Did.yml

meta:
  name: Did
  namespace:
    did: "https://www.w3.org/ns/did#"

content:
  bases: 
    - name: Did #from: https://www.w3.org/TR/did-core/
      subClassOf: "did:DIDSubject"
      attributes: 
        id: String
        alsoKnownAs: String
        verificationMethod: set<VerificationMethod>
        assertionMethod: set<String>
        authentication: set<String>
        capabilityDelegation: set<String>
        capabilityInvocation: set<String>
        keyAgreement: set<String>
        controller: String
        service: set<Service>
    - name: VerificationMethod
      subClassOf: "did:VerificationMethod"
      attributes:
        id: String
        controller: String
        type: String
        publicKeyJwk: String
        publicKeyBase58: String
        publicKeyMultibase: String
        blockchainAccountId: String
        publicKeyPgp: String
        publicKeyHex: String
        ethereumAddress: String
    - name: Service
      subClassOf: "did:Service"
      attributes:
        id: String
        type: String
        serviceEndpoint: String

  overlays: 
    - type: OverlayValidation
      base: Did
      name: DidValidationOverlay
      attributes:
        id: 
          cardinality: "1..1"
          # DID Core 3.1: did:<method-name>:<method-specific-id>, idchar or %HH, not ending in ":"
          pattern: &did_syntax '^did:[a-z0-9]+:(([A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*([A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+$'
          message: "there must be one valid 'id' in a DID document"
        controller: # DID Core 5.1.2: a DID or a set of DIDs
          pattern: *did_syntax
          message: "invalid 'controller'"
        alsoKnownAs: # DID Core 5.1.3: a set of URIs
          pattern: '^[A-Za-z][A-Za-z0-9+.-]*:[^\s]+$'
          message: "invalid 'alsoKnownAs'"
        verificationMethod: #from: https://www.w3.org/TR/did-spec-registries/#verification-method-types
          message: "invalid 'verificationMethod'"
          # DID Core 5.2.1: one representation of the key material per verification
          # method, so every alternative excludes the other key representations;
          # blockchainAccountId and ethereumAddress name an account, not the key
          attributes:
            or: 
              - &id_jwk
                id: &cardinality1_pattern
                  cardinality: "1..1"
                  # DID Core 3.2: a DID URL is a DID with optional path, query and
                  # fragment (RFC 3986 pchar), or a relative reference to a fragment
                  pattern: &did_url '^(did:[a-z0-9]+:(([A-Za-z0-9._-]|%[0-9A-Fa-f]{2})*:)*([A-Za-z0-9._-]|%[0-9A-Fa-f]{2})+(/([A-Za-z0-9._~!$&''()*+,;=:@-]|%[0-9A-Fa-f]{2})*)*(\?([A-Za-z0-9._~!$&''()*+,;=:@/?-]|%[0-9A-Fa-f]{2})*)?(#([A-Za-z0-9._~!$&''()*+,;=:@/?-]|%[0-9A-Fa-f]{2})*)?|#([A-Za-z0-9._~!$&''()*+,;=:@/?-]|%[0-9A-Fa-f]{2})+)$'
                type:
                  cardinality: "1..1"
                  valueOption:
                    - EcdsaSecp256k1RecoveryMethod2020
                    - EcdsaSecp256k1VerificationKey2019
                    - JsonWebKey2020
                    - JSONWebSignature2020
                    - RsaVerificationKey2018
                controller: &controller_did # DID Core 5.2: a DID
                  cardinality: "1..1"
                  pattern: *did_syntax
                publicKeyJwk:
                  cardinality: "1..1"
                  attributes: # DID Core 5.2.1: no private key members (RFC 7517, RFC 7518)
                    d: &absent
                      cardinality: "0..0"
                    p: *absent
                    q: *absent
                    dp: *absent
                    dq: *absent
                    qi: *absent
                    oth: *absent
                    k: *absent
                publicKeyBase58: *absent
                publicKeyMultibase: *absent
                publicKeyHex: *absent
                publicKeyPgp: *absent
              - &id_base58
                id: *cardinality1_pattern
                type:
                  cardinality: &cardinality1_value "1..1"
                  valueOption:
                    - Bls12381G1Key2020
                    - Bls12381G2Key2020
                    - EcdsaSecp256k1RecoveryMethod2020
                    - EcdsaSecp256k1VerificationKey2019
                    - Ed25519VerificationKey2018
                    - VerifiableCondition2021
                    - X25519KeyAgreementKey2019
                controller: *controller_did
                publicKeyBase58: &cardinality1
                  cardinality: "1..1"
                publicKeyJwk: *absent
                publicKeyMultibase: *absent
                publicKeyHex: *absent
                publicKeyPgp: *absent
              - &id_multibase
                id: *cardinality1_pattern
                type:
                  cardinality: *cardinality1_value
                  valueOption:
                    - EcdsaSecp256k1VerificationKey2019
                    - Ed25519VerificationKey2020
                    - Multikey
                controller: *controller_did
                publicKeyMultibase: *cardinality1
                publicKeyJwk: *absent
                publicKeyBase58: *absent
                publicKeyHex: *absent
                publicKeyPgp: *absent
              - &id_blockchain_account_id
                id: *cardinality1_pattern
                type:
                  cardinality: *cardinality1_value
                  valueOption: # DID Specification Registries, blockchainAccountId
                    - EcdsaSecp256k1RecoveryMethod2020
                    - EcdsaSecp256k1VerificationKey2019
                controller: *controller_did
                blockchainAccountId: *cardinality1
                publicKeyJwk: *absent
                publicKeyBase58: *absent
                publicKeyMultibase: *absent
                publicKeyHex: *absent
                publicKeyPgp: *absent
              - &id_public_key_pgp
                id: *cardinality1_pattern
                type:
                  cardinality: *cardinality1_value
                  valueOption:
                    - PgpVerificationKey2021
                controller: *controller_did
                publicKeyPgp: *cardinality1
                publicKeyJwk: *absent
                publicKeyBase58: *absent
                publicKeyMultibase: *absent
                publicKeyHex: *absent
              - &id_public_key_hex
                id: *cardinality1_pattern
                type:
                  cardinality: *cardinality1_value
                  valueOption:
                    - EcdsaSecp256k1RecoveryMethod2020
                controller: *controller_did
                publicKeyHex: *cardinality1
                publicKeyJwk: *absent
                publicKeyBase58: *absent
                publicKeyMultibase: *absent
                publicKeyPgp: *absent
              - &id_ethereum_address
                id: *cardinality1_pattern
                type:
                  cardinality: *cardinality1_value
                  valueOption:
                    - EcdsaSecp256k1RecoveryMethod2020
                controller: *controller_did
                ethereumAddress: *cardinality1
                publicKeyJwk: *absent
                publicKeyBase58: *absent
                publicKeyMultibase: *absent
                publicKeyHex: *absent
                publicKeyPgp: *absent
        authentication:
          message: "invalid 'authentication'"
          attributes: &verification_method_attributes
            or:
              - datatype: String # DID Core 5.3: a reference to a verification method is a DID URL
                pattern: *did_url
              - *id_jwk
              - *id_base58
              - *id_multibase
              - *id_blockchain_account_id
              - *id_public_key_pgp
              - *id_public_key_hex
              - *id_ethereum_address
        assertionMethod:
          message: "invalid 'assertionMethod'"
          attributes: *verification_method_attributes
        keyAgreement:
          message: "invalid 'keyAgreement'"
          attributes: *verification_method_attributes
        capabilityInvocation:
          message: "invalid 'capabilityInvocation'"
          attributes: *verification_method_attributes
        capabilityDelegation:
          message: "invalid 'capabilityDelegation'"
          attributes: *verification_method_attributes
        or:
          - verificationMethod: &verification_method_id
              cardinality: "0..n"
              attributes:
                id: 
                  *cardinality1_pattern
          - authentication: *verification_method_id
          - assertionMethod: *verification_method_id
          - keyAgreement: *verification_method_id
          - capabilityInvocation: *verification_method_id
          - capabilityDelegation: *verification_method_id
        service:
          message: "duplicate 'id' in 'service'" # DID Core 5.4: no two services with the same id
          unique: id
          attributes:
            id: # DID Core 5.4: a URI; a reference relative to the DID document like "#linked-domain" is accepted, as for verification methods
              cardinality: "1..1"
              pattern: '^([A-Za-z][A-Za-z0-9+.-]*:[^\s]+|#[^\s]+)$'
              message: "there must be one valid 'id' in 'service'"
            type: # DID Core 5.4: a string or a set of strings
              cardinality: "1..n"
              message: "there must be at least one 'type' in 'service'"
            serviceEndpoint: # DID Core 5.4: a URI, a map, or a set of URIs and/or maps
              cardinality: "1..n"
              message: "invalid 'serviceEndpoint' in 'service'"
              attributes:
                or:
                  - datatype: String
                    pattern: '^[A-Za-z][A-Za-z0-9+.-]*:[^\s]+$'
                  - nodeKind: BlankNodeOrIRI

    - type: OverlayDidContextValidation
      base: Did
      name: DidContextValidationOverlay
      constraints:
        - id: "*"
          context: "https://www.w3.org/ns/did/v1"
        - type: JsonWebKey2020
          context: "https://w3id.org/security/suites/jws-2020/v1"
        - type: EcdsaSecp256k1VerificationKey2019
          context: "https://w3id.org/security/suites/secp256k1-2019"
        - type: Ed25519VerificationKey2018
          context: "https://w3id.org/security/suites/ed25519-2018/v1"
        - type: Ed25519VerificationKey2020
          context: "https://w3id.org/security/suites/ed25519-2020/v1"
        - type: Bls12381G1Key2020
          context: "https://w3id.org/security/suites/bls12381-2020/v1"
        - type: Bls12381G2Key2020
          context: "https://w3id.org/security/suites/bls12381-2020/v1"
        - type: PgpVerificationKey2021
          context: "https://w3id.org/security/suites/pgp-2021/v1"
        - type: RsaVerificationKey2018
          context: "https://www.w3.org/2018/credentials/v1"
        - type: X25519KeyAgreementKey2019
          context: "http://w3id.org/security/suites/x25519-2019/v1"
        - type: EcdsaSecp256k1RecoveryMethod2020
          context: "https://w3id.org/security/suites/secp256k1recovery-2020"
        - type: VerifiableCondition2021
          context: "https://w3c-ccg.github.io/verifiable-conditions/contexts/verifiable-conditions-2021-v1.json"
        - type: Multikey
          context: "https://w3id.org/security/multikey/v1"