sq: URI Scheme Specification

1. Abstract

The sq: scheme identifies a resource relative to a cryptographically controlled did:sizuq identity root. It is intended for links in documents, QR codes, native applications, and cross-application references where an HTTPS origin would couple identity to a particular hosting provider.

2. Syntax

The scheme name is exactly lowercase sq. Parsers MUST compare the URI scheme case-insensitively as required by RFC 3986, but emitters SHOULD serialize it as lowercase sq.

sq-uri   = "sq:" sq-root [ "/" sq-path ] [ "?" query ] [ "#" fragment ]
sq-root  = "z" 1*base58btc-char
sq-path  = segment-nz *( "/" segment )
base58btc-char = %x31-39 / %x41-48 / %x4A-4E / %x50-5A / %x61-6B / %x6D-7A

; segment, segment-nz, query and fragment are from RFC 3986.
; sq-root uses the did:sizuq v0.1 method-specific-id syntax.

The sq-root MUST be a valid did:sizuq v0.1 method-specific identifier. Empty paths are allowed; sq:<root> identifies the identity root itself.

3. Semantics

An sq: URI has two stable layers. The root selects the DID did:sizuq:<sq-root>. The optional path identifies a resource within the namespace controlled by that DID. Query parameters carry request or representation hints and MUST NOT change the underlying resource identity unless a resource type specification explicitly states otherwise. Fragments identify a secondary resource in the representation returned by dereferencing.

Path segments are opaque to the generic scheme. Version 0.1 reserves the first segments profile, post, collection, and service for Sizuq ecosystem profiles. Unknown first segments MUST be preserved and MAY be handled by application-specific extensions.

4. Resolution and dereferencing

1. Parse and validate the URI. Reject invalid percent-encoding and an invalid sq-root.
2. Construct did:sizuq:<sq-root> and resolve it using the did:sizuq method.
3. If the URI has no path, return the identity-root result appropriate to the calling API.
4. Locate a current DID service whose type is SizuqResourceService. If none is present, return resourceServiceNotFound.
5. Dereference the path through that service using its declared service endpoint. A client MUST treat the endpoint as untrusted transport and MUST retain the original sq: URI as the canonical identifier.

A service endpoint conforming to this profile accepts:

GET {serviceEndpoint}/{sq-path}
Accept: application/json, text/html;q=0.9, */*;q=0.1
Sizuq-Resource-URI: sq:{root}/{sq-path}

HTTP redirects MAY be followed according to client policy, but a redirect does not change the canonical sq: identifier. A gateway MAY expose sq: resources over HTTPS for browsers that do not have a native handler.

5. Comparison and normalization

The scheme name is case-insensitive; sq-root is case-sensitive because it is a base58btc encoding. Clients MUST NOT lowercase the root. Percent-encoded octets representing unreserved characters MAY be normalized according to RFC 3986. Dot-segment removal applies only when an application interprets the path hierarchically; generic sq: comparison MUST NOT invent file-system semantics.

Two URIs that differ only by fragment identify the same primary resource but different secondary resources. Query ordering is significant unless the relevant resource profile declares otherwise.

6. Interoperability considerations

Generic operating-system URI handlers often dispatch an entire URI to one application. Multiple applications may legitimately understand sq:. Platforms SHOULD allow user choice rather than assuming one vendor is authoritative. A conforming application SHOULD provide copy, paste, and QR representations using the canonical URI text.

Implementations that cannot resolve did:sizuq directly MAY delegate to a configured resolver or gateway. Such delegation affects availability and privacy but MUST NOT alter identifier syntax or the verification rules of the underlying DID method.

7. Security considerations

Untrusted URI input. Applications MUST parse sq: as data, not as a shell command or executable instruction. Handlers MUST validate length and percent-encoding before passing values to other components. Resource paths can contain attacker-controlled content and MUST be escaped before use in HTML, database queries, logs, or file-system APIs.

Resolver and gateway substitution. A malicious gateway can return false content, track requests, or redirect users. Identity claims MUST be validated against the resolved did:sizuq state. Applications MUST NOT treat possession of an HTTPS origin or successful gateway response as proof of control over the sq-root.

Service endpoint attacks. DID-controlled service endpoints can target internal addresses. Server-side dereferencers SHOULD block local and link-local network ranges unless explicitly configured, MUST validate TLS for HTTPS endpoints, and SHOULD enforce response-size and redirect limits.

Handler confusion. Applications SHOULD display the resolved controller and resource type before performing a sensitive action initiated by an external sq: link. Merely opening a URI MUST NOT authorize payments, credential release, account linking, or destructive actions.

8. Privacy considerations

Because the root is a stable identifier, repeated sq: links can be correlated. Applications SHOULD offer context-specific identities where correlation is not necessary. Resource paths SHOULD avoid embedding email addresses, names, exact locations, access tokens, or other sensitive attributes.

Delegated resolution can reveal the full URI to a gateway or directory. Privacy-sensitive clients SHOULD support local caches or alternate resolvers and SHOULD avoid sending fragments to network services when the fragment can be processed locally.

9. IANA considerations

The intended application is a Provisional URI Scheme registration under RFC 7595. The name sq is a short contraction associated specifically with sizuq; it is not intended as an abbreviation for a generic concept such as “standard query” and does not claim a general-purpose namespace outside this protocol family.

The scheme has no default port and does not define a DNS authority component. It does not itself carry credentials. MIME-type handling is determined during dereferencing, not by URI syntax.

10. Examples

sq:z75o3YCSEJnivnVp76pexncihFSzBTaRJ7jdCtaXURwtM
sq:z75o3YCSEJnivnVp76pexncihFSzBTaRJ7jdCtaXURwtM/profile
sq:z75o3YCSEJnivnVp76pexncihFSzBTaRJ7jdCtaXURwtM/post/0196f7d5-8a2f-7d18-a2c2-60b22e8ce176
sq:z75o3YCSEJnivnVp76pexncihFSzBTaRJ7jdCtaXURwtM/collection/reading?view=compact#item-4

The root in these examples is derived by the normative did:sizuq test vector. The resource paths are illustrative and are not asserted to resolve.