@fedify/fedify 1.6.0-dev.814 → 1.6.0

package/dist/sig/ld.d.ts

@@ -0,0 +1,150 @@
+import { Temporal } from "@js-temporal/polyfill";
+import { URLPattern } from "urlpattern-polyfill";
+import { DocumentLoader } from "../runtime/docloader.js";
+import { CryptographicKey$1 as CryptographicKey } from "../vocab/vocab.js";
+import { KeyCache } from "./key.js";
+import { TracerProvider } from "@opentelemetry/api";
+
+//#region sig/ld.d.ts
+/**
+* A signature of a JSON-LD document.
+* @since 1.0.0
+*/
+/**
+ * A signature of a JSON-LD document.
+ * @since 1.0.0
+ */
+interface Signature {
+  "@context"?: "https://w3id.org/identity/v1";
+  type: "RsaSignature2017";
+  id?: string;
+  creator: string;
+  created: string;
+  signatureValue: string;
+}
+/**
+ * Attaches a LD signature to the given JSON-LD document.
+ * @param jsonLd The JSON-LD document to attach the signature to.  It is not
+ *               modified.
+ * @param signature The signature to attach.
+ * @returns The JSON-LD document with the attached signature.
+ * @throws {TypeError} If the input document is not a valid JSON-LD document.
+ * @since 1.0.0
+ */
+declare function attachSignature(jsonLd: unknown, signature: Signature): {
+  signature: Signature;
+};
+/**
+ * Options for creating Linked Data Signatures.
+ * @since 1.0.0
+ */
+interface CreateSignatureOptions {
+  /**
+   * The context loader for loading remote JSON-LD contexts.
+   */
+  contextLoader?: DocumentLoader;
+  /**
+   * The time when the signature was created.  If not specified, the current
+   * time will be used.
+   */
+  created?: Temporal.Instant;
+}
+/**
+ * Creates a LD signature for the given JSON-LD document.
+ * @param jsonLd The JSON-LD document to sign.
+ * @param privateKey The private key to sign the document.
+ * @param keyId The ID of the public key that corresponds to the private key.
+ * @param options Additional options for creating the signature.
+ *                See also {@link CreateSignatureOptions}.
+ * @return The created signature.
+ * @throws {TypeError} If the private key is invalid or unsupported.
+ * @since 1.0.0
+ */
+declare function createSignature(jsonLd: unknown, privateKey: CryptoKey, keyId: URL, {
+  contextLoader,
+  created
+}?: CreateSignatureOptions): Promise<Signature>;
+/**
+ * Options for signing JSON-LD documents.
+ * @since 1.0.0
+ */
+interface SignJsonLdOptions extends CreateSignatureOptions {
+  /**
+   * The OpenTelemetry tracer provider for tracing the signing process.
+   * If omitted, the global tracer provider is used.
+   * @since 1.3.0
+   */
+  tracerProvider?: TracerProvider;
+}
+/**
+ * Signs the given JSON-LD document with the private key and returns the signed
+ * JSON-LD document.
+ * @param jsonLd The JSON-LD document to sign.
+ * @param privateKey The private key to sign the document.
+ * @param keyId The key ID to use in the signature.  It will be used by the
+ *              verifier to fetch the corresponding public key.
+ * @param options Additional options for signing the document.
+ *                See also {@link SignJsonLdOptions}.
+ * @returns The signed JSON-LD document.
+ * @throws {TypeError} If the private key is invalid or unsupported.
+ * @since 1.0.0
+ */
+declare function signJsonLd(jsonLd: unknown, privateKey: CryptoKey, keyId: URL, options: SignJsonLdOptions): Promise<{
+  signature: Signature;
+}>;
+/**
+ * Detaches Linked Data Signatures from the given JSON-LD document.
+ * @param jsonLd The JSON-LD document to modify.
+ * @returns The modified JSON-LD document.  If the input document does not
+ *          contain a signature, the original document is returned.
+ * @since 1.0.0
+ */
+declare function detachSignature(jsonLd: unknown): unknown;
+/**
+ * Options for verifying Linked Data Signatures.
+ * @since 1.0.0
+ */
+interface VerifySignatureOptions {
+  /**
+   * The document loader to use for fetching the public key.
+   */
+  documentLoader?: DocumentLoader;
+  /**
+   * The context loader to use for JSON-LD context retrieval.
+   */
+  contextLoader?: DocumentLoader;
+  /**
+   * The key cache to use for caching public keys.
+   */
+  keyCache?: KeyCache;
+  /**
+   * The OpenTelemetry tracer provider for tracing the verification process.
+   * If omitted, the global tracer provider is used.
+   * @since 1.3.0
+   */
+  tracerProvider?: TracerProvider;
+}
+/**
+ * Verifies Linked Data Signatures of the given JSON-LD document.
+ * @param jsonLd The JSON-LD document to verify.
+ * @param options Options for verifying the signature.
+ * @returns The public key that signed the document or `null` if the signature
+ *          is invalid or the key is not found.
+ * @since 1.0.0
+ */
+declare function verifySignature(jsonLd: unknown, options?: VerifySignatureOptions): Promise<CryptographicKey | null>;
+/**
+ * Options for verifying JSON-LD documents.
+ */
+interface VerifyJsonLdOptions extends VerifySignatureOptions {}
+/**
+ * Verify the authenticity of the given JSON-LD document using Linked Data
+ * Signatures.  If the document is signed, this function verifies the signature
+ * and checks if the document is attributed to the owner of the public key.
+ * If the document is not signed, this function returns `false`.
+ * @param jsonLd The JSON-LD document to verify.
+ * @param options Options for verifying the document.
+ * @returns `true` if the document is authentic; `false` otherwise.
+ */
+declare function verifyJsonLd(jsonLd: unknown, options?: VerifyJsonLdOptions): Promise<boolean>; //#endregion
+export { CreateSignatureOptions, SignJsonLdOptions, VerifyJsonLdOptions, VerifySignatureOptions, attachSignature as attachSignature$1, createSignature as createSignature$1, detachSignature as detachSignature$1, signJsonLd as signJsonLd$1, verifyJsonLd as verifyJsonLd$1, verifySignature as verifySignature$1 };

package/dist/sig/ld.js

@@ -0,0 +1,270 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+    
+import { deno_default } from "../deno.js";
+import { getTypeId } from "../vocab/type.js";
+import { getDocumentLoader } from "../runtime/docloader.js";
+import { Activity, CryptographicKey, Object as Object$1 } from "../vocab/vocab.js";
+import { fetchKey, validateCryptoKey } from "./key.js";
+import { getLogger } from "@logtape/logtape";
+import { SpanStatusCode, trace } from "@opentelemetry/api";
+import jsonld from "jsonld";
+import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
+import { encodeHex } from "byte-encodings/hex";
+
+//#region sig/ld.ts
+const logger = getLogger([
+	"fedify",
+	"sig",
+	"ld"
+]);
+/**
+* Attaches a LD signature to the given JSON-LD document.
+* @param jsonLd The JSON-LD document to attach the signature to.  It is not
+*               modified.
+* @param signature The signature to attach.
+* @returns The JSON-LD document with the attached signature.
+* @throws {TypeError} If the input document is not a valid JSON-LD document.
+* @since 1.0.0
+*/
+function attachSignature(jsonLd, signature) {
+	if (typeof jsonLd !== "object" || jsonLd == null) throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
+	return {
+		...jsonLd,
+		signature
+	};
+}
+/**
+* Creates a LD signature for the given JSON-LD document.
+* @param jsonLd The JSON-LD document to sign.
+* @param privateKey The private key to sign the document.
+* @param keyId The ID of the public key that corresponds to the private key.
+* @param options Additional options for creating the signature.
+*                See also {@link CreateSignatureOptions}.
+* @return The created signature.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 1.0.0
+*/
+async function createSignature(jsonLd, privateKey, keyId, { contextLoader, created } = {}) {
+	validateCryptoKey(privateKey, "private");
+	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
+	const options = {
+		"@context": "https://w3id.org/identity/v1",
+		creator: keyId.href,
+		created: created?.toString() ?? new Date().toISOString()
+	};
+	const optionsHash = await hashJsonLd(options, contextLoader);
+	const docHash = await hashJsonLd(jsonLd, contextLoader);
+	const message = optionsHash + docHash;
+	const encoder = new TextEncoder();
+	const messageBytes = encoder.encode(message);
+	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, messageBytes);
+	return {
+		...options,
+		type: "RsaSignature2017",
+		signatureValue: encodeBase64(signature)
+	};
+}
+/**
+* Signs the given JSON-LD document with the private key and returns the signed
+* JSON-LD document.
+* @param jsonLd The JSON-LD document to sign.
+* @param privateKey The private key to sign the document.
+* @param keyId The key ID to use in the signature.  It will be used by the
+*              verifier to fetch the corresponding public key.
+* @param options Additional options for signing the document.
+*                See also {@link SignJsonLdOptions}.
+* @returns The signed JSON-LD document.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 1.0.0
+*/
+async function signJsonLd(jsonLd, privateKey, keyId, options) {
+	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
+	return await tracer.startActiveSpan("ld_signatures.sign", { attributes: { "ld_signatures.key_id": keyId.href } }, async (span) => {
+		try {
+			const signature = await createSignature(jsonLd, privateKey, keyId, options);
+			if (span.isRecording()) {
+				span.setAttribute("ld_signatures.type", signature.type);
+				span.setAttribute("ld_signatures.signature", encodeHex(decodeBase64(signature.signatureValue)));
+			}
+			return attachSignature(jsonLd, signature);
+		} catch (error) {
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
+/**
+* Checks if the given JSON-LD document has a Linked Data Signature.
+* @param jsonLd The JSON-LD document to check.
+* @returns `true` if the document has a signature; `false` otherwise.
+* @since 1.0.0
+*/
+function hasSignature(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	if ("signature" in jsonLd) {
+		const signature = jsonLd.signature;
+		if (typeof signature !== "object" || signature == null) return false;
+		return "type" in signature && signature.type === "RsaSignature2017" && "creator" in signature && typeof signature.creator === "string" && "created" in signature && typeof signature.created === "string" && "signatureValue" in signature && typeof signature.signatureValue === "string";
+	}
+	return false;
+}
+/**
+* Detaches Linked Data Signatures from the given JSON-LD document.
+* @param jsonLd The JSON-LD document to modify.
+* @returns The modified JSON-LD document.  If the input document does not
+*          contain a signature, the original document is returned.
+* @since 1.0.0
+*/
+function detachSignature(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
+	const doc = { ...jsonLd };
+	delete doc.signature;
+	return doc;
+}
+/**
+* Verifies Linked Data Signatures of the given JSON-LD document.
+* @param jsonLd The JSON-LD document to verify.
+* @param options Options for verifying the signature.
+* @returns The public key that signed the document or `null` if the signature
+*          is invalid or the key is not found.
+* @since 1.0.0
+*/
+async function verifySignature(jsonLd, options = {}) {
+	if (!hasSignature(jsonLd)) return null;
+	const sig = jsonLd.signature;
+	let signature;
+	try {
+		signature = decodeBase64(sig.signatureValue);
+	} catch (error) {
+		logger.debug("Failed to verify; invalid base64 signatureValue: {signatureValue}", {
+			...sig,
+			error
+		});
+		return null;
+	}
+	const { key, cached } = await fetchKey(new URL(sig.creator), CryptographicKey, options);
+	if (key == null) return null;
+	const sigOpts = {
+		...sig,
+		"@context": "https://w3id.org/identity/v1"
+	};
+	delete sigOpts.type;
+	delete sigOpts.id;
+	delete sigOpts.signatureValue;
+	let sigOptsHash;
+	try {
+		sigOptsHash = await hashJsonLd(sigOpts, options.contextLoader);
+	} catch (error) {
+		logger.warn("Failed to verify; failed to hash the signature options: {signatureOptions}\n{error}", {
+			signatureOptions: sigOpts,
+			error
+		});
+		return null;
+	}
+	const document = { ...jsonLd };
+	delete document.signature;
+	let docHash;
+	try {
+		docHash = await hashJsonLd(document, options.contextLoader);
+	} catch (error) {
+		logger.warn("Failed to verify; failed to hash the document: {document}\n{error}", {
+			document,
+			error
+		});
+		return null;
+	}
+	const encoder = new TextEncoder();
+	const message = sigOptsHash + docHash;
+	const messageBytes = encoder.encode(message);
+	const verified = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature, messageBytes);
+	if (verified) return key;
+	if (cached) {
+		logger.debug("Failed to verify with the cached key {keyId}; signature {signatureValue} is invalid.  Retrying with the freshly fetched key...", {
+			keyId: sig.creator,
+			...sig
+		});
+		const { key: key$1 } = await fetchKey(new URL(sig.creator), CryptographicKey, {
+			...options,
+			keyCache: {
+				get: () => Promise.resolve(void 0),
+				set: async (keyId, key$2) => await options.keyCache?.set(keyId, key$2)
+			}
+		});
+		if (key$1 == null) return null;
+		const verified$1 = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key$1.publicKey, signature, messageBytes);
+		return verified$1 ? key$1 : null;
+	}
+	logger.debug("Failed to verify with the fetched key {keyId}; signature {signatureValue} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
+		keyId: sig.creator,
+		...sig,
+		message
+	});
+	return null;
+}
+/**
+* Verify the authenticity of the given JSON-LD document using Linked Data
+* Signatures.  If the document is signed, this function verifies the signature
+* and checks if the document is attributed to the owner of the public key.
+* If the document is not signed, this function returns `false`.
+* @param jsonLd The JSON-LD document to verify.
+* @param options Options for verifying the document.
+* @returns `true` if the document is authentic; `false` otherwise.
+*/
+async function verifyJsonLd(jsonLd, options = {}) {
+	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
+	return await tracer.startActiveSpan("ld_signatures.verify", async (span) => {
+		try {
+			const object = await Object$1.fromJsonLd(jsonLd, options);
+			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
+			span.setAttribute("activitypub.object.type", getTypeId(object).href);
+			if (typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd && typeof jsonLd.signature === "object" && jsonLd.signature != null) {
+				if ("creator" in jsonLd.signature && typeof jsonLd.signature.creator === "string") span.setAttribute("ld_signatures.key_id", jsonLd.signature.creator);
+				if ("signatureValue" in jsonLd.signature && typeof jsonLd.signature.signatureValue === "string") span.setAttribute("ld_signatures.signature", jsonLd.signature.signatureValue);
+				if ("type" in jsonLd.signature && typeof jsonLd.signature.type === "string") span.setAttribute("ld_signatures.type", jsonLd.signature.type);
+			}
+			const attributions = new Set(object.attributionIds.map((uri) => uri.href));
+			if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
+			const key = await verifySignature(jsonLd, options);
+			if (key == null) return false;
+			if (key.ownerId == null) {
+				logger.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
+				return false;
+			}
+			attributions.delete(key.ownerId.href);
+			if (attributions.size > 0) {
+				logger.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
+				return false;
+			}
+			return true;
+		} catch (error) {
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
+async function hashJsonLd(jsonLd, contextLoader) {
+	const canon = await jsonld.canonize(jsonLd, {
+		format: "application/n-quads",
+		documentLoader: contextLoader ?? getDocumentLoader()
+	});
+	const encoder = new TextEncoder();
+	const hash = await crypto.subtle.digest("SHA-256", encoder.encode(canon));
+	return encodeHex(hash);
+}
+
+//#endregion
+export { attachSignature, createSignature, detachSignature, hasSignature, signJsonLd, verifyJsonLd, verifySignature };

package/dist/sig/ld.test.d.ts

@@ -0,0 +1,2 @@
+import { Temporal } from "@js-temporal/polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/sig/ld.test.js

@@ -0,0 +1,224 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+    
+import { CryptographicKey } from "../vocab/vocab.js";
+import { generateCryptoKeyPair } from "./key.js";
+import { attachSignature, createSignature, detachSignature, signJsonLd, verifyJsonLd, verifySignature } from "./ld.js";
+import { assert } from "../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert.js";
+import { assertEquals } from "../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert_equals.js";
+import { test } from "../testing/mod.js";
+import { assertFalse } from "../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert_false.js";
+import { assertRejects } from "../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert_rejects.js";
+import { assertThrows } from "../node_modules/.pnpm/@jsr_std__assert@0.226.0/node_modules/@jsr/std__assert/assert_throws.js";
+import { mockDocumentLoader } from "../testing/docloader.js";
+import { ed25519Multikey, ed25519PrivateKey, rsaPrivateKey2, rsaPrivateKey3, rsaPublicKey2, rsaPublicKey3 } from "../testing/keys.js";
+import { encodeBase64 } from "byte-encodings/base64";
+
+//#region sig/ld.test.ts
+test("attachSignature()", () => {
+	const sig = {
+		"@context": "https://w3id.org/identity/v1",
+		type: "RsaSignature2017",
+		creator: "https://activitypub.academy/users/brauca_darradiul#main-key",
+		created: "2024-09-12T16:50:46Z",
+		signatureValue: "asdf"
+	};
+	const doc = {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/1"
+	};
+	assertEquals(attachSignature(doc, sig), {
+		...doc,
+		signature: sig
+	});
+	assertThrows(() => attachSignature(null, sig), TypeError);
+	assertThrows(() => attachSignature(1234, sig), TypeError);
+});
+test("createSignature()", async () => {
+	const doc = {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/1",
+		type: "Create"
+	};
+	const sig = await createSignature(doc, rsaPrivateKey2, rsaPublicKey2.id, { contextLoader: mockDocumentLoader });
+	const key = await verifySignature(attachSignature(doc, sig), {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	assertEquals(key, rsaPublicKey2);
+	assertRejects(() => createSignature(doc, rsaPublicKey2.publicKey, rsaPublicKey2.id, { contextLoader: mockDocumentLoader }), TypeError);
+	assertRejects(() => createSignature(doc, ed25519PrivateKey, ed25519Multikey.id, { contextLoader: mockDocumentLoader }), TypeError);
+});
+test("signJsonLd()", async () => {
+	const doc = {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/1",
+		type: "Create",
+		actor: "https://example.com/person2"
+	};
+	const signed = await signJsonLd(doc, rsaPrivateKey3, rsaPublicKey3.id, { contextLoader: mockDocumentLoader });
+	const verified = await verifyJsonLd(signed, {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	assert(verified);
+});
+const document = {
+	"@context": ["https://www.w3.org/ns/activitystreams", {
+		"ostatus": "http://ostatus.org#",
+		"atomUri": "ostatus:atomUri",
+		"inReplyToAtomUri": "ostatus:inReplyToAtomUri",
+		"conversation": "ostatus:conversation",
+		"sensitive": "as:sensitive",
+		"toot": "http://joinmastodon.org/ns#",
+		"votersCount": "toot:votersCount"
+	}],
+	"id": "https://activitypub.academy/users/brauca_darradiul/statuses/113125611605598678/activity",
+	"type": "Create",
+	"actor": "https://activitypub.academy/users/brauca_darradiul",
+	"published": "2024-09-12T16:50:45Z",
+	"to": ["https://www.w3.org/ns/activitystreams#Public"],
+	"cc": ["https://activitypub.academy/users/brauca_darradiul/followers"],
+	"object": {
+		"id": "https://activitypub.academy/users/brauca_darradiul/statuses/113125611605598678",
+		"type": "Note",
+		"summary": null,
+		"inReplyTo": null,
+		"published": "2024-09-12T16:50:45Z",
+		"url": "https://activitypub.academy/@brauca_darradiul/113125611605598678",
+		"attributedTo": "https://activitypub.academy/users/brauca_darradiul",
+		"to": ["https://www.w3.org/ns/activitystreams#Public"],
+		"cc": ["https://activitypub.academy/users/brauca_darradiul/followers"],
+		"sensitive": false,
+		"atomUri": "https://activitypub.academy/users/brauca_darradiul/statuses/113125611605598678",
+		"inReplyToAtomUri": null,
+		"conversation": "tag:activitypub.academy,2024-09-12:objectId=187606:objectType=Conversation",
+		"content": "<p>Test</p>",
+		"contentMap": { "en": "<p>Test</p>" },
+		"attachment": [],
+		"tag": [],
+		"replies": {
+			"id": "https://activitypub.academy/users/brauca_darradiul/statuses/113125611605598678/replies",
+			"type": "Collection",
+			"first": {
+				"type": "CollectionPage",
+				"next": "https://activitypub.academy/users/brauca_darradiul/statuses/113125611605598678/replies?only_other_accounts=true&page=true",
+				"partOf": "https://activitypub.academy/users/brauca_darradiul/statuses/113125611605598678/replies",
+				"items": []
+			}
+		}
+	}
+};
+const signature = {
+	"type": "RsaSignature2017",
+	"creator": "https://activitypub.academy/users/brauca_darradiul#main-key",
+	"created": "2024-09-12T16:50:46Z",
+	"signatureValue": "osp9n4Pubp8XFvBi0iwrpCjDkIpuuUr2klp+r8Jp289ISqRNlUPeHVvNrQSE2vqNm4j/cJGuQruIqZPTAmTjjB3HtqgawoAG11DA7OPpY6mJLruKnbqadV1cy5V0DJI9CRJXEBuEmMTJRO9gi1cyzlM4QxK30YrjmtQNLoU9th97da4lumsl+a5cAue38MDuJZvLWDOTZ1EGixwhLP8FevdnZ+jqwctGu9KrgDImBIpBkQaqHFTTGrbE7FlXsj1pneOUQTuRDa9zlk2DmgXeEBWN2OJZDjgJ4iBsF2JHtCn6PccKbuI9s2VLhnobPtLB8YdHYKqIPLmv0UOjAM8XrQ=="
+};
+const testVector = {
+	...document,
+	signature
+};
+test("detachSignature()", () => {
+	assertEquals(detachSignature(testVector), document);
+	assertEquals(detachSignature(document), document);
+});
+test("verifySignature()", async () => {
+	const doc = { ...testVector };
+	const key = await verifySignature(doc, {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	assertEquals(doc, testVector);
+	assertEquals(key, await CryptographicKey.fromJsonLd({
+		"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+		id: "https://activitypub.academy/users/brauca_darradiul#main-key",
+		owner: "https://activitypub.academy/users/brauca_darradiul",
+		publicKeyPem: "-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5W/9rYXddIjKo9Ury/LK XqQYbj0cOx/c+T1uRHJzced8JbvXdiBCNZXVVrIaygy3G/MOvxMW4kbA1bqeiSYY V9TXBMI6gVVDnl5VG64uGxswcvUWqQU5Q1mwuwyGCPhexAq3BKe/7uH64AZgx11e KLl3W3WcIMKmunYn8+z6hm0003hMensXMNpMVfqLoXaeuro7pYnwOSWoHFS3AxWK llMwAoa5waulgai8gD7/uA5Y9Hvguk/OBYBh9YnIX5N5jScsmY/EYuesNIH2Ct9s E3aVkTjZUt55JtXnk8Q9eTnrcB/98RtLWH4pJTKJhzxv19i3aZT3yDApPk0Q/biI JQIDAQAB -----END PUBLIC KEY----- "
+	}));
+	const doc2 = {
+		...testVector,
+		signature: {
+			...testVector.signature,
+			signatureValue: "!"
+		}
+	};
+	const key2 = await verifySignature(doc2, {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	assertEquals(doc2, {
+		...testVector,
+		signature: {
+			...testVector.signature,
+			signatureValue: "!"
+		}
+	});
+	assertEquals(key2, null);
+	const incorrectSig = encodeBase64(new Uint8Array([
+		1,
+		2,
+		3,
+		4
+	]));
+	const doc3 = {
+		...testVector,
+		signature: {
+			...testVector.signature,
+			signatureValue: incorrectSig
+		}
+	};
+	const key3 = await verifySignature(doc3, {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	assertEquals(doc3, {
+		...testVector,
+		signature: {
+			...testVector.signature,
+			signatureValue: incorrectSig
+		}
+	});
+	assertEquals(key3, null);
+	const doc4 = { ...testVector };
+	const key4 = await verifySignature(doc4, {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader,
+		keyCache: {
+			async get(keyId) {
+				return new CryptographicKey({
+					id: keyId,
+					owner: new URL("https://activitypub.academy/users/brauca_darradiul"),
+					publicKey: (await generateCryptoKeyPair("RSASSA-PKCS1-v1_5")).publicKey
+				});
+			},
+			set(_keyId, _key) {
+				return Promise.resolve();
+			}
+		}
+	});
+	assertEquals(doc4, testVector);
+	assertEquals(key4, key);
+});
+test("verifyJsonLd()", async () => {
+	const verified = await verifyJsonLd(testVector, {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	assert(verified);
+	const doc = {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/1",
+		type: "Create",
+		actor: "https://example.com/person2"
+	};
+	const signed = await signJsonLd(doc, rsaPrivateKey2, rsaPublicKey2.id, { contextLoader: mockDocumentLoader });
+	const verified2 = await verifyJsonLd(signed, {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	assertFalse(verified2);
+});
+
+//#endregion

package/dist/sig/mod.d.ts

@@ -0,0 +1,8 @@
+import { Temporal } from "@js-temporal/polyfill";
+import { URLPattern } from "urlpattern-polyfill";
+import { FetchKeyOptions, FetchKeyResult, KeyCache, exportJwk$1 as exportJwk, fetchKey$1 as fetchKey, generateCryptoKeyPair$1 as generateCryptoKeyPair, importJwk$1 as importJwk } from "./key.js";
+import { DoesActorOwnKeyOptions, GetKeyOwnerOptions, doesActorOwnKey$1 as doesActorOwnKey, getKeyOwner$1 as getKeyOwner } from "./owner.js";
+import { HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, SignRequestOptions, VerifyRequestOptions, signRequest$1 as signRequest, verifyRequest$1 as verifyRequest } from "./http.js";
+import { CreateSignatureOptions, SignJsonLdOptions, VerifyJsonLdOptions, VerifySignatureOptions, attachSignature$1 as attachSignature, createSignature$1 as createSignature, detachSignature$1 as detachSignature, signJsonLd$1 as signJsonLd, verifyJsonLd$1 as verifyJsonLd, verifySignature$1 as verifySignature } from "./ld.js";
+import { CreateProofOptions, SignObjectOptions, VerifyObjectOptions, VerifyProofOptions, createProof$1 as createProof, signObject$1 as signObject, verifyObject$1 as verifyObject, verifyProof$1 as verifyProof } from "./proof.js";
+export { CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyOptions, FetchKeyResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyProofOptions, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, generateCryptoKeyPair, getKeyOwner, importJwk, signJsonLd, signObject, signRequest, verifyJsonLd, verifyObject, verifyProof, verifyRequest, verifySignature };

package/dist/sig/mod.js

@@ -0,0 +1,11 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+    
+import { exportJwk, fetchKey, generateCryptoKeyPair, importJwk } from "./key.js";
+import { signRequest, verifyRequest } from "./http.js";
+import { attachSignature, createSignature, detachSignature, signJsonLd, verifyJsonLd, verifySignature } from "./ld.js";
+import { doesActorOwnKey, getKeyOwner } from "./owner.js";
+import { createProof, signObject, verifyObject, verifyProof } from "./proof.js";
+
+export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, generateCryptoKeyPair, getKeyOwner, importJwk, signJsonLd, signObject, signRequest, verifyJsonLd, verifyObject, verifyProof, verifyRequest, verifySignature };