fix(did): resolve path-based did:web documents per spec

.changeset/fair-zebras-talk.md

@@ -0,0 +1,10 @@
+---
+"@agentcommercekit/did": patch
+---
+
+Fix `did:web` resolution URL construction to follow the spec:
+
+- Keep root identifiers at `/.well-known/did.json` (for example, `did:web:example.com`)
+- Resolve path-based identifiers to `/:path/did.json` (for example, `did:web:example.com:abc`)
+
+Also adds regression tests for path-based resolution, including `allowedHttpHosts`.

packages/did/src/did-resolvers/web-did-resolver.test.ts

@@ -93,6 +93,58 @@ describe("web-did-resolver", () => {
       )
     })
 
+    it("resolves path-based did:web documents at /:path/did.json", async () => {
+      const pathDidDocument = {
+        ...mockDidDocument,
+        id: "did:web:example.com:issuers:v1",
+      }
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve(pathDidDocument),
+      })
+
+      const did = "did:web:example.com:issuers:v1"
+      const resolver = getResolver()
+      const parsedDid: ParsedDID = {
+        did,
+        didUrl: did,
+        method: "web",
+        id: "example.com:issuers:v1",
+      }
+      await resolver.web(did, parsedDid, { resolve: vi.fn() }, {})
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        "https://example.com/issuers/v1/did.json",
+        { mode: "cors" },
+      )
+    })
+
+    it("allows http for specified hosts with path-based did:web documents", async () => {
+      const pathDidDocument = {
+        ...mockDidDocument,
+        id: "did:web:localhost%3A8787:issuers:v1",
+      }
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve(pathDidDocument),
+      })
+
+      const did = "did:web:localhost%3A8787:issuers:v1"
+      const resolver = getResolver({ allowedHttpHosts: ["localhost"] })
+      const parsedDid: ParsedDID = {
+        did,
+        didUrl: did,
+        method: "web",
+        id: "localhost%3A8787:issuers:v1",
+      }
+      await resolver.web(did, parsedDid, { resolve: vi.fn() }, {})
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        "http://localhost:8787/issuers/v1/did.json",
+        { mode: "cors" },
+      )
+    })
+
     it("handles fetch errors", async () => {
       mockFetch.mockRejectedValueOnce(new Error("Network error"))
 

packages/did/src/did-resolvers/web-did-resolver.ts

@@ -105,7 +105,18 @@ function buildDidPath(did: string, docPath: string = DEFAULT_DOC_PATH): string {
   }
 
   const parts = did.replace("did:web:", "").split(":")
-  return parts.map(decodeURIComponent).join("/") + docPath
+  const decodedParts = parts.map(decodeURIComponent)
+  const [host, ...path] = decodedParts
+
+  if (!host) {
+    throw new Error("Invalid did:web DID")
+  }
+
+  if (path.length === 0) {
+    return `${host}${docPath}`
+  }
+
+  return `${host}/${path.join("/")}/did.json`
 }
 
 /**