis.html",
-      "https://pkl-lang.org/main/current/language-reference/index.html",
-      "https://docs.cosmos.network/v0.50/user/run-node/run-testnet"
-    ]
+    "scope": "app",
+    "path": "app/params"
   },
   {
-    "name": "pkl/hway",
-    "path": "pkl/sonr.hway",
-    "docs": [
-      "https://pkl-lang.org/main/current/language-reference/index.html"
-    ]
+    "scope": "app",
+    "path": "app/upgrades"
   },
   {
-    "name": "pkl/motr",
-    "path": "pkl/sonr.motr",
-    "docs": [
-      "https://pkl-lang.org/main/current/language-reference/index.html",
-      "https://web.dev/learn/pwa/service-workers/",
-      "https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API"
-    ]
+    "scope": "app",
+    "path": "app"
   },
   {
-    "name": "x/did",
-    "path": "proto/did",
-    "docs": [
-      "https://docs.cosmos.network/v0.50/build/packages/orm",
-      "https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations",
-      "https://docs.cosmos.network/v0.50/build/modules/auth",
-      "https://docs.cosmos.network/v0.50/build/packages/collections",
-      "https://docs.cosmos.network/v0.50/build/modules/bank"
-    ]
+    "scope": "chains",
+    "path": "chains"
   },
   {
-    "name": "x/dwn",
-    "path": "proto/dwn",
-    "docs": [
-      "https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations",
-      "https://docs.cosmos.network/v0.50/build/packages/orm",
-      "https://docs.cosmos.network/v0.50/build/modules/authz",
-      "https://docs.cosmos.network/v0.50/build/packages/collections",
-      "https://docs.cosmos.network/v0.50/build/modules/gov",
-      "https://docs.cosmos.network/v0.50/build/modules/staking"
-    ]
+    "scope": "cmd",
+    "path": "cmd/snrd"
   },
   {
-    "name": "x/svc",
-    "path": "proto/svc",
-    "docs": [
-      "https://docs.cosmos.network/v0.50/build/packages/collections",
-      "https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations",
-      "https://docs.cosmos.network/v0.50/build/packages/orm",
-      "https://docs.cosmos.network/v0.50/build/modules/group",
-      "https://docs.cosmos.network/v0.50/build/modules/nft"
-    ]
+    "scope": "cmd",
+    "path": "cmd"
   },
   {
-    "name": "repo/ci-cd",
-    "path": "deploy",
-    "docs": [
-      "https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions",
-      "https://docs.cosmos.network/v0.50/build/tooling/cosmovisor",
-      "https://f1bonacc1.github.io/process-compose/configuration/",
-      "https://docs.nomic.io/network/ibc-relayer",
-      "https://www.jetify.com/docs/devbox",
-      "https://taskfile.dev/reference/cli",
-      "https://taskfile.dev/reference/schema",
-      "https://taskfile.dev/reference/templating/"
-    ]
+    "scope": "docs",
+    "path": "docs"
   },
   {
-    "name": "repo/docs",
-    "path": "docs",
-    "docs": [
-      "https://squidfunk.github.io/mkdocs-material/reference/",
-      "https://github.com/mkdocs/catalog/blob/main/README.md"
-    ]
+    "scope": "config",
+    "path": "networks/localnet"
+  },
+  {
+    "scope": "config",
+    "path": "networks/testnet"
+  },
+  {
+    "scope": "config",
+    "path": "networks"
+  },
+  {
+    "scope": "dex",
+    "path": "proto/dex"
+  },
+  {
+    "scope": "did",
+    "path": "proto/did"
+  },
+  {
+    "scope": "dwn",
+    "path": "proto/dwn"
+  },
+  {
+    "scope": "svc",
+    "path": "proto/svc"
+  },
+  {
+    "scope": "proto",
+    "path": "proto"
+  },
+  {
+    "scope": "scripts",
+    "path": "scripts"
+  },
+  {
+    "scope": "test",
+    "path": "test/e2e"
+  },
+  {
+    "scope": "test",
+    "path": "test/integration"
+  },
+  {
+    "scope": "test",
+    "path": "test/oauth"
+  },
+  {
+    "scope": "test",
+    "path": "test"
+  },
+  {
+    "scope": "dex",
+    "path": "x/dex"
+  },
+  {
+    "scope": "did",
+    "path": "x/did"
+  },
+  {
+    "scope": "dwn",
+    "path": "x/dwn"
+  },
+  {
+    "scope": "svc",
+    "path": "x/svc"
+  },
+  {
+    "scope": "ci",
+    "path": "Makefile"
+  },
+  {
+    "scope": "ci",
+    "path": ".github"
   }
 ]

.github/scopes.json.backup.20251023_150305

@@ -0,0 +1,58 @@
+[
+  {
+    "scope": "deps",
+    "path": "go.sum"
+  },
+  {
+    "scope": "deps",
+    "path": "go.mod"
+  },
+  {
+    "scope": "mdx",
+    "path": "docs"
+  },
+  {
+    "scope": "ci",
+    "path": "Makefile"
+  },
+  {
+    "scope": "ci",
+    "path": ".github"
+  },
+  {
+    "scope": "dex",
+    "path": "x/dex"
+  },
+  {
+    "scope": "dex",
+    "path": "proto/dex"
+  },
+  {
+    "scope": "did",
+    "path": "x/did"
+  },
+  {
+    "scope": "did",
+    "path": "proto/did"
+  },
+  {
+    "scope": "dwn",
+    "path": "x/dwn"
+  },
+  {
+    "scope": "dwn",
+    "path": "proto/dwn"
+  },
+  {
+    "scope": "svc",
+    "path": "x/svc"
+  },
+  {
+    "scope": "svc",
+    "path": "proto/svc"
+  },
+  {
+    "scope": "config",
+    "path": "networks"
+  }
+]

.github/scripts/make_docs.sh

@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-ROOT_DIR=$(git rev-parse --show-toplevel)
-
-

.github/scripts/new_issue.sh

@@ -1,63 +0,0 @@
-#!/bin/bash
-
-set -e
-
-ROOT_DIR=$(git rev-parse --show-toplevel)
-
-# Extract scope name and path using jq, and pass it to fzf for selection
-SCOPE=$(cat "$ROOT_DIR/.github/scopes.json" | jq -r '.[] | "\(.name)"' | fzf --prompt "Select scope:")
-DOCS=$(cat "$ROOT_DIR/.github/scopes.json" | jq -r ".[] | select(.name == \"$SCOPE\") | .docs[]")
-
-# Write Title
-TITLE=$(gum input --placeholder "Issue Title...")
-
-# Write Goal
-GOAL=$(mods --role "determine-issue-goal" "$SCOPE $TITLE")
-
-# Input Requirements
-REQUIREMENTS=()
-while true; do
-    if [ ${#REQUIREMENTS[@]} -ge 2 ]; then
-        if ! gum confirm "Do you want to add another requirement?"; then
-            break
-        fi
-    fi
-    REQUIREMENT=$(gum input --placeholder "Add a requirement...")
-    if [ -n "$REQUIREMENT" ]; then
-        REQUIREMENTS+=("$REQUIREMENT")
-    else
-        echo "Requirement cannot be empty. Please enter a valid requirement."
-    fi
-done
-
-create_body() {
-    echo "### Goal(s):"
-    echo "$GOAL"
-    echo "### Requirements:"
-    for i in "${!REQUIREMENTS[@]}"; do
-        echo "$(($i + 1)). ${REQUIREMENTS[$i]}"
-    done
-    echo "### Resources:"
-    for doc in "${DOCS[@]}"; do
-        echo "- $doc"
-    done
-}
-
-ISSUE_BODY=$(create_body)
-
-# Function to collect output
-preview_output() {
-    echo "# ($SCOPE) $TITLE"
-    echo "$ISSUE_BODY"
-}
-
-# Display the formatted output
-preview_output | gum format
-
-# Confirm to create a GitHub issue
-if gum confirm "Do you want to create a new GitHub issue with this information?"; then
-    # Create a new GitHub issue using the gh CLI
-    gh issue create --repo onsonr/sonr --title "($SCOPE) $TITLE" --body "$ISSUE_BODY"
-else
-  exit 1
-fi

.github/scripts/upload_cdn.sh

@@ -1,39 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-ROOT_DIR=$(git rev-parse --show-toplevel)
-
-# Package the PKL projects
-bunx pkl project package $ROOT_DIR/pkl/*/
-
-# Process each directory in .out
-for dir in .out/*/; do
-    # Get the folder name and version
-    folder=$(basename "$dir")
-    version=$(echo "$folder" | grep -o '@.*' | sed 's/@//')
-    new_folder=$(echo "$folder" | sed 's/@[0-9.]*$//')
-    
-    # Create new directory without version
-    mkdir -p ".out/$new_folder/$version"
-    
-    # Copy contents to versioned subdirectory
-    cp -r "$dir"* ".out/$new_folder/$version/"
-    
-    # Find and copy only .pkl files from the original package
-    pkg_dir="$ROOT_DIR/pkl/$new_folder"
-    if [ -d "$pkg_dir" ]; then
-        # Copy only .pkl files to version directory
-        find "$pkg_dir" -name "*.pkl" -exec cp {} ".out/$new_folder/$version/" \;
-    fi
-    
-    # Remove old versioned directory
-    rm -rf "$dir"
-    
-    # Upload to R2 with new structure
-    rclone copy ".out/$new_folder" "r2:pkljar/$new_folder"
-done
-
-# Cleanup .out directory
-rm -rf .out
-

.github/testnet.md

@@ -1,8 +0,0 @@
----
-title: New Testnet {{ date | date('dddd MMMM Do') }}
-labels: enhancement
----
-Server IP: {{ env.SERVER_IPV4_ADDR }}
-SSH: `ssh -o StrictHostKeyChecking=no root@{{ env.SERVER_IPV4_ADDR }}`
-Tag: {{ env.GITHUB_REF_NAME }} / Commit: {{ env.GITHUB_SHA }}
-Local-Interchain API: http://{{ env.SERVER_IPV4_ADDR }}:{{ env.LOCALIC_PORT }}

.github/workflows/archive/bump.yml

@@ -0,0 +1,97 @@
+name: Bump version
+on:
+  push:
+    branches:
+      - master
+env:
+  NODE_VERSION: 20
+  PNPM_VERSION: 10
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      minor: ${{ steps.check-milestone.outputs.minor }}
+      non-docs: ${{ steps.filter.outputs.non-docs }}
+      packages: ${{ steps.filter.outputs.packages }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            non-docs:
+              - '!docs/**'
+              - '!README.md'
+            packages:
+              - 'packages/**'
+              - 'cli/**'
+              - 'web/**'
+              - 'pnpm-lock.yaml'
+      # Check if any milestone has all issues closed
+      - name: Check milestone completion
+        id: check-milestone
+        run: |
+          # Get all open milestones and check if any have all issues closed
+          MILESTONES=$(gh api repos/${{ github.repository }}/milestones --jq '.[] | select(.state == "open") | {title, open_issues}')
+
+          # Check if any milestone has 0 open issues
+          MINOR_BUMP=false
+          while IFS= read -r milestone; do
+            if [ -n "$milestone" ]; then
+              OPEN_ISSUES=$(echo "$milestone" | jq -r '.open_issues')
+              TITLE=$(echo "$milestone" | jq -r '.title')
+              if [ "$OPEN_ISSUES" = "0" ]; then
+                echo "Milestone '$TITLE' is complete (0 open issues). Minor bump required."
+                MINOR_BUMP=true
+                break
+              fi
+            fi
+          done <<< "$(echo "$MILESTONES" | jq -c '.')"
+
+          echo "minor=$MINOR_BUMP" >> $GITHUB_OUTPUT
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT_TOKEN }}  # Handle Go/Binary versioning with commitizen
+
+  version-go:
+    needs: changes
+    if: "!startsWith(github.event.head_commit.message, 'bump:') && !startsWith(github.event.head_commit.message, 'hotfix:') && !startsWith(github.event.head_commit.message, 'Version Packages') && needs.changes.outputs.non-docs == 'true'"
+    runs-on: ubuntu-latest
+    name: "Bump Go binary version and create changelog"
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ssh-key: "${{ secrets.COMMIT_KEY }}"
+      - name: Determine increment type
+        id: increment
+        run: |
+          # Use the version-bump.sh script to determine increment type
+          INCREMENT_TYPE=$(./scripts/version-bump.sh increment-type true ${{ github.repository }})
+          echo "type=$INCREMENT_TYPE" >> $GITHUB_OUTPUT
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT_TOKEN }}
+      - name: Create bump and changelog
+        uses: commitizen-tools/commitizen-action@master
+        with:
+          push: false
+          increment: ${{ steps.increment.outputs.type }}
+      - name: Push using ssh
+        run: |
+          git push origin master --tags
+
+  close-milestone:
+    needs: [changes, version-go]
+    if: "needs.changes.outputs.minor == 'true'"
+    runs-on: ubuntu-latest
+    name: "Close completed milestone"
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+      - name: Close completed milestone
+        run: |
+          ./scripts/version-bump.sh close-milestone ${{ github.repository }}
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT_TOKEN }}

.github/workflows/archive/cd.yml

@@ -0,0 +1,129 @@
+name: CD
+on:
+  workflow_call:
+    inputs:
+      bump:
+        required: false
+        type: string
+      release:
+        required: false
+        type: string
+      publish:
+        required: false
+        type: string
+      deploy:
+        required: false
+        type: string
+      continue-on-error:
+        required: false
+        default: false
+        type: boolean
+      devbox-version:
+        required: false
+        default: 0.16.0
+        type: string
+      enable-cache:
+        required: false
+        default: false
+        type: boolean
+      fetch-depth:
+        required: false
+        default: 0
+        type: number
+      persist-credentials:
+        required: false
+        default: false
+        type: boolean
+      runs-on:
+        required: false
+        default: ubuntu-latest
+        type: string
+
+jobs:
+  bump:
+    runs-on: ${{ inputs.runs-on }}
+    environment: staging - cd
+    if: ${{ inputs.test != '' }}
+    name: Bump
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: ${{ inputs.persist-credentials }}
+          fetch-depth: ${{ inputs.fetch-depth }}
+      - name: Install devbox
+        uses: jetify-com/devbox-install-action@v0.13.0
+        with:
+          enable-cache: ${{ inputs.enable-cache }}
+          devbox-version: ${{ inputs.devbox-version }}
+      - name: "Bump ${{ inputs.bump }}"
+        run: devbox run bump:${{ inputs.bump }}
+        if: ${{ inputs.bump != '' }}
+        continue-on-error: ${{ inputs.continue-on-error }}
+
+  release:
+    runs-on: ${{ inputs.runs-on }}
+    environment: staging - cd
+    if: ${{ inputs.release != '' }}
+    name: Release
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: ${{ inputs.persist-credentials }}
+          fetch-depth: ${{ inputs.fetch-depth }}
+      - name: Install devbox
+        uses: jetify-com/devbox-install-action@v0.13.0
+        with:
+          enable-cache: ${{ inputs.enable-cache }}
+          devbox-version: ${{ inputs.devbox-version }}
+      - name: "Release ${{ inputs.release }}"
+        run: devbox run release:${{ inputs.release }}
+        if: ${{ inputs.release != '' }}
+        continue-on-error: ${{ inputs.continue-on-error }}
+
+  publish:
+    runs-on: ${{ inputs.runs-on }}
+    environment: staging - publish
+    if: ${{ inputs.publish != '' }}
+    name: Publish
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: ${{ inputs.persist-credentials }}
+          fetch-depth: ${{ inputs.fetch-depth }}
+      - name: Install devbox
+        uses: jetify-com/devbox-install-action@v0.13.0
+        with:
+          enable-cache: ${{ inputs.enable-cache }}
+          devbox-version: ${{ inputs.devbox-version }}
+      - name: "Install ${{ inputs.install }}"
+        run: devbox run install:${{ inputs.install }}
+      - name: "Publish ${{ inputs.publish }}"
+        run: devbox run publish:${{ inputs.publish }}
+        if: ${{ inputs.publish != '' }}
+        continue-on-error: ${{ inputs.continue-on-error }}
+
+  deploy:
+    runs-on: ${{ inputs.runs-on }}
+    environment: staging - deploy
+    if: ${{ inputs.deploy != '' }}
+    name: Deploy
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: ${{ inputs.persist-credentials }}
+          fetch-depth: ${{ inputs.fetch-depth }}
+      - name: Install devbox
+        uses: jetify-com/devbox-install-action@v0.13.0
+        with:
+          enable-cache: ${{ inputs.enable-cache }}
+          devbox-version: ${{ inputs.devbox-version }}
+      - name: "Install ${{ inputs.install }}"
+        run: devbox run install:${{ inputs.install }}
+      - name: "Deploy ${{ inputs.deploy }}"
+        run: devbox run deploy:${{ inputs.deploy }}
+        if: ${{ inputs.deploy != '' }}
+        continue-on-error: ${{ inputs.continue-on-error }}

.github/workflows/archive/changes.yml

@@ -0,0 +1,136 @@
+
+name: Changes
+on:
+  workflow_call:
+    outputs:
+      modules:
+        description: "JSON array of changed modules"
+        value: ${{ jobs.detect.outputs.modules }}
+      core:
+        description: "True if core files changed"
+        value: ${{ jobs.detect.outputs.core }}
+      app:
+        description: "True if app files changed"
+        value: ${{ jobs.detect.outputs.app }}
+      crypto:
+        description: "True if crypto files changed"
+        value: ${{ jobs.detect.outputs.crypto }}
+      hway:
+        description: "True if highway files changed"
+        value: ${{ jobs.detect.outputs.hway }}
+      client:
+        description: "True if client files changed"
+        value: ${{ jobs.detect.outputs.client }}
+      packages-changes:
+        description: "True if JS packages changed"
+        value: ${{ jobs.detect.outputs.packages-changes }}
+      web-changes:
+        description: "True if web app files changed"
+        value: ${{ jobs.detect.outputs.web-changes }}
+      go-changes:
+        description: "True if Go files changed"
+        value: ${{ jobs.detect.outputs.go-changes }}
+      wasm-changes:
+        description: "True if WASM files changed"
+        value: ${{ jobs.detect.outputs.wasm-changes }}
+      docker-changes:
+        description: "True if Docker files changed"
+        value: ${{ jobs.detect.outputs.docker-changes }}
+
+jobs:
+  detect:
+    name: Find Changes
+    runs-on: ubuntu-latest
+    outputs:
+      modules: ${{ steps.set-modules.outputs.modules }}
+      core: ${{ steps.filter.outputs.core }}
+      app: ${{ steps.filter.outputs.app }}
+      crypto: ${{ steps.filter.outputs.crypto }}
+      hway: ${{ steps.filter.outputs.hway }}
+      client: ${{ steps.filter.outputs.client }}
+      packages-changes: ${{ steps.filter.outputs.packages-changes == 'true' }}
+      web-changes: ${{ steps.filter.outputs.web-changes == 'true' }}
+      go-changes: ${{ steps.filter.outputs.go-changes == 'true' }}
+      wasm-changes: ${{ steps.filter.outputs.wasm-changes == 'true' }}
+      docker-changes: ${{ steps.filter.outputs.docker-changes == 'true' }}
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+      - name: Detect changed files
+        uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            dex:
+              - 'x/dex/**'
+              - 'proto/sonr/dex/**'
+            did:
+              - 'x/did/**'
+              - 'proto/sonr/did/**'
+            dwn:
+              - 'x/dwn/**'
+              - 'proto/sonr/dwn/**'
+            svc:
+              - 'x/svc/**'
+              - 'proto/sonr/svc/**'
+            hway:
+              - 'cmd/hway/**'
+              - 'internal/bridge/**'
+              - 'internal/**'
+            crypto:
+              - 'crypto/**'
+            client:
+              - 'client/**'
+              - 'client/go.mod'
+              - 'client/go.sum'
+            core:
+              - 'app/**'
+              - 'cmd/**'
+              - 'go.mod'
+              - 'go.sum'
+            packages-changes:
+              - 'packages/**'
+              - 'pnpm-lock.yaml'
+              - 'package.json'
+              - 'tsconfig.json'
+            web-changes:
+              - 'web/**'
+              - 'pnpm-lock.yaml'
+              - 'package.json'
+            go-changes:
+              - 'app/**'
+              - 'x/**'
+              - 'cmd/**'
+              - 'client/**'
+              - 'go.mod'
+              - 'go.sum'
+            wasm-changes:
+              - 'cmd/vault/**'
+              - 'x/dwn/client/wasm/main.go'
+              - 'x/dwn/Makefile'
+            docker-changes:
+              - 'Dockerfile'
+          list-files: json
+      - name: Set module outputs
+        id: set-modules
+        run: |
+          modules=()
+          if [[ "${{ steps.filter.outputs.dex }}" == "true" ]]; then
+            modules+=("dex")
+          fi
+          if [[ "${{ steps.filter.outputs.did }}" == "true" ]]; then
+            modules+=("did")
+          fi
+          if [[ "${{ steps.filter.outputs.dwn }}" == "true" ]]; then
+            modules+=("dwn")
+          fi
+          if [[ "${{ steps.filter.outputs.svc }}" == "true" ]]; then
+            modules+=("svc")
+          fi
+
+          if [[ ${#modules[@]} -eq 0 ]]; then
+            echo "modules=[]" >> $GITHUB_OUTPUT
+          else
+            printf -v joined '"%s",' "${modules[@]}"
+            echo "modules=[${joined%,}]" >> $GITHUB_OUTPUT
+          fi

.github/workflows/archive/ci.yml

@@ -0,0 +1,101 @@
+name: CI
+on:
+  workflow_call:
+    inputs:
+      build:
+        required: false
+        type: string
+      snapshot:
+        required: false
+        type: string
+      test:
+        required: false
+        type: string
+      continue-on-error:
+        required: false
+        default: false
+        type: boolean
+      devbox-version:
+        required: false
+        default: 0.16.0
+        type: string
+      enable-cache:
+        required: false
+        default: false
+        type: boolean
+      fetch-depth:
+        required: false
+        default: 0
+        type: number
+      persist-credentials:
+        required: false
+        default: false
+        type: boolean
+      runs-on:
+        required: false
+        default: ubuntu-latest
+        type: string
+
+jobs:
+  test:
+    runs-on: ${{ inputs.runs-on }}
+    environment: staging - ci
+    if: ${{ inputs.test != '' }}
+    name: Test
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: ${{ inputs.persist-credentials }}
+          fetch-depth: ${{ inputs.fetch-depth }}
+      - name: Install devbox
+        uses: jetify-com/devbox-install-action@v0.13.0
+        with:
+          enable-cache: ${{ inputs.enable-cache }}
+          devbox-version: ${{ inputs.devbox-version }}
+      - name: "Test ${{ inputs.test }}"
+        run: devbox run test:${{ inputs.test }}
+        if: ${{ inputs.test != '' }}
+        continue-on-error: ${{ inputs.continue-on-error }}
+
+  build:
+    runs-on: ${{ inputs.runs-on }}
+    environment: staging - ci
+    if: ${{ inputs.build != '' }}
+    name: Build
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: ${{ inputs.persist-credentials }}
+          fetch-depth: ${{ inputs.fetch-depth }}
+      - name: Install devbox
+        uses: jetify-com/devbox-install-action@v0.13.0
+        with:
+          enable-cache: ${{ inputs.enable-cache }}
+          devbox-version: ${{ inputs.devbox-version }}
+      - name: "Build ${{ inputs.build }}"
+        run: devbox run build:${{ inputs.build }}
+        if: ${{ inputs.build != '' }}
+        continue-on-error: ${{ inputs.continue-on-error }}
+
+  snapshot:
+    runs-on: ${{ inputs.runs-on }}
+    environment: staging - ci
+    if: ${{ inputs.snapshot != '' }}
+    name: Deploy
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: ${{ inputs.persist-credentials }}
+          fetch-depth: ${{ inputs.fetch-depth }}
+      - name: Install devbox
+        uses: jetify-com/devbox-install-action@v0.13.0
+        with:
+          enable-cache: ${{ inputs.enable-cache }}
+          devbox-version: ${{ inputs.devbox-version }}
+      - name: "Snapshot ${{ inputs.snapshot }}"
+        run: devbox run snapshot:${{ inputs.snapshot }}
+        if: ${{ inputs.snapshot != '' }}
+        continue-on-error: ${{ inputs.continue-on-error }}

.github/workflows/archive/devbox.yml

@@ -0,0 +1,137 @@
+name: Devbox Run
+on:
+  workflow_call:
+    inputs:
+      install:
+        required: true
+        default: go
+        type: string
+      build:
+        required: false
+        type: string
+      deploy:
+        required: false
+        type: string
+      publish:
+        required: false
+        type: string
+      test:
+        required: false
+        type: string
+      continue-on-error:
+        required: false
+        default: false
+        type: boolean
+      devbox-version:
+        required: false
+        default: 0.16.0
+        type: string
+      enable-cache:
+        required: false
+        default: false
+        type: boolean
+      fetch-depth:
+        required: false
+        default: 0
+        type: number
+      persist-credentials:
+        required: false
+        default: false
+        type: boolean
+      runs-on:
+        required: false
+        default: ubuntu-latest
+        type: string
+
+jobs:
+  test:
+    runs-on: ${{ inputs.runs-on }}
+    environment: staging - test
+    if: ${{ inputs.test != '' }}
+    name: Test
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: ${{ inputs.persist-credentials }}
+          fetch-depth: ${{ inputs.fetch-depth }}
+      - name: Install devbox
+        uses: jetify-com/devbox-install-action@v0.13.0
+        with:
+          enable-cache: ${{ inputs.enable-cache }}
+          devbox-version: ${{ inputs.devbox-version }}
+      - name: "Install ${{ inputs.install }}"
+        run: devbox run install:${{ inputs.install }}
+      - name: "Test ${{ inputs.test }}"
+        run: devbox run test:${{ inputs.test }}
+        if: ${{ inputs.test != '' }}
+        continue-on-error: ${{ inputs.continue-on-error }}
+
+  build:
+    runs-on: ${{ inputs.runs-on }}
+    environment: staging - build
+    if: ${{ inputs.build != '' }}
+    name: Build
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: ${{ inputs.persist-credentials }}
+          fetch-depth: ${{ inputs.fetch-depth }}
+      - name: Install devbox
+        uses: jetify-com/devbox-install-action@v0.13.0
+        with:
+          enable-cache: ${{ inputs.enable-cache }}
+          devbox-version: ${{ inputs.devbox-version }}
+      - name: "Install ${{ inputs.install }}"
+        run: devbox run install:${{ inputs.install }}
+      - name: "Build ${{ inputs.build }}"
+        run: devbox run build:${{ inputs.build }}
+        if: ${{ inputs.build != '' }}
+        continue-on-error: ${{ inputs.continue-on-error }}
+
+  publish:
+    runs-on: ${{ inputs.runs-on }}
+    environment: staging - publish
+    if: ${{ inputs.publish != '' }}
+    name: Publish
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: ${{ inputs.persist-credentials }}
+          fetch-depth: ${{ inputs.fetch-depth }}
+      - name: Install devbox
+        uses: jetify-com/devbox-install-action@v0.13.0
+        with:
+          enable-cache: ${{ inputs.enable-cache }}
+          devbox-version: ${{ inputs.devbox-version }}
+      - name: "Install ${{ inputs.install }}"
+        run: devbox run install:${{ inputs.install }}
+      - name: "Publish ${{ inputs.publish }}"
+        run: devbox run publish:${{ inputs.publish }}
+        if: ${{ inputs.publish != '' }}
+        continue-on-error: ${{ inputs.continue-on-error }}
+
+  deploy:
+    runs-on: ${{ inputs.runs-on }}
+    environment: staging - deploy
+    if: ${{ inputs.deploy != '' }}
+    name: Deploy
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: ${{ inputs.persist-credentials }}
+          fetch-depth: ${{ inputs.fetch-depth }}
+      - name: Install devbox
+        uses: jetify-com/devbox-install-action@v0.13.0
+        with:
+          enable-cache: ${{ inputs.enable-cache }}
+          devbox-version: ${{ inputs.devbox-version }}
+      - name: "Install ${{ inputs.install }}"
+        run: devbox run install:${{ inputs.install }}
+      - name: "Deploy ${{ inputs.deploy }}"
+        run: devbox run deploy:${{ inputs.deploy }}
+        if: ${{ inputs.deploy != '' }}
+        continue-on-error: ${{ inputs.continue-on-error }}

.github/workflows/archive/new-pr.yml

@@ -0,0 +1,99 @@
+name: CI
+on:
+  pull_request:
+  push:
+    branches: [master]
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+env:
+  GO_VERSION: 1.24.4
+  NODE_VERSION: 20
+  PNPM_VERSION: 10
+permissions:
+  contents: read
+  pull-requests: read
+  packages: write
+jobs:
+  detect-changes:
+    name: Analyze
+    uses: ./.github/workflows/changes.yml
+
+  client:
+    name: Client
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.client == 'true' }}
+    uses: ./.github/workflows/devbox.yml
+    with:
+      install: go
+      test: client
+      build: client
+
+  core:
+    name: Core
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.go-changes == 'true' }}
+    uses: ./.github/workflows/devbox.yml
+    with:
+      install: go
+      test: app
+      build: snrd
+
+  crypto:
+    name: Crypto
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.crypto == 'true' }}
+    uses: ./.github/workflows/devbox.yml
+    with:
+      install: go
+      test: crypto
+
+  docker:
+    name: Docker
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.docker-changes == 'true' }}
+    uses: ./.github/workflows/devbox.yml
+    with:
+      install: go
+      build: docker
+
+  hway:
+    name: Highway
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.hway == 'true' }}
+    uses: ./.github/workflows/devbox.yml
+    with:
+      install: go
+      build: hway
+
+  packages:
+    name: Packages
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.packages-changes == 'true' }}
+    uses: ./.github/workflows/devbox.yml
+    with:
+      install: pnpm
+      test: packages
+
+  web:
+    name: Web
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.web-changes == 'true' }}
+    uses: ./.github/workflows/devbox.yml
+    with:
+      install: pnpm
+      test: web
+
+  x-modules:
+    name: X
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.modules != '[]' && needs.detect-changes.outputs.modules != '' }}
+    strategy:
+      matrix:
+        module: ${{ fromJSON(needs.detect-changes.outputs.modules) }}
+      fail-fast: false
+    uses: ./.github/workflows/devbox.yml
+    with:
+      install: go
+      test: ${{ matrix.module }}

.github/workflows/archive/release.yml

@@ -0,0 +1,406 @@
+name: Release
+
+# This workflow handles the complete release process:
+# 1. Build binaries for multiple platforms (snrd, hway)
+# 2. Build WASM modules (vault, motor)
+# 3. Publish to GitHub releases, S3, and package registries
+# 4. Build and push Docker images for all services
+# 5. Publish NPM packages
+# 6. Push protobuf definitions to Buf Schema Registry
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+" # ignore rc
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+
+jobs:
+  # Prepare job runs on multiple OS for native builds
+  prepare:
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            goos: linux
+            goarch: amd64
+          - os: ubuntu-latest
+            goos: linux
+            goarch: arm64
+          - os: macos-latest
+            goos: darwin
+            goarch: amd64
+          - os: macos-latest
+            goos: darwin
+            goarch: arm64
+    runs-on: ${{ matrix.os }}
+    env:
+      flags: ""
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache-dependency-path: "**/*.sum"
+
+      - name: Install dependencies
+        run: |
+          go mod download
+          # Build WASM modules
+          make build-motr
+          make build-vault
+
+      # Set flags for workflow dispatch (nightly builds)
+      - if: ${{ github.event_name == 'workflow_dispatch' }}
+        shell: bash
+        run: |
+          echo "flags=--nightly" >> $GITHUB_ENV
+
+      # Generate cache key
+      - shell: bash
+        run: |
+          echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+
+      # Cache the built artifacts
+      - uses: actions/cache@v4
+        with:
+          path: dist/${{ matrix.goos }}
+          key: ${{ matrix.goos }}-${{ matrix.goarch }}-${{ env.sha_short }}${{ env.flags }}
+          enableCrossOsArchive: true
+
+      # Run goreleaser in split mode for snrd
+      - name: Run GoReleaser for snrd (Split)
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser-pro
+          version: latest
+          args: release --clean --split --config cmd/snrd/.goreleaser.yml ${{ env.flags }}
+          workdir: cmd/snrd
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_PAT_TOKEN }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          GGOOS: ${{ matrix.goos }}
+          GGOARCH: ${{ matrix.goarch }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+      # Run goreleaser in split mode for hway
+      - name: Run GoReleaser for hway (Split)
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser-pro
+          version: latest
+          args: release --clean --split --config cmd/hway/.goreleaser.yml ${{ env.flags }}
+          workdir: cmd/hway
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_PAT_TOKEN }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          GGOOS: ${{ matrix.goos }}
+          GGOARCH: ${{ matrix.goarch }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+  # WASM modules build job
+  wasm:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          check-latest: true
+
+      - name: Setup TinyGo
+        uses: acifani/setup-tinygo@v2
+        with:
+          tinygo-version: '0.32.0'
+
+      - name: Build WASM modules
+        run: |
+          # Build vault WASM
+          cd cmd/vault
+          make build
+          cd ../..
+
+          # Build motor WASM
+          cd cmd/motr
+          make build
+          cd ../..
+
+      - name: Run GoReleaser for WASM modules
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser-pro
+          version: latest
+          args: release --clean --config cmd/vault/.goreleaser.yml
+          workdir: cmd/vault
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_PAT_TOKEN }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+      - name: Run GoReleaser for Motor WASM
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser-pro
+          version: latest
+          args: release --clean --config cmd/motr/.goreleaser.yml
+          workdir: cmd/motr
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_PAT_TOKEN }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+  # Merge and release job combines all artifacts
+  release:
+    runs-on: ubuntu-latest
+    needs: [prepare, wasm]
+    env:
+      flags: ""
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache-dependency-path: "**/*.sum"
+
+      # Set flags for workflow dispatch
+      - if: ${{ github.event_name == 'workflow_dispatch' }}
+        shell: bash
+        run: |
+          echo "flags=--nightly" >> $GITHUB_ENV
+
+      # Generate cache key
+      - shell: bash
+        run: |
+          echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+
+      # Restore all cached artifacts from prepare jobs
+      - name: Restore Linux AMD64 artifacts
+        uses: actions/cache@v4
+        with:
+          path: dist/linux
+          key: linux-amd64-${{ env.sha_short }}${{ env.flags }}
+          enableCrossOsArchive: true
+
+      - name: Restore Linux ARM64 artifacts
+        uses: actions/cache@v4
+        with:
+          path: dist/linux
+          key: linux-arm64-${{ env.sha_short }}${{ env.flags }}
+          enableCrossOsArchive: true
+
+      - name: Restore Darwin AMD64 artifacts
+        uses: actions/cache@v4
+        with:
+          path: dist/darwin
+          key: darwin-amd64-${{ env.sha_short }}${{ env.flags }}
+          enableCrossOsArchive: true
+
+      - name: Restore Darwin ARM64 artifacts
+        uses: actions/cache@v4
+        with:
+          path: dist/darwin
+          key: darwin-arm64-${{ env.sha_short }}${{ env.flags }}
+          enableCrossOsArchive: true
+
+      # Merge and publish the release for snrd
+      - name: Run GoReleaser for snrd (Merge)
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser-pro
+          version: latest
+          args: continue --merge --config cmd/snrd/.goreleaser.yml ${{ env.flags }}
+          workdir: cmd/snrd
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_PAT_TOKEN }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+      # Merge and publish the release for hway
+      - name: Run GoReleaser for hway (Merge)
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser-pro
+          version: latest
+          args: continue --merge --config cmd/hway/.goreleaser.yml ${{ env.flags }}
+          workdir: cmd/hway
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_PAT_TOKEN }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+  # Protobuf publishing job
+  protobuf:
+    runs-on: ubuntu-latest
+    needs: release
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Buf
+        uses: bufbuild/buf-setup-action@v1
+        with:
+          version: latest
+
+      - name: Push to Buf Schema Registry
+        uses: bufbuild/buf-push-action@v1
+        with:
+          input: proto
+          buf_token: ${{ secrets.BUF_TOKEN }}
+          github_token: ${{ secrets.GH_PAT_TOKEN }}
+
+  # NPM packages publishing job
+  npm:
+    runs-on: ubuntu-latest
+    needs: release
+    if: github.event_name == 'push' # Only on tag push, not workflow_dispatch
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v2
+        with:
+          version: 9
+          run_install: false
+
+      - name: Get pnpm store directory
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - uses: actions/cache@v4
+        name: Setup pnpm cache
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build packages
+        run: pnpm build
+
+      - name: Publish packages
+        run: |
+          # Update package versions to match git tag
+          export VERSION=${GITHUB_REF#refs/tags/v}
+          bash scripts/version-bump.sh sync-packages all
+
+          # Publish to npm
+          pnpm --filter "./packages/*" publish --access public --no-git-checks
+          pnpm --filter "./cli/*" publish --access public --no-git-checks
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+  # Docker multi-platform build job
+  docker:
+    runs-on: ubuntu-latest
+    needs: release
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        include:
+          - service: snrd
+            dockerfile: cmd/snrd/Dockerfile
+            description: "Sonr blockchain daemon"
+          - service: hway
+            dockerfile: cmd/hway/Dockerfile
+            description: "Highway service - task processor"
+          - service: auth
+            dockerfile: web/auth/Dockerfile
+            description: "Authentication web application"
+          - service: dash
+            dockerfile: web/dash/Dockerfile
+            description: "Dashboard web application"
+          - service: postgres
+            dockerfile: etc/postgres/Dockerfile
+            description: "PostgreSQL with extensions"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GH_PAT_TOKEN }}
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ghcr.io/sonr-io/${{ matrix.service }}
+            onsonr/${{ matrix.service }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=raw,value=latest
+            type=raw,value=${{ inputs.tag || 'latest' }},enable=${{ github.event_name == 'workflow_dispatch' }}
+
+      - name: Build and push ${{ matrix.service }}
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: |
+            ${{ steps.meta.outputs.labels }}
+            org.opencontainers.image.description=${{ matrix.description }}
+          cache-from: type=gha,scope=${{ matrix.service }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.service }}

.github/workflows/ci-status.yml

@@ -0,0 +1,18 @@
+name: CI Status
+on:
+  workflow_run:
+    workflows: ["PR CI", "Post-Merge Release", "Nightly Snapshot"]
+    types: [completed]
+
+jobs:
+  report:
+    name: Report CI Status
+    runs-on: builder
+    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
+    steps:
+      - name: Report Failure
+        run: |
+          echo "❌ Workflow Failed: ${{ github.event.workflow_run.name }}"
+          echo "Branch: ${{ github.event.workflow_run.head_branch }}"
+          echo "Commit: ${{ github.event.workflow_run.head_sha }}"
+          echo "URL: ${{ github.event.workflow_run.html_url }}"

.github/workflows/label-pr.yml

@@ -1,19 +0,0 @@
-name: PR Labeler
-on:
-  pull_request:
-    types: [opened]
-
-permissions:
-  contents: read
-
-jobs:
-  pr-labeler:
-    permissions:
-      contents: read # for TimonVS/pr-labeler-action to read config file
-      pull-requests: write # for TimonVS/pr-labeler-action to add labels in PR
-    runs-on: ubuntu-latest
-    steps:
-      - uses: TimonVS/pr-labeler-action@v5
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          configuration-path: .github/pr-labeler.yml # optional, .github/pr-labeler.yml is the default value

.github/workflows/make-docs.yml

@@ -1,28 +0,0 @@
-name: Publish Docs via GitHub Pages
-on:
-  push:
-    branches:
-      - master
-permissions:
-  contents: write
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Configure Git Credentials
-        run: |
-          git config user.name github-actions[bot]
-          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
-      - uses: actions/setup-python@v5
-        with:
-          python-version: 3.x
-      - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-      - uses: actions/cache@v4
-        with:
-          key: mkdocs-material-${{ env.cache_id }}
-          path: .cache
-          restore-keys: |
-            mkdocs-material-
-      - run: pip install mkdocs-material
-      - run: cd docs && mkdocs gh-deploy --force

.github/workflows/pr.yml

@@ -0,0 +1,60 @@
+name: PR CI
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+concurrency:
+  group: pr-${{ github.head_ref }}
+  cancel-in-progress: true
+
+env:
+  DEVBOX_VERSION: 0.16.0
+
+jobs:
+  validate:
+    name: Validate & Test
+    runs-on: builder  # Self-hosted runner
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Required for github-env.sh comparisons
+      # Cache can be local on self-hosted runner for better performance
+      - name: Cache Dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+            ~/.devbox
+          key: deps-builder-${{ hashFiles('go.sum', 'devbox.json') }}
+          restore-keys: deps-builder-
+
+      - name: Install Dependencies
+        run: devbox install
+
+      - name: Test Affected Scopes
+        run: |
+          echo "🔍 Analyzing changes..."
+          ./scripts/github-env.sh git-context
+          echo ""
+          devbox run test
+
+      - name: Build Affected Scopes
+        run: devbox run build
+
+      - name: Verify Build Artifacts
+        run: |
+          # Verify critical build outputs exist
+          if [ -d "build/" ]; then
+            ls -la build/
+          fi
+
+      # Cleanup workspace for self-hosted runner
+      - name: Cleanup
+        if: always()
+        run: |
+          # Clean build artifacts to prevent disk fill
+          make clean || true
+          # Keep caches but remove build outputs
+          rm -rf dist/ build/ || true

.github/workflows/publish-assets.yml

@@ -1,25 +0,0 @@
-name: Publish Versioned Assets
-on:
-  push:
-    branches:
-      - develop
-
-permissions:
-  contents: write
-  issues: write
-
-jobs:
-  buf_push_core:
-    name: Publish to buf.build/onsonr/sonr
-    runs-on: ubuntu-latest
-    steps:
-      # Run `git checkout`
-      - uses: actions/checkout@v3
-      # Install the `buf` CLI
-      - uses: bufbuild/buf-setup-action@v1
-      # Push only the Input in `proto` to the BSR
-      - uses: bufbuild/buf-push-action@v1
-        continue-on-error: true
-        with:
-          input: proto
-          buf_token: ${{ secrets.BUF_TOKEN }}

.github/workflows/run-tests.yml

@@ -1,59 +0,0 @@
-name: Run Tests
-
-on:
-  pull_request:
-  merge_group:
-
-jobs:
-  test-unit:
-    runs-on: ubuntu-latest
-    name: Run Unit Tests
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          repository: onsonr/sonr
-          fetch-depth: 0
-          fetch-tags: true
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.23"
-          check-latest: true
-      - run: make test-unit
-
-  test-race:
-    runs-on: ubuntu-latest
-    name: Run Race Tests
-    continue-on-error: true
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          repository: onsonr/sonr
-          fetch-depth: 0
-          fetch-tags: true
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.23"
-          check-latest: true
-      - run: make test-race
-
-  test-cover:
-    runs-on: ubuntu-latest
-    name: Run Coverage Tests
-    continue-on-error: true
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          repository: onsonr/sonr
-          fetch-depth: 0
-          fetch-tags: true
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.23"
-          check-latest: true
-      - run: make test-cover

.github/workflows/scheduled-release.yml

@@ -1,48 +0,0 @@
-name: Scheduled Release
-
-on:
-  workflow_dispatch:
-  push:
-    tags:
-      - v*
-
-permissions:
-  contents: write
-
-jobs:
-  goreleaser:
-    name: Release motr, sonrd, and DWN
-    permissions: write-all
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          repository: onsonr/sonr
-          fetch-depth: 0
-          fetch-tags: true
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.23"
-          check-latest: true
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Release
-        uses: goreleaser/goreleaser-action@v6
-        with:
-          distribution: goreleaser-pro
-          version: latest
-          args: release --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GH_RELEASER_TOKEN }}
-          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-          GITHUB_PERSONAL_AUTH_TOKEN: ${{ secrets.GH_RELEASER_TOKEN }}
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}

.github/workflows/version-bump.yml

@@ -1,39 +0,0 @@
-name: Update Version
-
-on:
-  push:
-    branches:
-      - master
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  run-tests:
-    name: "Run tests"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.23"
-          check-latest: true
-      - name: Run tests
-        run: make test
-
-  bump-version:
-    needs: [run-tests]
-    runs-on: ubuntu-latest
-    name: "Bump Version"
-    if: ${{ !startsWith(github.event.head_commit.message, 'bump:') }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          fetch-depth: 0
-      - name: Create bump and changelog
-        uses: commitizen-tools/commitizen-action@master
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          increment: "PATCH"

.gitignore

@@ -1,96 +1,123 @@
-# Binaries
-.data
-schemas
-*.db
-tools-stamp
-*.exe
-*.exe~
-*.dll
-*.so
-*.dylib
-*.app
+# ======================================
+# Sonr Blockchain & Monorepo .gitignore
+# ======================================
+
+# ===== Operating System Files =====
 .DS_Store
-.session.vim
-aof*
-dist
-**/.haptic
-static
-pkg/webapp/dist
-.agent
+Thumbs.db
+*~
+*.swp
+*.swo
+.logs/
+.venv/
+services/
+Taskfile*
+mprocs*
+.claude*
 
-# Test binary
+# ===== IDE & Editor Files =====
+.vscode/
+.idea/
+*.tmp
+.aider*
+.opencode
+
+# ===== Build Artifacts & Binaries =====
+*.wasm
+bin/
+dist/
+dist*/
+build/
+out/
 *.test
-.devon*
-**/.DS_Store
-.task
-.wrangler
+*.wasm
 
-# Output of the go coverage tool
-*.out
-tmp
-# Exclude embedded files
-!internal/files/dist
+# Go binaries (but allow docs references)
+snrd
+!cmd/snrd/
 
-# Dependency directories
-node_modules/
+# Allow specific CLI binaries
+!cli/join-testnet/bin/
+!cli/install/bin/
 
-# Go workspace file
+# ===== Removed: Node.js & Frontend (no longer needed for blockchain-only repo) =====
+# node_modules/
+# .pnpm-debug.log*
+# pnpm-debug.log*
+# package-lock.json
+# yarn.lock
+# *.tsbuildinfo
+# .next/
+# .vercel/
+# **/.open-next
+
+# ===== Go Development =====
+pkg/mod/
 go.work
 go.work.sum
+go.work.mod
+coverage.out
+coverage.txt
+profile.out
+*.cover
 
-# Environment files
-.env
-**/*.env
+# ===== Rust/CosmWasm Development =====
+target/
+Cargo.lock
+artifacts/
+**/target/
+**/Cargo.lock
 
+# ===== Blockchain & Cosmos SDK =====
+.snrd/
+keyring-test/
+mytestnet/
+docker/testnet/testnet-data
 
-# Terraform
-**/.terraform/*
-.terraform
-*.tfstate
-*.tfstate.*
-crash.log
-crash.*.log
-*.tfvars
-*.tfvars.json
-override.tf
-override.tf.json
-*_override.tf
-*_override.tf.json
+# ===== Build Tools =====
+.devbox/
+.task*
+Taskfile.yml
 
-.terraformrc
-terraform.rc
+# ===== Testing & Coverage =====
+testdata/
+coverage/
 
-# Misc
-.DS_Store
-.tmp/
-tmp/
-**/*tmp*/
-*.tmp
+# ===== Logs & Temporary Files =====
+logs/
 *.log
-*.dot
+configs/logs.json
+tmp/
+tmp*
+tmp-openapi-gen/
+
+# ===== Environment & Secrets =====
+.env
+.env.local
+.env.production
+.env.development
+*.key
 *.pem
-dist/
-bin/
-build/
-.devbox
-.ignore
-.opencommitignore
+
+# ===== Documentation & Planning =====
+PLAN.md
+ANALYSIS.md
+COMPLETION_SUMMARY.md
+**/CLAUDE.md
+
+# ===== Miscellaneous =====
+.claude/
+**/.claude
+.gmap
+.aim
+.spawn
+.wrangler/
+.browser-echo-mcp.json
+data/
+compose/
 heighliner*
-sonr
-deploy/**/data
-x/.DS_Store
-.aider*
-buildenv*
-node_modules
-cmd/gateway/node_modules
-pkg/nebula/node_modules
-
-mprocs.yaml
-build
-sonr.wiki
-
-!devbox.lock
-!buf.lock
-
-.air.toml
-
+# Ignore individual module OpenAPI files (generated in tmp directory)
+tmp-openapi-gen/**/*.json
+# Allow the final combined openapi.yml
+!docs/static/openapi.yml
+.mcp.json

.golangci.yml

@@ -0,0 +1,91 @@
+#jsonschema:https://golangci-lint.run/jsonschema/golangci.jsonschema.json
+version: "2"
+linters:
+  enable:
+    - govet
+    - ineffassign
+    - misspell
+    - unconvert
+    - staticcheck
+    - errcheck
+    - gosec
+    - goconst
+    - prealloc
+    - dupl
+    - whitespace
+  disable:
+    - exhaustruct
+  settings:
+    govet:
+      enable-all: true
+      disable:
+        - fieldalignment
+    gocyclo:
+      min-complexity: 15
+    dupl:
+      threshold: 100
+    goconst:
+      min-len: 3
+      min-occurrences: 3
+    funlen:
+      lines: 100
+      statements: 50
+    gocognit:
+      min-complexity: 20
+    gocritic:
+      enabled-checks:
+        - nilValReturn
+        - rangeExprCopy
+    revive:
+      confidence: 0.8
+      rules:
+        - name: exported
+          arguments: [checkPrivateReceivers, sayRepetitiveInsteadOfStutters]
+    staticcheck:
+      checks:
+        [
+          "all",
+          "-SA1019",
+          "-SA1029",
+          "-SA2002",
+          "-SA4006",
+          "-ST1021",
+          "-S1004",
+          "-ST1003",
+          "-ST1005",
+          "-ST1016",
+        ]
+    gosec:
+      excludes:
+        - G204 # Subprocess launched with function call as argument or cmd arguments
+        - G404 # Weak random number generator
+        - G115 # Weak random number generator
+formatters:
+  enable:
+    - gofmt
+    - gofumpt
+    - goimports
+    - golines
+  exclusions:
+    warn-unused: true
+    generated: strict
+    paths:
+      - ".*\\.pb\\.go$"
+      - ".*\\.pulsar\\.go$"
+      - ".*\\.cosmos_orm\\.go$"
+      - ".*\\._orm\\.go$"
+      - "types/webauthn/.*\\.go$"
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+  new: true
+  fix: true
+run:
+  timeout: 5m
+  relative-path-mode: gomod
+  issues-exit-code: 2
+  tests: true
+  modules-download-mode: readonly
+  allow-parallel-runners: true
+  allow-serial-runners: true
+  concurrency: 8

.goreleaser.yaml

@@ -1,60 +0,0 @@
-# yaml-language-server: $schema=https://goreleaser.com/static/schema-pro.json
-version: 2
-project_name: sonr
-
-builds:
-  - id: sonr
-    goos: [linux, darwin]
-    goarch: [amd64, arm64]
-    main: ./cmd/sonrd
-    binary: sonrd
-    builder: go
-    gobinary: go
-    command: build
-    ldflags:
-      - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}
-
-archives:
-  - id: sonr
-    builds: [sonr]
-    name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}'
-    format: tar.gz
-    files:
-      - src: README*
-      - src: CHANGELOG*
-
-release:
-  github:
-    owner: onsonr
-    name: sonr
-  name_template: "Release {{.Version}}"
-  draft: false
-  replace_existing_draft: true
-  replace_existing_artifacts: true
-  extra_files:
-    - glob: ./CHANGELOG*
-    - glob: ./README*
-    - glob: ./LICENSE*
-
-brews:
-  - name: sonr
-    ids: [sonr]
-    commit_author:
-      name: goreleaserbot
-      email: bot@goreleaser.com
-    directory: Formula
-    caveats: "Run a local sonr node and access it with the hway proxy"
-    homepage: "https://sonr.io/"
-    description: "Sonr is a decentralized, permissionless, and censorship-resistant identity network."
-    dependencies:
-      - name: ipfs
-    repository:
-      owner: onsonr
-      name: homebrew-tap
-      branch: master
-      token: "{{ .Env.GITHUB_PERSONAL_AUTH_TOKEN }}"
-
-announce:
-  telegram:
-    enabled: true
-    chat_id: -1002222617755

.goreleaser.yml

@@ -0,0 +1,329 @@
+# yaml-language-server: $schema=https://goreleaser.com/static/schema-pro.json
+---
+version: 2
+dist: dist/snrd
+
+project_name: snrd
+
+before:
+  hooks:
+    - go mod download
+
+builds:
+  # Darwin AMD64 Build
+  - id: snrd-darwin-amd64
+    main: ./cmd/snrd
+    binary: snrd
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    env:
+      - CGO_ENABLED=1
+      - CC=o64-clang
+      - CXX=o64-clang++
+      - CGO_LDFLAGS=-lm
+    goos:
+      - darwin
+    goarch:
+      - amd64
+    flags:
+      - -mod=readonly
+      - -trimpath
+    ldflags:
+      - -X github.com/cosmos/cosmos-sdk/version.Name=sonr
+      - -X github.com/cosmos/cosmos-sdk/version.AppName=snrd
+      - -X github.com/cosmos/cosmos-sdk/version.Version={{.Version}}
+      - -X github.com/cosmos/cosmos-sdk/version.Commit={{.Commit}}
+      - -X "github.com/cosmos/cosmos-sdk/version.BuildTags=netgo,ledger"
+      - -s -w
+    tags:
+      - netgo
+      - ledger
+
+  # Darwin ARM64 Build
+  - id: snrd-darwin-arm64
+    main: ./cmd/snrd
+    binary: snrd
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    env:
+      - CGO_ENABLED=1
+      - CC=oa64-clang
+      - CXX=oa64-clang++
+      - CGO_LDFLAGS=-lm
+    goos:
+      - darwin
+    goarch:
+      - arm64
+    flags:
+      - -mod=readonly
+      - -trimpath
+    ldflags:
+      - -X github.com/cosmos/cosmos-sdk/version.Name=sonr
+      - -X github.com/cosmos/cosmos-sdk/version.AppName=snrd
+      - -X github.com/cosmos/cosmos-sdk/version.Version={{.Version}}
+      - -X github.com/cosmos/cosmos-sdk/version.Commit={{.Commit}}
+      - -X "github.com/cosmos/cosmos-sdk/version.BuildTags=netgo,ledger"
+      - -s -w
+    tags:
+      - netgo
+      - ledger
+
+  # Linux AMD64 Build
+  - id: snrd-linux-amd64
+    main: ./cmd/snrd
+    binary: snrd
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    env:
+      - CGO_ENABLED=1
+      - CC=x86_64-linux-gnu-gcc
+      - CXX=x86_64-linux-gnu-g++
+      - CGO_LDFLAGS=-lm
+    goos:
+      - linux
+    goarch:
+      - amd64
+    goamd64:
+      - v1
+    flags:
+      - -mod=readonly
+      - -trimpath
+    ldflags:
+      - -X github.com/cosmos/cosmos-sdk/version.Name=sonr
+      - -X github.com/cosmos/cosmos-sdk/version.AppName=snrd
+      - -X github.com/cosmos/cosmos-sdk/version.Version={{.Version}}
+      - -X github.com/cosmos/cosmos-sdk/version.Commit={{.Commit}}
+      - -X "github.com/cosmos/cosmos-sdk/version.BuildTags=netgo,ledger"
+      - -s -w
+    tags:
+      - netgo
+      - ledger
+
+  # Linux ARM64 Build
+  - id: snrd-linux-arm64
+    main: ./cmd/snrd
+    binary: snrd
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    env:
+      - CGO_ENABLED=1
+      - CC=aarch64-linux-gnu-gcc
+      - CXX=aarch64-linux-gnu-g++
+      - CGO_LDFLAGS=-lm
+    goos:
+      - linux
+    goarch:
+      - arm64
+    flags:
+      - -mod=readonly
+      - -trimpath
+    ldflags:
+      - -X github.com/cosmos/cosmos-sdk/version.Name=sonr
+      - -X github.com/cosmos/cosmos-sdk/version.AppName=snrd
+      - -X github.com/cosmos/cosmos-sdk/version.Version={{.Version}}
+      - -X github.com/cosmos/cosmos-sdk/version.Commit={{.Commit}}
+      - -X "github.com/cosmos/cosmos-sdk/version.BuildTags=netgo,ledger"
+      - -s -w
+    tags:
+      - netgo
+      - ledger
+
+aur_sources:
+  - name: snrd
+    disable: true
+    homepage: "https://sonr.io"
+    description: "Sonr blockchain daemon - decentralized identity and data storage network"
+    maintainers:
+      - "Sonr <support@sonr.io>"
+    license: "GPL-3.0"
+    private_key: "{{ .Env.AUR_KEY }}"
+    git_url: "ssh://[email protected]/snrd.git"
+    skip_upload: auto
+    provides:
+      - snrd
+    conflicts:
+      - snrd-bin
+    depends:
+      - glibc
+    makedepends:
+      - go
+      - git
+      - make
+    commit_msg_template: "Update to {{ .Tag }}"
+    commit_author:
+      name: goreleaserbot
+      email: "prad@sonr.io"
+    prepare: |-
+      cd "${pkgname}_${pkgver}"
+      go mod download
+    build: |-
+      cd "${pkgname}_${pkgver}"
+      export CGO_ENABLED=1
+      export CGO_CPPFLAGS="${CPPFLAGS}"
+      export CGO_CFLAGS="${CFLAGS}"
+      export CGO_CXXFLAGS="${CXXFLAGS}"
+      export CGO_LDFLAGS="${LDFLAGS}"
+      export GOFLAGS="-buildmode=pie -trimpath -mod=readonly -modcacherw"
+      go build \
+        -ldflags="-w -s -buildid='' -linkmode=external \
+          -X github.com/cosmos/cosmos-sdk/version.Name=sonr \
+          -X github.com/cosmos/cosmos-sdk/version.AppName=snrd \
+          -X github.com/cosmos/cosmos-sdk/version.Version=${pkgver} \
+          -X 'github.com/cosmos/cosmos-sdk/version.BuildTags=netgo,ledger'" \
+        -tags "netgo,ledger" \
+        -o snrd ./cmd/snrd
+      chmod +x ./snrd
+    package: |-
+      cd "${pkgname}_${pkgver}"
+
+      # bin
+      install -Dm755 "./snrd" "${pkgdir}/usr/bin/snrd"
+
+      # license
+      if [ -f "./LICENSE" ]; then
+        install -Dm644 "./LICENSE" "${pkgdir}/usr/share/licenses/snrd/LICENSE"
+      fi
+
+      # readme
+      if [ -f "./README.md" ]; then
+        install -Dm644 "./README.md" "${pkgdir}/usr/share/doc/snrd/README.md"
+      fi
+
+      # config directory
+      install -dm755 "${pkgdir}/etc/snrd"
+      install -dm755 "${pkgdir}/var/lib/snrd"
+    backup:
+      - /etc/snrd/config.toml
+      - /etc/snrd/app.toml
+
+nix:
+  - name: snrd
+    ids:
+      - snrd
+    homepage: "https://sonr.io"
+    description: "Sonr blockchain daemon - decentralized identity network"
+    license: "gpl3"
+    path: pkgs/snrd/default.nix
+    commit_msg_template: "snrd: {{ .Tag }}"
+    dependencies:
+      - stdenv
+      - glibc
+    extra_install: |-
+      wrapProgram $out/bin/snrd --prefix PATH : ${lib.makeBinPath [ glibc stdenv.cc.cc.lib ]}
+    repository:
+      owner: sonr-io
+      name: nur
+      branch: main
+      token: "{{ .Env.GITHUB_TOKEN }}"
+
+archives:
+  - id: snrd
+    ids:
+      - snrd-linux-amd64
+      - snrd-linux-arm64
+      - snrd-darwin-amd64
+      - snrd-darwin-arm64
+    name_template: >-
+      snrd_{{ .Os }}_{{- if eq .Arch "amd64" }}x86_64 {{- else if eq .Arch "386" }}i386 {{- else }}{{ .Arch }}{{ end }}
+    formats: ["tar.gz"]
+    files:
+      - src: README*
+    wrap_in_directory: false
+
+homebrew_casks:
+  - name: snrd
+    ids:
+      - snrd
+    homepage: "https://sonr.io"
+    description: "Sonr blockchain daemon - decentralized identity and data storage network"
+    commit_msg_template: "Brew cask update for {{ .ProjectName }} version {{ .Tag }}"
+    directory: Casks
+    repository:
+      owner: sonr-io
+      name: homebrew-tap
+      branch: main
+      token: "{{ .Env.GITHUB_TOKEN }}"
+    commit_author:
+      name: goreleaserbot
+      email: "prad@sonr.io"
+    hooks:
+      post:
+        install: |
+          if OS.mac?
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/snrd"]
+          end
+
+nfpms:
+  - id: snrd
+    package_name: snrd
+    ids:
+      - snrd-linux-amd64
+      - snrd-linux-arm64
+    file_name_template: "snrd_{{ .Os }}_{{ .Arch }}{{ .ConventionalExtension }}"
+    vendor: Sonr
+    homepage: "https://sonr.io"
+    maintainer: "Sonr <support@sonr.io>"
+    description: "Sonr is a decentralized, permissionless, and censorship-resistant identity network."
+    license: "GPL-3.0"
+    formats:
+      - rpm
+      - deb
+      - apk
+      - archlinux
+    contents:
+      - src: README*
+        dst: /usr/share/doc/snrd
+    bindir: /usr/bin
+    section: net
+    priority: optional
+
+blobs:
+  - provider: s3
+    endpoint: https://eb37925850388bca807b7fab964c12bb.r2.cloudflarestorage.com
+    bucket: releases
+    region: auto
+    directory: "snrd/{{ .Tag }}"
+    ids:
+      - snrd
+
+release:
+  disable: false
+  github:
+    owner: sonr-io
+    name: sonr
+  name_template: "{{ .Tag }}"
+  draft: false
+  replace_existing_draft: false # Don't replace drafts
+  replace_existing_artifacts: false # Append, don't replace
+  mode: append # Explicitly set to append mode
+
+checksum:
+  name_template: "snrd_checksums.txt"
+
+npms:
+  - name: "@sonr.io/snrd"
+    ids:
+      - snrd
+    description: "Sonr blockchain daemon - decentralized identity and data storage network"
+    homepage: "https://sonr.io"
+    license: "GPL-3.0"
+    author: "Sonr <support@sonr.io>"
+    repository: "https://github.com/sonr-io/sonr"
+    bugs: "https://github.com/sonr-io/sonr/issues"
+    keywords:
+      - blockchain
+      - cosmos
+      - did
+      - identity
+      - web3
+      - sonr
+    access: public
+    format: tar.gz
+
+snapshot:
+  version_template: "{{ .Branch }}-{{ .ShortCommit }}-dev"
+
+# Changelog configuration
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+      - "^chore:"

.rgignore

@@ -0,0 +1,14 @@
+.dockerignore
+.goreleaser.yml
+api
+proto
+test
+**/_test.go
+.golangci.yml
+tsconfig.json
+pnpm-workspace.yaml
+biome.json
+CLAUDE.md
+CONSTITUTION.md
+CHANGELOG.md
+Caddyfile

CONSTITUTION.md

@@ -0,0 +1,197 @@
+# Sonr Blockchain Constitution
+
+## Preamble
+
+We, the members of the Sonr Network Community, establish this Constitution to govern the decentralized ecosystem built upon the principles of self-sovereign identity, user-controlled authentication, and distributed consensus. This Constitution defines the governance framework for the Sonr blockchain, operated under the stewardship of the Decentralized Identity DAO LC (diDAO), a Wyoming Decentralized Unincorporated Nonprofit Association (DUNA), dedicated to advancing decentralized identity infrastructure for the benefit of all participants.
+
+The Sonr Network operates through a dual-token system, with SNR serving as the governance token and uSNR as the base denomination, enabling democratic participation while maintaining operational efficiency through authentication-based revenue generation and cryptographic security anchored in users’ personal Motr vaults.
+
+This Constitution serves as the immutable foundation of our governance, establishing the rights, responsibilities, and procedures that will guide Sonr through technological evolution, regulatory changes, and societal transformation while maintaining our core mission of human-centric identity protection for the next 100 years and beyond.
+
+## Article I: Mission, Values, and Foundational Principles
+
+### Section 1: Constitutional Mission
+
+The Sonr Network commits to building a Digital Identity System capable of protecting humanity for the next 100 years and beyond. This network serves as a perpetual guardian of human digital identity, balancing technological innovation with fundamental rights protection through democratic governance, technical excellence, and unwavering commitment to privacy.
+
+### Section 2: Core Values and Inviolable Principles
+
+The Sonr Network operates on these inviolable principles that form the bedrock of all network operations.
+
+Human Sovereignty establishes that every individual possesses inherent rights to control their digital identity and personal data. The network recognizes that identity ownership represents a fundamental human right that cannot be compromised, transferred to third parties, or subjected to external control mechanisms.
+
+Privacy by Design requires that privacy protection must be embedded at the protocol level, not added as an afterthought. All network operations implement privacy-preserving technologies by default, ensuring user data remains confidential and secure throughout all interactions and transactions.
+
+Decentralization mandates that no single entity shall control identity verification, data access, or governance processes. The network maintains distributed control across validators, token holders, and the broader community to prevent centralized points of failure or manipulation.
+
+Interoperability ensures that identity solutions must work seamlessly across all chains and systems. Users maintain consistent identity across different platforms and applications while preserving privacy and security, enabling universal digital identity portability.
+
+Perpetual Accessibility requires that the network must remain accessible to all humanity regardless of technological sophistication, economic status, geographic location, or any other discriminating factors. Universal usability and inclusion remain paramount design considerations.
+
+Quantum Resilience mandates that all cryptographic systems must evolve proactively to maintain security against emerging threats, including quantum computing advances and other technological developments that could compromise traditional security models.
+
+### Section 3: Rights and Obligations
+
+All users of the Sonr Network possess these inalienable rights. Identity Sovereignty encompasses complete ownership and control over one’s digital identity and associated data, with no external entity possessing override authority over individual identity decisions. Selective Disclosure provides the ability to share only necessary information for specific purposes, maintaining privacy while enabling required verifications and interactions. Data Portability ensures freedom to export identity data and migrate between systems without restriction or penalty, preventing vendor lock-in and maintaining user autonomy. Consent Granularity delivers fine-grained control over data usage permissions, allowing users to specify exactly how, when, and where their information may be utilized. Erasure Rights enable users to request deletion of personal data in compliance with privacy regulations while maintaining network integrity and security. Access Equality guarantees equal access to network services regardless of stake size, geographic location, or socioeconomic status, ensuring universal participation opportunities.
+
+All network participants accept these fundamental obligations. Privacy Protection requires commitment to protecting user privacy and data sovereignty through both technical implementation and operational practices. Network Security encompasses responsibility to maintain network integrity, report vulnerabilities through appropriate channels, and contribute to overall system resilience. Governance Participation mandates active participation in governance processes when holding staked tokens, ensuring democratic legitimacy through stakeholder engagement. Regulatory Compliance involves adherence to applicable laws while preserving user privacy and maintaining the network’s decentralized character. Transparency requires open communication about network operations, decision-making processes, and any conflicts of interest that might affect network governance.
+
+### Section 4: Identity-Specific Governance Framework
+
+The network implements multi-level verification tiers ranging from self-attested to cryptographically verified credentials. Privacy-preserving verification utilizes zero-knowledge proofs to enable authentication without revealing underlying personal data. Decentralized reputation systems provide community-driven trust mechanisms while maintaining user anonymity. Biometric data protection standards ensure the highest level of security for biological identifiers. Recovery mechanisms for compromised identities include social recovery protocols and hardware security module integration.
+
+Governance approval processes determine authorization for trusted credential issuers within the network ecosystem. Standardized schemas for common credentials enable interoperability while maintaining flexibility for emerging use cases. Privacy-preserving credential revocation mechanisms allow for credential invalidation without compromising user privacy. Cross-chain recognition agreements establish mutual credential recognition with other blockchain networks and traditional identity systems.
+
+All network operations collect only essential data required for stated purposes, implementing selective disclosure by default across all interactions. Zero-knowledge proofs enable verification without data revelation whenever technically feasible. Sensitive data receives encryption protection both at rest and in transit using industry-leading cryptographic standards. Users maintain granular consent management systems enabling fine-tuned control over data access and usage permissions. Real-time data access logs provide complete transparency regarding who accessed what information and when. Immediate revocation capabilities allow users to withdraw consent and access permissions instantly. Complete data portability ensures users can export their identity data and migrate between systems without restrictions.
+
+### Section 5: Long-Term Sustainability and Evolution
+
+The network commits to hundred-year sustainability through establishment of endowment funds sourced from the community treasury. Technology-agnostic governance frameworks ensure adaptability as underlying technologies evolve over decades. Succession planning addresses all critical roles to prevent single points of failure across extended timeframes. Regular ten-year strategic reviews assess network direction and adjust long-term planning accordingly.
+
+Annual governance effectiveness reviews evaluate and improve decision-making processes based on outcomes and community feedback. Adaptive parameter adjustment mechanisms enable network optimization based on growth patterns and usage metrics. Continuous integration of privacy-enhancing technologies ensures the network remains at the forefront of privacy protection. Proactive regulatory compliance updates anticipate and address changing legal landscapes across multiple jurisdictions.
+
+Emergency response protocols address potential network disruptions, security breaches, and governance attacks. Crisis management procedures enable rapid response while maintaining democratic oversight and accountability. Validator coordination mechanisms ensure network continuity during technical emergencies or coordinated attacks. Recovery procedures establish clear processes for restoring normal operations following any network disruption.
+
+### Section 6: Technical Standards and Compliance
+
+Full compliance with W3C Decentralized Identifier specifications includes proper DID Method implementation and registration with appropriate standards bodies. Verifiable Credentials standards adherence ensures interoperability with existing and emerging digital credential ecosystems. Resolution and dereferencing compatibility enables seamless integration with external systems and applications. Cross-platform interoperability requirements ensure broad accessibility across different technological platforms.
+
+Implementation of NIST post-quantum standards including FIPS 203, 204, and 205 algorithms ensures long-term security against quantum computing threats. Cryptographic agility enables smooth transitions between cryptographic algorithms as new standards emerge. Emergency upgrade procedures address immediate cryptographic threats through rapid deployment mechanisms. Regular security audits verify quantum resistance and overall cryptographic security posture.
+
+GDPR data protection requirements integration ensures European privacy standard compliance while maintaining decentralized architecture. CCPA privacy rights implementation provides California residents with required privacy protections and controls. Cross-jurisdictional privacy standards ensure broad regulatory compliance across multiple legal frameworks. User consent and data sovereignty mechanisms provide granular control while meeting regulatory requirements.
+
+### Section 7: Constitutional Supremacy and Immutable Provisions
+
+This Constitution represents the supreme governance document of the Sonr Network. Any governance proposal, validator action, network upgrade, or diDAO decision that contradicts these constitutional provisions shall be considered null and void.
+
+The following provisions cannot be amended through any governance mechanism: the core mission of protecting human digital identity sovereignty for the next century and beyond, privacy-by-design requirements embedded in all network operations and future developments, user data ownership rights and control mechanisms ensuring individual autonomy, decentralization principles preventing any form of centralized control or authority, and the commitment to serve all of humanity’s identity needs regardless of technological evolution.
+
+## Article II: Token Economics
+
+### Section 1: Token Structure
+
+The governance token SNR serves as the primary token for network governance, staking, and ecosystem participation. The base denomination uSNR represents the smallest unit of account, where 1 SNR equals 1,000,000 uSNR. The network maintains a fixed maximum supply of 1,000,000,000 SNR tokens to ensure economic predictability and scarcity preservation.
+
+### Section 2: Token Distribution
+
+The genesis distribution of SNR tokens shall be allocated across four primary categories to ensure balanced ecosystem development and sustainable growth.
+
+Community and Ecosystem allocation of 45% supports broad network adoption and long-term sustainability. Public Distribution receives 15% to ensure democratic access and widespread token ownership. Community Treasury obtains 15% for governance-directed initiatives and ecosystem development. Ecosystem Development Fund captures 10% for strategic partnerships, integrations, and technology advancement. Validator Rewards Pool secures 5% for initial network security incentives.
+
+Network Development allocation of 25% ensures continued technical advancement and operational excellence. Core Protocol Development receives 10% for fundamental blockchain infrastructure and identity protocol enhancement. Infrastructure and Operations obtains 8% for network maintenance, security monitoring, and operational support. Security and Audits captures 4% for comprehensive security assessments, penetration testing, and vulnerability remediation. Research and Innovation secures 3% for experimental technologies and future-oriented development initiatives.
+
+The diDAO Foundation allocation of 15% provides institutional stability and strategic guidance. Foundation Reserve receives 10% for long-term operational sustainability and emergency response capabilities. Strategic Partnerships obtains 5% for critical alliance formation and ecosystem expansion initiatives.
+
+Contributors and Team allocation of 15% recognizes the human capital essential for network success. Core Team receives 10% acknowledging the foundational work and ongoing commitment of primary developers and leaders. Advisors obtain 3% compensating strategic guidance and domain expertise. Early Contributors secure 2% recognizing initial community builders and supporters.
+
+### Section 3: Vesting and Unlock Schedules
+
+Community allocations provide immediate availability for public distribution while treasury and ecosystem funds remain subject to governance proposals ensuring democratic control over resource allocation. Network Development follows a six-month cliff period followed by linear vesting over 36 months to align long-term incentives with network development goals. The diDAO Foundation implements a twelve-month cliff followed by linear vesting over 48 months ensuring institutional stability while preventing premature token concentration. Contributors and Team follow a twelve-month cliff with linear vesting over 48 months aligning personal incentives with long-term network success.
+
+### Section 4: Revenue Mechanisms
+
+The network generates sustainable revenue through authentication service fees paid in uSNR, creating direct utility for the native token. Motr vault operation fees provide enhanced security features while maintaining basic functionality accessibility. Verification and attestation services offer tiered pricing based on verification complexity and security requirements. Cross-chain identity bridge operations generate fees for interoperability services across different blockchain ecosystems. Smart contract execution fees for identity operations ensure computational resources remain fairly compensated.
+
+## Article III: Governance Structure
+
+### Section 1: The diDAO Foundation
+
+The Decentralized Identity DAO LC, organized as a Wyoming DUNA, serves as the steward of the Sonr Network. The foundation assumes responsibility for protocol governance coordination ensuring democratic processes remain effective and inclusive. Treasury management oversight provides fiscal responsibility while maintaining transparency and accountability. Ecosystem development initiatives support strategic growth and partnership formation. Legal representation and compliance ensure regulatory adherence while protecting network decentralization. Strategic partnership facilitation connects the network with compatible organizations and technologies.
+
+### Section 2: Governance Bodies
+
+SNR Token Holders possess ultimate decision-making authority within the governance framework. Proposal voting rights operate proportionally to staked SNR holdings ensuring democratic representation while incentivizing network participation. A minimum requirement of 100 SNR enables proposal submission, maintaining accessibility while preventing spam and frivolous governance actions.
+
+The Validator Assembly handles technical governance and protocol upgrades ensuring network security and performance optimization. Network security and performance monitoring provides continuous oversight of critical infrastructure. A minimum self-bonded stake requirement of 50,000 SNR ensures validator commitment and alignment with network success.
+
+The Identity Council comprises seven elected members serving twelve-month terms providing specialized governance oversight. The council oversees identity standards and authentication protocols ensuring technical excellence and user protection. Council members review and recommend governance proposals offering expert analysis and community guidance.
+
+### Section 3: Voting Mechanisms
+
+Standard Proposals require simple majority approval exceeding 50% with a 20% quorum ensuring broad community participation in routine governance decisions. Protocol Upgrades demand supermajority approval exceeding 66.7% with a 33% quorum reflecting the critical nature of technical changes. Constitutional Amendments require supermajority approval exceeding 75% with a 40% quorum protecting fundamental network principles from hasty modification. Emergency Actions enable Identity Council approval through 5 of 7 members for time-sensitive security matters requiring rapid response capabilities.
+
+### Section 4: Proposal Process
+
+Submission requires a 100 SNR deposit returned upon proposal reaching quorum, ensuring serious proposals while maintaining accessibility. A seven-day discussion period enables community review and debate fostering informed decision-making. A seven-day voting period provides token holder participation opportunities while maintaining governance efficiency. Implementation includes a 48-hour timelock for non-emergency proposals ensuring final review and preventing malicious governance attacks.
+
+## Article IV: Network Operations
+
+### Section 1: Validation and Consensus
+
+Validator requirements include a minimum self-bonded stake of 50,000 SNR ensuring significant skin in the game for network security participants. Maximum total delegation caps at 10% of total staked SNR preventing excessive centralization and maintaining distributed control. Technical specifications remain determined by the Validator Assembly ensuring expertise guides infrastructure requirements.
+
+The consensus mechanism implements Proof-of-Stake consensus with Byzantine Fault Tolerance ensuring network security and finality. Block time targets and finality parameters operate under protocol control enabling optimization based on network performance and user experience requirements.
+
+### Section 2: Staking and Rewards
+
+Staking parameters establish a minimum delegation of 10 SNR ensuring broad accessibility while maintaining meaningful participation thresholds. The unbonding period extends 21 days providing security against rapid stake manipulation while enabling legitimate validator changes. Automatic compounding remains available for delegators seeking to maximize staking returns through compound interest effects.
+
+Reward distribution includes block rewards sourced from the Validator Rewards Pool ensuring sustainable validator compensation. Transaction fees distribute proportionally to validators and delegators aligning incentives with network usage and security provision. Authentication service revenue sharing with active validators creates additional income streams beyond traditional staking rewards.
+
+### Section 3: Motr Vault Integration
+
+The Motr serves as users’ personal cryptographic key vault providing fundamental identity infrastructure. Secure key generation and storage ensures cryptographic security while maintaining user control and accessibility. Authentication credential management enables seamless interaction with applications and services across the ecosystem. Cross-application identity portability allows users to maintain consistent identity across different platforms and use cases. Recovery mechanisms through social recovery or hardware security modules provide security without sacrificing usability. Integration with the network’s UCAN authorization system enables granular permission management and secure authentication flows.
+
+## Article V: Treasury and Funding
+
+### Section 1: Community Treasury
+
+The Community Treasury receives initial funding of 15% of total supply supporting ecosystem development and community initiatives. Ecosystem development grants provide funding for projects advancing network adoption and technological innovation. Security audits and bug bounties ensure network security through professional assessment and community-driven vulnerability discovery. Community initiatives and events foster engagement and education within the ecosystem. Emergency response funding enables rapid action during critical situations requiring immediate resource deployment. Strategic acquisitions or partnerships support network growth through consolidation or alliance formation.
+
+### Section 2: Treasury Management
+
+Disbursement limits ensure appropriate oversight commensurate with funding amounts. Expenditures below 10,000 SNR require Identity Council approval enabling efficient small-scale funding decisions. Expenditures between 10,000 and 100,000 SNR require standard proposal approval ensuring democratic oversight of moderate expenditures. Expenditures exceeding 100,000 SNR demand supermajority proposal approval protecting community assets from inappropriate large-scale spending.
+
+Transparency requirements include quarterly treasury reports providing regular community updates on fund utilization and remaining resources. Real-time on-chain tracking enables continuous monitoring of treasury activities and expenditures. Annual third-party audits ensure fiscal responsibility and identify potential improvements in treasury management practices.
+
+### Section 3: Fee Structure
+
+Network fees collected in uSNR create sustainable revenue streams for network operations and development. Base Transaction Fees adjust dynamically based on network congestion ensuring fair pricing while maintaining network accessibility. Authentication Service Fees operate under service provider control with minimum network fees applied ensuring baseline revenue generation. Storage Fees calculate based on data size and retention period reflecting actual resource consumption and infrastructure costs. Identity Verification Fees implement tiered pricing based on verification level ensuring appropriate compensation for different security and verification requirements.
+
+## Article VI: Security and Compliance
+
+### Section 1: Security Measures
+
+Slashing conditions protect network integrity through economic penalties for malicious or negligent behavior. Double signing results in a 5% stake slash ensuring validators maintain proper key security and operational procedures. Prolonged downtime triggers a 0.1% stake slash incentivizing reliable validator performance and network availability. Governance attacks may result in stake slashing up to 100% protecting democratic processes from manipulation or coordinated attacks.
+
+Emergency response capabilities enable rapid action during critical situations. Identity Council emergency powers address critical vulnerabilities requiring immediate intervention beyond normal governance timelines. Validator Assembly coordination manages network halts and recovery procedures ensuring orderly response to technical emergencies. Emergency action periods limit to maximum 72 hours preventing abuse while enabling necessary rapid response capabilities.
+
+### Section 2: Compliance Framework
+
+The diDAO ensures regulatory compliance through structured legal and operational frameworks. KYC and AML procedures apply to high-value transactions where required by applicable law ensuring legal compliance while preserving network accessibility. Sanctions screening for validator operations ensures compliance with international law while maintaining decentralized operation principles. Tax reporting assistance supports network participants in meeting legal obligations while preserving privacy where legally permissible. Regulatory liaison and legal representation provide professional advocacy and compliance guidance across multiple jurisdictions.
+
+## Article VII: Amendments and Governance Evolution
+
+### Section 1: Amendment Process
+
+Constitutional amendments require formal proposal submission with detailed rationale ensuring thoughtful consideration of fundamental changes. A thirty-day discussion period enables comprehensive community review and debate fostering informed democratic decision-making. Approval requires 75% support with 40% quorum protecting constitutional stability while enabling necessary evolution. A seven-day implementation timelock provides final review opportunity and prevents malicious constitutional manipulation.
+
+### Section 2: Transition Provisions
+
+The initial parameter adjustment period spanning the first 180 days allows parameter changes via supermajority vote enabling network optimization during early operation. Foundation transition processes transfer diDAO operational control to full DAO governance after 24 months ensuring decentralization progression while maintaining initial stability. Vesting acceleration through governance vote may occur during extraordinary circumstances providing flexibility while protecting long-term incentive alignment.
+
+### Section 3: Dispute Resolution
+
+Technical disputes receive resolution through Validator Assembly expertise ensuring appropriate technical knowledge guides infrastructure decisions. Governance disputes undergo arbitration by Identity Council providing specialized oversight of democratic processes and constitutional interpretation. Constitutional disputes require referral to external arbitration under Wyoming DUNA framework ensuring neutral resolution of fundamental disagreements. User disputes utilize community-selected arbitrators providing peer-based resolution mechanisms for interpersonal conflicts.
+
+## Article VIII: Implementation and Final Provisions
+
+### Section 1: Effective Date and Ratification
+
+This Constitution becomes effective upon mainnet genesis block production and ratification by the initial validator set ensuring democratic legitimacy from network inception.
+
+### Section 2: Legal Framework
+
+If any provision of this Constitution becomes invalid or unenforceable, the remaining provisions shall continue in full force and effect ensuring constitutional stability despite potential legal challenges. The Identity Council provides non-binding interpretative guidance for constitutional questions while maintaining democratic oversight of interpretation. Ambiguities receive resolution favoring decentralization and user sovereignty ensuring alignment with fundamental network principles. Technical specifications undergo interpretation by Validator Assembly ensuring appropriate expertise guides infrastructure decisions.
+
+### Section 3: Legacy and Evolution
+
+This Constitution establishes Sonr as a perpetual guardian of human digital identity, balancing technological innovation with fundamental rights protection. Through democratic governance, technical excellence, and unwavering commitment to privacy, the Sonr Network shall serve humanity’s identity needs for the next century and beyond. The provisions herein create a resilient framework capable of evolving with technology while maintaining core principles that respect human dignity, ensure data sovereignty, and enable secure digital interactions for all.
+
+By ratifying this Constitution, the Sonr community commits to building and maintaining a digital identity system that respects human dignity, ensures data sovereignty, and enables secure digital interactions for all participants while maintaining democratic governance and technological excellence throughout the network’s centennial mission.
+
+---
+
+- _Ratified by the Sonr Network Community_
+- _Stewarded by the Decentralized Identity DAO LC (diDAO)_
+- _**Empowering Self-Sovereign Identity Through Distributed Consensus**_

Dockerfile

@@ -1,89 +1,92 @@
-FROM jetpackio/devbox:latest AS sonrvm
-
-# Installing your devbox project
-WORKDIR /code
-USER root:root
-
-RUN mkdir -p /code && chown ${DEVBOX_USER}:${DEVBOX_USER} /code
-
-USER ${DEVBOX_USER}:${DEVBOX_USER}
-
-COPY --chown=${DEVBOX_USER}:${DEVBOX_USER} devbox.json devbox.json
-COPY --chown=${DEVBOX_USER}:${DEVBOX_USER} process-compose.yaml process-compose.yaml
-
-RUN devbox run -- echo "Installed Packages."
-
-ENTRYPOINT ["devbox", "run"]
-
-# --------------------------------------------------------
-FROM jetpackio/devbox:latest AS sonr-runner
-
-WORKDIR /code
-USER root:root
-
-RUN mkdir -p /code && chown ${DEVBOX_USER}:${DEVBOX_USER} /code
-
-USER ${DEVBOX_USER}:${DEVBOX_USER}
-
-COPY --chown=${DEVBOX_USER}:${DEVBOX_USER} devbox.json devbox.json
-COPY --chown=${DEVBOX_USER}:${DEVBOX_USER} process-compose.yaml process-compose.yaml
-COPY --chown=${DEVBOX_USER}:${DEVBOX_USER} . .
-
-RUN devbox run -- echo "Installed Packages."
-
-RUN git config --global --add safe.directory /code
-ENTRYPOINT ["devbox", "run", "testnet"]
-
-# --------------------------------------------------------
-FROM golang:1.22-alpine AS go-builder
+# Use build argument for base image to allow using pre-cached base
+ARG BASE_IMAGE=golang:1.25-alpine3.22
 
+FROM ${BASE_IMAGE} AS builder
 SHELL ["/bin/sh", "-ecuxo", "pipefail"]
 
-RUN apk add --no-cache ca-certificates build-base git
+# Install build dependencies
+RUN apk add --no-cache \
+    ca-certificates \
+    build-base \
+    git \
+    linux-headers \
+    bash \
+    binutils-gold \
+    wget
 
 WORKDIR /code
 
-COPY go.mod go.sum ./
-RUN set -eux; \
-  export ARCH=$(uname -m); \
-  WASM_VERSION=$(go list -m all | grep github.com/CosmWasm/wasmvm || true); \
-  if [ ! -z "${WASM_VERSION}" ]; then \
-  WASMVM_REPO=$(echo $WASM_VERSION | awk '{print $1}');\
-  WASMVM_VERS=$(echo $WASM_VERSION | awk '{print $2}');\
-  wget -O /lib/libwasmvm_muslc.a https://${WASMVM_REPO}/releases/download/${WASMVM_VERS}/libwasmvm_muslc.$(uname -m).a;\
-  fi; \
-  go mod download;
+# Copy entire source code
+COPY . .
 
-# Copy over code
-COPY . /code
+# Fix git ownership issue
+RUN git config --global --add safe.directory /code
 
-# force it to use static lib (from above) not standard libgo_cosmwasm.so file
-# then log output of file /code/bin/sonrd
-# then ensure static linking
-RUN LEDGER_ENABLED=false BUILD_TAGS=muslc LINK_STATICALLY=true make build \
-  && file /code/build/sonrd \
-  && echo "Ensuring binary is statically linked ..." \
-  && (file /code/build/sonrd | grep "statically linked")
+# Download WasmVM library
+RUN --mount=type=cache,target=/tmp/wasmvm \
+    set -eux; \
+    export ARCH=$(uname -m); \
+    WASM_VERSION=$(GOTOOLCHAIN=auto go list -m all | grep github.com/CosmWasm/wasmvm | head -1 || echo ""); \
+    if [ ! -z "${WASM_VERSION}" ]; then \
+        WASMVM_REPO=$(echo $WASM_VERSION | awk '{print $1}'); \
+        WASMVM_VERS=$(echo $WASM_VERSION | awk '{print $2}'); \
+        WASMVM_FILE="libwasmvm_muslc.${ARCH}.a"; \
+        if [ ! -f "/tmp/wasmvm/${WASMVM_FILE}" ]; then \
+            wget -O "/tmp/wasmvm/${WASMVM_FILE}" "https://${WASMVM_REPO}/releases/download/${WASMVM_VERS}/${WASMVM_FILE}"; \
+        fi; \
+        cp "/tmp/wasmvm/${WASMVM_FILE}" /lib/libwasmvm_muslc.a; \
+    fi
+
+# Download Go modules
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    GOTOOLCHAIN=auto go mod download
+
+# Build binary with optimizations
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    set -eux; \
+    VERSION=$(git describe --tags --always 2>/dev/null || echo "dev"); \
+    COMMIT=$(git log -1 --format='%H' 2>/dev/null || echo "unknown"); \
+    LEDGER_ENABLED=false BUILD_TAGS=muslc LINK_STATICALLY=true \
+    CGO_ENABLED=1 GOOS=linux \
+    GOTOOLCHAIN=auto go build \
+        -mod=readonly \
+        -tags "netgo,ledger,muslc" \
+        -ldflags "-X github.com/cosmos/cosmos-sdk/version.Name=sonr \
+                  -X github.com/cosmos/cosmos-sdk/version.AppName=snrd \
+                  -X github.com/cosmos/cosmos-sdk/version.Version=${VERSION} \
+                  -X github.com/cosmos/cosmos-sdk/version.Commit=${COMMIT} \
+                  -X github.com/cosmos/cosmos-sdk/version.BuildTags=netgo,ledger,muslc \
+                  -w -s -linkmode=external -extldflags '-Wl,-z,muldefs -static'" \
+        -buildvcs=false \
+        -trimpath \
+        -o /code/build/snrd \
+        ./cmd/snrd; \
+    file /code/build/snrd; \
+    echo "Ensuring binary is statically linked ..."; \
+    (file /code/build/snrd | grep "statically linked")
 
 # --------------------------------------------------------
-FROM debian:11-slim
+# Final minimal runtime image (default target for snrd)
+FROM alpine:3.17
 
-COPY --from=go-builder /code/build/sonrd /usr/bin/sonrd
+LABEL org.opencontainers.image.title="Sonr Daemon"
+LABEL org.opencontainers.image.source="https://github.com/sonr-io/sonr"
 
-# Install dependencies for Debian 11
-RUN apt-get update && apt-get install -y \
-  curl \
-  make \
-  bash \
-  jq \
-  sed \
-  && rm -rf /var/lib/apt/lists/*
+# Copy binary from build stage
+COPY --from=builder /code/build/snrd /usr/bin
+COPY --from=builder /lib/libwasmvm_muslc.a /lib/libwasmvm_muslc.a
 
-COPY scripts/test_node.sh /usr/bin/test_node.sh 
+# Copy runtime scripts and make them executable
+COPY --from=builder /code/scripts/test_node.sh /usr/bin/devnet
+COPY --from=builder /code/scripts/testnet-setup.sh /usr/bin/testnet
+COPY --from=builder /code/scripts/lib/ /usr/local/lib/sonr-scripts/
+
+# Set up dependencies
+ENV PACKAGES="curl make bash jq sed"
+
+# Install minimum necessary dependencies
+RUN apk add --no-cache $PACKAGES
 
 WORKDIR /opt
-
-# rest server, tendermint p2p, tendermint rpc
-EXPOSE 1317 26656 26657 6060
-
-ENTRYPOINT ["/usr/bin/sonrd"]

LICENSE

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

Makefile

@@ -1,19 +1,34 @@
 #!/usr/bin/make -f
 
+# Default target - show help when no target specified
+.DEFAULT_GOAL := help
+
+PACKAGE_NAME          := github.com/sonr-io/sonr
+GORELEASER_VERSION    ?= latest
 PACKAGES_SIMTEST=$(shell go list ./... | grep '/simulation')
 VERSION := $(shell echo $(shell git describe --tags) | sed 's/^v//')
 COMMIT := $(shell git log -1 --format='%H')
+GOLANGCI_VERSION := v1.62.2
 LEDGER_ENABLED ?= true
 SDK_PACK := $(shell go list -m github.com/cosmos/cosmos-sdk | sed  's/ /\@/g')
 BINDIR ?= $(GOPATH)/bin
 SIMAPP = ./app
+GIT_ROOT := $(shell git rev-parse --show-toplevel)
 
-# for dockerized protobuf tools
-DOCKER := $(shell which docker)
-HTTPS_GIT := github.com/onsonr/sonr.git
+# Git configuration
+HTTPS_GIT := github.com/sonr-io/sonr.git
 
 export GO111MODULE = on
 
+# don't override user values
+ifeq (,$(VERSION))
+  VERSION := $(shell git describe --tags --always)
+  # if VERSION is empty, then populate it with branch's name and raw commit hash
+  ifeq (,$(VERSION))
+    VERSION := $(BRANCH)-$(COMMIT)
+  endif
+endif
+
 # process build tags
 
 build_tags = netgo
@@ -52,11 +67,16 @@ comma := ,
 build_tags_comma_sep := $(subst $(empty),$(comma),$(build_tags))
 
 # process linker flags
+
+# flags '-s -w' resolves an issue with xcode 16 and signing of go binaries
+# ref: https://github.com/golang/go/issues/63997
 ldflags = -X github.com/cosmos/cosmos-sdk/version.Name=sonr \
-		  -X github.com/cosmos/cosmos-sdk/version.AppName=sonrd \
+		  -X github.com/cosmos/cosmos-sdk/version.AppName=snrd \
 		  -X github.com/cosmos/cosmos-sdk/version.Version=$(VERSION) \
 		  -X github.com/cosmos/cosmos-sdk/version.Commit=$(COMMIT) \
-		  -X "github.com/cosmos/cosmos-sdk/version.BuildTags=$(build_tags_comma_sep)"
+		  -X "github.com/cosmos/cosmos-sdk/version.BuildTags=$(build_tags_comma_sep)" \
+		  -checklinkname=0 \
+		  -s -w
 
 ifeq ($(WITH_CLEVELDB),yes)
   ldflags += -X github.com/cosmos/cosmos-sdk/types.DBBackend=cleveldb
@@ -69,292 +89,325 @@ ldflags := $(strip $(ldflags))
 
 BUILD_FLAGS := -tags "$(build_tags_comma_sep)" -ldflags '$(ldflags)' -trimpath
 
-# The below include contains the tools and runsim targets.
-include contrib/devtools/Makefile
 
-all: install lint test
+all: help
 
-build: go.sum
-ifeq ($(OS),Windows_NT)
-	$(error wasmd server not supported. Use "make build-windows-client" for client)
-	exit 1
-else
-	go build -mod=readonly $(BUILD_FLAGS) -o build/sonrd ./cmd/sonrd
-endif
+start: docker
+	@gum log --level info "Starting all services..."
+	@devbox services up
 
-build-windows-client: go.sum
-	GOOS=windows GOARCH=amd64 go build -mod=readonly $(BUILD_FLAGS) -o build/sonrd.exe ./cmd/sonrd
-
-build-contract-tests-hooks:
-ifeq ($(OS),Windows_NT)
-	go build -mod=readonly $(BUILD_FLAGS) -o build/contract_tests.exe ./cmd/contract_tests
-else
-	go build -mod=readonly $(BUILD_FLAGS) -o build/contract_tests ./cmd/contract_tests
-endif
-
-install: go.sum
-	go install -mod=readonly $(BUILD_FLAGS) ./cmd/sonrd
+stop:
+	@gum log --level info "Stopping all services..."
+	@devbox services stop
+	@$(MAKE) clean-docker
 
 ########################################
 ### Tools & dependencies
+########################################
+format: go-format
+go-format:
+	@gum log --level info "Formatting Go code with gofumpt and goimports..."
+	@if command -v gofumpt > /dev/null; then \
+		gofumpt -w .; \
+	else \
+		go run -mod=readonly mvdan.cc/gofumpt@latest -w .; \
+	fi
+	@if command -v goimports > /dev/null; then \
+		goimports -w .; \
+	else \
+		go run -mod=readonly golang.org/x/tools/cmd/goimports@latest -w .; \
+	fi
+	@gum log --level info "✅ Code formatted"
+
+lint: go-lint
+
+go-lint:
+	@gum log --level info "Running golangci-lint..."
+	@if command -v golangci-lint > /dev/null; then \
+		golangci-lint run --timeout=10m; \
+	else \
+		docker run --rm -v $$(pwd):/app -w /app \
+			-v ~/.cache/golangci-lint:/root/.cache/golangci-lint \
+			golangci/golangci-lint:$(GOLANGCI_VERSION) \
+			golangci-lint run --timeout=10m; \
+	fi
+
+.PHONY: lint go-lint format
 
 go-mod-cache: go.sum
-	@echo "--> Download go modules to local cache"
+	@gum log --level info "Download go modules to local cache"
 	@go mod download
 
 go.sum: go.mod
-	@echo "--> Ensure dependencies have not been modified"
+	@gum log --level info "Ensure dependencies have not been modified"
+	@go mod tidy
 	@go mod verify
 
 draw-deps:
 	@# requires brew install graphviz or apt-get install graphviz
 	go install github.com/RobotsAndPencils/goviz@latest
-	@goviz -i ./cmd/sonrd -d 2 | dot -Tpng -o dependency-graph.png
+	@goviz -i ./cmd/snrd -d 2 | dot -Tpng -o .github/assets/dependency-graph.png
 
-clean:
-	rm -rf .aider*
-	rm -rf static
-	rm -rf .out
-	rm -rf build
-	rm -rf hway.db
-	rm -rf snapcraft-local.yaml build/
 
-distclean: clean
-	rm -rf vendor/
+tidy:
+	@go mod tidy
+	@make -C client tidy
+
+clean: tidy
+	@gum log --level info "Cleaning build artifacts..."
+	rm -rf snapcraft-local.yaml build/ dist/
+	@$(MAKE) -C cmd/snrd clean
+
+clean-docker:
+	@gum log --level info "Removing all Docker volumes and networks..."
+	@rm -rf .logs
+	@docker compose down -v
+	@docker network prune -f
+	@docker volume prune -f
+
+###############################################################################
+###                              Build Targets                              ###
+###############################################################################
+
+install: go.sum
+	@$(MAKE) -C cmd/snrd install LEDGER_ENABLED=$(LEDGER_ENABLED) WITH_CLEVELDB=$(WITH_CLEVELDB) LINK_STATICALLY=$(LINK_STATICALLY) BUILD_TAGS="$(BUILD_TAGS)"
+
+build: go.sum
+	@$(MAKE) -C cmd/snrd build LEDGER_ENABLED=$(LEDGER_ENABLED) WITH_CLEVELDB=$(WITH_CLEVELDB) LINK_STATICALLY=$(LINK_STATICALLY) BUILD_TAGS="$(BUILD_TAGS)"
+
+build-snrd: build
+
+build-client: go.sum
+	@$(MAKE) -C client build
+	@cd /tmp && go mod init test || true
+	@cd /tmp && go get github.com/sonr-io/sonr/client@main || true
+	@cd /tmp && gum log --level info "Client SDK import successful"
+
+# Build all components in parallel
+build-all: go.sum
+	@gum log --level info "Building all components in parallel..."
+	@$(MAKE) -j2 build build-client
+	@gum log --level info "✅ All components built successfully"
+
+.PHONY: install build build-client build-snrd build-all
 
 ########################################
-### Testing
+### Docker & Services
+########################################
 
+docker:
+	@gum log --level info "Building Docker images..."
+	@docker buildx build -t onsonr/snrd:latest -f Dockerfile .
+
+localnet: ## Start single-node localnet with Docker (cleans HOME_DIR first)
+	@gum log --level info "Cleaning HOME_DIR (~/.sonr)..."
+	@chmod -R u+rwX $(HOME)/.sonr 2>/dev/null || true
+	@rm -rf $(HOME)/.sonr 2>/dev/null || true
+	@$(MAKE) dockernet
+
+dockernet:
+	@gum log --level info "Starting network with Docker in detached mode..."
+	@docker stop sonr-testnode 2>/dev/null || true
+	@docker rm sonr-testnode 2>/dev/null || true
+	@sleep 3
+	@HOME_DIR=$(HOME)/.sonr CHAIN_ID="sonrtest_1-1" BLOCK_TIME="1000ms" CLEAN=true FORCE_DOCKER=true DOCKER_DETACHED=true bash scripts/test_node.sh
+
+.PHONY: docker localnet dockernet
+
+########################################
+### Prepare Scripts - AI & Release Automation
+########################################
+# Smart component release detection and automation
+release:
+	@$(MAKE) -C cmd/snrd release
+
+# Snapshot builds for development
+snapshot:
+	@gum log --level info "📦 Preparing component snapshot..."
+	@$(MAKE) -C cmd/snrd snapshot
+
+.PHONY: release snapshot
+
+########################################
+### Testing - Simplified
+########################################
+
+# Main test targets
 test: test-unit
-test-all: test-race test-cover test-system
+test-all: test-race test-cover
 
 test-unit:
-	@VERSION=$(VERSION) go test -mod=readonly -tags='ledger test_ledger_mock' ./...
+	@VERSION=$(VERSION) go test -mod=readonly -tags='ledger test_ledger_mock test' ./...
 
 test-race:
-	@VERSION=$(VERSION) go test -mod=readonly -race -tags='ledger test_ledger_mock' ./...
+	@VERSION=$(VERSION) go test -mod=readonly -race -tags='ledger test_ledger_mock test' ./...
 
 test-cover:
-	@go test -mod=readonly -timeout 30m -race -coverprofile=coverage.txt -covermode=atomic -tags='ledger test_ledger_mock' ./...
+	@go test -mod=readonly -timeout 30m -race -coverprofile=coverage.txt -covermode=atomic -tags='ledger test_ledger_mock test' ./...
 
-benchmark:
+test-e2e:
+	@gum log --level info "Running basic e2e tests"
+	@cd test/e2e && go test -race -v -run TestBasic ./tests/basic
+
+test-e2e-all:
+	@gum log --level info "Running all e2e tests"
+	@cd test/e2e && go test -race -v ./tests/...
+
+test-build-snrd: build
+	@ls -la build/snrd
+	@chmod +x build/snrd
+	@./build/snrd version
+
+test-tdd:
+	go test -json ./... 2>&1 | tdd-guard-go -project-root ${GIT_ROOT}
+
+test-app:
+	@VERSION=$(VERSION) CGO_LDFLAGS="-lm" go test -C . -mod=readonly -tags='ledger test_ledger_mock test' github.com/sonr-io/sonr/app/... github.com/sonr-io/sonr/x/... github.com/sonr-io/common/... github.com/sonr-io/sonr/internal/...
+
+test-devops:
+	@echo "No devops tests"
+
+test-client:
+	@$(MAKE) -C client test
+
+test-dwn-ci:
+	@go test -mod=readonly -tags='ledger test_ledger_mock test' -run='!IPFS' ./x/dwn/...
+
+test-internal:
+	@VERSION=$(VERSION) go test -mod=readonly -tags='ledger test_ledger_mock test' ./internal/...
+
+# Module testing - Simplified
+# MODULE=did|dwn|svc VARIANT=unit|race|cover|bench
+test-module:
+	@if [ -z "$(MODULE)" ]; then \
+		gum log --level info "Testing all modules..."; \
+		$(MAKE) test-module MODULE=did; \
+		$(MAKE) test-module MODULE=dwn; \
+		$(MAKE) test-module MODULE=svc; \
+	else \
+		if [ "$(VARIANT)" = "cover" ]; then \
+			gum log --level info "Testing x/$(MODULE) with coverage..."; \
+			go test -mod=readonly -timeout 30m -race -coverprofile=x/$(MODULE)/coverage.txt -covermode=atomic -tags='ledger test_ledger_mock test' ./x/$(MODULE)/...; \
+		elif [ "$(VARIANT)" = "race" ]; then \
+			gum log --level info "Testing x/$(MODULE) with race detector..."; \
+			VERSION=$(VERSION) go test -mod=readonly -race -tags='ledger test_ledger_mock test' ./x/$(MODULE)/...; \
+		elif [ "$(VARIANT)" = "bench" ]; then \
+			gum log --level info "Running x/$(MODULE) benchmarks..."; \
+			go test -mod=readonly -bench=. ./x/$(MODULE)/...; \
+		else \
+			gum log --level info "Testing x/$(MODULE) module..."; \
+			VERSION=$(VERSION) go test -mod=readonly -tags='ledger test_ledger_mock test' ./x/$(MODULE)/...; \
+		fi \
+	fi
+test-proto:
+	@$(MAKE) -C proto lint
+	@$(MAKE) -C proto check-breaking
+
+test-benchmark:
 	@go test -mod=readonly -bench=. ./...
 
-test-sim-import-export: runsim
-	@echo "Running application import/export simulation. This may take several minutes..."
-	@$(BINDIR)/runsim -Jobs=4 -SimAppPkg=$(SIMAPP) -ExitOnFail 50 5 TestAppImportExport
-
-test-sim-multi-seed-short: runsim
-	@echo "Running short multi-seed application simulation. This may take awhile!"
-	@$(BINDIR)/runsim -Jobs=4 -SimAppPkg=$(SIMAPP) -ExitOnFail 50 5 TestFullAppSimulation
-
-test-sim-deterministic: runsim
-	@echo "Running application deterministic simulation. This may take awhile!"
-	@$(BINDIR)/runsim -Jobs=4 -SimAppPkg=$(SIMAPP) -ExitOnFail 1 1 TestAppStateDeterminism
-
-test-system: install
-	$(MAKE) -C tests/system/ test
-
-###############################################################################
-###                                Linting                                  ###
-###############################################################################
-
-format-tools:
-	go install mvdan.cc/gofumpt@v0.4.0
-	go install github.com/client9/misspell/cmd/misspell@v0.3.4
-	go install github.com/daixiang0/gci@v0.11.2
-
-lint: format-tools
-	golangci-lint run --tests=false
-	find . -name '*.go' -type f -not -path "./vendor*" -not -path "./tests/system/vendor*" -not -path "*.git*" -not -path "*_test.go" | xargs gofumpt -d
-
-format: format-tools
-	find . -name '*.go' -type f -not -path "./vendor*" -not -path "./tests/system/vendor*" -not -path "*.git*" -not -path "./client/lcd/statik/statik.go" | xargs gofumpt -w
-	find . -name '*.go' -type f -not -path "./vendor*" -not -path "./tests/system/vendor*" -not -path "*.git*" -not -path "./client/lcd/statik/statik.go" | xargs misspell -w
-	find . -name '*.go' -type f -not -path "./vendor*" -not -path "./tests/system/vendor*" -not -path "*.git*" -not -path "./client/lcd/statik/statik.go" | xargs gci write --skip-generated -s standard -s default -s "prefix(cosmossdk.io)" -s "prefix(github.com/cosmos/cosmos-sdk)" -s "prefix(github.com/CosmWasm/wasmd)" --custom-order
-
-mod-tidy:
-	go mod tidy
-	cd interchaintest && go mod tidy
-
-.PHONY: format-tools lint format mod-tidy
-
+.PHONY: test test-all test-unit test-race test-cover test-tdd test-module test-benchmark
 
 ###############################################################################
 ###                                Protobuf                                 ###
 ###############################################################################
-protoVer=0.15.1
-protoImageName=ghcr.io/cosmos/proto-builder:$(protoVer)
-protoImage=$(DOCKER) run --rm -v $(CURDIR):/workspace --workdir /workspace $(protoImageName)
+climd-gen:
+	@gum log --level info "Generating MD Docs from snrd CLI..."
+	@sh ./scripts/cli-docgen.sh
 
 proto-gen:
-	@echo "Generating Protobuf files"
-	@go install cosmossdk.io/orm/cmd/protoc-gen-go-cosmos-orm@latest
-	@$(protoImage) sh ./scripts/protocgen.sh
-	spawn stub-gen
+	@gum log --level info "Generating Go protobuf files..."
+	@$(MAKE) -C proto gen
+	@gum log --level info "Auto-formatting generated protobuf files..."
+	@$(MAKE) format
 
-proto-format:
-	@echo "Formatting Protobuf files"
-	@$(protoImage) find ./ -name "*.proto" -exec clang-format -i {} \;
+openapi-gen:
+	@$(MAKE) -C proto openapi-gen
+	@gum log --level info "✅ OpenAPI generation complete. Output: docs/static/openapi.yml"
 
-proto-lint:
-	@$(protoImage) buf lint --error-format=json
-
-proto-check-breaking:
-	@$(protoImage) buf breaking --against $(HTTPS_GIT)#branch=master
-
-.PHONY: all install install-debug \
-	go-mod-cache draw-deps clean build format \
-	test test-all test-build test-cover test-unit test-race \
-	test-sim-import-export build-windows-client \
-	test-system
-
-## --- Testnet Utilities ---
-get-localic:
-	@echo "Installing local-interchain"
-	git clone --branch v8.7.0 https://github.com/strangelove-ventures/interchaintest.git interchaintest-downloader
-	cd interchaintest-downloader/local-interchain && make install
-	@echo ✅ local-interchain installed $(shell which local-ic)
-
-is-localic-installed:
-ifeq (,$(shell which local-ic))
-	make get-localic
-endif
-
-get-heighliner:
-	git clone https://github.com/strangelove-ventures/heighliner.git
-	cd heighliner && go install
-
-local-image:
-ifeq (,$(shell which heighliner))
-	echo 'heighliner' binary not found. Consider running `make get-heighliner`
-else
-	heighliner build -c sonrd --local -f chains.yaml
-endif
-
-.PHONY: get-heighliner local-image is-localic-installed
-
-###############################################################################
-###                                     e2e                                 ###
-###############################################################################
-
-ictest-basic:
-	@echo "Running basic interchain tests"
-	@cd interchaintest && go test -race -v -run TestBasicChain .
-
-ictest-ibc:
-	@echo "Running IBC interchain tests"
-	@cd interchaintest && go test -race -v -run TestIBC .
-
-ictest-wasm:
-	@echo "Running cosmwasm interchain tests"
-	@cd interchaintest && go test -race -v -run TestCosmWasmIntegration .
-
-ictest-packetforward:
-	@echo "Running packet forward middleware interchain tests"
-	@cd interchaintest && go test -race -v -run TestPacketForwardMiddleware .
-
-ictest-poa:
-	@echo "Running proof of authority interchain tests"
-	@cd interchaintest && go test -race -v -run TestPOA .
-
-ictest-tokenfactory:
-	@echo "Running token factory interchain tests"
-	@cd interchaintest && go test -race -v -run TestTokenFactory .
-
-###############################################################################
-###                                    testnet                              ###
-###############################################################################
-
-setup-ipfs:
-	./scripts/ipfs_config.sh
-
-setup-testnet: mod-tidy is-localic-installed install local-image set-testnet-configs setup-testnet-keys
-
-# Run this before testnet keys are added
-# chainid-1 is used in the testnet.json
-set-testnet-configs:
-	sonrd config set client chain-id sonr-testnet-1
-	sonrd config set client keyring-backend test
-	sonrd config set client output text
-
-# import keys from testnet.json into test keyring
-setup-testnet-keys:
-	-`echo "decorate bright ozone fork gallery riot bus exhaust worth way bone indoor calm squirrel merry zero scheme cotton until shop any excess stage laundry" | sonrd keys add acc0 --recover`
-	-`echo "wealth flavor believe regret funny network recall kiss grape useless pepper cram hint member few certain unveil rather brick bargain curious require crowd raise" | sonrd keys add acc1 --recover`
-
-# default testnet is with IBC
-testnet: setup-testnet
-	spawn local-ic start ibc-testnet
-
-testnet-basic: setup-testnet
-	spawn local-ic start testnet
-
-sh-testnet: mod-tidy
-	CHAIN_ID="sonr-testnet-1" BLOCK_TIME="1000ms" CLEAN=true sh scripts/test_node.sh
-
-.PHONY: setup-testnet set-testnet-configs testnet testnet-basic sh-testnet
-
-###############################################################################
-###                                generation                               ###
-###############################################################################
-.PHONY: pkl-gen tailwind-gen templ-gen
-
-pkl-gen:
-	go install github.com/apple/pkl-go/cmd/pkl-gen-go@latest
-	pkl-gen-go pkl/sonr.motr/ATN.pkl
-	pkl-gen-go pkl/sonr.hway/Env.pkl
-	pkl-gen-go pkl/sonr.motr/DWN.pkl
-	pkl-gen-go pkl/sonr.hway/ORM.pkl
+# Backwards compatibility alias
+swagger-gen: openapi-gen
 
 templ-gen:
-	@go install github.com/a-h/templ/cmd/templ@latest
-	templ generate
+	@docker run --rm -v `pwd`:/code -w=/code --user $(shell id -u):$(shell id -g) ghcr.io/a-h/templ:latest generate
 
+.PHONY: proto-gen proto-openapi-gen openapi-gen swagger-gen proto-lint proto-check-breaking proto-publish
 
 ###############################################################################
-###                             custom builds                               ###
-###############################################################################
-.PHONY: motr-build hway-build hway-serve
-
-motr-build:
-	GOOS=js GOARCH=wasm go build -o static/wasm/app.wasm ./cmd/motr/main.go
-
-hway-build: templ-gen
-	go build -o build/hway ./cmd/hway/main.go
-
-hway-serve: hway-build
-	./build/hway
-
-###############################################################################
-###                                     help                                ###
-###############################################################################
-.PHONY: deploy-buf deploy-pkl
-
-deploy-buf:
-	cd ./proto && bunx buf dep update && bunx buf build && bunx buf push
-
-deploy-pkl: 
-	sh ./.github/scripts/upload_cdn.sh
-
-
-###############################################################################
-###                                     help                                ###
+###                           Network Operations                            ###
 ###############################################################################
 
+# Starship network management
+testnet: testnet-restart
+
+testnet-restart: testnet-stop testnet-start
+	@gum log --level info "✅ Starship network restarted"
+
+testnet-start:
+	@gum log --level info "Starting Starship network..."
+	@if [ -z "$(NETWORK)" ]; then \
+		NETWORK=devnet; \
+	fi; \
+	bash scripts/run.sh $$NETWORK
+
+testnet-stop:
+	@gum log --level info "Stopping Starship network..."
+	@helm delete -n ci sonr-testnet 2>/dev/null || true
+	@kubectl delete namespace ci --ignore-not-found=true 2>/dev/null || true
+	@sleep 2
+
+.PHONY: testnet testnet-restart testnet-start testnet-stop
+
+###############################################################################
+###                                   Help                                  ###
+###############################################################################
 
 help:
-	@echo "Usage: make <target>"
-	@echo ""
-	@echo "Available targets:"
-	@echo "  install             : Install the binary"
-	@echo "  local-image         : Install the docker image"
-	@echo "  proto-gen           : Generate code from proto files"
-	@echo "  testnet             : Local devnet with IBC"
-	@echo "  sh-testnet          : Shell local devnet"
-	@echo "  ictest-basic        : Basic end-to-end test"
-	@echo "  ictest-ibc          : IBC end-to-end test"
-	@echo "  templ               : Generate templ files"
-	@echo "  vault               : Build vault.wasm"
+	@gum log --level info "Sonr Blockchain Makefile"
+	@gum log --level info "========================"
+	@gum log --level info ""
+	@gum log --level info "🛠️  Build & Install:"
+	@gum log --level info "  install             Install snrd binary"
+	@gum log --level info "  build               Build snrd binary"
+	@gum log --level info "  build-all           Build all components in parallel"
+	@gum log --level info "  build-client        Build client SDK"
+	@gum log --level info "  docker              Build Docker images"
+	@gum log --level info ""
+	@gum log --level info "📦 Release & Distribution:"
+	@gum log --level info "  release             Create production release with GoReleaser"
+	@gum log --level info "  snapshot            Create development snapshot builds"
+	@gum log --level info ""
+	@gum log --level info "🚀 Local Development:"
+	@gum log --level info "  localnet            Start single-node testnet"
+	@gum log --level info "  start               Start backend services"
+	@gum log --level info "  stop                Stop backend services"
+	@gum log --level info "  status              Check service health"
+	@gum log --level info "  testnet             Manage Starship network (start/stop/restart)"
+	@gum log --level info ""
+	@gum log --level info "📦 Code Generation:"
+	@gum log --level info "  proto-gen           Generate protobuf code"
+	@gum log --level info "  openapi-gen         Generate OpenAPI documentation"
+	@gum log --level info ""
+	@gum log --level info "🔧 Development Tools:"
+	@gum log --level info "  format              Format code (Go + TypeScript)"
+	@gum log --level info "  lint                Run all linters"
+	@gum log --level info "  clean               Remove build artifacts"
+	@gum log --level info ""
+	@gum log --level info "🧪 Testing:"
+	@gum log --level info "  benchmark           Run benchmarks"
+	@gum log --level info "  test                Run unit tests"
+	@gum log --level info "  test-all            Run all test variants"
+	@gum log --level info "  test-cover          Generate coverage report"
+	@gum log --level info "  test-e2e            Run e2e tests"
+	@gum log --level info "  test-e2e-all        Run all e2e tests"
+	@gum log --level info "  test-module         Test specific module (MODULE=did|dwn|svc)"
+	@gum log --level info ""
+	@gum log --level info "📚 Module Testing Examples:"
+	@gum log --level info "  make test-module MODULE=did           # Test DID module"
+	@gum log --level info "  make test-module MODULE=dwn VARIANT=cover  # DWN with coverage"
+	@gum log --level info "  make test-module MODULE=svc VARIANT=race   # SVC with race detector"
+	@gum log --level info "  make test-module MODULE=did VARIANT=bench  # DID benchmarks"
+	@gum log --level info ""
+	@gum log --level info "For more detailed options, see the Makefile source."
 
-.PHONY: help
+.PHONY: help release release-platform snapshot snapshot-platform

README.md

@@ -1,40 +1,353 @@
-# `sonr` - Sonr Chain
 
-[![Go Reference](https://pkg.go.dev/badge/github.com/onsonr/sonr.svg)](https://pkg.go.dev/github.com/onsonr/sonr)
-![GitHub commit activity](https://img.shields.io/github/commit-activity/w/onsonr/sonr)
-![GitHub Release Date - Published_At](https://img.shields.io/github/release-date/onsonr/sonr)
+[![Go Reference](https://pkg.go.dev/badge/github.com/sonr-io/sonr.svg)](https://pkg.go.dev/github.com/sonr-io/sonr)
+![GitHub commit activity](https://img.shields.io/github/commit-activity/w/sonr-io/sonr)
 [![Static Badge](https://img.shields.io/badge/homepage-sonr.io-blue?style=flat-square)](https://sonr.io)
-[![Go Report Card](https://goreportcard.com/badge/github.com/onsonr/sonr)](https://goreportcard.com/report/github.com/onsonr/sonr)
-[![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=sonrhq_sonr&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=sonr-io_sonr)
+[![Go Report Card](https://goreportcard.com/badge/github.com/sonr-io/sonr)](https://goreportcard.com/report/github.com/sonr-io/sonr)
 
-> Sonr is a combination of decentralized primitives. Fundamentally, it is a peer-to-peer identity and asset management system that leverages DID documents, Webauthn, and IPFS—providing users with a secure, portable decentralized identity.
+[![Sonr](.github/banner.png)](https://sonr.io)
 
-# Documentation
+> **Sonr is a blockchain ecosystem combining decentralized identity, secure data storage, and multi-chain interoperability. Built on Cosmos SDK v0.50.14, it provides users with self-sovereign identity through W3C DIDs, WebAuthn authentication, and personal data vaults—all without requiring cryptocurrency for onboarding.**
 
-1. [Quick Start](https://github.com/onsonr/sonr/wiki/1-%E2%80%90-Quick-Start)
-2. [Chain Modules](https://github.com/onsonr/sonr/wiki/2-%E2%80%90-Chain-Modules)
-3. [System Architecture](https://github.com/onsonr/sonr/wiki/3-%E2%80%90-System-Architecture)
-4. [Token Economy](https://github.com/onsonr/sonr/wiki/4-%E2%80%90-Token-Economy)
-5. [Service Mangement](https://github.com/onsonr/sonr/wiki/5-%E2%80%90-Service-Management)
-6. [Design System](https://github.com/onsonr/sonr/wiki/6-%E2%80%90-Design-System)
-7. [Self Custody](https://github.com/onsonr/sonr/wiki/7-%E2%80%90-Self-Custody)
+## 💡 Key Features
 
-# Stats
+### 🔐 Gasless Onboarding
 
-![Alt](https://repobeats.axiom.co/api/embed/8d0b17e889942889c5b6e632da09bd597efd84c4.svg "Repobeats analytics image")
+Create your first decentralized identity without owning cryptocurrency:
 
-# Acknowledgements
+```bash
+# Register with WebAuthn (no tokens required!)
+snrd auth register --username alice
 
-Sonr would not have been possible without the direct and indirect support of the following individuals:
+# Register with automatic vault creation
+snrd auth register --username bob --auto-vault
+```
 
-- **Juan Benet**: For the IPFS Ecosystem.
-- **Satoshi Nakamoto**: For Bitcoin.
-- **Steve Jobs**: For User first UX.
-- **Tim Berners-Lee**: For the Internet.
+### 🌐 Multi-Chain Support
 
-# Community & Support
+- **Cosmos SDK**: Native integration with IBC ecosystem
+- **EVM Compatibility**: Ethereum smart contract support
+- **External Wallets**: MetaMask, Keplr, and more
 
-- [Forum](https://github.com/onsonr/sonr/discussions)
-- [Issues](https://github.com/onsonr/sonr/issues)
-- [Twitter](https://sonr.io/twitter)
-- [Dev Chat](https://sonr.io/discord)
+### 🔑 Advanced Authentication
+
+- **WebAuthn/Passkeys**: Biometric authentication
+- **Hardware Security Keys**: YubiKey, Titan Key support
+- **Multi-Signature**: Multiple verification methods per DID
+
+### 📦 Decentralized Storage
+
+- **IPFS Integration**: Distributed file storage
+- **Encrypted Vaults**: Hardware-backed encryption
+- **Protocol Schemas**: Structured data validation
+
+## 📚 Technical Specifications
+
+- **Cosmos SDK**: v0.50.14
+- **CometBFT**: v0.38.17
+- **IBC**: v8.7.0
+- **Go**: 1.24.1 (toolchain 1.24.4)
+- **WebAssembly**: CosmWasm v1.5.8
+- **Task Queue**: Asynq (Redis-based)
+- **Actor System**: Proto.Actor
+- **Storage**: IPFS, LevelDB
+
+## 🔒 Security
+
+### Gasless Transaction Security
+
+- Limited to WebAuthn registration only
+- Full cryptographic validation required
+- Credential uniqueness enforcement
+- Anti-replay protection
+
+### WebAuthn Security
+
+- Origin validation
+- Challenge-response authentication
+- Device binding
+- Attestation verification
+
+### Multi-Algorithm Support
+
+- Ed25519 (quantum-resistant)
+- ECDSA (secp256k1, P-256)
+- RSA (2048, 3072, 4096 bits)
+- WebAuthn (ES256, RS256)
+
+## 🚀 Quick Start
+
+### Installation
+
+```bash
+# Clone the repository
+git clone https://github.com/sonr-io/sonr
+cd sonr
+
+# Install the binary
+make install
+
+# Verify installation
+snrd version
+```
+
+### Running a Local Node
+
+```bash
+# Start single-node testnet (quick iteration)
+make localnet
+
+# Start multi-node testnet with Starship
+make testnet-start
+
+# Stop testnet
+make testnet-stop
+```
+
+### Building from Source
+
+```bash
+# Build blockchain node
+make build
+
+# Build Docker image
+make docker
+
+# Generate code from proto files
+make proto-gen
+```
+
+### Local Development Network
+
+```bash
+# Standard localnet (auto-detects best method for your system)
+make localnet     # Works on Arch Linux, Ubuntu, macOS, etc.
+
+# Docker-based localnet (requires Docker)
+make dockernet    # Runs in detached mode
+
+# One-time setup for your system (optional)
+./scripts/setup_localnet.sh  # Installs dependencies and configures environment
+```
+
+### Testing
+
+```bash
+# Run all tests
+make test-all
+
+# Module-specific tests
+make test-did     # DID module tests
+make test-dwn     # DWN module tests
+make test-svc     # Service module tests
+
+# E2E tests
+make ictest-basic # Basic chain functionality
+make ictest-ibc   # IBC transfers
+make ictest-wasm  # CosmWasm integration
+
+# Test with coverage
+make test-cover
+```
+
+### Infrastructure
+
+```bash
+# IPFS for vault operations
+make ipfs-up      # Start IPFS infrastructure
+make ipfs-down    # Stop IPFS infrastructure
+make ipfs-status  # Check IPFS connectivity
+```
+
+## 🏗️ Architecture
+
+Sonr is a Cosmos SDK-based blockchain with integrated IPFS storage and three custom modules:
+
+### Core Components
+
+#### **Blockchain Node (`snrd`)**
+
+The main blockchain daemon built with Cosmos SDK v0.50.14, providing:
+
+- AutoCLI for command generation
+- EVM compatibility via Evmos integration
+- IBC for cross-chain communication
+- CosmWasm smart contract support
+- IPFS integration for decentralized storage
+
+### Cross-Platform Support
+
+The `localnet` target automatically detects and uses the best available method:
+1. Checks for local binary (built with `make install`)
+2. Falls back to Docker if available
+3. Handles permission issues on systems like Arch Linux
+4. Supports systemd service installation (see `etc/systemd/`)
+
+## 📖 Module Documentation
+
+### DID Module
+
+W3C DID specification implementation with:
+
+- **Gasless WebAuthn Registration**: Create DIDs without cryptocurrency
+- **Multi-Algorithm Signatures**: Ed25519, ECDSA, RSA, WebAuthn
+- **External Wallet Linking**: MetaMask, Keplr integration
+- **Verifiable Credentials**: W3C-compliant credential issuance
+
+```bash
+# Create a DID
+snrd tx did create-did did:sonr:alice '{"id":"did:sonr:alice",...}' --from alice
+
+# Link external wallet
+snrd tx did link-external-wallet did:sonr:alice \
+  --wallet-address 0x742d35Cc6635C0532925a3b8c17C6e583F4d6A42 \
+  --wallet-type ethereum \
+  --from alice
+
+# Query DID
+snrd query did resolve did:sonr:alice
+```
+
+[Full DID Module Documentation](x/did/README.md)
+
+### DWN Module
+
+Personal data stores with:
+
+- **Structured Data Records**: Hierarchical data organization
+- **Protocol-Based Interactions**: Enforceable data schemas
+- **Secure Vaults**: Enclave-based key management
+- **Multi-Chain Support**: Cosmos SDK and EVM transaction building
+
+```bash
+# Create a vault
+snrd tx dwn create-vault --from alice
+
+# Store a record
+snrd tx dwn write-record '{"data":"...", "protocol":"example.com"}' --from alice
+
+# Query records
+snrd query dwn records --owner alice
+```
+
+[Full DWN Module Documentation](x/dwn/README.md)
+
+### Service Module
+
+Decentralized service registry featuring:
+
+- **Domain Verification**: DNS-based ownership proof
+- **Service Registration**: Verified service endpoints
+- **Permission Management**: UCAN capability integration
+
+```bash
+# Verify domain ownership
+snrd tx svc initiate-domain-verification example.com --from alice
+snrd tx svc verify-domain example.com --from alice
+
+# Register service
+snrd tx svc register-service my-service example.com \
+  --permissions "read,write" --from alice
+```
+
+[Full Service Module Documentation](x/svc/README.md)
+
+## 🔧 Configuration
+
+### Environment Variables
+
+Environment variables can be configured via Docker Compose:
+
+```bash
+# Chain configuration
+export CHAIN_ID="localchain_9000-1"
+export BLOCK_TIME="1000ms"
+
+# Network selection for Starship
+export NETWORK="devnet"  # or "testnet"
+
+# IPFS configuration
+IPFS_API_URL=http://ipfs:5001
+```
+
+Environment variables can be set directly or via a `.env` file in the project root.
+
+### Starship Configuration
+
+Edit `starship.yml` to configure multi-node testnets:
+
+```yaml
+chains:
+  - id: sonrtest_1-1
+    name: custom
+    numValidators: 3
+    image: onsonr/snrd:latest
+    # ... additional configuration
+```
+
+### Troubleshooting
+
+**IPFS not accessible:**
+```bash
+# Verify IPFS is running
+curl http://127.0.0.1:5001/api/v0/version
+
+# Check IPFS status
+make ipfs-status
+```
+
+**Port conflicts:**
+- IPFS API: 5001
+- IPFS Gateway: 8080
+- Node gRPC: 9090
+- Node REST API: 1317
+
+Stop conflicting services or modify ports in configuration files.
+
+## 🏗️ Project Structure
+
+Sonr is a focused Cosmos SDK blockchain implementation:
+
+```
+sonr/
+├── app/              # Application setup and module wiring
+├── cmd/              # Binary entry points
+│   └── snrd/        # Blockchain node daemon
+├── x/               # Custom Cosmos SDK modules
+│   ├── did/         # W3C DID implementation
+│   ├── dwn/         # Decentralized Web Nodes
+│   └── svc/         # Service management
+├── types/           # Internal Go packages
+├── proto/           # Protobuf definitions
+├── scripts/         # Utility scripts
+├── test/            # Integration tests
+├── docs/            # Documentation
+└── client/          # Client libraries and tooling
+```
+
+### Key Technologies
+
+- **Cosmos SDK v0.50.14**: Blockchain framework
+- **CometBFT v0.38.17**: Byzantine fault-tolerant consensus
+- **IBC v8.7.0**: Inter-blockchain communication
+- **CosmWasm v1.5.8**: Smart contract support
+- **IPFS**: Decentralized storage integration
+
+## 🤝 Community & Support
+
+- [GitHub Discussions](https://github.com/sonr-io/sonr/discussions) - Community forum
+- [GitHub Issues](https://github.com/sonr-io/sonr/issues) - Bug reports and feature requests
+- [Twitter](https://sonr.io/twitter) - Latest updates
+- [Documentation Wiki](https://github.com/sonr-io/sonr/wiki) - Detailed guides
+
+
+## 📄 License
+
+Copyright © 2024 Sonr, Inc.
+
+Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) for details.
+
+---
+
+<p align="center">
+  Built with ❤️ by the Sonr team
+</p>

api/dex/module/v1/module.pulsar.go

@@ -0,0 +1,498 @@
+// Code generated by protoc-gen-go-pulsar. DO NOT EDIT.
+package modulev1
+
+import (
+	_ "cosmossdk.io/api/cosmos/app/v1alpha1"
+	fmt "fmt"
+	runtime "github.com/cosmos/cosmos-proto/runtime"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoiface "google.golang.org/protobuf/runtime/protoiface"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	io "io"
+	reflect "reflect"
+	sync "sync"
+)
+
+var (
+	md_Module protoreflect.MessageDescriptor
+)
+
+func init() {
+	file_dex_module_v1_module_proto_init()
+	md_Module = File_dex_module_v1_module_proto.Messages().ByName("Module")
+}
+
+var _ protoreflect.Message = (*fastReflection_Module)(nil)
+
+type fastReflection_Module Module
+
+func (x *Module) ProtoReflect() protoreflect.Message {
+	return (*fastReflection_Module)(x)
+}
+
+func (x *Module) slowProtoReflect() protoreflect.Message {
+	mi := &file_dex_module_v1_module_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+var _fastReflection_Module_messageType fastReflection_Module_messageType
+var _ protoreflect.MessageType = fastReflection_Module_messageType{}
+
+type fastReflection_Module_messageType struct{}
+
+func (x fastReflection_Module_messageType) Zero() protoreflect.Message {
+	return (*fastReflection_Module)(nil)
+}
+func (x fastReflection_Module_messageType) New() protoreflect.Message {
+	return new(fastReflection_Module)
+}
+func (x fastReflection_Module_messageType) Descriptor() protoreflect.MessageDescriptor {
+	return md_Module
+}
+
+// Descriptor returns message descriptor, which contains only the protobuf
+// type information for the message.
+func (x *fastReflection_Module) Descriptor() protoreflect.MessageDescriptor {
+	return md_Module
+}
+
+// Type returns the message type, which encapsulates both Go and protobuf
+// type information. If the Go type information is not needed,
+// it is recommended that the message descriptor be used instead.
+func (x *fastReflection_Module) Type() protoreflect.MessageType {
+	return _fastReflection_Module_messageType
+}
+
+// New returns a newly allocated and mutable empty message.
+func (x *fastReflection_Module) New() protoreflect.Message {
+	return new(fastReflection_Module)
+}
+
+// Interface unwraps the message reflection interface and
+// returns the underlying ProtoMessage interface.
+func (x *fastReflection_Module) Interface() protoreflect.ProtoMessage {
+	return (*Module)(x)
+}
+
+// Range iterates over every populated field in an undefined order,
+// calling f for each field descriptor and value encountered.
+// Range returns immediately if f returns false.
+// While iterating, mutating operations may only be performed
+// on the current field descriptor.
+func (x *fastReflection_Module) Range(f func(protoreflect.FieldDescriptor, protoreflect.Value) bool) {
+}
+
+// Has reports whether a field is populated.
+//
+// Some fields have the property of nullability where it is possible to
+// distinguish between the default value of a field and whether the field
+// was explicitly populated with the default value. Singular message fields,
+// member fields of a oneof, and proto2 scalar fields are nullable. Such
+// fields are populated only if explicitly set.
+//
+// In other cases (aside from the nullable cases above),
+// a proto3 scalar field is populated if it contains a non-zero value, and
+// a repeated field is populated if it is non-empty.
+func (x *fastReflection_Module) Has(fd protoreflect.FieldDescriptor) bool {
+	switch fd.FullName() {
+	default:
+		if fd.IsExtension() {
+			panic(fmt.Errorf("proto3 declared messages do not support extensions: dex.module.v1.Module"))
+		}
+		panic(fmt.Errorf("message dex.module.v1.Module does not contain field %s", fd.FullName()))
+	}
+}
+
+// Clear clears the field such that a subsequent Has call reports false.
+//
+// Clearing an extension field clears both the extension type and value
+// associated with the given field number.
+//
+// Clear is a mutating operation and unsafe for concurrent use.
+func (x *fastReflection_Module) Clear(fd protoreflect.FieldDescriptor) {
+	switch fd.FullName() {
+	default:
+		if fd.IsExtension() {
+			panic(fmt.Errorf("proto3 declared messages do not support extensions: dex.module.v1.Module"))
+		}
+		panic(fmt.Errorf("message dex.module.v1.Module does not contain field %s", fd.FullName()))
+	}
+}
+
+// Get retrieves the value for a field.
+//
+// For unpopulated scalars, it returns the default value, where
+// the default value of a bytes scalar is guaranteed to be a copy.
+// For unpopulated composite types, it returns an empty, read-only view
+// of the value; to obtain a mutable reference, use Mutable.
+func (x *fastReflection_Module) Get(descriptor protoreflect.FieldDescriptor) protoreflect.Value {
+	switch descriptor.FullName() {
+	default:
+		if descriptor.IsExtension() {
+			panic(fmt.Errorf("proto3 declared messages do not support extensions: dex.module.v1.Module"))
+		}
+		panic(fmt.Errorf("message dex.module.v1.Module does not contain field %s", descriptor.FullName()))
+	}
+}
+
+// Set stores the value for a field.
+//
+// For a field belonging to a oneof, it implicitly clears any other field
+// that may be currently set within the same oneof.
+// For extension fields, it implicitly stores the provided ExtensionType.
+// When setting a composite type, it is unspecified whether the stored value
+// aliases the source's memory in any way. If the composite value is an
+// empty, read-only value, then it panics.
+//
+// Set is a mutating operation and unsafe for concurrent use.
+func (x *fastReflection_Module) Set(fd protoreflect.FieldDescriptor, value protoreflect.Value) {
+	switch fd.FullName() {
+	default:
+		if fd.IsExtension() {
+			panic(fmt.Errorf("proto3 declared messages do not support extensions: dex.module.v1.Module"))
+		}
+		panic(fmt.Errorf("message dex.module.v1.Module does not contain field %s", fd.FullName()))
+	}
+}
+
+// Mutable returns a mutable reference to a composite type.
+//
+// If the field is unpopulated, it may allocate a composite value.
+// For a field belonging to a oneof, it implicitly clears any other field
+// that may be currently set within the same oneof.
+// For extension fields, it implicitly stores the provided ExtensionType
+// if not already stored.
+// It panics if the field does not contain a composite type.
+//
+// Mutable is a mutating operation and unsafe for concurrent use.
+func (x *fastReflection_Module) Mutable(fd protoreflect.FieldDescriptor) protoreflect.Value {
+	switch fd.FullName() {
+	default:
+		if fd.IsExtension() {
+			panic(fmt.Errorf("proto3 declared messages do not support extensions: dex.module.v1.Module"))
+		}
+		panic(fmt.Errorf("message dex.module.v1.Module does not contain field %s", fd.FullName()))
+	}
+}
+
+// NewField returns a new value that is assignable to the field
+// for the given descriptor. For scalars, this returns the default value.
+// For lists, maps, and messages, this returns a new, empty, mutable value.
+func (x *fastReflection_Module) NewField(fd protoreflect.FieldDescriptor) protoreflect.Value {
+	switch fd.FullName() {
+	default:
+		if fd.IsExtension() {
+			panic(fmt.Errorf("proto3 declared messages do not support extensions: dex.module.v1.Module"))
+		}
+		panic(fmt.Errorf("message dex.module.v1.Module does not contain field %s", fd.FullName()))
+	}
+}
+
+// WhichOneof reports which field within the oneof is populated,
+// returning nil if none are populated.
+// It panics if the oneof descriptor does not belong to this message.
+func (x *fastReflection_Module) WhichOneof(d protoreflect.OneofDescriptor) protoreflect.FieldDescriptor {
+	switch d.FullName() {
+	default:
+		panic(fmt.Errorf("%s is not a oneof field in dex.module.v1.Module", d.FullName()))
+	}
+	panic("unreachable")
+}
+
+// GetUnknown retrieves the entire list of unknown fields.
+// The caller may only mutate the contents of the RawFields
+// if the mutated bytes are stored back into the message with SetUnknown.
+func (x *fastReflection_Module) GetUnknown() protoreflect.RawFields {
+	return x.unknownFields
+}
+
+// SetUnknown stores an entire list of unknown fields.
+// The raw fields must be syntactically valid according to the wire format.
+// An implementation may panic if this is not the case.
+// Once stored, the caller must not mutate the content of the RawFields.
+// An empty RawFields may be passed to clear the fields.
+//
+// SetUnknown is a mutating operation and unsafe for concurrent use.
+func (x *fastReflection_Module) SetUnknown(fields protoreflect.RawFields) {
+	x.unknownFields = fields
+}
+
+// IsValid reports whether the message is valid.
+//
+// An invalid message is an empty, read-only value.
+//
+// An invalid message often corresponds to a nil pointer of the concrete
+// message type, but the details are implementation dependent.
+// Validity is not part of the protobuf data model, and may not
+// be preserved in marshaling or other operations.
+func (x *fastReflection_Module) IsValid() bool {
+	return x != nil
+}
+
+// ProtoMethods returns optional fastReflectionFeature-path implementations of various operations.
+// This method may return nil.
+//
+// The returned methods type is identical to
+// "google.golang.org/protobuf/runtime/protoiface".Methods.
+// Consult the protoiface package documentation for details.
+func (x *fastReflection_Module) ProtoMethods() *protoiface.Methods {
+	size := func(input protoiface.SizeInput) protoiface.SizeOutput {
+		x := input.Message.Interface().(*Module)
+		if x == nil {
+			return protoiface.SizeOutput{
+				NoUnkeyedLiterals: input.NoUnkeyedLiterals,
+				Size:              0,
+			}
+		}
+		options := runtime.SizeInputToOptions(input)
+		_ = options
+		var n int
+		var l int
+		_ = l
+		if x.unknownFields != nil {
+			n += len(x.unknownFields)
+		}
+		return protoiface.SizeOutput{
+			NoUnkeyedLiterals: input.NoUnkeyedLiterals,
+			Size:              n,
+		}
+	}
+
+	marshal := func(input protoiface.MarshalInput) (protoiface.MarshalOutput, error) {
+		x := input.Message.Interface().(*Module)
+		if x == nil {
+			return protoiface.MarshalOutput{
+				NoUnkeyedLiterals: input.NoUnkeyedLiterals,
+				Buf:               input.Buf,
+			}, nil
+		}
+		options := runtime.MarshalInputToOptions(input)
+		_ = options
+		size := options.Size(x)
+		dAtA := make([]byte, size)
+		i := len(dAtA)
+		_ = i
+		var l int
+		_ = l
+		if x.unknownFields != nil {
+			i -= len(x.unknownFields)
+			copy(dAtA[i:], x.unknownFields)
+		}
+		if input.Buf != nil {
+			input.Buf = append(input.Buf, dAtA...)
+		} else {
+			input.Buf = dAtA
+		}
+		return protoiface.MarshalOutput{
+			NoUnkeyedLiterals: input.NoUnkeyedLiterals,
+			Buf:               input.Buf,
+		}, nil
+	}
+	unmarshal := func(input protoiface.UnmarshalInput) (protoiface.UnmarshalOutput, error) {
+		x := input.Message.Interface().(*Module)
+		if x == nil {
+			return protoiface.UnmarshalOutput{
+				NoUnkeyedLiterals: input.NoUnkeyedLiterals,
+				Flags:             input.Flags,
+			}, nil
+		}
+		options := runtime.UnmarshalInputToOptions(input)
+		_ = options
+		dAtA := input.Buf
+		l := len(dAtA)
+		iNdEx := 0
+		for iNdEx < l {
+			preIndex := iNdEx
+			var wire uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protoiface.UnmarshalOutput{NoUnkeyedLiterals: input.NoUnkeyedLiterals, Flags: input.Flags}, runtime.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return protoiface.UnmarshalOutput{NoUnkeyedLiterals: input.NoUnkeyedLiterals, Flags: input.Flags}, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				wire |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			fieldNum := int32(wire >> 3)
+			wireType := int(wire & 0x7)
+			if wireType == 4 {
+				return protoiface.UnmarshalOutput{NoUnkeyedLiterals: input.NoUnkeyedLiterals, Flags: input.Flags}, fmt.Errorf("proto: Module: wiretype end group for non-group")
+			}
+			if fieldNum <= 0 {
+				return protoiface.UnmarshalOutput{NoUnkeyedLiterals: input.NoUnkeyedLiterals, Flags: input.Flags}, fmt.Errorf("proto: Module: illegal tag %d (wire type %d)", fieldNum, wire)
+			}
+			switch fieldNum {
+			default:
+				iNdEx = preIndex
+				skippy, err := runtime.Skip(dAtA[iNdEx:])
+				if err != nil {
+					return protoiface.UnmarshalOutput{NoUnkeyedLiterals: input.NoUnkeyedLiterals, Flags: input.Flags}, err
+				}
+				if (skippy < 0) || (iNdEx+skippy) < 0 {
+					return protoiface.UnmarshalOutput{NoUnkeyedLiterals: input.NoUnkeyedLiterals, Flags: input.Flags}, runtime.ErrInvalidLength
+				}
+				if (iNdEx + skippy) > l {
+					return protoiface.UnmarshalOutput{NoUnkeyedLiterals: input.NoUnkeyedLiterals, Flags: input.Flags}, io.ErrUnexpectedEOF
+				}
+				if !options.DiscardUnknown {
+					x.unknownFields = append(x.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+				}
+				iNdEx += skippy
+			}
+		}
+
+		if iNdEx > l {
+			return protoiface.UnmarshalOutput{NoUnkeyedLiterals: input.NoUnkeyedLiterals, Flags: input.Flags}, io.ErrUnexpectedEOF
+		}
+		return protoiface.UnmarshalOutput{NoUnkeyedLiterals: input.NoUnkeyedLiterals, Flags: input.Flags}, nil
+	}
+	return &protoiface.Methods{
+		NoUnkeyedLiterals: struct{}{},
+		Flags:             protoiface.SupportMarshalDeterministic | protoiface.SupportUnmarshalDiscardUnknown,
+		Size:              size,
+		Marshal:           marshal,
+		Unmarshal:         unmarshal,
+		Merge:             nil,
+		CheckInitialized:  nil,
+	}
+}
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.27.0
+// 	protoc        (unknown)
+// source: dex/module/v1/module.proto
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Module is the app config object of the module.
+// Learn more: https://docs.cosmos.network/main/building-modules/depinject
+type Module struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *Module) Reset() {
+	*x = Module{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_dex_module_v1_module_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Module) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Module) ProtoMessage() {}
+
+// Deprecated: Use Module.ProtoReflect.Descriptor instead.
+func (*Module) Descriptor() ([]byte, []int) {
+	return file_dex_module_v1_module_proto_rawDescGZIP(), []int{0}
+}
+
+var File_dex_module_v1_module_proto protoreflect.FileDescriptor
+
+var file_dex_module_v1_module_proto_rawDesc = []byte{
+	0x0a, 0x1a, 0x64, 0x65, 0x78, 0x2f, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x2f,
+	0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x64, 0x65,
+	0x78, 0x2e, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x20, 0x63, 0x6f, 0x73,
+	0x6d, 0x6f, 0x73, 0x2f, 0x61, 0x70, 0x70, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2f, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x29, 0x0a,
+	0x06, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x3a, 0x1f, 0xba, 0xc0, 0x96, 0xda, 0x01, 0x19, 0x0a,
+	0x17, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x6f, 0x6e, 0x72,
+	0x2d, 0x69, 0x6f, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x42, 0xaa, 0x01, 0x0a, 0x11, 0x63, 0x6f, 0x6d,
+	0x2e, 0x64, 0x65, 0x78, 0x2e, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x42, 0x0b,
+	0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x32, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x2d, 0x69,
+	0x6f, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x64, 0x65, 0x78, 0x2f, 0x6d,
+	0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x76,
+	0x31, 0xa2, 0x02, 0x03, 0x44, 0x4d, 0x58, 0xaa, 0x02, 0x0d, 0x44, 0x65, 0x78, 0x2e, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x0d, 0x44, 0x65, 0x78, 0x5c, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x5c, 0x56, 0x31, 0xe2, 0x02, 0x19, 0x44, 0x65, 0x78, 0x5c, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x5c, 0x56, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x44, 0x65, 0x78, 0x3a, 0x3a, 0x4d, 0x6f, 0x64, 0x75, 0x6c,
+	0x65, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_dex_module_v1_module_proto_rawDescOnce sync.Once
+	file_dex_module_v1_module_proto_rawDescData = file_dex_module_v1_module_proto_rawDesc
+)
+
+func file_dex_module_v1_module_proto_rawDescGZIP() []byte {
+	file_dex_module_v1_module_proto_rawDescOnce.Do(func() {
+		file_dex_module_v1_module_proto_rawDescData = protoimpl.X.CompressGZIP(file_dex_module_v1_module_proto_rawDescData)
+	})
+	return file_dex_module_v1_module_proto_rawDescData
+}
+
+var file_dex_module_v1_module_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_dex_module_v1_module_proto_goTypes = []interface{}{
+	(*Module)(nil), // 0: dex.module.v1.Module
+}
+var file_dex_module_v1_module_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_dex_module_v1_module_proto_init() }
+func file_dex_module_v1_module_proto_init() {
+	if File_dex_module_v1_module_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_dex_module_v1_module_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Module); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_dex_module_v1_module_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_dex_module_v1_module_proto_goTypes,
+		DependencyIndexes: file_dex_module_v1_module_proto_depIdxs,
+		MessageInfos:      file_dex_module_v1_module_proto_msgTypes,
+	}.Build()
+	File_dex_module_v1_module_proto = out.File
+	file_dex_module_v1_module_proto_rawDesc = nil
+	file_dex_module_v1_module_proto_goTypes = nil
+	file_dex_module_v1_module_proto_depIdxs = nil
+}

api/dex/v1/query_grpc.pb.go

@@ -0,0 +1,415 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: dex/v1/query.proto
+
+package dexv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	Query_Params_FullMethodName   = "/dex.v1.Query/Params"
+	Query_Account_FullMethodName  = "/dex.v1.Query/Account"
+	Query_Accounts_FullMethodName = "/dex.v1.Query/Accounts"
+	Query_Balance_FullMethodName  = "/dex.v1.Query/Balance"
+	Query_Pool_FullMethodName     = "/dex.v1.Query/Pool"
+	Query_Orders_FullMethodName   = "/dex.v1.Query/Orders"
+	Query_History_FullMethodName  = "/dex.v1.Query/History"
+)
+
+// QueryClient is the client API for Query service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type QueryClient interface {
+	// Params queries the parameters of the module
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	Params(ctx context.Context, in *QueryParamsRequest, opts ...grpc.CallOption) (*QueryParamsResponse, error)
+	// Account queries a DEX account by DID and connection
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	Account(ctx context.Context, in *QueryAccountRequest, opts ...grpc.CallOption) (*QueryAccountResponse, error)
+	// Accounts queries all DEX accounts for a DID
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	Accounts(ctx context.Context, in *QueryAccountsRequest, opts ...grpc.CallOption) (*QueryAccountsResponse, error)
+	// Balance queries remote chain balance
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	Balance(ctx context.Context, in *QueryBalanceRequest, opts ...grpc.CallOption) (*QueryBalanceResponse, error)
+	// Pool queries pool information
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	Pool(ctx context.Context, in *QueryPoolRequest, opts ...grpc.CallOption) (*QueryPoolResponse, error)
+	// Orders queries orders for a DID
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	Orders(ctx context.Context, in *QueryOrdersRequest, opts ...grpc.CallOption) (*QueryOrdersResponse, error)
+	// History queries transaction history
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	History(ctx context.Context, in *QueryHistoryRequest, opts ...grpc.CallOption) (*QueryHistoryResponse, error)
+}
+
+type queryClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewQueryClient(cc grpc.ClientConnInterface) QueryClient {
+	return &queryClient{cc}
+}
+
+func (c *queryClient) Params(ctx context.Context, in *QueryParamsRequest, opts ...grpc.CallOption) (*QueryParamsResponse, error) {
+	out := new(QueryParamsResponse)
+	err := c.cc.Invoke(ctx, Query_Params_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) Account(ctx context.Context, in *QueryAccountRequest, opts ...grpc.CallOption) (*QueryAccountResponse, error) {
+	out := new(QueryAccountResponse)
+	err := c.cc.Invoke(ctx, Query_Account_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) Accounts(ctx context.Context, in *QueryAccountsRequest, opts ...grpc.CallOption) (*QueryAccountsResponse, error) {
+	out := new(QueryAccountsResponse)
+	err := c.cc.Invoke(ctx, Query_Accounts_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) Balance(ctx context.Context, in *QueryBalanceRequest, opts ...grpc.CallOption) (*QueryBalanceResponse, error) {
+	out := new(QueryBalanceResponse)
+	err := c.cc.Invoke(ctx, Query_Balance_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) Pool(ctx context.Context, in *QueryPoolRequest, opts ...grpc.CallOption) (*QueryPoolResponse, error) {
+	out := new(QueryPoolResponse)
+	err := c.cc.Invoke(ctx, Query_Pool_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) Orders(ctx context.Context, in *QueryOrdersRequest, opts ...grpc.CallOption) (*QueryOrdersResponse, error) {
+	out := new(QueryOrdersResponse)
+	err := c.cc.Invoke(ctx, Query_Orders_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) History(ctx context.Context, in *QueryHistoryRequest, opts ...grpc.CallOption) (*QueryHistoryResponse, error) {
+	out := new(QueryHistoryResponse)
+	err := c.cc.Invoke(ctx, Query_History_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// QueryServer is the server API for Query service.
+// All implementations must embed UnimplementedQueryServer
+// for forward compatibility
+type QueryServer interface {
+	// Params queries the parameters of the module
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	Params(context.Context, *QueryParamsRequest) (*QueryParamsResponse, error)
+	// Account queries a DEX account by DID and connection
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	Account(context.Context, *QueryAccountRequest) (*QueryAccountResponse, error)
+	// Accounts queries all DEX accounts for a DID
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	Accounts(context.Context, *QueryAccountsRequest) (*QueryAccountsResponse, error)
+	// Balance queries remote chain balance
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	Balance(context.Context, *QueryBalanceRequest) (*QueryBalanceResponse, error)
+	// Pool queries pool information
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	Pool(context.Context, *QueryPoolRequest) (*QueryPoolResponse, error)
+	// Orders queries orders for a DID
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	Orders(context.Context, *QueryOrdersRequest) (*QueryOrdersResponse, error)
+	// History queries transaction history
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_query_docs.md"}}
+	History(context.Context, *QueryHistoryRequest) (*QueryHistoryResponse, error)
+	mustEmbedUnimplementedQueryServer()
+}
+
+// UnimplementedQueryServer must be embedded to have forward compatible implementations.
+type UnimplementedQueryServer struct {
+}
+
+func (UnimplementedQueryServer) Params(context.Context, *QueryParamsRequest) (*QueryParamsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Params not implemented")
+}
+func (UnimplementedQueryServer) Account(context.Context, *QueryAccountRequest) (*QueryAccountResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Account not implemented")
+}
+func (UnimplementedQueryServer) Accounts(context.Context, *QueryAccountsRequest) (*QueryAccountsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Accounts not implemented")
+}
+func (UnimplementedQueryServer) Balance(context.Context, *QueryBalanceRequest) (*QueryBalanceResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Balance not implemented")
+}
+func (UnimplementedQueryServer) Pool(context.Context, *QueryPoolRequest) (*QueryPoolResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Pool not implemented")
+}
+func (UnimplementedQueryServer) Orders(context.Context, *QueryOrdersRequest) (*QueryOrdersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Orders not implemented")
+}
+func (UnimplementedQueryServer) History(context.Context, *QueryHistoryRequest) (*QueryHistoryResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method History not implemented")
+}
+func (UnimplementedQueryServer) mustEmbedUnimplementedQueryServer() {}
+
+// UnsafeQueryServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to QueryServer will
+// result in compilation errors.
+type UnsafeQueryServer interface {
+	mustEmbedUnimplementedQueryServer()
+}
+
+func RegisterQueryServer(s grpc.ServiceRegistrar, srv QueryServer) {
+	s.RegisterService(&Query_ServiceDesc, srv)
+}
+
+func _Query_Params_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryParamsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Params(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Params_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Params(ctx, req.(*QueryParamsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_Account_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryAccountRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Account(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Account_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Account(ctx, req.(*QueryAccountRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_Accounts_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryAccountsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Accounts(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Accounts_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Accounts(ctx, req.(*QueryAccountsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_Balance_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryBalanceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Balance(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Balance_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Balance(ctx, req.(*QueryBalanceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_Pool_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryPoolRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Pool(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Pool_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Pool(ctx, req.(*QueryPoolRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_Orders_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryOrdersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Orders(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Orders_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Orders(ctx, req.(*QueryOrdersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_History_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryHistoryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).History(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_History_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).History(ctx, req.(*QueryHistoryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// Query_ServiceDesc is the grpc.ServiceDesc for Query service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Query_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "dex.v1.Query",
+	HandlerType: (*QueryServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Params",
+			Handler:    _Query_Params_Handler,
+		},
+		{
+			MethodName: "Account",
+			Handler:    _Query_Account_Handler,
+		},
+		{
+			MethodName: "Accounts",
+			Handler:    _Query_Accounts_Handler,
+		},
+		{
+			MethodName: "Balance",
+			Handler:    _Query_Balance_Handler,
+		},
+		{
+			MethodName: "Pool",
+			Handler:    _Query_Pool_Handler,
+		},
+		{
+			MethodName: "Orders",
+			Handler:    _Query_Orders_Handler,
+		},
+		{
+			MethodName: "History",
+			Handler:    _Query_History_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "dex/v1/query.proto",
+}

api/dex/v1/tx_grpc.pb.go

@@ -0,0 +1,366 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: dex/v1/tx.proto
+
+package dexv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	Msg_RegisterDEXAccount_FullMethodName = "/dex.v1.Msg/RegisterDEXAccount"
+	Msg_ExecuteSwap_FullMethodName        = "/dex.v1.Msg/ExecuteSwap"
+	Msg_ProvideLiquidity_FullMethodName   = "/dex.v1.Msg/ProvideLiquidity"
+	Msg_RemoveLiquidity_FullMethodName    = "/dex.v1.Msg/RemoveLiquidity"
+	Msg_CreateLimitOrder_FullMethodName   = "/dex.v1.Msg/CreateLimitOrder"
+	Msg_CancelOrder_FullMethodName        = "/dex.v1.Msg/CancelOrder"
+)
+
+// MsgClient is the client API for Msg service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type MsgClient interface {
+	// RegisterDEXAccount creates a new ICA account for DEX operations
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_tx_docs.md"}}
+	RegisterDEXAccount(ctx context.Context, in *MsgRegisterDEXAccount, opts ...grpc.CallOption) (*MsgRegisterDEXAccountResponse, error)
+	// ExecuteSwap performs a token swap on a remote chain
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_tx_docs.md"}}
+	ExecuteSwap(ctx context.Context, in *MsgExecuteSwap, opts ...grpc.CallOption) (*MsgExecuteSwapResponse, error)
+	// ProvideLiquidity adds liquidity to a pool
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_tx_docs.md"}}
+	ProvideLiquidity(ctx context.Context, in *MsgProvideLiquidity, opts ...grpc.CallOption) (*MsgProvideLiquidityResponse, error)
+	// RemoveLiquidity removes liquidity from a pool
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_tx_docs.md"}}
+	RemoveLiquidity(ctx context.Context, in *MsgRemoveLiquidity, opts ...grpc.CallOption) (*MsgRemoveLiquidityResponse, error)
+	// CreateLimitOrder creates a limit order
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_tx_docs.md"}}
+	CreateLimitOrder(ctx context.Context, in *MsgCreateLimitOrder, opts ...grpc.CallOption) (*MsgCreateLimitOrderResponse, error)
+	// CancelOrder cancels an existing order
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_tx_docs.md"}}
+	CancelOrder(ctx context.Context, in *MsgCancelOrder, opts ...grpc.CallOption) (*MsgCancelOrderResponse, error)
+}
+
+type msgClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewMsgClient(cc grpc.ClientConnInterface) MsgClient {
+	return &msgClient{cc}
+}
+
+func (c *msgClient) RegisterDEXAccount(ctx context.Context, in *MsgRegisterDEXAccount, opts ...grpc.CallOption) (*MsgRegisterDEXAccountResponse, error) {
+	out := new(MsgRegisterDEXAccountResponse)
+	err := c.cc.Invoke(ctx, Msg_RegisterDEXAccount_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) ExecuteSwap(ctx context.Context, in *MsgExecuteSwap, opts ...grpc.CallOption) (*MsgExecuteSwapResponse, error) {
+	out := new(MsgExecuteSwapResponse)
+	err := c.cc.Invoke(ctx, Msg_ExecuteSwap_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) ProvideLiquidity(ctx context.Context, in *MsgProvideLiquidity, opts ...grpc.CallOption) (*MsgProvideLiquidityResponse, error) {
+	out := new(MsgProvideLiquidityResponse)
+	err := c.cc.Invoke(ctx, Msg_ProvideLiquidity_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) RemoveLiquidity(ctx context.Context, in *MsgRemoveLiquidity, opts ...grpc.CallOption) (*MsgRemoveLiquidityResponse, error) {
+	out := new(MsgRemoveLiquidityResponse)
+	err := c.cc.Invoke(ctx, Msg_RemoveLiquidity_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) CreateLimitOrder(ctx context.Context, in *MsgCreateLimitOrder, opts ...grpc.CallOption) (*MsgCreateLimitOrderResponse, error) {
+	out := new(MsgCreateLimitOrderResponse)
+	err := c.cc.Invoke(ctx, Msg_CreateLimitOrder_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) CancelOrder(ctx context.Context, in *MsgCancelOrder, opts ...grpc.CallOption) (*MsgCancelOrderResponse, error) {
+	out := new(MsgCancelOrderResponse)
+	err := c.cc.Invoke(ctx, Msg_CancelOrder_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// MsgServer is the server API for Msg service.
+// All implementations must embed UnimplementedMsgServer
+// for forward compatibility
+type MsgServer interface {
+	// RegisterDEXAccount creates a new ICA account for DEX operations
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_tx_docs.md"}}
+	RegisterDEXAccount(context.Context, *MsgRegisterDEXAccount) (*MsgRegisterDEXAccountResponse, error)
+	// ExecuteSwap performs a token swap on a remote chain
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_tx_docs.md"}}
+	ExecuteSwap(context.Context, *MsgExecuteSwap) (*MsgExecuteSwapResponse, error)
+	// ProvideLiquidity adds liquidity to a pool
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_tx_docs.md"}}
+	ProvideLiquidity(context.Context, *MsgProvideLiquidity) (*MsgProvideLiquidityResponse, error)
+	// RemoveLiquidity removes liquidity from a pool
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_tx_docs.md"}}
+	RemoveLiquidity(context.Context, *MsgRemoveLiquidity) (*MsgRemoveLiquidityResponse, error)
+	// CreateLimitOrder creates a limit order
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_tx_docs.md"}}
+	CreateLimitOrder(context.Context, *MsgCreateLimitOrder) (*MsgCreateLimitOrderResponse, error)
+	// CancelOrder cancels an existing order
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dex_tx_docs.md"}}
+	CancelOrder(context.Context, *MsgCancelOrder) (*MsgCancelOrderResponse, error)
+	mustEmbedUnimplementedMsgServer()
+}
+
+// UnimplementedMsgServer must be embedded to have forward compatible implementations.
+type UnimplementedMsgServer struct {
+}
+
+func (UnimplementedMsgServer) RegisterDEXAccount(context.Context, *MsgRegisterDEXAccount) (*MsgRegisterDEXAccountResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RegisterDEXAccount not implemented")
+}
+func (UnimplementedMsgServer) ExecuteSwap(context.Context, *MsgExecuteSwap) (*MsgExecuteSwapResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ExecuteSwap not implemented")
+}
+func (UnimplementedMsgServer) ProvideLiquidity(context.Context, *MsgProvideLiquidity) (*MsgProvideLiquidityResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ProvideLiquidity not implemented")
+}
+func (UnimplementedMsgServer) RemoveLiquidity(context.Context, *MsgRemoveLiquidity) (*MsgRemoveLiquidityResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveLiquidity not implemented")
+}
+func (UnimplementedMsgServer) CreateLimitOrder(context.Context, *MsgCreateLimitOrder) (*MsgCreateLimitOrderResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateLimitOrder not implemented")
+}
+func (UnimplementedMsgServer) CancelOrder(context.Context, *MsgCancelOrder) (*MsgCancelOrderResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CancelOrder not implemented")
+}
+func (UnimplementedMsgServer) mustEmbedUnimplementedMsgServer() {}
+
+// UnsafeMsgServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to MsgServer will
+// result in compilation errors.
+type UnsafeMsgServer interface {
+	mustEmbedUnimplementedMsgServer()
+}
+
+func RegisterMsgServer(s grpc.ServiceRegistrar, srv MsgServer) {
+	s.RegisterService(&Msg_ServiceDesc, srv)
+}
+
+func _Msg_RegisterDEXAccount_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgRegisterDEXAccount)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).RegisterDEXAccount(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_RegisterDEXAccount_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).RegisterDEXAccount(ctx, req.(*MsgRegisterDEXAccount))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_ExecuteSwap_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgExecuteSwap)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).ExecuteSwap(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_ExecuteSwap_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).ExecuteSwap(ctx, req.(*MsgExecuteSwap))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_ProvideLiquidity_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgProvideLiquidity)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).ProvideLiquidity(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_ProvideLiquidity_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).ProvideLiquidity(ctx, req.(*MsgProvideLiquidity))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_RemoveLiquidity_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgRemoveLiquidity)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).RemoveLiquidity(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_RemoveLiquidity_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).RemoveLiquidity(ctx, req.(*MsgRemoveLiquidity))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_CreateLimitOrder_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgCreateLimitOrder)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).CreateLimitOrder(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_CreateLimitOrder_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).CreateLimitOrder(ctx, req.(*MsgCreateLimitOrder))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_CancelOrder_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgCancelOrder)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).CancelOrder(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_CancelOrder_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).CancelOrder(ctx, req.(*MsgCancelOrder))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// Msg_ServiceDesc is the grpc.ServiceDesc for Msg service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Msg_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "dex.v1.Msg",
+	HandlerType: (*MsgServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "RegisterDEXAccount",
+			Handler:    _Msg_RegisterDEXAccount_Handler,
+		},
+		{
+			MethodName: "ExecuteSwap",
+			Handler:    _Msg_ExecuteSwap_Handler,
+		},
+		{
+			MethodName: "ProvideLiquidity",
+			Handler:    _Msg_ProvideLiquidity_Handler,
+		},
+		{
+			MethodName: "RemoveLiquidity",
+			Handler:    _Msg_RemoveLiquidity_Handler,
+		},
+		{
+			MethodName: "CreateLimitOrder",
+			Handler:    _Msg_CreateLimitOrder_Handler,
+		},
+		{
+			MethodName: "CancelOrder",
+			Handler:    _Msg_CancelOrder_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "dex/v1/tx.proto",
+}

api/did/module/v1/module.pulsar.go

@@ -417,21 +417,21 @@ var file_did_module_v1_module_proto_rawDesc = []byte{
 	0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x64, 0x69,
 	0x64, 0x2e, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x20, 0x63, 0x6f, 0x73,
 	0x6d, 0x6f, 0x73, 0x2f, 0x61, 0x70, 0x70, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
-	0x2f, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x28, 0x0a,
-	0x06, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x3a, 0x1e, 0xba, 0xc0, 0x96, 0xda, 0x01, 0x18, 0x0a,
-	0x16, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x6e, 0x73, 0x6f,
-	0x6e, 0x72, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x42, 0xa9, 0x01, 0x0a, 0x11, 0x63, 0x6f, 0x6d, 0x2e,
-	0x64, 0x69, 0x64, 0x2e, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x42, 0x0b, 0x4d,
-	0x6f, 0x64, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x31, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x6e, 0x73, 0x6f, 0x6e, 0x72, 0x2f,
-	0x73, 0x6f, 0x6e, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x64, 0x69, 0x64, 0x2f, 0x6d, 0x6f, 0x64,
-	0x75, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x76, 0x31, 0xa2,
-	0x02, 0x03, 0x44, 0x4d, 0x58, 0xaa, 0x02, 0x0d, 0x44, 0x69, 0x64, 0x2e, 0x4d, 0x6f, 0x64, 0x75,
-	0x6c, 0x65, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x0d, 0x44, 0x69, 0x64, 0x5c, 0x4d, 0x6f, 0x64, 0x75,
-	0x6c, 0x65, 0x5c, 0x56, 0x31, 0xe2, 0x02, 0x19, 0x44, 0x69, 0x64, 0x5c, 0x4d, 0x6f, 0x64, 0x75,
-	0x6c, 0x65, 0x5c, 0x56, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0xea, 0x02, 0x0f, 0x44, 0x69, 0x64, 0x3a, 0x3a, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x3a,
-	0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x2f, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x29, 0x0a,
+	0x06, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x3a, 0x1f, 0xba, 0xc0, 0x96, 0xda, 0x01, 0x19, 0x0a,
+	0x17, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x6f, 0x6e, 0x72,
+	0x2d, 0x69, 0x6f, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x42, 0xaa, 0x01, 0x0a, 0x11, 0x63, 0x6f, 0x6d,
+	0x2e, 0x64, 0x69, 0x64, 0x2e, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x42, 0x0b,
+	0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x32, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x2d, 0x69,
+	0x6f, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x64, 0x69, 0x64, 0x2f, 0x6d,
+	0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x76,
+	0x31, 0xa2, 0x02, 0x03, 0x44, 0x4d, 0x58, 0xaa, 0x02, 0x0d, 0x44, 0x69, 0x64, 0x2e, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x0d, 0x44, 0x69, 0x64, 0x5c, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x5c, 0x56, 0x31, 0xe2, 0x02, 0x19, 0x44, 0x69, 0x64, 0x5c, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x5c, 0x56, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x44, 0x69, 0x64, 0x3a, 0x3a, 0x4d, 0x6f, 0x64, 0x75, 0x6c,
+	0x65, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

api/did/v1/query_grpc.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.5.1
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             (unknown)
 // source: did/v1/query.proto
 
@@ -15,27 +15,57 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.64.0 or later.
-const _ = grpc.SupportPackageIsVersion9
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
 
 const (
-	Query_Params_FullMethodName  = "/did.v1.Query/Params"
-	Query_Resolve_FullMethodName = "/did.v1.Query/Resolve"
-	Query_Verify_FullMethodName  = "/did.v1.Query/Verify"
+	Query_Params_FullMethodName                      = "/did.v1.Query/Params"
+	Query_ResolveDID_FullMethodName                  = "/did.v1.Query/ResolveDID"
+	Query_GetDIDDocument_FullMethodName              = "/did.v1.Query/GetDIDDocument"
+	Query_ListDIDDocuments_FullMethodName            = "/did.v1.Query/ListDIDDocuments"
+	Query_GetDIDDocumentsByController_FullMethodName = "/did.v1.Query/GetDIDDocumentsByController"
+	Query_GetVerificationMethod_FullMethodName       = "/did.v1.Query/GetVerificationMethod"
+	Query_GetService_FullMethodName                  = "/did.v1.Query/GetService"
+	Query_GetVerifiableCredential_FullMethodName     = "/did.v1.Query/GetVerifiableCredential"
+	Query_ListVerifiableCredentials_FullMethodName   = "/did.v1.Query/ListVerifiableCredentials"
+	Query_GetCredentialsByDID_FullMethodName         = "/did.v1.Query/GetCredentialsByDID"
+	Query_RegisterStart_FullMethodName               = "/did.v1.Query/RegisterStart"
+	Query_LoginStart_FullMethodName                  = "/did.v1.Query/LoginStart"
 )
 
 // QueryClient is the client API for Query service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-//
-// Query provides defines the gRPC querier service.
 type QueryClient interface {
 	// Params queries all parameters of the module.
-	Params(ctx context.Context, in *QueryRequest, opts ...grpc.CallOption) (*QueryParamsResponse, error)
-	// Resolve queries the DID document by its id.
-	Resolve(ctx context.Context, in *QueryRequest, opts ...grpc.CallOption) (*QueryResolveResponse, error)
-	// Verify verifies a message with the DID document
-	Verify(ctx context.Context, in *QueryVerifyRequest, opts ...grpc.CallOption) (*QueryVerifyResponse, error)
+	Params(ctx context.Context, in *QueryParamsRequest, opts ...grpc.CallOption) (*QueryParamsResponse, error)
+	// ResolveDID resolves a DID to its DID document
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "did_query_docs.md"}}
+	ResolveDID(ctx context.Context, in *QueryResolveDIDRequest, opts ...grpc.CallOption) (*QueryResolveDIDResponse, error)
+	// GetDIDDocument retrieves a DID document by its ID
+	GetDIDDocument(ctx context.Context, in *QueryGetDIDDocumentRequest, opts ...grpc.CallOption) (*QueryGetDIDDocumentResponse, error)
+	// ListDIDDocuments lists all DID documents with pagination
+	ListDIDDocuments(ctx context.Context, in *QueryListDIDDocumentsRequest, opts ...grpc.CallOption) (*QueryListDIDDocumentsResponse, error)
+	// GetDIDDocumentsByController retrieves DID documents by controller
+	GetDIDDocumentsByController(ctx context.Context, in *QueryGetDIDDocumentsByControllerRequest, opts ...grpc.CallOption) (*QueryGetDIDDocumentsByControllerResponse, error)
+	// GetVerificationMethod retrieves a specific verification method
+	GetVerificationMethod(ctx context.Context, in *QueryGetVerificationMethodRequest, opts ...grpc.CallOption) (*QueryGetVerificationMethodResponse, error)
+	// GetService retrieves a specific service endpoint
+	GetService(ctx context.Context, in *QueryGetServiceRequest, opts ...grpc.CallOption) (*QueryGetServiceResponse, error)
+	// GetVerifiableCredential retrieves a verifiable credential by ID
+	GetVerifiableCredential(ctx context.Context, in *QueryGetVerifiableCredentialRequest, opts ...grpc.CallOption) (*QueryGetVerifiableCredentialResponse, error)
+	// ListVerifiableCredentials lists all verifiable credentials with filtering options
+	ListVerifiableCredentials(ctx context.Context, in *QueryListVerifiableCredentialsRequest, opts ...grpc.CallOption) (*QueryListVerifiableCredentialsResponse, error)
+	// GetCredentialsByDID retrieves all credentials (verifiable and WebAuthn) associated with a DID
+	GetCredentialsByDID(ctx context.Context, in *QueryGetCredentialsByDIDRequest, opts ...grpc.CallOption) (*QueryGetCredentialsByDIDResponse, error)
+	// RegisterStart represents the start of the registration process
+	RegisterStart(ctx context.Context, in *QueryRegisterStartRequest, opts ...grpc.CallOption) (*QueryRegisterStartResponse, error)
+	// LoginStart represents the start of the login process
+	LoginStart(ctx context.Context, in *QueryLoginStartRequest, opts ...grpc.CallOption) (*QueryLoginStartResponse, error)
 }
 
 type queryClient struct {
@@ -46,30 +76,108 @@ func NewQueryClient(cc grpc.ClientConnInterface) QueryClient {
 	return &queryClient{cc}
 }
 
-func (c *queryClient) Params(ctx context.Context, in *QueryRequest, opts ...grpc.CallOption) (*QueryParamsResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+func (c *queryClient) Params(ctx context.Context, in *QueryParamsRequest, opts ...grpc.CallOption) (*QueryParamsResponse, error) {
 	out := new(QueryParamsResponse)
-	err := c.cc.Invoke(ctx, Query_Params_FullMethodName, in, out, cOpts...)
+	err := c.cc.Invoke(ctx, Query_Params_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *queryClient) Resolve(ctx context.Context, in *QueryRequest, opts ...grpc.CallOption) (*QueryResolveResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(QueryResolveResponse)
-	err := c.cc.Invoke(ctx, Query_Resolve_FullMethodName, in, out, cOpts...)
+func (c *queryClient) ResolveDID(ctx context.Context, in *QueryResolveDIDRequest, opts ...grpc.CallOption) (*QueryResolveDIDResponse, error) {
+	out := new(QueryResolveDIDResponse)
+	err := c.cc.Invoke(ctx, Query_ResolveDID_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *queryClient) Verify(ctx context.Context, in *QueryVerifyRequest, opts ...grpc.CallOption) (*QueryVerifyResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(QueryVerifyResponse)
-	err := c.cc.Invoke(ctx, Query_Verify_FullMethodName, in, out, cOpts...)
+func (c *queryClient) GetDIDDocument(ctx context.Context, in *QueryGetDIDDocumentRequest, opts ...grpc.CallOption) (*QueryGetDIDDocumentResponse, error) {
+	out := new(QueryGetDIDDocumentResponse)
+	err := c.cc.Invoke(ctx, Query_GetDIDDocument_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) ListDIDDocuments(ctx context.Context, in *QueryListDIDDocumentsRequest, opts ...grpc.CallOption) (*QueryListDIDDocumentsResponse, error) {
+	out := new(QueryListDIDDocumentsResponse)
+	err := c.cc.Invoke(ctx, Query_ListDIDDocuments_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) GetDIDDocumentsByController(ctx context.Context, in *QueryGetDIDDocumentsByControllerRequest, opts ...grpc.CallOption) (*QueryGetDIDDocumentsByControllerResponse, error) {
+	out := new(QueryGetDIDDocumentsByControllerResponse)
+	err := c.cc.Invoke(ctx, Query_GetDIDDocumentsByController_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) GetVerificationMethod(ctx context.Context, in *QueryGetVerificationMethodRequest, opts ...grpc.CallOption) (*QueryGetVerificationMethodResponse, error) {
+	out := new(QueryGetVerificationMethodResponse)
+	err := c.cc.Invoke(ctx, Query_GetVerificationMethod_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) GetService(ctx context.Context, in *QueryGetServiceRequest, opts ...grpc.CallOption) (*QueryGetServiceResponse, error) {
+	out := new(QueryGetServiceResponse)
+	err := c.cc.Invoke(ctx, Query_GetService_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) GetVerifiableCredential(ctx context.Context, in *QueryGetVerifiableCredentialRequest, opts ...grpc.CallOption) (*QueryGetVerifiableCredentialResponse, error) {
+	out := new(QueryGetVerifiableCredentialResponse)
+	err := c.cc.Invoke(ctx, Query_GetVerifiableCredential_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) ListVerifiableCredentials(ctx context.Context, in *QueryListVerifiableCredentialsRequest, opts ...grpc.CallOption) (*QueryListVerifiableCredentialsResponse, error) {
+	out := new(QueryListVerifiableCredentialsResponse)
+	err := c.cc.Invoke(ctx, Query_ListVerifiableCredentials_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) GetCredentialsByDID(ctx context.Context, in *QueryGetCredentialsByDIDRequest, opts ...grpc.CallOption) (*QueryGetCredentialsByDIDResponse, error) {
+	out := new(QueryGetCredentialsByDIDResponse)
+	err := c.cc.Invoke(ctx, Query_GetCredentialsByDID_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) RegisterStart(ctx context.Context, in *QueryRegisterStartRequest, opts ...grpc.CallOption) (*QueryRegisterStartResponse, error) {
+	out := new(QueryRegisterStartResponse)
+	err := c.cc.Invoke(ctx, Query_RegisterStart_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) LoginStart(ctx context.Context, in *QueryLoginStartRequest, opts ...grpc.CallOption) (*QueryLoginStartResponse, error) {
+	out := new(QueryLoginStartResponse)
+	err := c.cc.Invoke(ctx, Query_LoginStart_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -78,37 +186,81 @@ func (c *queryClient) Verify(ctx context.Context, in *QueryVerifyRequest, opts .
 
 // QueryServer is the server API for Query service.
 // All implementations must embed UnimplementedQueryServer
-// for forward compatibility.
-//
-// Query provides defines the gRPC querier service.
+// for forward compatibility
 type QueryServer interface {
 	// Params queries all parameters of the module.
-	Params(context.Context, *QueryRequest) (*QueryParamsResponse, error)
-	// Resolve queries the DID document by its id.
-	Resolve(context.Context, *QueryRequest) (*QueryResolveResponse, error)
-	// Verify verifies a message with the DID document
-	Verify(context.Context, *QueryVerifyRequest) (*QueryVerifyResponse, error)
+	Params(context.Context, *QueryParamsRequest) (*QueryParamsResponse, error)
+	// ResolveDID resolves a DID to its DID document
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "did_query_docs.md"}}
+	ResolveDID(context.Context, *QueryResolveDIDRequest) (*QueryResolveDIDResponse, error)
+	// GetDIDDocument retrieves a DID document by its ID
+	GetDIDDocument(context.Context, *QueryGetDIDDocumentRequest) (*QueryGetDIDDocumentResponse, error)
+	// ListDIDDocuments lists all DID documents with pagination
+	ListDIDDocuments(context.Context, *QueryListDIDDocumentsRequest) (*QueryListDIDDocumentsResponse, error)
+	// GetDIDDocumentsByController retrieves DID documents by controller
+	GetDIDDocumentsByController(context.Context, *QueryGetDIDDocumentsByControllerRequest) (*QueryGetDIDDocumentsByControllerResponse, error)
+	// GetVerificationMethod retrieves a specific verification method
+	GetVerificationMethod(context.Context, *QueryGetVerificationMethodRequest) (*QueryGetVerificationMethodResponse, error)
+	// GetService retrieves a specific service endpoint
+	GetService(context.Context, *QueryGetServiceRequest) (*QueryGetServiceResponse, error)
+	// GetVerifiableCredential retrieves a verifiable credential by ID
+	GetVerifiableCredential(context.Context, *QueryGetVerifiableCredentialRequest) (*QueryGetVerifiableCredentialResponse, error)
+	// ListVerifiableCredentials lists all verifiable credentials with filtering options
+	ListVerifiableCredentials(context.Context, *QueryListVerifiableCredentialsRequest) (*QueryListVerifiableCredentialsResponse, error)
+	// GetCredentialsByDID retrieves all credentials (verifiable and WebAuthn) associated with a DID
+	GetCredentialsByDID(context.Context, *QueryGetCredentialsByDIDRequest) (*QueryGetCredentialsByDIDResponse, error)
+	// RegisterStart represents the start of the registration process
+	RegisterStart(context.Context, *QueryRegisterStartRequest) (*QueryRegisterStartResponse, error)
+	// LoginStart represents the start of the login process
+	LoginStart(context.Context, *QueryLoginStartRequest) (*QueryLoginStartResponse, error)
 	mustEmbedUnimplementedQueryServer()
 }
 
-// UnimplementedQueryServer must be embedded to have
-// forward compatible implementations.
-//
-// NOTE: this should be embedded by value instead of pointer to avoid a nil
-// pointer dereference when methods are called.
-type UnimplementedQueryServer struct{}
+// UnimplementedQueryServer must be embedded to have forward compatible implementations.
+type UnimplementedQueryServer struct {
+}
 
-func (UnimplementedQueryServer) Params(context.Context, *QueryRequest) (*QueryParamsResponse, error) {
+func (UnimplementedQueryServer) Params(context.Context, *QueryParamsRequest) (*QueryParamsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Params not implemented")
 }
-func (UnimplementedQueryServer) Resolve(context.Context, *QueryRequest) (*QueryResolveResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Resolve not implemented")
+func (UnimplementedQueryServer) ResolveDID(context.Context, *QueryResolveDIDRequest) (*QueryResolveDIDResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ResolveDID not implemented")
 }
-func (UnimplementedQueryServer) Verify(context.Context, *QueryVerifyRequest) (*QueryVerifyResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Verify not implemented")
+func (UnimplementedQueryServer) GetDIDDocument(context.Context, *QueryGetDIDDocumentRequest) (*QueryGetDIDDocumentResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetDIDDocument not implemented")
+}
+func (UnimplementedQueryServer) ListDIDDocuments(context.Context, *QueryListDIDDocumentsRequest) (*QueryListDIDDocumentsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListDIDDocuments not implemented")
+}
+func (UnimplementedQueryServer) GetDIDDocumentsByController(context.Context, *QueryGetDIDDocumentsByControllerRequest) (*QueryGetDIDDocumentsByControllerResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetDIDDocumentsByController not implemented")
+}
+func (UnimplementedQueryServer) GetVerificationMethod(context.Context, *QueryGetVerificationMethodRequest) (*QueryGetVerificationMethodResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetVerificationMethod not implemented")
+}
+func (UnimplementedQueryServer) GetService(context.Context, *QueryGetServiceRequest) (*QueryGetServiceResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetService not implemented")
+}
+func (UnimplementedQueryServer) GetVerifiableCredential(context.Context, *QueryGetVerifiableCredentialRequest) (*QueryGetVerifiableCredentialResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetVerifiableCredential not implemented")
+}
+func (UnimplementedQueryServer) ListVerifiableCredentials(context.Context, *QueryListVerifiableCredentialsRequest) (*QueryListVerifiableCredentialsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListVerifiableCredentials not implemented")
+}
+func (UnimplementedQueryServer) GetCredentialsByDID(context.Context, *QueryGetCredentialsByDIDRequest) (*QueryGetCredentialsByDIDResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetCredentialsByDID not implemented")
+}
+func (UnimplementedQueryServer) RegisterStart(context.Context, *QueryRegisterStartRequest) (*QueryRegisterStartResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RegisterStart not implemented")
+}
+func (UnimplementedQueryServer) LoginStart(context.Context, *QueryLoginStartRequest) (*QueryLoginStartResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method LoginStart not implemented")
 }
 func (UnimplementedQueryServer) mustEmbedUnimplementedQueryServer() {}
-func (UnimplementedQueryServer) testEmbeddedByValue()               {}
 
 // UnsafeQueryServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to QueryServer will
@@ -118,18 +270,11 @@ type UnsafeQueryServer interface {
 }
 
 func RegisterQueryServer(s grpc.ServiceRegistrar, srv QueryServer) {
-	// If the following call pancis, it indicates UnimplementedQueryServer was
-	// embedded by pointer and is nil.  This will cause panics if an
-	// unimplemented method is ever invoked, so we test this at initialization
-	// time to prevent it from happening at runtime later due to I/O.
-	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
-		t.testEmbeddedByValue()
-	}
 	s.RegisterService(&Query_ServiceDesc, srv)
 }
 
 func _Query_Params_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(QueryRequest)
+	in := new(QueryParamsRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
@@ -141,43 +286,205 @@ func _Query_Params_Handler(srv interface{}, ctx context.Context, dec func(interf
 		FullMethod: Query_Params_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(QueryServer).Params(ctx, req.(*QueryRequest))
+		return srv.(QueryServer).Params(ctx, req.(*QueryParamsRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Query_Resolve_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(QueryRequest)
+func _Query_ResolveDID_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryResolveDIDRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(QueryServer).Resolve(ctx, in)
+		return srv.(QueryServer).ResolveDID(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: Query_Resolve_FullMethodName,
+		FullMethod: Query_ResolveDID_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(QueryServer).Resolve(ctx, req.(*QueryRequest))
+		return srv.(QueryServer).ResolveDID(ctx, req.(*QueryResolveDIDRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Query_Verify_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(QueryVerifyRequest)
+func _Query_GetDIDDocument_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryGetDIDDocumentRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(QueryServer).Verify(ctx, in)
+		return srv.(QueryServer).GetDIDDocument(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: Query_Verify_FullMethodName,
+		FullMethod: Query_GetDIDDocument_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(QueryServer).Verify(ctx, req.(*QueryVerifyRequest))
+		return srv.(QueryServer).GetDIDDocument(ctx, req.(*QueryGetDIDDocumentRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_ListDIDDocuments_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryListDIDDocumentsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).ListDIDDocuments(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_ListDIDDocuments_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).ListDIDDocuments(ctx, req.(*QueryListDIDDocumentsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_GetDIDDocumentsByController_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryGetDIDDocumentsByControllerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).GetDIDDocumentsByController(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_GetDIDDocumentsByController_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).GetDIDDocumentsByController(ctx, req.(*QueryGetDIDDocumentsByControllerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_GetVerificationMethod_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryGetVerificationMethodRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).GetVerificationMethod(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_GetVerificationMethod_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).GetVerificationMethod(ctx, req.(*QueryGetVerificationMethodRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_GetService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryGetServiceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).GetService(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_GetService_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).GetService(ctx, req.(*QueryGetServiceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_GetVerifiableCredential_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryGetVerifiableCredentialRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).GetVerifiableCredential(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_GetVerifiableCredential_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).GetVerifiableCredential(ctx, req.(*QueryGetVerifiableCredentialRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_ListVerifiableCredentials_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryListVerifiableCredentialsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).ListVerifiableCredentials(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_ListVerifiableCredentials_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).ListVerifiableCredentials(ctx, req.(*QueryListVerifiableCredentialsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_GetCredentialsByDID_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryGetCredentialsByDIDRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).GetCredentialsByDID(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_GetCredentialsByDID_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).GetCredentialsByDID(ctx, req.(*QueryGetCredentialsByDIDRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_RegisterStart_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryRegisterStartRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).RegisterStart(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_RegisterStart_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).RegisterStart(ctx, req.(*QueryRegisterStartRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_LoginStart_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryLoginStartRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).LoginStart(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_LoginStart_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).LoginStart(ctx, req.(*QueryLoginStartRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -194,12 +501,48 @@ var Query_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _Query_Params_Handler,
 		},
 		{
-			MethodName: "Resolve",
-			Handler:    _Query_Resolve_Handler,
+			MethodName: "ResolveDID",
+			Handler:    _Query_ResolveDID_Handler,
 		},
 		{
-			MethodName: "Verify",
-			Handler:    _Query_Verify_Handler,
+			MethodName: "GetDIDDocument",
+			Handler:    _Query_GetDIDDocument_Handler,
+		},
+		{
+			MethodName: "ListDIDDocuments",
+			Handler:    _Query_ListDIDDocuments_Handler,
+		},
+		{
+			MethodName: "GetDIDDocumentsByController",
+			Handler:    _Query_GetDIDDocumentsByController_Handler,
+		},
+		{
+			MethodName: "GetVerificationMethod",
+			Handler:    _Query_GetVerificationMethod_Handler,
+		},
+		{
+			MethodName: "GetService",
+			Handler:    _Query_GetService_Handler,
+		},
+		{
+			MethodName: "GetVerifiableCredential",
+			Handler:    _Query_GetVerifiableCredential_Handler,
+		},
+		{
+			MethodName: "ListVerifiableCredentials",
+			Handler:    _Query_ListVerifiableCredentials_Handler,
+		},
+		{
+			MethodName: "GetCredentialsByDID",
+			Handler:    _Query_GetCredentialsByDID_Handler,
+		},
+		{
+			MethodName: "RegisterStart",
+			Handler:    _Query_RegisterStart_Handler,
+		},
+		{
+			MethodName: "LoginStart",
+			Handler:    _Query_LoginStart_Handler,
 		},
 	},
 	Streams:  []grpc.StreamDesc{},

api/did/v1/tx_grpc.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.5.1
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             (unknown)
 // source: did/v1/tx.proto
 
@@ -15,37 +15,69 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.64.0 or later.
-const _ = grpc.SupportPackageIsVersion9
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
 
 const (
-	Msg_ExecuteTx_FullMethodName            = "/did.v1.Msg/ExecuteTx"
-	Msg_LinkAssertion_FullMethodName        = "/did.v1.Msg/LinkAssertion"
-	Msg_LinkAuthentication_FullMethodName   = "/did.v1.Msg/LinkAuthentication"
-	Msg_UnlinkAssertion_FullMethodName      = "/did.v1.Msg/UnlinkAssertion"
-	Msg_UnlinkAuthentication_FullMethodName = "/did.v1.Msg/UnlinkAuthentication"
-	Msg_UpdateParams_FullMethodName         = "/did.v1.Msg/UpdateParams"
+	Msg_UpdateParams_FullMethodName               = "/did.v1.Msg/UpdateParams"
+	Msg_CreateDID_FullMethodName                  = "/did.v1.Msg/CreateDID"
+	Msg_UpdateDID_FullMethodName                  = "/did.v1.Msg/UpdateDID"
+	Msg_DeactivateDID_FullMethodName              = "/did.v1.Msg/DeactivateDID"
+	Msg_AddVerificationMethod_FullMethodName      = "/did.v1.Msg/AddVerificationMethod"
+	Msg_RemoveVerificationMethod_FullMethodName   = "/did.v1.Msg/RemoveVerificationMethod"
+	Msg_AddService_FullMethodName                 = "/did.v1.Msg/AddService"
+	Msg_RemoveService_FullMethodName              = "/did.v1.Msg/RemoveService"
+	Msg_IssueVerifiableCredential_FullMethodName  = "/did.v1.Msg/IssueVerifiableCredential"
+	Msg_RevokeVerifiableCredential_FullMethodName = "/did.v1.Msg/RevokeVerifiableCredential"
+	Msg_LinkExternalWallet_FullMethodName         = "/did.v1.Msg/LinkExternalWallet"
+	Msg_RegisterWebAuthnCredential_FullMethodName = "/did.v1.Msg/RegisterWebAuthnCredential"
 )
 
 // MsgClient is the client API for Msg service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-//
-// Msg defines the Msg service.
 type MsgClient interface {
-	// ExecuteTx executes a transaction on the Sonr Blockchain. It leverages
-	// Macaroon for verification.
-	ExecuteTx(ctx context.Context, in *MsgExecuteTx, opts ...grpc.CallOption) (*MsgExecuteTxResponse, error)
-	// LinkAssertion links an assertion to a controller.
-	LinkAssertion(ctx context.Context, in *MsgLinkAssertion, opts ...grpc.CallOption) (*MsgLinkAssertionResponse, error)
-	// LinkAuthentication links an authentication to a controller.
-	LinkAuthentication(ctx context.Context, in *MsgLinkAuthentication, opts ...grpc.CallOption) (*MsgLinkAuthenticationResponse, error)
-	// UnlinkAssertion unlinks an assertion from a controller.
-	UnlinkAssertion(ctx context.Context, in *MsgUnlinkAssertion, opts ...grpc.CallOption) (*MsgUnlinkAssertionResponse, error)
-	// UnlinkAuthentication unlinks an authentication from a controller.
-	UnlinkAuthentication(ctx context.Context, in *MsgUnlinkAuthentication, opts ...grpc.CallOption) (*MsgUnlinkAuthenticationResponse, error)
 	// UpdateParams defines a governance operation for updating the parameters.
+	//
+	// Since: cosmos-sdk 0.47
 	UpdateParams(ctx context.Context, in *MsgUpdateParams, opts ...grpc.CallOption) (*MsgUpdateParamsResponse, error)
+	// CreateDID creates a new DID document
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "did_tx_docs.md"}}
+	CreateDID(ctx context.Context, in *MsgCreateDID, opts ...grpc.CallOption) (*MsgCreateDIDResponse, error)
+	// UpdateDID updates an existing DID document
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "did_tx_docs.md"}}
+	UpdateDID(ctx context.Context, in *MsgUpdateDID, opts ...grpc.CallOption) (*MsgUpdateDIDResponse, error)
+	// DeactivateDID deactivates a DID document
+	DeactivateDID(ctx context.Context, in *MsgDeactivateDID, opts ...grpc.CallOption) (*MsgDeactivateDIDResponse, error)
+	// AddVerificationMethod adds a new verification method to a DID document
+	AddVerificationMethod(ctx context.Context, in *MsgAddVerificationMethod, opts ...grpc.CallOption) (*MsgAddVerificationMethodResponse, error)
+	// RemoveVerificationMethod removes a verification method from a DID document
+	RemoveVerificationMethod(ctx context.Context, in *MsgRemoveVerificationMethod, opts ...grpc.CallOption) (*MsgRemoveVerificationMethodResponse, error)
+	// AddService adds a new service endpoint to a DID document
+	AddService(ctx context.Context, in *MsgAddService, opts ...grpc.CallOption) (*MsgAddServiceResponse, error)
+	// RemoveService removes a service endpoint from a DID document
+	RemoveService(ctx context.Context, in *MsgRemoveService, opts ...grpc.CallOption) (*MsgRemoveServiceResponse, error)
+	// IssueVerifiableCredential issues a new verifiable credential
+	IssueVerifiableCredential(ctx context.Context, in *MsgIssueVerifiableCredential, opts ...grpc.CallOption) (*MsgIssueVerifiableCredentialResponse, error)
+	// RevokeVerifiableCredential revokes a verifiable credential
+	RevokeVerifiableCredential(ctx context.Context, in *MsgRevokeVerifiableCredential, opts ...grpc.CallOption) (*MsgRevokeVerifiableCredentialResponse, error)
+	// LinkExternalWallet links an external wallet as an assertion method
+	LinkExternalWallet(ctx context.Context, in *MsgLinkExternalWallet, opts ...grpc.CallOption) (*MsgLinkExternalWalletResponse, error)
+	// RegisterWebAuthnCredential registers a new WebAuthn credential and creates a DID
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "did_tx_docs.md"}}
+	RegisterWebAuthnCredential(ctx context.Context, in *MsgRegisterWebAuthnCredential, opts ...grpc.CallOption) (*MsgRegisterWebAuthnCredentialResponse, error)
 }
 
 type msgClient struct {
@@ -56,60 +88,108 @@ func NewMsgClient(cc grpc.ClientConnInterface) MsgClient {
 	return &msgClient{cc}
 }
 
-func (c *msgClient) ExecuteTx(ctx context.Context, in *MsgExecuteTx, opts ...grpc.CallOption) (*MsgExecuteTxResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(MsgExecuteTxResponse)
-	err := c.cc.Invoke(ctx, Msg_ExecuteTx_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *msgClient) LinkAssertion(ctx context.Context, in *MsgLinkAssertion, opts ...grpc.CallOption) (*MsgLinkAssertionResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(MsgLinkAssertionResponse)
-	err := c.cc.Invoke(ctx, Msg_LinkAssertion_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *msgClient) LinkAuthentication(ctx context.Context, in *MsgLinkAuthentication, opts ...grpc.CallOption) (*MsgLinkAuthenticationResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(MsgLinkAuthenticationResponse)
-	err := c.cc.Invoke(ctx, Msg_LinkAuthentication_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *msgClient) UnlinkAssertion(ctx context.Context, in *MsgUnlinkAssertion, opts ...grpc.CallOption) (*MsgUnlinkAssertionResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(MsgUnlinkAssertionResponse)
-	err := c.cc.Invoke(ctx, Msg_UnlinkAssertion_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *msgClient) UnlinkAuthentication(ctx context.Context, in *MsgUnlinkAuthentication, opts ...grpc.CallOption) (*MsgUnlinkAuthenticationResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(MsgUnlinkAuthenticationResponse)
-	err := c.cc.Invoke(ctx, Msg_UnlinkAuthentication_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *msgClient) UpdateParams(ctx context.Context, in *MsgUpdateParams, opts ...grpc.CallOption) (*MsgUpdateParamsResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(MsgUpdateParamsResponse)
-	err := c.cc.Invoke(ctx, Msg_UpdateParams_FullMethodName, in, out, cOpts...)
+	err := c.cc.Invoke(ctx, Msg_UpdateParams_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) CreateDID(ctx context.Context, in *MsgCreateDID, opts ...grpc.CallOption) (*MsgCreateDIDResponse, error) {
+	out := new(MsgCreateDIDResponse)
+	err := c.cc.Invoke(ctx, Msg_CreateDID_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) UpdateDID(ctx context.Context, in *MsgUpdateDID, opts ...grpc.CallOption) (*MsgUpdateDIDResponse, error) {
+	out := new(MsgUpdateDIDResponse)
+	err := c.cc.Invoke(ctx, Msg_UpdateDID_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) DeactivateDID(ctx context.Context, in *MsgDeactivateDID, opts ...grpc.CallOption) (*MsgDeactivateDIDResponse, error) {
+	out := new(MsgDeactivateDIDResponse)
+	err := c.cc.Invoke(ctx, Msg_DeactivateDID_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) AddVerificationMethod(ctx context.Context, in *MsgAddVerificationMethod, opts ...grpc.CallOption) (*MsgAddVerificationMethodResponse, error) {
+	out := new(MsgAddVerificationMethodResponse)
+	err := c.cc.Invoke(ctx, Msg_AddVerificationMethod_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) RemoveVerificationMethod(ctx context.Context, in *MsgRemoveVerificationMethod, opts ...grpc.CallOption) (*MsgRemoveVerificationMethodResponse, error) {
+	out := new(MsgRemoveVerificationMethodResponse)
+	err := c.cc.Invoke(ctx, Msg_RemoveVerificationMethod_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) AddService(ctx context.Context, in *MsgAddService, opts ...grpc.CallOption) (*MsgAddServiceResponse, error) {
+	out := new(MsgAddServiceResponse)
+	err := c.cc.Invoke(ctx, Msg_AddService_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) RemoveService(ctx context.Context, in *MsgRemoveService, opts ...grpc.CallOption) (*MsgRemoveServiceResponse, error) {
+	out := new(MsgRemoveServiceResponse)
+	err := c.cc.Invoke(ctx, Msg_RemoveService_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) IssueVerifiableCredential(ctx context.Context, in *MsgIssueVerifiableCredential, opts ...grpc.CallOption) (*MsgIssueVerifiableCredentialResponse, error) {
+	out := new(MsgIssueVerifiableCredentialResponse)
+	err := c.cc.Invoke(ctx, Msg_IssueVerifiableCredential_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) RevokeVerifiableCredential(ctx context.Context, in *MsgRevokeVerifiableCredential, opts ...grpc.CallOption) (*MsgRevokeVerifiableCredentialResponse, error) {
+	out := new(MsgRevokeVerifiableCredentialResponse)
+	err := c.cc.Invoke(ctx, Msg_RevokeVerifiableCredential_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) LinkExternalWallet(ctx context.Context, in *MsgLinkExternalWallet, opts ...grpc.CallOption) (*MsgLinkExternalWalletResponse, error) {
+	out := new(MsgLinkExternalWalletResponse)
+	err := c.cc.Invoke(ctx, Msg_LinkExternalWallet_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) RegisterWebAuthnCredential(ctx context.Context, in *MsgRegisterWebAuthnCredential, opts ...grpc.CallOption) (*MsgRegisterWebAuthnCredentialResponse, error) {
+	out := new(MsgRegisterWebAuthnCredentialResponse)
+	err := c.cc.Invoke(ctx, Msg_RegisterWebAuthnCredential_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -118,53 +198,93 @@ func (c *msgClient) UpdateParams(ctx context.Context, in *MsgUpdateParams, opts
 
 // MsgServer is the server API for Msg service.
 // All implementations must embed UnimplementedMsgServer
-// for forward compatibility.
-//
-// Msg defines the Msg service.
+// for forward compatibility
 type MsgServer interface {
-	// ExecuteTx executes a transaction on the Sonr Blockchain. It leverages
-	// Macaroon for verification.
-	ExecuteTx(context.Context, *MsgExecuteTx) (*MsgExecuteTxResponse, error)
-	// LinkAssertion links an assertion to a controller.
-	LinkAssertion(context.Context, *MsgLinkAssertion) (*MsgLinkAssertionResponse, error)
-	// LinkAuthentication links an authentication to a controller.
-	LinkAuthentication(context.Context, *MsgLinkAuthentication) (*MsgLinkAuthenticationResponse, error)
-	// UnlinkAssertion unlinks an assertion from a controller.
-	UnlinkAssertion(context.Context, *MsgUnlinkAssertion) (*MsgUnlinkAssertionResponse, error)
-	// UnlinkAuthentication unlinks an authentication from a controller.
-	UnlinkAuthentication(context.Context, *MsgUnlinkAuthentication) (*MsgUnlinkAuthenticationResponse, error)
 	// UpdateParams defines a governance operation for updating the parameters.
+	//
+	// Since: cosmos-sdk 0.47
 	UpdateParams(context.Context, *MsgUpdateParams) (*MsgUpdateParamsResponse, error)
+	// CreateDID creates a new DID document
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "did_tx_docs.md"}}
+	CreateDID(context.Context, *MsgCreateDID) (*MsgCreateDIDResponse, error)
+	// UpdateDID updates an existing DID document
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "did_tx_docs.md"}}
+	UpdateDID(context.Context, *MsgUpdateDID) (*MsgUpdateDIDResponse, error)
+	// DeactivateDID deactivates a DID document
+	DeactivateDID(context.Context, *MsgDeactivateDID) (*MsgDeactivateDIDResponse, error)
+	// AddVerificationMethod adds a new verification method to a DID document
+	AddVerificationMethod(context.Context, *MsgAddVerificationMethod) (*MsgAddVerificationMethodResponse, error)
+	// RemoveVerificationMethod removes a verification method from a DID document
+	RemoveVerificationMethod(context.Context, *MsgRemoveVerificationMethod) (*MsgRemoveVerificationMethodResponse, error)
+	// AddService adds a new service endpoint to a DID document
+	AddService(context.Context, *MsgAddService) (*MsgAddServiceResponse, error)
+	// RemoveService removes a service endpoint from a DID document
+	RemoveService(context.Context, *MsgRemoveService) (*MsgRemoveServiceResponse, error)
+	// IssueVerifiableCredential issues a new verifiable credential
+	IssueVerifiableCredential(context.Context, *MsgIssueVerifiableCredential) (*MsgIssueVerifiableCredentialResponse, error)
+	// RevokeVerifiableCredential revokes a verifiable credential
+	RevokeVerifiableCredential(context.Context, *MsgRevokeVerifiableCredential) (*MsgRevokeVerifiableCredentialResponse, error)
+	// LinkExternalWallet links an external wallet as an assertion method
+	LinkExternalWallet(context.Context, *MsgLinkExternalWallet) (*MsgLinkExternalWalletResponse, error)
+	// RegisterWebAuthnCredential registers a new WebAuthn credential and creates a DID
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "did_tx_docs.md"}}
+	RegisterWebAuthnCredential(context.Context, *MsgRegisterWebAuthnCredential) (*MsgRegisterWebAuthnCredentialResponse, error)
 	mustEmbedUnimplementedMsgServer()
 }
 
-// UnimplementedMsgServer must be embedded to have
-// forward compatible implementations.
-//
-// NOTE: this should be embedded by value instead of pointer to avoid a nil
-// pointer dereference when methods are called.
-type UnimplementedMsgServer struct{}
+// UnimplementedMsgServer must be embedded to have forward compatible implementations.
+type UnimplementedMsgServer struct {
+}
 
-func (UnimplementedMsgServer) ExecuteTx(context.Context, *MsgExecuteTx) (*MsgExecuteTxResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ExecuteTx not implemented")
-}
-func (UnimplementedMsgServer) LinkAssertion(context.Context, *MsgLinkAssertion) (*MsgLinkAssertionResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method LinkAssertion not implemented")
-}
-func (UnimplementedMsgServer) LinkAuthentication(context.Context, *MsgLinkAuthentication) (*MsgLinkAuthenticationResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method LinkAuthentication not implemented")
-}
-func (UnimplementedMsgServer) UnlinkAssertion(context.Context, *MsgUnlinkAssertion) (*MsgUnlinkAssertionResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method UnlinkAssertion not implemented")
-}
-func (UnimplementedMsgServer) UnlinkAuthentication(context.Context, *MsgUnlinkAuthentication) (*MsgUnlinkAuthenticationResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method UnlinkAuthentication not implemented")
-}
 func (UnimplementedMsgServer) UpdateParams(context.Context, *MsgUpdateParams) (*MsgUpdateParamsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateParams not implemented")
 }
+func (UnimplementedMsgServer) CreateDID(context.Context, *MsgCreateDID) (*MsgCreateDIDResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateDID not implemented")
+}
+func (UnimplementedMsgServer) UpdateDID(context.Context, *MsgUpdateDID) (*MsgUpdateDIDResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateDID not implemented")
+}
+func (UnimplementedMsgServer) DeactivateDID(context.Context, *MsgDeactivateDID) (*MsgDeactivateDIDResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeactivateDID not implemented")
+}
+func (UnimplementedMsgServer) AddVerificationMethod(context.Context, *MsgAddVerificationMethod) (*MsgAddVerificationMethodResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AddVerificationMethod not implemented")
+}
+func (UnimplementedMsgServer) RemoveVerificationMethod(context.Context, *MsgRemoveVerificationMethod) (*MsgRemoveVerificationMethodResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveVerificationMethod not implemented")
+}
+func (UnimplementedMsgServer) AddService(context.Context, *MsgAddService) (*MsgAddServiceResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AddService not implemented")
+}
+func (UnimplementedMsgServer) RemoveService(context.Context, *MsgRemoveService) (*MsgRemoveServiceResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveService not implemented")
+}
+func (UnimplementedMsgServer) IssueVerifiableCredential(context.Context, *MsgIssueVerifiableCredential) (*MsgIssueVerifiableCredentialResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method IssueVerifiableCredential not implemented")
+}
+func (UnimplementedMsgServer) RevokeVerifiableCredential(context.Context, *MsgRevokeVerifiableCredential) (*MsgRevokeVerifiableCredentialResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RevokeVerifiableCredential not implemented")
+}
+func (UnimplementedMsgServer) LinkExternalWallet(context.Context, *MsgLinkExternalWallet) (*MsgLinkExternalWalletResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method LinkExternalWallet not implemented")
+}
+func (UnimplementedMsgServer) RegisterWebAuthnCredential(context.Context, *MsgRegisterWebAuthnCredential) (*MsgRegisterWebAuthnCredentialResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RegisterWebAuthnCredential not implemented")
+}
 func (UnimplementedMsgServer) mustEmbedUnimplementedMsgServer() {}
-func (UnimplementedMsgServer) testEmbeddedByValue()             {}
 
 // UnsafeMsgServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to MsgServer will
@@ -174,106 +294,9 @@ type UnsafeMsgServer interface {
 }
 
 func RegisterMsgServer(s grpc.ServiceRegistrar, srv MsgServer) {
-	// If the following call pancis, it indicates UnimplementedMsgServer was
-	// embedded by pointer and is nil.  This will cause panics if an
-	// unimplemented method is ever invoked, so we test this at initialization
-	// time to prevent it from happening at runtime later due to I/O.
-	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
-		t.testEmbeddedByValue()
-	}
 	s.RegisterService(&Msg_ServiceDesc, srv)
 }
 
-func _Msg_ExecuteTx_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(MsgExecuteTx)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(MsgServer).ExecuteTx(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Msg_ExecuteTx_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(MsgServer).ExecuteTx(ctx, req.(*MsgExecuteTx))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Msg_LinkAssertion_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(MsgLinkAssertion)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(MsgServer).LinkAssertion(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Msg_LinkAssertion_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(MsgServer).LinkAssertion(ctx, req.(*MsgLinkAssertion))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Msg_LinkAuthentication_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(MsgLinkAuthentication)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(MsgServer).LinkAuthentication(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Msg_LinkAuthentication_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(MsgServer).LinkAuthentication(ctx, req.(*MsgLinkAuthentication))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Msg_UnlinkAssertion_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(MsgUnlinkAssertion)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(MsgServer).UnlinkAssertion(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Msg_UnlinkAssertion_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(MsgServer).UnlinkAssertion(ctx, req.(*MsgUnlinkAssertion))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Msg_UnlinkAuthentication_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(MsgUnlinkAuthentication)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(MsgServer).UnlinkAuthentication(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Msg_UnlinkAuthentication_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(MsgServer).UnlinkAuthentication(ctx, req.(*MsgUnlinkAuthentication))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _Msg_UpdateParams_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(MsgUpdateParams)
 	if err := dec(in); err != nil {
@@ -292,6 +315,204 @@ func _Msg_UpdateParams_Handler(srv interface{}, ctx context.Context, dec func(in
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Msg_CreateDID_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgCreateDID)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).CreateDID(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_CreateDID_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).CreateDID(ctx, req.(*MsgCreateDID))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_UpdateDID_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgUpdateDID)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).UpdateDID(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_UpdateDID_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).UpdateDID(ctx, req.(*MsgUpdateDID))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_DeactivateDID_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgDeactivateDID)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).DeactivateDID(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_DeactivateDID_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).DeactivateDID(ctx, req.(*MsgDeactivateDID))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_AddVerificationMethod_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgAddVerificationMethod)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).AddVerificationMethod(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_AddVerificationMethod_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).AddVerificationMethod(ctx, req.(*MsgAddVerificationMethod))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_RemoveVerificationMethod_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgRemoveVerificationMethod)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).RemoveVerificationMethod(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_RemoveVerificationMethod_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).RemoveVerificationMethod(ctx, req.(*MsgRemoveVerificationMethod))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_AddService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgAddService)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).AddService(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_AddService_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).AddService(ctx, req.(*MsgAddService))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_RemoveService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgRemoveService)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).RemoveService(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_RemoveService_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).RemoveService(ctx, req.(*MsgRemoveService))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_IssueVerifiableCredential_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgIssueVerifiableCredential)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).IssueVerifiableCredential(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_IssueVerifiableCredential_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).IssueVerifiableCredential(ctx, req.(*MsgIssueVerifiableCredential))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_RevokeVerifiableCredential_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgRevokeVerifiableCredential)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).RevokeVerifiableCredential(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_RevokeVerifiableCredential_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).RevokeVerifiableCredential(ctx, req.(*MsgRevokeVerifiableCredential))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_LinkExternalWallet_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgLinkExternalWallet)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).LinkExternalWallet(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_LinkExternalWallet_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).LinkExternalWallet(ctx, req.(*MsgLinkExternalWallet))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_RegisterWebAuthnCredential_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgRegisterWebAuthnCredential)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).RegisterWebAuthnCredential(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_RegisterWebAuthnCredential_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).RegisterWebAuthnCredential(ctx, req.(*MsgRegisterWebAuthnCredential))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // Msg_ServiceDesc is the grpc.ServiceDesc for Msg service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -299,30 +520,54 @@ var Msg_ServiceDesc = grpc.ServiceDesc{
 	ServiceName: "did.v1.Msg",
 	HandlerType: (*MsgServer)(nil),
 	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "ExecuteTx",
-			Handler:    _Msg_ExecuteTx_Handler,
-		},
-		{
-			MethodName: "LinkAssertion",
-			Handler:    _Msg_LinkAssertion_Handler,
-		},
-		{
-			MethodName: "LinkAuthentication",
-			Handler:    _Msg_LinkAuthentication_Handler,
-		},
-		{
-			MethodName: "UnlinkAssertion",
-			Handler:    _Msg_UnlinkAssertion_Handler,
-		},
-		{
-			MethodName: "UnlinkAuthentication",
-			Handler:    _Msg_UnlinkAuthentication_Handler,
-		},
 		{
 			MethodName: "UpdateParams",
 			Handler:    _Msg_UpdateParams_Handler,
 		},
+		{
+			MethodName: "CreateDID",
+			Handler:    _Msg_CreateDID_Handler,
+		},
+		{
+			MethodName: "UpdateDID",
+			Handler:    _Msg_UpdateDID_Handler,
+		},
+		{
+			MethodName: "DeactivateDID",
+			Handler:    _Msg_DeactivateDID_Handler,
+		},
+		{
+			MethodName: "AddVerificationMethod",
+			Handler:    _Msg_AddVerificationMethod_Handler,
+		},
+		{
+			MethodName: "RemoveVerificationMethod",
+			Handler:    _Msg_RemoveVerificationMethod_Handler,
+		},
+		{
+			MethodName: "AddService",
+			Handler:    _Msg_AddService_Handler,
+		},
+		{
+			MethodName: "RemoveService",
+			Handler:    _Msg_RemoveService_Handler,
+		},
+		{
+			MethodName: "IssueVerifiableCredential",
+			Handler:    _Msg_IssueVerifiableCredential_Handler,
+		},
+		{
+			MethodName: "RevokeVerifiableCredential",
+			Handler:    _Msg_RevokeVerifiableCredential_Handler,
+		},
+		{
+			MethodName: "LinkExternalWallet",
+			Handler:    _Msg_LinkExternalWallet_Handler,
+		},
+		{
+			MethodName: "RegisterWebAuthnCredential",
+			Handler:    _Msg_RegisterWebAuthnCredential_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "did/v1/tx.proto",

api/dwn/module/v1/module.pulsar.go

@@ -417,21 +417,21 @@ var file_dwn_module_v1_module_proto_rawDesc = []byte{
 	0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x64, 0x77,
 	0x6e, 0x2e, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x20, 0x63, 0x6f, 0x73,
 	0x6d, 0x6f, 0x73, 0x2f, 0x61, 0x70, 0x70, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
-	0x2f, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x28, 0x0a,
-	0x06, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x3a, 0x1e, 0xba, 0xc0, 0x96, 0xda, 0x01, 0x18, 0x0a,
-	0x16, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x6e, 0x73, 0x6f,
-	0x6e, 0x72, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x42, 0xa9, 0x01, 0x0a, 0x11, 0x63, 0x6f, 0x6d, 0x2e,
-	0x64, 0x77, 0x6e, 0x2e, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x42, 0x0b, 0x4d,
-	0x6f, 0x64, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x31, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x6e, 0x73, 0x6f, 0x6e, 0x72, 0x2f,
-	0x73, 0x6f, 0x6e, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x64, 0x77, 0x6e, 0x2f, 0x6d, 0x6f, 0x64,
-	0x75, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x76, 0x31, 0xa2,
-	0x02, 0x03, 0x44, 0x4d, 0x58, 0xaa, 0x02, 0x0d, 0x44, 0x77, 0x6e, 0x2e, 0x4d, 0x6f, 0x64, 0x75,
-	0x6c, 0x65, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x0d, 0x44, 0x77, 0x6e, 0x5c, 0x4d, 0x6f, 0x64, 0x75,
-	0x6c, 0x65, 0x5c, 0x56, 0x31, 0xe2, 0x02, 0x19, 0x44, 0x77, 0x6e, 0x5c, 0x4d, 0x6f, 0x64, 0x75,
-	0x6c, 0x65, 0x5c, 0x56, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0xea, 0x02, 0x0f, 0x44, 0x77, 0x6e, 0x3a, 0x3a, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x3a,
-	0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x2f, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x29, 0x0a,
+	0x06, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x3a, 0x1f, 0xba, 0xc0, 0x96, 0xda, 0x01, 0x19, 0x0a,
+	0x17, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x6f, 0x6e, 0x72,
+	0x2d, 0x69, 0x6f, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x42, 0xaa, 0x01, 0x0a, 0x11, 0x63, 0x6f, 0x6d,
+	0x2e, 0x64, 0x77, 0x6e, 0x2e, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x42, 0x0b,
+	0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x32, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x2d, 0x69,
+	0x6f, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x64, 0x77, 0x6e, 0x2f, 0x6d,
+	0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x76,
+	0x31, 0xa2, 0x02, 0x03, 0x44, 0x4d, 0x58, 0xaa, 0x02, 0x0d, 0x44, 0x77, 0x6e, 0x2e, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x0d, 0x44, 0x77, 0x6e, 0x5c, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x5c, 0x56, 0x31, 0xe2, 0x02, 0x19, 0x44, 0x77, 0x6e, 0x5c, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x5c, 0x56, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x44, 0x77, 0x6e, 0x3a, 0x3a, 0x4d, 0x6f, 0x64, 0x75, 0x6c,
+	0x65, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

api/dwn/v1/query_grpc.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.5.1
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             (unknown)
 // source: dwn/v1/query.proto
 
@@ -15,33 +15,60 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.64.0 or later.
-const _ = grpc.SupportPackageIsVersion9
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
 
 const (
-	Query_Params_FullMethodName   = "/dwn.v1.Query/Params"
-	Query_Schema_FullMethodName   = "/dwn.v1.Query/Schema"
-	Query_Allocate_FullMethodName = "/dwn.v1.Query/Allocate"
-	Query_Sync_FullMethodName     = "/dwn.v1.Query/Sync"
+	Query_Params_FullMethodName           = "/dwn.v1.Query/Params"
+	Query_IPFS_FullMethodName             = "/dwn.v1.Query/IPFS"
+	Query_CID_FullMethodName              = "/dwn.v1.Query/CID"
+	Query_Records_FullMethodName          = "/dwn.v1.Query/Records"
+	Query_Record_FullMethodName           = "/dwn.v1.Query/Record"
+	Query_Protocols_FullMethodName        = "/dwn.v1.Query/Protocols"
+	Query_Protocol_FullMethodName         = "/dwn.v1.Query/Protocol"
+	Query_Permissions_FullMethodName      = "/dwn.v1.Query/Permissions"
+	Query_Vault_FullMethodName            = "/dwn.v1.Query/Vault"
+	Query_Vaults_FullMethodName           = "/dwn.v1.Query/Vaults"
+	Query_EncryptedRecord_FullMethodName  = "/dwn.v1.Query/EncryptedRecord"
+	Query_EncryptionStatus_FullMethodName = "/dwn.v1.Query/EncryptionStatus"
+	Query_VRFContributions_FullMethodName = "/dwn.v1.Query/VRFContributions"
 )
 
 // QueryClient is the client API for Query service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-//
-// Query provides defines the gRPC querier service.
 type QueryClient interface {
 	// Params queries all parameters of the module.
 	Params(ctx context.Context, in *QueryParamsRequest, opts ...grpc.CallOption) (*QueryParamsResponse, error)
-	// Schema queries the DID document by its id. And returns the required PKL
-	// information
-	Schema(ctx context.Context, in *QuerySchemaRequest, opts ...grpc.CallOption) (*QuerySchemaResponse, error)
-	// Allocate initializes a Target Vault available for claims with a compatible
-	// Authentication mechanism. The default authentication mechanism is WebAuthn.
-	Allocate(ctx context.Context, in *QueryAllocateRequest, opts ...grpc.CallOption) (*QueryAllocateResponse, error)
-	// Sync queries the DID document by its id. And returns the required PKL
-	// information
-	Sync(ctx context.Context, in *QuerySyncRequest, opts ...grpc.CallOption) (*QuerySyncResponse, error)
+	// IPFS queries the status of the IPFS node
+	IPFS(ctx context.Context, in *QueryIPFSRequest, opts ...grpc.CallOption) (*QueryIPFSResponse, error)
+	// CID returns the data for a given CID
+	CID(ctx context.Context, in *QueryCIDRequest, opts ...grpc.CallOption) (*QueryCIDResponse, error)
+	// Records queries DWN records with filters
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dwn_docs.md"}}
+	Records(ctx context.Context, in *QueryRecordsRequest, opts ...grpc.CallOption) (*QueryRecordsResponse, error)
+	// Record queries a specific DWN record by ID
+	Record(ctx context.Context, in *QueryRecordRequest, opts ...grpc.CallOption) (*QueryRecordResponse, error)
+	// Protocols queries DWN protocols
+	Protocols(ctx context.Context, in *QueryProtocolsRequest, opts ...grpc.CallOption) (*QueryProtocolsResponse, error)
+	// Protocol queries a specific DWN protocol
+	Protocol(ctx context.Context, in *QueryProtocolRequest, opts ...grpc.CallOption) (*QueryProtocolResponse, error)
+	// Permissions queries DWN permissions
+	Permissions(ctx context.Context, in *QueryPermissionsRequest, opts ...grpc.CallOption) (*QueryPermissionsResponse, error)
+	// Vault queries a specific vault
+	Vault(ctx context.Context, in *QueryVaultRequest, opts ...grpc.CallOption) (*QueryVaultResponse, error)
+	// Vaults queries vaults by owner
+	Vaults(ctx context.Context, in *QueryVaultsRequest, opts ...grpc.CallOption) (*QueryVaultsResponse, error)
+	// EncryptedRecord queries a specific encrypted record with automatic decryption
+	EncryptedRecord(ctx context.Context, in *QueryEncryptedRecordRequest, opts ...grpc.CallOption) (*QueryEncryptedRecordResponse, error)
+	// EncryptionStatus queries current encryption key state and version
+	EncryptionStatus(ctx context.Context, in *QueryEncryptionStatusRequest, opts ...grpc.CallOption) (*QueryEncryptionStatusResponse, error)
+	// VRFContributions lists VRF contributions for current consensus round
+	VRFContributions(ctx context.Context, in *QueryVRFContributionsRequest, opts ...grpc.CallOption) (*QueryVRFContributionsResponse, error)
 }
 
 type queryClient struct {
@@ -53,39 +80,116 @@ func NewQueryClient(cc grpc.ClientConnInterface) QueryClient {
 }
 
 func (c *queryClient) Params(ctx context.Context, in *QueryParamsRequest, opts ...grpc.CallOption) (*QueryParamsResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(QueryParamsResponse)
-	err := c.cc.Invoke(ctx, Query_Params_FullMethodName, in, out, cOpts...)
+	err := c.cc.Invoke(ctx, Query_Params_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *queryClient) Schema(ctx context.Context, in *QuerySchemaRequest, opts ...grpc.CallOption) (*QuerySchemaResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(QuerySchemaResponse)
-	err := c.cc.Invoke(ctx, Query_Schema_FullMethodName, in, out, cOpts...)
+func (c *queryClient) IPFS(ctx context.Context, in *QueryIPFSRequest, opts ...grpc.CallOption) (*QueryIPFSResponse, error) {
+	out := new(QueryIPFSResponse)
+	err := c.cc.Invoke(ctx, Query_IPFS_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *queryClient) Allocate(ctx context.Context, in *QueryAllocateRequest, opts ...grpc.CallOption) (*QueryAllocateResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(QueryAllocateResponse)
-	err := c.cc.Invoke(ctx, Query_Allocate_FullMethodName, in, out, cOpts...)
+func (c *queryClient) CID(ctx context.Context, in *QueryCIDRequest, opts ...grpc.CallOption) (*QueryCIDResponse, error) {
+	out := new(QueryCIDResponse)
+	err := c.cc.Invoke(ctx, Query_CID_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *queryClient) Sync(ctx context.Context, in *QuerySyncRequest, opts ...grpc.CallOption) (*QuerySyncResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(QuerySyncResponse)
-	err := c.cc.Invoke(ctx, Query_Sync_FullMethodName, in, out, cOpts...)
+func (c *queryClient) Records(ctx context.Context, in *QueryRecordsRequest, opts ...grpc.CallOption) (*QueryRecordsResponse, error) {
+	out := new(QueryRecordsResponse)
+	err := c.cc.Invoke(ctx, Query_Records_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) Record(ctx context.Context, in *QueryRecordRequest, opts ...grpc.CallOption) (*QueryRecordResponse, error) {
+	out := new(QueryRecordResponse)
+	err := c.cc.Invoke(ctx, Query_Record_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) Protocols(ctx context.Context, in *QueryProtocolsRequest, opts ...grpc.CallOption) (*QueryProtocolsResponse, error) {
+	out := new(QueryProtocolsResponse)
+	err := c.cc.Invoke(ctx, Query_Protocols_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) Protocol(ctx context.Context, in *QueryProtocolRequest, opts ...grpc.CallOption) (*QueryProtocolResponse, error) {
+	out := new(QueryProtocolResponse)
+	err := c.cc.Invoke(ctx, Query_Protocol_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) Permissions(ctx context.Context, in *QueryPermissionsRequest, opts ...grpc.CallOption) (*QueryPermissionsResponse, error) {
+	out := new(QueryPermissionsResponse)
+	err := c.cc.Invoke(ctx, Query_Permissions_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) Vault(ctx context.Context, in *QueryVaultRequest, opts ...grpc.CallOption) (*QueryVaultResponse, error) {
+	out := new(QueryVaultResponse)
+	err := c.cc.Invoke(ctx, Query_Vault_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) Vaults(ctx context.Context, in *QueryVaultsRequest, opts ...grpc.CallOption) (*QueryVaultsResponse, error) {
+	out := new(QueryVaultsResponse)
+	err := c.cc.Invoke(ctx, Query_Vaults_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) EncryptedRecord(ctx context.Context, in *QueryEncryptedRecordRequest, opts ...grpc.CallOption) (*QueryEncryptedRecordResponse, error) {
+	out := new(QueryEncryptedRecordResponse)
+	err := c.cc.Invoke(ctx, Query_EncryptedRecord_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) EncryptionStatus(ctx context.Context, in *QueryEncryptionStatusRequest, opts ...grpc.CallOption) (*QueryEncryptionStatusResponse, error) {
+	out := new(QueryEncryptionStatusResponse)
+	err := c.cc.Invoke(ctx, Query_EncryptionStatus_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) VRFContributions(ctx context.Context, in *QueryVRFContributionsRequest, opts ...grpc.CallOption) (*QueryVRFContributionsResponse, error) {
+	out := new(QueryVRFContributionsResponse)
+	err := c.cc.Invoke(ctx, Query_VRFContributions_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -94,45 +198,86 @@ func (c *queryClient) Sync(ctx context.Context, in *QuerySyncRequest, opts ...gr
 
 // QueryServer is the server API for Query service.
 // All implementations must embed UnimplementedQueryServer
-// for forward compatibility.
-//
-// Query provides defines the gRPC querier service.
+// for forward compatibility
 type QueryServer interface {
 	// Params queries all parameters of the module.
 	Params(context.Context, *QueryParamsRequest) (*QueryParamsResponse, error)
-	// Schema queries the DID document by its id. And returns the required PKL
-	// information
-	Schema(context.Context, *QuerySchemaRequest) (*QuerySchemaResponse, error)
-	// Allocate initializes a Target Vault available for claims with a compatible
-	// Authentication mechanism. The default authentication mechanism is WebAuthn.
-	Allocate(context.Context, *QueryAllocateRequest) (*QueryAllocateResponse, error)
-	// Sync queries the DID document by its id. And returns the required PKL
-	// information
-	Sync(context.Context, *QuerySyncRequest) (*QuerySyncResponse, error)
+	// IPFS queries the status of the IPFS node
+	IPFS(context.Context, *QueryIPFSRequest) (*QueryIPFSResponse, error)
+	// CID returns the data for a given CID
+	CID(context.Context, *QueryCIDRequest) (*QueryCIDResponse, error)
+	// Records queries DWN records with filters
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dwn_docs.md"}}
+	Records(context.Context, *QueryRecordsRequest) (*QueryRecordsResponse, error)
+	// Record queries a specific DWN record by ID
+	Record(context.Context, *QueryRecordRequest) (*QueryRecordResponse, error)
+	// Protocols queries DWN protocols
+	Protocols(context.Context, *QueryProtocolsRequest) (*QueryProtocolsResponse, error)
+	// Protocol queries a specific DWN protocol
+	Protocol(context.Context, *QueryProtocolRequest) (*QueryProtocolResponse, error)
+	// Permissions queries DWN permissions
+	Permissions(context.Context, *QueryPermissionsRequest) (*QueryPermissionsResponse, error)
+	// Vault queries a specific vault
+	Vault(context.Context, *QueryVaultRequest) (*QueryVaultResponse, error)
+	// Vaults queries vaults by owner
+	Vaults(context.Context, *QueryVaultsRequest) (*QueryVaultsResponse, error)
+	// EncryptedRecord queries a specific encrypted record with automatic decryption
+	EncryptedRecord(context.Context, *QueryEncryptedRecordRequest) (*QueryEncryptedRecordResponse, error)
+	// EncryptionStatus queries current encryption key state and version
+	EncryptionStatus(context.Context, *QueryEncryptionStatusRequest) (*QueryEncryptionStatusResponse, error)
+	// VRFContributions lists VRF contributions for current consensus round
+	VRFContributions(context.Context, *QueryVRFContributionsRequest) (*QueryVRFContributionsResponse, error)
 	mustEmbedUnimplementedQueryServer()
 }
 
-// UnimplementedQueryServer must be embedded to have
-// forward compatible implementations.
-//
-// NOTE: this should be embedded by value instead of pointer to avoid a nil
-// pointer dereference when methods are called.
-type UnimplementedQueryServer struct{}
+// UnimplementedQueryServer must be embedded to have forward compatible implementations.
+type UnimplementedQueryServer struct {
+}
 
 func (UnimplementedQueryServer) Params(context.Context, *QueryParamsRequest) (*QueryParamsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Params not implemented")
 }
-func (UnimplementedQueryServer) Schema(context.Context, *QuerySchemaRequest) (*QuerySchemaResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Schema not implemented")
+func (UnimplementedQueryServer) IPFS(context.Context, *QueryIPFSRequest) (*QueryIPFSResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method IPFS not implemented")
 }
-func (UnimplementedQueryServer) Allocate(context.Context, *QueryAllocateRequest) (*QueryAllocateResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Allocate not implemented")
+func (UnimplementedQueryServer) CID(context.Context, *QueryCIDRequest) (*QueryCIDResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CID not implemented")
 }
-func (UnimplementedQueryServer) Sync(context.Context, *QuerySyncRequest) (*QuerySyncResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Sync not implemented")
+func (UnimplementedQueryServer) Records(context.Context, *QueryRecordsRequest) (*QueryRecordsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Records not implemented")
+}
+func (UnimplementedQueryServer) Record(context.Context, *QueryRecordRequest) (*QueryRecordResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Record not implemented")
+}
+func (UnimplementedQueryServer) Protocols(context.Context, *QueryProtocolsRequest) (*QueryProtocolsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Protocols not implemented")
+}
+func (UnimplementedQueryServer) Protocol(context.Context, *QueryProtocolRequest) (*QueryProtocolResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Protocol not implemented")
+}
+func (UnimplementedQueryServer) Permissions(context.Context, *QueryPermissionsRequest) (*QueryPermissionsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Permissions not implemented")
+}
+func (UnimplementedQueryServer) Vault(context.Context, *QueryVaultRequest) (*QueryVaultResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Vault not implemented")
+}
+func (UnimplementedQueryServer) Vaults(context.Context, *QueryVaultsRequest) (*QueryVaultsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Vaults not implemented")
+}
+func (UnimplementedQueryServer) EncryptedRecord(context.Context, *QueryEncryptedRecordRequest) (*QueryEncryptedRecordResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method EncryptedRecord not implemented")
+}
+func (UnimplementedQueryServer) EncryptionStatus(context.Context, *QueryEncryptionStatusRequest) (*QueryEncryptionStatusResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method EncryptionStatus not implemented")
+}
+func (UnimplementedQueryServer) VRFContributions(context.Context, *QueryVRFContributionsRequest) (*QueryVRFContributionsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method VRFContributions not implemented")
 }
 func (UnimplementedQueryServer) mustEmbedUnimplementedQueryServer() {}
-func (UnimplementedQueryServer) testEmbeddedByValue()               {}
 
 // UnsafeQueryServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to QueryServer will
@@ -142,13 +287,6 @@ type UnsafeQueryServer interface {
 }
 
 func RegisterQueryServer(s grpc.ServiceRegistrar, srv QueryServer) {
-	// If the following call pancis, it indicates UnimplementedQueryServer was
-	// embedded by pointer and is nil.  This will cause panics if an
-	// unimplemented method is ever invoked, so we test this at initialization
-	// time to prevent it from happening at runtime later due to I/O.
-	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
-		t.testEmbeddedByValue()
-	}
 	s.RegisterService(&Query_ServiceDesc, srv)
 }
 
@@ -170,56 +308,218 @@ func _Query_Params_Handler(srv interface{}, ctx context.Context, dec func(interf
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Query_Schema_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(QuerySchemaRequest)
+func _Query_IPFS_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryIPFSRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(QueryServer).Schema(ctx, in)
+		return srv.(QueryServer).IPFS(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: Query_Schema_FullMethodName,
+		FullMethod: Query_IPFS_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(QueryServer).Schema(ctx, req.(*QuerySchemaRequest))
+		return srv.(QueryServer).IPFS(ctx, req.(*QueryIPFSRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Query_Allocate_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(QueryAllocateRequest)
+func _Query_CID_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryCIDRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(QueryServer).Allocate(ctx, in)
+		return srv.(QueryServer).CID(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: Query_Allocate_FullMethodName,
+		FullMethod: Query_CID_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(QueryServer).Allocate(ctx, req.(*QueryAllocateRequest))
+		return srv.(QueryServer).CID(ctx, req.(*QueryCIDRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Query_Sync_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(QuerySyncRequest)
+func _Query_Records_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryRecordsRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(QueryServer).Sync(ctx, in)
+		return srv.(QueryServer).Records(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: Query_Sync_FullMethodName,
+		FullMethod: Query_Records_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(QueryServer).Sync(ctx, req.(*QuerySyncRequest))
+		return srv.(QueryServer).Records(ctx, req.(*QueryRecordsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_Record_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryRecordRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Record(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Record_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Record(ctx, req.(*QueryRecordRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_Protocols_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryProtocolsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Protocols(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Protocols_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Protocols(ctx, req.(*QueryProtocolsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_Protocol_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryProtocolRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Protocol(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Protocol_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Protocol(ctx, req.(*QueryProtocolRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_Permissions_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryPermissionsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Permissions(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Permissions_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Permissions(ctx, req.(*QueryPermissionsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_Vault_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryVaultRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Vault(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Vault_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Vault(ctx, req.(*QueryVaultRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_Vaults_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryVaultsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Vaults(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Vaults_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Vaults(ctx, req.(*QueryVaultsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_EncryptedRecord_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryEncryptedRecordRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).EncryptedRecord(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_EncryptedRecord_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).EncryptedRecord(ctx, req.(*QueryEncryptedRecordRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_EncryptionStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryEncryptionStatusRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).EncryptionStatus(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_EncryptionStatus_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).EncryptionStatus(ctx, req.(*QueryEncryptionStatusRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_VRFContributions_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryVRFContributionsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).VRFContributions(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_VRFContributions_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).VRFContributions(ctx, req.(*QueryVRFContributionsRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -236,16 +536,52 @@ var Query_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _Query_Params_Handler,
 		},
 		{
-			MethodName: "Schema",
-			Handler:    _Query_Schema_Handler,
+			MethodName: "IPFS",
+			Handler:    _Query_IPFS_Handler,
 		},
 		{
-			MethodName: "Allocate",
-			Handler:    _Query_Allocate_Handler,
+			MethodName: "CID",
+			Handler:    _Query_CID_Handler,
 		},
 		{
-			MethodName: "Sync",
-			Handler:    _Query_Sync_Handler,
+			MethodName: "Records",
+			Handler:    _Query_Records_Handler,
+		},
+		{
+			MethodName: "Record",
+			Handler:    _Query_Record_Handler,
+		},
+		{
+			MethodName: "Protocols",
+			Handler:    _Query_Protocols_Handler,
+		},
+		{
+			MethodName: "Protocol",
+			Handler:    _Query_Protocol_Handler,
+		},
+		{
+			MethodName: "Permissions",
+			Handler:    _Query_Permissions_Handler,
+		},
+		{
+			MethodName: "Vault",
+			Handler:    _Query_Vault_Handler,
+		},
+		{
+			MethodName: "Vaults",
+			Handler:    _Query_Vaults_Handler,
+		},
+		{
+			MethodName: "EncryptedRecord",
+			Handler:    _Query_EncryptedRecord_Handler,
+		},
+		{
+			MethodName: "EncryptionStatus",
+			Handler:    _Query_EncryptionStatus_Handler,
+		},
+		{
+			MethodName: "VRFContributions",
+			Handler:    _Query_VRFContributions_Handler,
 		},
 	},
 	Streams:  []grpc.StreamDesc{},

api/dwn/v1/tx_grpc.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.5.1
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             (unknown)
 // source: dwn/v1/tx.proto
 
@@ -15,26 +15,40 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.64.0 or later.
-const _ = grpc.SupportPackageIsVersion9
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
 
 const (
-	Msg_UpdateParams_FullMethodName = "/dwn.v1.Msg/UpdateParams"
-	Msg_Initialize_FullMethodName   = "/dwn.v1.Msg/Initialize"
+	Msg_UpdateParams_FullMethodName       = "/dwn.v1.Msg/UpdateParams"
+	Msg_RecordsWrite_FullMethodName       = "/dwn.v1.Msg/RecordsWrite"
+	Msg_RecordsDelete_FullMethodName      = "/dwn.v1.Msg/RecordsDelete"
+	Msg_ProtocolsConfigure_FullMethodName = "/dwn.v1.Msg/ProtocolsConfigure"
+	Msg_PermissionsGrant_FullMethodName   = "/dwn.v1.Msg/PermissionsGrant"
+	Msg_PermissionsRevoke_FullMethodName  = "/dwn.v1.Msg/PermissionsRevoke"
+	Msg_RotateVaultKeys_FullMethodName    = "/dwn.v1.Msg/RotateVaultKeys"
 )
 
 // MsgClient is the client API for Msg service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-//
-// Msg defines the Msg service.
 type MsgClient interface {
 	// UpdateParams defines a governance operation for updating the parameters.
-	//
-	// Since: cosmos-sdk 0.47
 	UpdateParams(ctx context.Context, in *MsgUpdateParams, opts ...grpc.CallOption) (*MsgUpdateParamsResponse, error)
-	// Initialize spawns a new Vault
-	Initialize(ctx context.Context, in *MsgInitialize, opts ...grpc.CallOption) (*MsgInitializeResponse, error)
+	// DWN Records Operations
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dwn_docs.md"}}
+	RecordsWrite(ctx context.Context, in *MsgRecordsWrite, opts ...grpc.CallOption) (*MsgRecordsWriteResponse, error)
+	RecordsDelete(ctx context.Context, in *MsgRecordsDelete, opts ...grpc.CallOption) (*MsgRecordsDeleteResponse, error)
+	// DWN Protocols Operations
+	ProtocolsConfigure(ctx context.Context, in *MsgProtocolsConfigure, opts ...grpc.CallOption) (*MsgProtocolsConfigureResponse, error)
+	// DWN Permissions Operations
+	PermissionsGrant(ctx context.Context, in *MsgPermissionsGrant, opts ...grpc.CallOption) (*MsgPermissionsGrantResponse, error)
+	PermissionsRevoke(ctx context.Context, in *MsgPermissionsRevoke, opts ...grpc.CallOption) (*MsgPermissionsRevokeResponse, error)
+	// DWN Vault Operations
+	RotateVaultKeys(ctx context.Context, in *MsgRotateVaultKeys, opts ...grpc.CallOption) (*MsgRotateVaultKeysResponse, error)
 }
 
 type msgClient struct {
@@ -46,19 +60,62 @@ func NewMsgClient(cc grpc.ClientConnInterface) MsgClient {
 }
 
 func (c *msgClient) UpdateParams(ctx context.Context, in *MsgUpdateParams, opts ...grpc.CallOption) (*MsgUpdateParamsResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(MsgUpdateParamsResponse)
-	err := c.cc.Invoke(ctx, Msg_UpdateParams_FullMethodName, in, out, cOpts...)
+	err := c.cc.Invoke(ctx, Msg_UpdateParams_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *msgClient) Initialize(ctx context.Context, in *MsgInitialize, opts ...grpc.CallOption) (*MsgInitializeResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(MsgInitializeResponse)
-	err := c.cc.Invoke(ctx, Msg_Initialize_FullMethodName, in, out, cOpts...)
+func (c *msgClient) RecordsWrite(ctx context.Context, in *MsgRecordsWrite, opts ...grpc.CallOption) (*MsgRecordsWriteResponse, error) {
+	out := new(MsgRecordsWriteResponse)
+	err := c.cc.Invoke(ctx, Msg_RecordsWrite_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) RecordsDelete(ctx context.Context, in *MsgRecordsDelete, opts ...grpc.CallOption) (*MsgRecordsDeleteResponse, error) {
+	out := new(MsgRecordsDeleteResponse)
+	err := c.cc.Invoke(ctx, Msg_RecordsDelete_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) ProtocolsConfigure(ctx context.Context, in *MsgProtocolsConfigure, opts ...grpc.CallOption) (*MsgProtocolsConfigureResponse, error) {
+	out := new(MsgProtocolsConfigureResponse)
+	err := c.cc.Invoke(ctx, Msg_ProtocolsConfigure_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) PermissionsGrant(ctx context.Context, in *MsgPermissionsGrant, opts ...grpc.CallOption) (*MsgPermissionsGrantResponse, error) {
+	out := new(MsgPermissionsGrantResponse)
+	err := c.cc.Invoke(ctx, Msg_PermissionsGrant_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) PermissionsRevoke(ctx context.Context, in *MsgPermissionsRevoke, opts ...grpc.CallOption) (*MsgPermissionsRevokeResponse, error) {
+	out := new(MsgPermissionsRevokeResponse)
+	err := c.cc.Invoke(ctx, Msg_PermissionsRevoke_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) RotateVaultKeys(ctx context.Context, in *MsgRotateVaultKeys, opts ...grpc.CallOption) (*MsgRotateVaultKeysResponse, error) {
+	out := new(MsgRotateVaultKeysResponse)
+	err := c.cc.Invoke(ctx, Msg_RotateVaultKeys_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -67,34 +124,54 @@ func (c *msgClient) Initialize(ctx context.Context, in *MsgInitialize, opts ...g
 
 // MsgServer is the server API for Msg service.
 // All implementations must embed UnimplementedMsgServer
-// for forward compatibility.
-//
-// Msg defines the Msg service.
+// for forward compatibility
 type MsgServer interface {
 	// UpdateParams defines a governance operation for updating the parameters.
-	//
-	// Since: cosmos-sdk 0.47
 	UpdateParams(context.Context, *MsgUpdateParams) (*MsgUpdateParamsResponse, error)
-	// Initialize spawns a new Vault
-	Initialize(context.Context, *MsgInitialize) (*MsgInitializeResponse, error)
+	// DWN Records Operations
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "dwn_docs.md"}}
+	RecordsWrite(context.Context, *MsgRecordsWrite) (*MsgRecordsWriteResponse, error)
+	RecordsDelete(context.Context, *MsgRecordsDelete) (*MsgRecordsDeleteResponse, error)
+	// DWN Protocols Operations
+	ProtocolsConfigure(context.Context, *MsgProtocolsConfigure) (*MsgProtocolsConfigureResponse, error)
+	// DWN Permissions Operations
+	PermissionsGrant(context.Context, *MsgPermissionsGrant) (*MsgPermissionsGrantResponse, error)
+	PermissionsRevoke(context.Context, *MsgPermissionsRevoke) (*MsgPermissionsRevokeResponse, error)
+	// DWN Vault Operations
+	RotateVaultKeys(context.Context, *MsgRotateVaultKeys) (*MsgRotateVaultKeysResponse, error)
 	mustEmbedUnimplementedMsgServer()
 }
 
-// UnimplementedMsgServer must be embedded to have
-// forward compatible implementations.
-//
-// NOTE: this should be embedded by value instead of pointer to avoid a nil
-// pointer dereference when methods are called.
-type UnimplementedMsgServer struct{}
+// UnimplementedMsgServer must be embedded to have forward compatible implementations.
+type UnimplementedMsgServer struct {
+}
 
 func (UnimplementedMsgServer) UpdateParams(context.Context, *MsgUpdateParams) (*MsgUpdateParamsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateParams not implemented")
 }
-func (UnimplementedMsgServer) Initialize(context.Context, *MsgInitialize) (*MsgInitializeResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Initialize not implemented")
+func (UnimplementedMsgServer) RecordsWrite(context.Context, *MsgRecordsWrite) (*MsgRecordsWriteResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RecordsWrite not implemented")
+}
+func (UnimplementedMsgServer) RecordsDelete(context.Context, *MsgRecordsDelete) (*MsgRecordsDeleteResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RecordsDelete not implemented")
+}
+func (UnimplementedMsgServer) ProtocolsConfigure(context.Context, *MsgProtocolsConfigure) (*MsgProtocolsConfigureResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ProtocolsConfigure not implemented")
+}
+func (UnimplementedMsgServer) PermissionsGrant(context.Context, *MsgPermissionsGrant) (*MsgPermissionsGrantResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method PermissionsGrant not implemented")
+}
+func (UnimplementedMsgServer) PermissionsRevoke(context.Context, *MsgPermissionsRevoke) (*MsgPermissionsRevokeResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method PermissionsRevoke not implemented")
+}
+func (UnimplementedMsgServer) RotateVaultKeys(context.Context, *MsgRotateVaultKeys) (*MsgRotateVaultKeysResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RotateVaultKeys not implemented")
 }
 func (UnimplementedMsgServer) mustEmbedUnimplementedMsgServer() {}
-func (UnimplementedMsgServer) testEmbeddedByValue()             {}
 
 // UnsafeMsgServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to MsgServer will
@@ -104,13 +181,6 @@ type UnsafeMsgServer interface {
 }
 
 func RegisterMsgServer(s grpc.ServiceRegistrar, srv MsgServer) {
-	// If the following call pancis, it indicates UnimplementedMsgServer was
-	// embedded by pointer and is nil.  This will cause panics if an
-	// unimplemented method is ever invoked, so we test this at initialization
-	// time to prevent it from happening at runtime later due to I/O.
-	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
-		t.testEmbeddedByValue()
-	}
 	s.RegisterService(&Msg_ServiceDesc, srv)
 }
 
@@ -132,20 +202,110 @@ func _Msg_UpdateParams_Handler(srv interface{}, ctx context.Context, dec func(in
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Msg_Initialize_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(MsgInitialize)
+func _Msg_RecordsWrite_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgRecordsWrite)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(MsgServer).Initialize(ctx, in)
+		return srv.(MsgServer).RecordsWrite(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: Msg_Initialize_FullMethodName,
+		FullMethod: Msg_RecordsWrite_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(MsgServer).Initialize(ctx, req.(*MsgInitialize))
+		return srv.(MsgServer).RecordsWrite(ctx, req.(*MsgRecordsWrite))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_RecordsDelete_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgRecordsDelete)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).RecordsDelete(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_RecordsDelete_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).RecordsDelete(ctx, req.(*MsgRecordsDelete))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_ProtocolsConfigure_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgProtocolsConfigure)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).ProtocolsConfigure(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_ProtocolsConfigure_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).ProtocolsConfigure(ctx, req.(*MsgProtocolsConfigure))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_PermissionsGrant_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgPermissionsGrant)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).PermissionsGrant(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_PermissionsGrant_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).PermissionsGrant(ctx, req.(*MsgPermissionsGrant))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_PermissionsRevoke_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgPermissionsRevoke)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).PermissionsRevoke(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_PermissionsRevoke_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).PermissionsRevoke(ctx, req.(*MsgPermissionsRevoke))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_RotateVaultKeys_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgRotateVaultKeys)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).RotateVaultKeys(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_RotateVaultKeys_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).RotateVaultKeys(ctx, req.(*MsgRotateVaultKeys))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -162,8 +322,28 @@ var Msg_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _Msg_UpdateParams_Handler,
 		},
 		{
-			MethodName: "Initialize",
-			Handler:    _Msg_Initialize_Handler,
+			MethodName: "RecordsWrite",
+			Handler:    _Msg_RecordsWrite_Handler,
+		},
+		{
+			MethodName: "RecordsDelete",
+			Handler:    _Msg_RecordsDelete_Handler,
+		},
+		{
+			MethodName: "ProtocolsConfigure",
+			Handler:    _Msg_ProtocolsConfigure_Handler,
+		},
+		{
+			MethodName: "PermissionsGrant",
+			Handler:    _Msg_PermissionsGrant_Handler,
+		},
+		{
+			MethodName: "PermissionsRevoke",
+			Handler:    _Msg_PermissionsRevoke_Handler,
+		},
+		{
+			MethodName: "RotateVaultKeys",
+			Handler:    _Msg_RotateVaultKeys_Handler,
 		},
 	},
 	Streams:  []grpc.StreamDesc{},

api/svc/module/v1/module.pulsar.go

@@ -417,21 +417,21 @@ var file_svc_module_v1_module_proto_rawDesc = []byte{
 	0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x73, 0x76,
 	0x63, 0x2e, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x20, 0x63, 0x6f, 0x73,
 	0x6d, 0x6f, 0x73, 0x2f, 0x61, 0x70, 0x70, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
-	0x2f, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x28, 0x0a,
-	0x06, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x3a, 0x1e, 0xba, 0xc0, 0x96, 0xda, 0x01, 0x18, 0x0a,
-	0x16, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x6e, 0x73, 0x6f,
-	0x6e, 0x72, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x42, 0xa9, 0x01, 0x0a, 0x11, 0x63, 0x6f, 0x6d, 0x2e,
-	0x73, 0x76, 0x63, 0x2e, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x42, 0x0b, 0x4d,
-	0x6f, 0x64, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x31, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x6e, 0x73, 0x6f, 0x6e, 0x72, 0x2f,
-	0x73, 0x6f, 0x6e, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x73, 0x76, 0x63, 0x2f, 0x6d, 0x6f, 0x64,
-	0x75, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x76, 0x31, 0xa2,
-	0x02, 0x03, 0x53, 0x4d, 0x58, 0xaa, 0x02, 0x0d, 0x53, 0x76, 0x63, 0x2e, 0x4d, 0x6f, 0x64, 0x75,
-	0x6c, 0x65, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x0d, 0x53, 0x76, 0x63, 0x5c, 0x4d, 0x6f, 0x64, 0x75,
-	0x6c, 0x65, 0x5c, 0x56, 0x31, 0xe2, 0x02, 0x19, 0x53, 0x76, 0x63, 0x5c, 0x4d, 0x6f, 0x64, 0x75,
-	0x6c, 0x65, 0x5c, 0x56, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0xea, 0x02, 0x0f, 0x53, 0x76, 0x63, 0x3a, 0x3a, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x3a,
-	0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x2f, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x29, 0x0a,
+	0x06, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x3a, 0x1f, 0xba, 0xc0, 0x96, 0xda, 0x01, 0x19, 0x0a,
+	0x17, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x6f, 0x6e, 0x72,
+	0x2d, 0x69, 0x6f, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x42, 0xaa, 0x01, 0x0a, 0x11, 0x63, 0x6f, 0x6d,
+	0x2e, 0x73, 0x76, 0x63, 0x2e, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2e, 0x76, 0x31, 0x42, 0x0b,
+	0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x32, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x2d, 0x69,
+	0x6f, 0x2f, 0x73, 0x6f, 0x6e, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x73, 0x76, 0x63, 0x2f, 0x6d,
+	0x6f, 0x64, 0x75, 0x6c, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x76,
+	0x31, 0xa2, 0x02, 0x03, 0x53, 0x4d, 0x58, 0xaa, 0x02, 0x0d, 0x53, 0x76, 0x63, 0x2e, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x0d, 0x53, 0x76, 0x63, 0x5c, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x5c, 0x56, 0x31, 0xe2, 0x02, 0x19, 0x53, 0x76, 0x63, 0x5c, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x5c, 0x56, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x53, 0x76, 0x63, 0x3a, 0x3a, 0x4d, 0x6f, 0x64, 0x75, 0x6c,
+	0x65, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

api/svc/v1/query_grpc.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.5.1
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             (unknown)
 // source: svc/v1/query.proto
 
@@ -15,21 +15,45 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.64.0 or later.
-const _ = grpc.SupportPackageIsVersion9
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
 
 const (
-	Query_Params_FullMethodName = "/svc.v1.Query/Params"
+	Query_Params_FullMethodName               = "/svc.v1.Query/Params"
+	Query_DomainVerification_FullMethodName   = "/svc.v1.Query/DomainVerification"
+	Query_Service_FullMethodName              = "/svc.v1.Query/Service"
+	Query_ServicesByOwner_FullMethodName      = "/svc.v1.Query/ServicesByOwner"
+	Query_ServicesByDomain_FullMethodName     = "/svc.v1.Query/ServicesByDomain"
+	Query_ServiceOIDCDiscovery_FullMethodName = "/svc.v1.Query/ServiceOIDCDiscovery"
+	Query_ServiceOIDCJWKS_FullMethodName      = "/svc.v1.Query/ServiceOIDCJWKS"
+	Query_ServiceOIDCMetadata_FullMethodName  = "/svc.v1.Query/ServiceOIDCMetadata"
 )
 
 // QueryClient is the client API for Query service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-//
-// Query provides defines the gRPC querier service.
 type QueryClient interface {
 	// Params queries all parameters of the module.
 	Params(ctx context.Context, in *QueryParamsRequest, opts ...grpc.CallOption) (*QueryParamsResponse, error)
+	// DomainVerification queries domain verification status by domain name.
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "svc_docs.md"}}
+	DomainVerification(ctx context.Context, in *QueryDomainVerificationRequest, opts ...grpc.CallOption) (*QueryDomainVerificationResponse, error)
+	// Service queries service information by service ID.
+	Service(ctx context.Context, in *QueryServiceRequest, opts ...grpc.CallOption) (*QueryServiceResponse, error)
+	// ServicesByOwner queries all services owned by a specific address.
+	ServicesByOwner(ctx context.Context, in *QueryServicesByOwnerRequest, opts ...grpc.CallOption) (*QueryServicesByOwnerResponse, error)
+	// ServicesByDomain queries services bound to a specific domain.
+	ServicesByDomain(ctx context.Context, in *QueryServicesByDomainRequest, opts ...grpc.CallOption) (*QueryServicesByDomainResponse, error)
+	// ServiceOIDCDiscovery queries OIDC discovery configuration for a service
+	ServiceOIDCDiscovery(ctx context.Context, in *QueryServiceOIDCDiscoveryRequest, opts ...grpc.CallOption) (*QueryServiceOIDCDiscoveryResponse, error)
+	// ServiceOIDCJWKS queries OIDC JWKS for a service
+	ServiceOIDCJWKS(ctx context.Context, in *QueryServiceOIDCJWKSRequest, opts ...grpc.CallOption) (*QueryServiceOIDCJWKSResponse, error)
+	// ServiceOIDCMetadata queries OIDC metadata for a service
+	ServiceOIDCMetadata(ctx context.Context, in *QueryServiceOIDCMetadataRequest, opts ...grpc.CallOption) (*QueryServiceOIDCMetadataResponse, error)
 }
 
 type queryClient struct {
@@ -41,9 +65,71 @@ func NewQueryClient(cc grpc.ClientConnInterface) QueryClient {
 }
 
 func (c *queryClient) Params(ctx context.Context, in *QueryParamsRequest, opts ...grpc.CallOption) (*QueryParamsResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(QueryParamsResponse)
-	err := c.cc.Invoke(ctx, Query_Params_FullMethodName, in, out, cOpts...)
+	err := c.cc.Invoke(ctx, Query_Params_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) DomainVerification(ctx context.Context, in *QueryDomainVerificationRequest, opts ...grpc.CallOption) (*QueryDomainVerificationResponse, error) {
+	out := new(QueryDomainVerificationResponse)
+	err := c.cc.Invoke(ctx, Query_DomainVerification_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) Service(ctx context.Context, in *QueryServiceRequest, opts ...grpc.CallOption) (*QueryServiceResponse, error) {
+	out := new(QueryServiceResponse)
+	err := c.cc.Invoke(ctx, Query_Service_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) ServicesByOwner(ctx context.Context, in *QueryServicesByOwnerRequest, opts ...grpc.CallOption) (*QueryServicesByOwnerResponse, error) {
+	out := new(QueryServicesByOwnerResponse)
+	err := c.cc.Invoke(ctx, Query_ServicesByOwner_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) ServicesByDomain(ctx context.Context, in *QueryServicesByDomainRequest, opts ...grpc.CallOption) (*QueryServicesByDomainResponse, error) {
+	out := new(QueryServicesByDomainResponse)
+	err := c.cc.Invoke(ctx, Query_ServicesByDomain_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) ServiceOIDCDiscovery(ctx context.Context, in *QueryServiceOIDCDiscoveryRequest, opts ...grpc.CallOption) (*QueryServiceOIDCDiscoveryResponse, error) {
+	out := new(QueryServiceOIDCDiscoveryResponse)
+	err := c.cc.Invoke(ctx, Query_ServiceOIDCDiscovery_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) ServiceOIDCJWKS(ctx context.Context, in *QueryServiceOIDCJWKSRequest, opts ...grpc.CallOption) (*QueryServiceOIDCJWKSResponse, error) {
+	out := new(QueryServiceOIDCJWKSResponse)
+	err := c.cc.Invoke(ctx, Query_ServiceOIDCJWKS_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *queryClient) ServiceOIDCMetadata(ctx context.Context, in *QueryServiceOIDCMetadataRequest, opts ...grpc.CallOption) (*QueryServiceOIDCMetadataResponse, error) {
+	out := new(QueryServiceOIDCMetadataResponse)
+	err := c.cc.Invoke(ctx, Query_ServiceOIDCMetadata_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -52,27 +138,61 @@ func (c *queryClient) Params(ctx context.Context, in *QueryParamsRequest, opts .
 
 // QueryServer is the server API for Query service.
 // All implementations must embed UnimplementedQueryServer
-// for forward compatibility.
-//
-// Query provides defines the gRPC querier service.
+// for forward compatibility
 type QueryServer interface {
 	// Params queries all parameters of the module.
 	Params(context.Context, *QueryParamsRequest) (*QueryParamsResponse, error)
+	// DomainVerification queries domain verification status by domain name.
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "svc_docs.md"}}
+	DomainVerification(context.Context, *QueryDomainVerificationRequest) (*QueryDomainVerificationResponse, error)
+	// Service queries service information by service ID.
+	Service(context.Context, *QueryServiceRequest) (*QueryServiceResponse, error)
+	// ServicesByOwner queries all services owned by a specific address.
+	ServicesByOwner(context.Context, *QueryServicesByOwnerRequest) (*QueryServicesByOwnerResponse, error)
+	// ServicesByDomain queries services bound to a specific domain.
+	ServicesByDomain(context.Context, *QueryServicesByDomainRequest) (*QueryServicesByDomainResponse, error)
+	// ServiceOIDCDiscovery queries OIDC discovery configuration for a service
+	ServiceOIDCDiscovery(context.Context, *QueryServiceOIDCDiscoveryRequest) (*QueryServiceOIDCDiscoveryResponse, error)
+	// ServiceOIDCJWKS queries OIDC JWKS for a service
+	ServiceOIDCJWKS(context.Context, *QueryServiceOIDCJWKSRequest) (*QueryServiceOIDCJWKSResponse, error)
+	// ServiceOIDCMetadata queries OIDC metadata for a service
+	ServiceOIDCMetadata(context.Context, *QueryServiceOIDCMetadataRequest) (*QueryServiceOIDCMetadataResponse, error)
 	mustEmbedUnimplementedQueryServer()
 }
 
-// UnimplementedQueryServer must be embedded to have
-// forward compatible implementations.
-//
-// NOTE: this should be embedded by value instead of pointer to avoid a nil
-// pointer dereference when methods are called.
-type UnimplementedQueryServer struct{}
+// UnimplementedQueryServer must be embedded to have forward compatible implementations.
+type UnimplementedQueryServer struct {
+}
 
 func (UnimplementedQueryServer) Params(context.Context, *QueryParamsRequest) (*QueryParamsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Params not implemented")
 }
+func (UnimplementedQueryServer) DomainVerification(context.Context, *QueryDomainVerificationRequest) (*QueryDomainVerificationResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DomainVerification not implemented")
+}
+func (UnimplementedQueryServer) Service(context.Context, *QueryServiceRequest) (*QueryServiceResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Service not implemented")
+}
+func (UnimplementedQueryServer) ServicesByOwner(context.Context, *QueryServicesByOwnerRequest) (*QueryServicesByOwnerResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ServicesByOwner not implemented")
+}
+func (UnimplementedQueryServer) ServicesByDomain(context.Context, *QueryServicesByDomainRequest) (*QueryServicesByDomainResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ServicesByDomain not implemented")
+}
+func (UnimplementedQueryServer) ServiceOIDCDiscovery(context.Context, *QueryServiceOIDCDiscoveryRequest) (*QueryServiceOIDCDiscoveryResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ServiceOIDCDiscovery not implemented")
+}
+func (UnimplementedQueryServer) ServiceOIDCJWKS(context.Context, *QueryServiceOIDCJWKSRequest) (*QueryServiceOIDCJWKSResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ServiceOIDCJWKS not implemented")
+}
+func (UnimplementedQueryServer) ServiceOIDCMetadata(context.Context, *QueryServiceOIDCMetadataRequest) (*QueryServiceOIDCMetadataResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ServiceOIDCMetadata not implemented")
+}
 func (UnimplementedQueryServer) mustEmbedUnimplementedQueryServer() {}
-func (UnimplementedQueryServer) testEmbeddedByValue()               {}
 
 // UnsafeQueryServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to QueryServer will
@@ -82,13 +202,6 @@ type UnsafeQueryServer interface {
 }
 
 func RegisterQueryServer(s grpc.ServiceRegistrar, srv QueryServer) {
-	// If the following call pancis, it indicates UnimplementedQueryServer was
-	// embedded by pointer and is nil.  This will cause panics if an
-	// unimplemented method is ever invoked, so we test this at initialization
-	// time to prevent it from happening at runtime later due to I/O.
-	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
-		t.testEmbeddedByValue()
-	}
 	s.RegisterService(&Query_ServiceDesc, srv)
 }
 
@@ -110,6 +223,132 @@ func _Query_Params_Handler(srv interface{}, ctx context.Context, dec func(interf
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Query_DomainVerification_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryDomainVerificationRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).DomainVerification(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_DomainVerification_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).DomainVerification(ctx, req.(*QueryDomainVerificationRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_Service_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryServiceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).Service(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_Service_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).Service(ctx, req.(*QueryServiceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_ServicesByOwner_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryServicesByOwnerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).ServicesByOwner(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_ServicesByOwner_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).ServicesByOwner(ctx, req.(*QueryServicesByOwnerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_ServicesByDomain_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryServicesByDomainRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).ServicesByDomain(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_ServicesByDomain_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).ServicesByDomain(ctx, req.(*QueryServicesByDomainRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_ServiceOIDCDiscovery_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryServiceOIDCDiscoveryRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).ServiceOIDCDiscovery(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_ServiceOIDCDiscovery_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).ServiceOIDCDiscovery(ctx, req.(*QueryServiceOIDCDiscoveryRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_ServiceOIDCJWKS_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryServiceOIDCJWKSRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).ServiceOIDCJWKS(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_ServiceOIDCJWKS_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).ServiceOIDCJWKS(ctx, req.(*QueryServiceOIDCJWKSRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Query_ServiceOIDCMetadata_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(QueryServiceOIDCMetadataRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(QueryServer).ServiceOIDCMetadata(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Query_ServiceOIDCMetadata_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(QueryServer).ServiceOIDCMetadata(ctx, req.(*QueryServiceOIDCMetadataRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // Query_ServiceDesc is the grpc.ServiceDesc for Query service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -121,6 +360,34 @@ var Query_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Params",
 			Handler:    _Query_Params_Handler,
 		},
+		{
+			MethodName: "DomainVerification",
+			Handler:    _Query_DomainVerification_Handler,
+		},
+		{
+			MethodName: "Service",
+			Handler:    _Query_Service_Handler,
+		},
+		{
+			MethodName: "ServicesByOwner",
+			Handler:    _Query_ServicesByOwner_Handler,
+		},
+		{
+			MethodName: "ServicesByDomain",
+			Handler:    _Query_ServicesByDomain_Handler,
+		},
+		{
+			MethodName: "ServiceOIDCDiscovery",
+			Handler:    _Query_ServiceOIDCDiscovery_Handler,
+		},
+		{
+			MethodName: "ServiceOIDCJWKS",
+			Handler:    _Query_ServiceOIDCJWKS_Handler,
+		},
+		{
+			MethodName: "ServiceOIDCMetadata",
+			Handler:    _Query_ServiceOIDCMetadata_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "svc/v1/query.proto",

api/svc/v1/tx_grpc.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.5.1
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             (unknown)
 // source: svc/v1/tx.proto
 
@@ -15,26 +15,34 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.64.0 or later.
-const _ = grpc.SupportPackageIsVersion9
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
 
 const (
-	Msg_UpdateParams_FullMethodName    = "/svc.v1.Msg/UpdateParams"
-	Msg_RegisterService_FullMethodName = "/svc.v1.Msg/RegisterService"
+	Msg_UpdateParams_FullMethodName               = "/svc.v1.Msg/UpdateParams"
+	Msg_InitiateDomainVerification_FullMethodName = "/svc.v1.Msg/InitiateDomainVerification"
+	Msg_VerifyDomain_FullMethodName               = "/svc.v1.Msg/VerifyDomain"
+	Msg_RegisterService_FullMethodName            = "/svc.v1.Msg/RegisterService"
 )
 
 // MsgClient is the client API for Msg service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-//
-// Msg defines the Msg service.
 type MsgClient interface {
 	// UpdateParams defines a governance operation for updating the parameters.
 	//
 	// Since: cosmos-sdk 0.47
 	UpdateParams(ctx context.Context, in *MsgUpdateParams, opts ...grpc.CallOption) (*MsgUpdateParamsResponse, error)
-	// RegisterService initializes a Service with a given permission scope and
-	// URI. The domain must have a valid TXT record containing the public key.
+	// InitiateDomainVerification starts the domain verification process
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "svc_docs.md"}}
+	InitiateDomainVerification(ctx context.Context, in *MsgInitiateDomainVerification, opts ...grpc.CallOption) (*MsgInitiateDomainVerificationResponse, error)
+	// VerifyDomain completes domain verification by checking DNS TXT records
+	VerifyDomain(ctx context.Context, in *MsgVerifyDomain, opts ...grpc.CallOption) (*MsgVerifyDomainResponse, error)
+	// RegisterService registers a new service with verified domain binding
 	RegisterService(ctx context.Context, in *MsgRegisterService, opts ...grpc.CallOption) (*MsgRegisterServiceResponse, error)
 }
 
@@ -47,9 +55,26 @@ func NewMsgClient(cc grpc.ClientConnInterface) MsgClient {
 }
 
 func (c *msgClient) UpdateParams(ctx context.Context, in *MsgUpdateParams, opts ...grpc.CallOption) (*MsgUpdateParamsResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(MsgUpdateParamsResponse)
-	err := c.cc.Invoke(ctx, Msg_UpdateParams_FullMethodName, in, out, cOpts...)
+	err := c.cc.Invoke(ctx, Msg_UpdateParams_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) InitiateDomainVerification(ctx context.Context, in *MsgInitiateDomainVerification, opts ...grpc.CallOption) (*MsgInitiateDomainVerificationResponse, error) {
+	out := new(MsgInitiateDomainVerificationResponse)
+	err := c.cc.Invoke(ctx, Msg_InitiateDomainVerification_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *msgClient) VerifyDomain(ctx context.Context, in *MsgVerifyDomain, opts ...grpc.CallOption) (*MsgVerifyDomainResponse, error) {
+	out := new(MsgVerifyDomainResponse)
+	err := c.cc.Invoke(ctx, Msg_VerifyDomain_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -57,9 +82,8 @@ func (c *msgClient) UpdateParams(ctx context.Context, in *MsgUpdateParams, opts
 }
 
 func (c *msgClient) RegisterService(ctx context.Context, in *MsgRegisterService, opts ...grpc.CallOption) (*MsgRegisterServiceResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(MsgRegisterServiceResponse)
-	err := c.cc.Invoke(ctx, Msg_RegisterService_FullMethodName, in, out, cOpts...)
+	err := c.cc.Invoke(ctx, Msg_RegisterService_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -68,35 +92,43 @@ func (c *msgClient) RegisterService(ctx context.Context, in *MsgRegisterService,
 
 // MsgServer is the server API for Msg service.
 // All implementations must embed UnimplementedMsgServer
-// for forward compatibility.
-//
-// Msg defines the Msg service.
+// for forward compatibility
 type MsgServer interface {
 	// UpdateParams defines a governance operation for updating the parameters.
 	//
 	// Since: cosmos-sdk 0.47
 	UpdateParams(context.Context, *MsgUpdateParams) (*MsgUpdateParamsResponse, error)
-	// RegisterService initializes a Service with a given permission scope and
-	// URI. The domain must have a valid TXT record containing the public key.
+	// InitiateDomainVerification starts the domain verification process
+	//
+	// {{.MethodDescriptorProto.Name}} is a call with the method(s) {{$first := true}}{{range .Bindings}}{{if $first}}{{$first = false}}{{else}}, {{end}}{{.HTTPMethod}}{{end}} within the "{{.Service.Name}}" service.
+	// It takes in "{{.RequestType.Name}}" and returns a "{{.ResponseType.Name}}".
+	//
+	// {{import "svc_docs.md"}}
+	InitiateDomainVerification(context.Context, *MsgInitiateDomainVerification) (*MsgInitiateDomainVerificationResponse, error)
+	// VerifyDomain completes domain verification by checking DNS TXT records
+	VerifyDomain(context.Context, *MsgVerifyDomain) (*MsgVerifyDomainResponse, error)
+	// RegisterService registers a new service with verified domain binding
 	RegisterService(context.Context, *MsgRegisterService) (*MsgRegisterServiceResponse, error)
 	mustEmbedUnimplementedMsgServer()
 }
 
-// UnimplementedMsgServer must be embedded to have
-// forward compatible implementations.
-//
-// NOTE: this should be embedded by value instead of pointer to avoid a nil
-// pointer dereference when methods are called.
-type UnimplementedMsgServer struct{}
+// UnimplementedMsgServer must be embedded to have forward compatible implementations.
+type UnimplementedMsgServer struct {
+}
 
 func (UnimplementedMsgServer) UpdateParams(context.Context, *MsgUpdateParams) (*MsgUpdateParamsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateParams not implemented")
 }
+func (UnimplementedMsgServer) InitiateDomainVerification(context.Context, *MsgInitiateDomainVerification) (*MsgInitiateDomainVerificationResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InitiateDomainVerification not implemented")
+}
+func (UnimplementedMsgServer) VerifyDomain(context.Context, *MsgVerifyDomain) (*MsgVerifyDomainResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method VerifyDomain not implemented")
+}
 func (UnimplementedMsgServer) RegisterService(context.Context, *MsgRegisterService) (*MsgRegisterServiceResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method RegisterService not implemented")
 }
 func (UnimplementedMsgServer) mustEmbedUnimplementedMsgServer() {}
-func (UnimplementedMsgServer) testEmbeddedByValue()             {}
 
 // UnsafeMsgServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to MsgServer will
@@ -106,13 +138,6 @@ type UnsafeMsgServer interface {
 }
 
 func RegisterMsgServer(s grpc.ServiceRegistrar, srv MsgServer) {
-	// If the following call pancis, it indicates UnimplementedMsgServer was
-	// embedded by pointer and is nil.  This will cause panics if an
-	// unimplemented method is ever invoked, so we test this at initialization
-	// time to prevent it from happening at runtime later due to I/O.
-	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
-		t.testEmbeddedByValue()
-	}
 	s.RegisterService(&Msg_ServiceDesc, srv)
 }
 
@@ -134,6 +159,42 @@ func _Msg_UpdateParams_Handler(srv interface{}, ctx context.Context, dec func(in
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Msg_InitiateDomainVerification_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgInitiateDomainVerification)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).InitiateDomainVerification(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_InitiateDomainVerification_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).InitiateDomainVerification(ctx, req.(*MsgInitiateDomainVerification))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Msg_VerifyDomain_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(MsgVerifyDomain)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MsgServer).VerifyDomain(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Msg_VerifyDomain_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MsgServer).VerifyDomain(ctx, req.(*MsgVerifyDomain))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Msg_RegisterService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(MsgRegisterService)
 	if err := dec(in); err != nil {
@@ -163,6 +224,14 @@ var Msg_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "UpdateParams",
 			Handler:    _Msg_UpdateParams_Handler,
 		},
+		{
+			MethodName: "InitiateDomainVerification",
+			Handler:    _Msg_InitiateDomainVerification_Handler,
+		},
+		{
+			MethodName: "VerifyDomain",
+			Handler:    _Msg_VerifyDomain_Handler,
+		},
 		{
 			MethodName: "RegisterService",
 			Handler:    _Msg_RegisterService_Handler,

app/ante.go

@@ -1,74 +0,0 @@
-package app
-
-import (
-	"errors"
-
-	ibcante "github.com/cosmos/ibc-go/v8/modules/core/ante"
-	"github.com/cosmos/ibc-go/v8/modules/core/keeper"
-
-	circuitante "cosmossdk.io/x/circuit/ante"
-	circuitkeeper "cosmossdk.io/x/circuit/keeper"
-
-	sdk "github.com/cosmos/cosmos-sdk/types"
-	"github.com/cosmos/cosmos-sdk/x/auth/ante"
-	stakingkeeper "github.com/cosmos/cosmos-sdk/x/staking/keeper"
-
-	sdkmath "cosmossdk.io/math"
-	poaante "github.com/strangelove-ventures/poa/ante"
-
-	globalfeeante "github.com/strangelove-ventures/globalfee/x/globalfee/ante"
-	globalfeekeeper "github.com/strangelove-ventures/globalfee/x/globalfee/keeper"
-)
-
-// HandlerOptions extend the SDK's AnteHandler options by requiring the IBC
-// channel keeper.
-type HandlerOptions struct {
-	ante.HandlerOptions
-	IBCKeeper            *keeper.Keeper
-	CircuitKeeper        *circuitkeeper.Keeper
-	StakingKeeper        *stakingkeeper.Keeper
-	GlobalFeeKeeper      globalfeekeeper.Keeper
-	BypassMinFeeMsgTypes []string
-}
-
-// NewAnteHandler constructor
-func NewAnteHandler(options HandlerOptions) (sdk.AnteHandler, error) {
-	if options.AccountKeeper == nil {
-		return nil, errors.New("account keeper is required for ante builder")
-	}
-	if options.BankKeeper == nil {
-		return nil, errors.New("bank keeper is required for ante builder")
-	}
-	if options.SignModeHandler == nil {
-		return nil, errors.New("sign mode handler is required for ante builder")
-	}
-	if options.CircuitKeeper == nil {
-		return nil, errors.New("circuit keeper is required for ante builder")
-	}
-
-	poaDoGenTxRateValidation := false
-	poaRateFloor := sdkmath.LegacyMustNewDecFromStr("0.05")
-	poaRateCeil := sdkmath.LegacyMustNewDecFromStr("0.25")
-
-	anteDecorators := []sdk.AnteDecorator{
-		ante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first
-		circuitante.NewCircuitBreakerDecorator(options.CircuitKeeper),
-		ante.NewExtensionOptionsDecorator(options.ExtensionOptionChecker),
-		ante.NewValidateBasicDecorator(),
-		ante.NewTxTimeoutHeightDecorator(),
-		ante.NewValidateMemoDecorator(options.AccountKeeper),
-		// ante.NewConsumeGasForTxSizeDecorator(options.AccountKeeper),
-		globalfeeante.NewFeeDecorator(options.BypassMinFeeMsgTypes, options.GlobalFeeKeeper, 2_000_000),
-		// ante.NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),
-		ante.NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators
-		ante.NewValidateSigCountDecorator(options.AccountKeeper),
-		ante.NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),
-		ante.NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),
-		ante.NewIncrementSequenceDecorator(options.AccountKeeper),
-		ibcante.NewRedundantRelayDecorator(options.IBCKeeper),
-		poaante.NewPOADisableStakingDecorator(),
-		poaante.NewCommissionLimitDecorator(poaDoGenTxRateValidation, poaRateFloor, poaRateCeil),
-	}
-
-	return sdk.ChainAnteDecorators(anteDecorators...), nil
-}

app/ante/ante.go

@@ -0,0 +1,60 @@
+// Package ante provides ante handler implementations for transaction processing
+// in the Sonr blockchain. It supports both Cosmos SDK and Ethereum transactions.
+package ante
+
+import (
+	errorsmod "cosmossdk.io/errors"
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	errortypes "github.com/cosmos/cosmos-sdk/types/errors"
+	authante "github.com/cosmos/cosmos-sdk/x/auth/ante"
+)
+
+// NewAnteHandler returns an ante handler responsible for attempting to route an
+// Ethereum or SDK transaction to an internal ante handler for performing
+// transaction-level processing (e.g. fee payment, signature verification) before
+// being passed onto it's respective handler.
+//
+// The handler inspects the transaction type and extension options to determine
+// the appropriate processing path:
+//   - Ethereum transactions with ExtensionOptionsEthereumTx
+//   - Cosmos SDK transactions with ExtensionOptionDynamicFeeTx
+//   - Standard Cosmos SDK transactions
+func NewAnteHandler(options HandlerOptions) sdk.AnteHandler {
+	return func(
+		ctx sdk.Context, tx sdk.Tx, sim bool,
+	) (newCtx sdk.Context, err error) {
+		var anteHandler sdk.AnteHandler
+
+		txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)
+		if ok {
+			opts := txWithExtensions.GetExtensionOptions()
+			if len(opts) > 0 {
+				switch typeURL := opts[0].GetTypeUrl(); typeURL {
+				case "/cosmos.evm.vm.v1.ExtensionOptionsEthereumTx":
+					// handle as *evmtypes.MsgEthereumTx
+					anteHandler = newMonoEVMAnteHandler(options)
+				case "/cosmos.evm.vm.v1.ExtensionOptionDynamicFeeTx":
+					// cosmos-sdk tx with dynamic fee extension
+					anteHandler = NewCosmosAnteHandler(options)
+				default:
+					return ctx, errorsmod.Wrapf(
+						errortypes.ErrUnknownExtensionOptions,
+						"rejecting tx with unsupported extension option: %s", typeURL,
+					)
+				}
+
+				return anteHandler(ctx, tx, sim)
+			}
+		}
+
+		// handle as totally normal Cosmos SDK tx
+		switch tx.(type) {
+		case sdk.Tx:
+			anteHandler = NewCosmosAnteHandler(options)
+		default:
+			return ctx, errorsmod.Wrapf(errortypes.ErrUnknownRequest, "invalid transaction type: %T", tx)
+		}
+
+		return anteHandler(ctx, tx, sim)
+	}
+}

app/ante/ante_cosmos.go

@@ -0,0 +1,107 @@
+package ante
+
+import (
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	"github.com/cosmos/cosmos-sdk/x/auth/ante"
+	sdkvesting "github.com/cosmos/cosmos-sdk/x/auth/vesting/types"
+	evmoscosmosante "github.com/cosmos/evm/ante/cosmos"
+	evmante "github.com/cosmos/evm/ante/evm"
+	evmtypes "github.com/cosmos/evm/x/vm/types"
+
+	circuitante "cosmossdk.io/x/circuit/ante"
+	ibcante "github.com/cosmos/ibc-go/v8/modules/core/ante"
+)
+
+// NewCosmosAnteHandler creates the default ante handler for Cosmos SDK transactions.
+// It sets up a chain of decorators that perform various checks and operations:
+//   - Rejects Ethereum transactions in Cosmos context
+//   - Enforces authz limitations
+//   - Sets up transaction context
+//   - Validates basic transaction properties
+//   - Handles WebAuthn gasless transactions
+//   - Handles gas consumption and fee deduction
+//   - Performs signature verification
+//   - Manages account sequences
+//   - Handles IBC-specific checks
+func NewCosmosAnteHandler(options HandlerOptions) sdk.AnteHandler {
+	// Determine if we should use enhanced gasless mode
+	// Enhanced mode allows address generation from credentials for true gasless onboarding
+	enhancedGaslessMode := options.EnableEnhancedGasless
+
+	// Build the decorator chain
+	decorators := []sdk.AnteDecorator{
+		// WebAuthn bypass - must be first to intercept WebAuthn transactions
+		NewWebAuthnBypassDecorator(),
+		evmoscosmosante.NewRejectMessagesDecorator(), // reject MsgEthereumTxs
+		evmoscosmosante.NewAuthzLimiterDecorator( // disable the Msg types that cannot be included on an authz.MsgExec msgs field
+			sdk.MsgTypeURL(&evmtypes.MsgEthereumTx{}),
+			sdk.MsgTypeURL(&sdkvesting.MsgCreateVestingAccount{}),
+		),
+
+		ante.NewSetUpContextDecorator(),
+		circuitante.NewCircuitBreakerDecorator(options.CircuitKeeper),
+		ante.NewExtensionOptionsDecorator(options.ExtensionOptionChecker),
+		ante.NewValidateBasicDecorator(),
+		ante.NewTxTimeoutHeightDecorator(),
+		ante.NewValidateMemoDecorator(options.AccountKeeper),
+
+		// UCAN validation - must come before fee deduction for gasless support
+		NewConditionalUCANDecorator(NewUCANDecorator()),
+		evmoscosmosante.NewMinGasPriceDecorator(
+			options.FeeMarketKeeper,
+			options.EvmKeeper,
+			options.ControlPanelKeeper,
+		),
+		ante.NewConsumeGasForTxSizeDecorator(options.AccountKeeper),
+
+		// WebAuthn gasless transaction support - must come before fee deduction
+		// Enhanced mode allows true gasless onboarding without pre-existing accounts
+		NewWebAuthnGaslessDecorator(options.AccountKeeper, options.DidKeeper, enhancedGaslessMode),
+
+		// Conditional fee deduction - skips fees for gasless WebAuthn and UCAN
+		NewUCANGaslessDecorator(
+			NewConditionalFeeDecorator(ante.NewDeductFeeDecorator(
+				options.AccountKeeper,
+				options.BankKeeper,
+				options.FeegrantKeeper,
+				options.TxFeeChecker,
+			)),
+		),
+	}
+
+	// Add signature verification decorators
+	// In enhanced gasless mode, we wrap these to be conditional
+	if enhancedGaslessMode {
+		// Conditional decorators that skip verification for gasless transactions
+		decorators = append(
+			decorators,
+			NewConditionalPubKeyDecorator(ante.NewSetPubKeyDecorator(options.AccountKeeper)),
+			NewConditionalSigCountDecorator(
+				ante.NewValidateSigCountDecorator(options.AccountKeeper),
+			),
+			NewConditionalSigGasDecorator(
+				ante.NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),
+			),
+			NewConditionalSignatureDecorator(
+				ante.NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),
+			),
+		)
+	} else {
+		// Standard signature verification decorators
+		decorators = append(decorators,
+			ante.NewSetPubKeyDecorator(options.AccountKeeper),
+			ante.NewValidateSigCountDecorator(options.AccountKeeper),
+			ante.NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),
+			ante.NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),
+		)
+	}
+
+	// Add remaining decorators
+	decorators = append(decorators,
+		ante.NewIncrementSequenceDecorator(options.AccountKeeper),
+		ibcante.NewRedundantRelayDecorator(options.IBCKeeper),
+		evmante.NewGasWantedDecorator(options.EvmKeeper, options.FeeMarketKeeper),
+	)
+
+	return sdk.ChainAnteDecorators(decorators...)
+}

app/ante/ante_evm.go

@@ -0,0 +1,23 @@
+package ante
+
+import (
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	evmante "github.com/cosmos/evm/ante/evm"
+)
+
+// newMonoEVMAnteHandler creates the ante handler for Ethereum Virtual Machine transactions.
+// It uses a single decorator that handles all EVM-specific validation and processing,
+// including gas calculation, fee market dynamics, and account management.
+//
+// The mono decorator performs all EVM ante operations in a single pass for efficiency.
+func newMonoEVMAnteHandler(options HandlerOptions) sdk.AnteHandler {
+	return sdk.ChainAnteDecorators(
+		evmante.NewEVMMonoDecorator(
+			options.AccountKeeper,
+			options.FeeMarketKeeper,
+			options.EvmKeeper,
+			options.ControlPanelKeeper,
+			options.MaxTxGasWanted,
+		),
+	)
+}

app/ante/control_panel.go

@@ -0,0 +1,59 @@
+package ante
+
+import (
+	"context"
+
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	anteinterfaces "github.com/cosmos/evm/ante/interfaces"
+)
+
+// Ensure ControlPanelKeeper implements the interface
+var _ anteinterfaces.ControlPanelKeeper = (*ControlPanelKeeper)(nil)
+
+// ControlPanelKeeper provides control panel functionality for sponsored transactions.
+// This is a simple implementation that can be extended to support sponsored addresses
+// and custom transaction priorities in the future.
+type ControlPanelKeeper struct {
+	// sponsoredAddresses could be loaded from state or configuration
+	sponsoredAddresses map[string]bool
+	// priority for sponsored transactions
+	sponsoredTxPriority int64
+}
+
+// NewControlPanelKeeper creates a new ControlPanelKeeper instance
+func NewControlPanelKeeper() *ControlPanelKeeper {
+	return &ControlPanelKeeper{
+		sponsoredAddresses:  make(map[string]bool),
+		sponsoredTxPriority: 0, // Default priority
+	}
+}
+
+// IsSponsoredAddress checks if an address is sponsored for gasless transactions
+func (k *ControlPanelKeeper) IsSponsoredAddress(ctx context.Context, addr []byte) bool {
+	// For now, return false for all addresses
+	// This can be extended to check against a whitelist or state
+	return false
+}
+
+// GetSponsoredTransactionPriority returns the priority for sponsored transactions
+func (k *ControlPanelKeeper) GetSponsoredTransactionPriority(ctx context.Context) int64 {
+	// Return default priority
+	// This can be made configurable or dynamic based on chain state
+	return k.sponsoredTxPriority
+}
+
+// SetSponsoredAddress adds or removes an address from the sponsored list
+// This is a helper method for future use
+func (k *ControlPanelKeeper) SetSponsoredAddress(addr sdk.AccAddress, sponsored bool) {
+	if sponsored {
+		k.sponsoredAddresses[addr.String()] = true
+	} else {
+		delete(k.sponsoredAddresses, addr.String())
+	}
+}
+
+// SetSponsoredTransactionPriority updates the priority for sponsored transactions
+// This is a helper method for future use
+func (k *ControlPanelKeeper) SetSponsoredTransactionPriority(priority int64) {
+	k.sponsoredTxPriority = priority
+}

app/ante/handler_options.go

@@ -0,0 +1,129 @@
+package ante
+
+import (
+	"context"
+
+	addresscodec "cosmossdk.io/core/address"
+	errorsmod "cosmossdk.io/errors"
+	storetypes "cosmossdk.io/store/types"
+	circuitkeeper "cosmossdk.io/x/circuit/keeper"
+	txsigning "cosmossdk.io/x/tx/signing"
+	"github.com/cosmos/cosmos-sdk/codec"
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	errortypes "github.com/cosmos/cosmos-sdk/types/errors"
+	"github.com/cosmos/cosmos-sdk/types/tx/signing"
+	"github.com/cosmos/cosmos-sdk/x/auth/ante"
+	authtypes "github.com/cosmos/cosmos-sdk/x/auth/types"
+	anteinterfaces "github.com/cosmos/evm/ante/interfaces"
+	ibckeeper "github.com/cosmos/ibc-go/v8/modules/core/keeper"
+)
+
+// WebAuthnKeeperInterface defines the required methods from the DID keeper for WebAuthn gasless processing
+type WebAuthnKeeperInterface interface {
+	// HasExistingCredential checks if this credential ID already exists
+	HasExistingCredential(ctx sdk.Context, credentialId string) bool
+}
+
+// BankKeeper defines the contract needed for supply related APIs.
+// It provides methods for checking send permissions and transferring coins
+// between accounts and modules.
+type BankKeeper interface {
+	IsSendEnabledCoins(ctx context.Context, coins ...sdk.Coin) error
+	SendCoins(ctx context.Context, from, to sdk.AccAddress, amt sdk.Coins) error
+	SendCoinsFromAccountToModule(
+		ctx context.Context,
+		senderAddr sdk.AccAddress,
+		recipientModule string,
+		amt sdk.Coins,
+	) error
+}
+
+// AccountKeeper defines the account management interface required by ante handlers.
+// It provides methods for account creation, retrieval, modification, and
+// sequence number management.
+type AccountKeeper interface {
+	NewAccountWithAddress(ctx context.Context, addr sdk.AccAddress) sdk.AccountI
+	GetModuleAddress(moduleName string) sdk.AccAddress
+	GetAccount(ctx context.Context, addr sdk.AccAddress) sdk.AccountI
+	SetAccount(ctx context.Context, account sdk.AccountI)
+	RemoveAccount(ctx context.Context, account sdk.AccountI)
+	GetParams(ctx context.Context) (params authtypes.Params)
+	GetSequence(ctx context.Context, addr sdk.AccAddress) (uint64, error)
+	AddressCodec() addresscodec.Codec
+}
+
+// HandlerOptions defines the list of module keepers and configurations required
+// to run the ante handler decorators. It includes both standard Cosmos SDK
+// keepers and EVM-specific components for processing different transaction types.
+type HandlerOptions struct {
+	Cdc                    codec.BinaryCodec
+	AccountKeeper          AccountKeeper
+	BankKeeper             BankKeeper
+	FeegrantKeeper         ante.FeegrantKeeper
+	ExtensionOptionChecker ante.ExtensionOptionChecker
+	SignModeHandler        *txsigning.HandlerMap
+	SigGasConsumer         func(meter storetypes.GasMeter, sig signing.SignatureV2, params authtypes.Params) error
+	TxFeeChecker           ante.TxFeeChecker // safe to be nil
+
+	MaxTxGasWanted     uint64
+	FeeMarketKeeper    anteinterfaces.FeeMarketKeeper
+	EvmKeeper          anteinterfaces.EVMKeeper
+	ControlPanelKeeper anteinterfaces.ControlPanelKeeper
+
+	IBCKeeper     *ibckeeper.Keeper
+	CircuitKeeper *circuitkeeper.Keeper
+
+	// WebAuthn gasless transaction support
+	DidKeeper             WebAuthnKeeperInterface
+	EnableEnhancedGasless bool // Enable enhanced gasless mode for true onboarding without pre-existing accounts
+
+	// UCAN module keepers for permission validation
+	DwnKeeper interface{} // Will be cast to proper type in decorator
+	DexKeeper interface{} // Will be cast to proper type in decorator
+	SvcKeeper interface{} // Will be cast to proper type in decorator
+}
+
+// Validate checks if all required keepers and handlers are properly initialized.
+// It ensures that the HandlerOptions struct has all necessary components to
+// process transactions without nil pointer errors.
+func (options HandlerOptions) Validate() error {
+	if options.Cdc == nil {
+		return errorsmod.Wrap(errortypes.ErrLogic, "codec is required for AnteHandler")
+	}
+	if options.AccountKeeper == nil {
+		return errorsmod.Wrap(errortypes.ErrLogic, "account keeper is required for AnteHandler")
+	}
+	if options.BankKeeper == nil {
+		return errorsmod.Wrap(errortypes.ErrLogic, "bank keeper is required for AnteHandler")
+	}
+	if options.SigGasConsumer == nil {
+		return errorsmod.Wrap(
+			errortypes.ErrLogic,
+			"signature gas consumer is required for AnteHandler",
+		)
+	}
+	if options.SignModeHandler == nil {
+		return errorsmod.Wrap(errortypes.ErrLogic, "sign mode handler is required for AnteHandler")
+	}
+	if options.CircuitKeeper == nil {
+		return errorsmod.Wrap(errortypes.ErrLogic, "circuit keeper is required for ante builder")
+	}
+
+	if options.TxFeeChecker == nil {
+		return errorsmod.Wrap(errortypes.ErrLogic, "tx fee checker is required for AnteHandler")
+	}
+	if options.FeeMarketKeeper == nil {
+		return errorsmod.Wrap(errortypes.ErrLogic, "fee market keeper is required for AnteHandler")
+	}
+	if options.EvmKeeper == nil {
+		return errorsmod.Wrap(errortypes.ErrLogic, "evm keeper is required for AnteHandler")
+	}
+	if options.ControlPanelKeeper == nil {
+		return errorsmod.Wrap(
+			errortypes.ErrLogic,
+			"control panel keeper is required for AnteHandler",
+		)
+	}
+
+	return nil
+}

app/ante/ucan_decorator.go

@@ -0,0 +1,127 @@
+package ante
+
+import (
+	"context"
+	"fmt"
+
+	sdk "github.com/cosmos/cosmos-sdk/types"
+
+	"github.com/sonr-io/crypto/keys"
+	"github.com/sonr-io/crypto/ucan"
+)
+
+// UCANDecorator validates UCAN tokens in transactions
+// This is a placeholder implementation that sets up the infrastructure
+// for UCAN validation. In production, UCAN tokens would be passed
+// in message fields or transaction extensions.
+type UCANDecorator struct {
+	verifier *ucan.Verifier
+}
+
+// NewUCANDecorator creates a new UCAN decorator
+func NewUCANDecorator() UCANDecorator {
+	// Create a basic DID resolver
+	didResolver := &BasicDIDResolver{}
+	verifier := ucan.NewVerifier(didResolver)
+
+	return UCANDecorator{
+		verifier: verifier,
+	}
+}
+
+// AnteHandle validates UCAN tokens for transactions requiring authorization
+func (ud UCANDecorator) AnteHandle(ctx sdk.Context, tx sdk.Tx, simulate bool, next sdk.AnteHandler) (sdk.Context, error) {
+	// Skip validation in simulation mode
+	if simulate {
+		return next(ctx, tx, simulate)
+	}
+
+	// Check if transaction has UCAN extension
+	// This is where we would extract and validate UCAN tokens
+	// For now, this is a placeholder that demonstrates the structure
+
+	// Future implementation would:
+	// 1. Extract UCAN token from transaction extensions or memo
+	// 2. Validate the token using the verifier
+	// 3. Check capabilities against message types
+	// 4. Mark transaction as gasless if appropriate
+
+	// Check if transaction qualifies for gasless execution
+	if ud.isGaslessTransaction(ctx, tx) {
+		// Mark context for gasless processing
+		ctx = ctx.WithValue("gasless_ucan", true)
+	}
+
+	return next(ctx, tx, simulate)
+}
+
+// isGaslessTransaction checks if transaction qualifies for gasless execution
+// This is a placeholder implementation
+func (ud UCANDecorator) isGaslessTransaction(ctx sdk.Context, tx sdk.Tx) bool {
+	// In production, this would check for UCAN tokens with gasless capabilities
+	// For now, return false to maintain normal fee processing
+	return false
+}
+
+// CheckTokenExpiration checks if UCAN token has expired
+func (ud UCANDecorator) CheckTokenExpiration(ctx sdk.Context, token *ucan.Token) error {
+	if token.ExpiresAt > 0 {
+		currentTime := ctx.BlockTime().Unix()
+		if currentTime > token.ExpiresAt {
+			return fmt.Errorf("UCAN token has expired")
+		}
+	}
+
+	// Check NotBefore
+	if token.NotBefore > 0 {
+		currentTime := ctx.BlockTime().Unix()
+		if currentTime < token.NotBefore {
+			return fmt.Errorf("UCAN token is not yet valid")
+		}
+	}
+
+	return nil
+}
+
+// ValidateCapabilities validates UCAN capabilities against required permissions
+func (ud UCANDecorator) ValidateCapabilities(token *ucan.Token, requiredCapabilities []string) error {
+	// Check if token grants required capabilities
+	for _, att := range token.Attenuations {
+		if att.Capability.Grants(requiredCapabilities) {
+			return nil
+		}
+	}
+
+	return fmt.Errorf("UCAN token does not grant required capabilities")
+}
+
+// BasicDIDResolver implements ucan.DIDResolver for the ante handler
+type BasicDIDResolver struct{}
+
+// ResolveDIDKey resolves DID to public key for UCAN verification
+func (r *BasicDIDResolver) ResolveDIDKey(ctx context.Context, did string) (keys.DID, error) {
+	// This is a basic implementation that accepts all DIDs
+	// In production, this would query the DID module
+	return keys.Parse(did)
+}
+
+// ConditionalUCANDecorator wraps UCAN decorator to skip for certain transactions
+type ConditionalUCANDecorator struct {
+	decorator sdk.AnteDecorator
+}
+
+// NewConditionalUCANDecorator creates a conditional UCAN decorator
+func NewConditionalUCANDecorator(decorator sdk.AnteDecorator) ConditionalUCANDecorator {
+	return ConditionalUCANDecorator{decorator: decorator}
+}
+
+// AnteHandle conditionally applies UCAN validation
+func (cud ConditionalUCANDecorator) AnteHandle(ctx sdk.Context, tx sdk.Tx, simulate bool, next sdk.AnteHandler) (sdk.Context, error) {
+	// Skip UCAN validation if already marked as gasless WebAuthn
+	if ctx.Value("bypass_ucan") != nil {
+		return next(ctx, tx, simulate)
+	}
+
+	// Apply UCAN validation
+	return cud.decorator.AnteHandle(ctx, tx, simulate, next)
+}