fix(did): resolve path-based did:web documents per spec

[venables]

Summary

• fix did:web URL construction in @agentcommercekit/did resolver
• keep root DIDs on /.well-known/did.json
• resolve path DIDs to /:path/did.json
• add regression tests for path-based DIDs over both https and allowedHttpHosts

Examples

• did:web:example.com -> https://example.com/.well-known/did.json
• did:web:example.com:abc -> https://example.com/abc/did.json
• did:web:example.com:abc:def -> https://example.com/abc/def/did.json

Spec Reference

DID Method Web spec, Read (Resolve) section:

• https://w3c-ccg.github.io/did-method-web/#read-resolve

That section defines root identifiers resolving via /.well-known/did.json, and identifiers with path components resolving via path segments plus /did.json.

Validation

• pnpm --filter ./packages/did test (70 passing)

Summary by CodeRabbit

• Bug Fixes

  • Updated DID web resolution to comply with specification requirements: root identifiers now resolve to /.well-known/did.json, while path-based identifiers resolve to /:path/did.json.

• Tests

  • Added regression tests for path-based DID resolution and HTTP host allowance.

[coderabbitai]

Walkthrough

This PR updates the did:web resolver to align with specification requirements. It refines the buildDidPath function to handle path-based DIDs with stricter validation and modified URL construction logic, adds regression tests for path-based resolution and host allowances, and includes a changelog entry documenting the patch-level changes.

Changes

Cohort / File(s)	Summary
Changelog Entry .changeset/fair-zebras-talk.md	Documents patch-level changes for @agentcommercekit/did, describing updates to did:web resolution specification alignment.
Core Implementation packages/did/src/did-resolvers/web-did-resolver.ts	Refines buildDidPath function with stricter validation: decodes path segments, validates host presence (throws if missing), and conditionally constructs URLs—returning host + docPath if no path segments, or host + decoded path + "/did.json" if path segments exist.
Test Coverage packages/did/src/did-resolvers/web-did-resolver.test.ts	Adds two regression tests validating path-based DID resolution: one asserting HTTPS resolution to example.com/issuers/v1/did.json, and another verifying HTTP resolution to localhost when allowedHttpHosts includes localhost.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Merge Conflict Detection	⚠️ Warning	❌ Merge conflicts detected (7 files): ⚔️ examples/issuer/bin/start-server.ts (content) ⚔️ examples/issuer/package.json (content) ⚔️ examples/issuer/src/db/get-db.ts (content) ⚔️ packages/did/src/did-resolvers/web-did-resolver.test.ts (content) ⚔️ packages/did/src/did-resolvers/web-did-resolver.ts (content) ⚔️ pnpm-lock.yaml (content) ⚔️ pnpm-workspace.yaml (content) These conflicts must be resolved before merging into main.	Resolve conflicts locally and push changes to this branch.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: fixing path-based did:web document resolution to align with specification requirements. It is specific, descriptive, and directly related to the core changeset.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch venables/fix-did-web-path-resolution

⚔️ Resolve merge conflicts (beta)

• Auto-commit resolved conflicts to branch venables/fix-did-web-path-resolution
• Create stacked PR with resolved conflicts
• Post resolved changes as copyable diffs in a comment

---

No actionable comments were generated in the recent review. 🎉

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[venables]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.