@fedify/fedify 2.0.36-dev.2530 → 2.0.36-dev.2598

package/dist/{proof-DMYwiD7d.js → proof-CE8nwTF6.js}

@@ -1,11 +1,11 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { a as fetchActorDocument, d as name, f as version, i as exportJwk, l as validateCryptoKey, o as fetchKey, u as verifyKeyOwnership } from "./http-YAfhvSad.js";
+import { a as fetchActorDocument, d as name, f as version, i as exportJwk, l as validateCryptoKey, o as fetchKey, u as verifyKeyOwnership } from "./http-CfyVeGgF.js";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { encodeHex } from "byte-encodings/hex";
-import { getDocumentLoader } from "@fedify/vocab-runtime";
+import { getDocumentLoader, preloadedContexts } from "@fedify/vocab-runtime";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import serialize from "json-canon";
@@ -297,24 +297,110 @@ function assertSafeJsonLd(jsonLd) {
 		}
 	}
 }
+const signatureTermDefinition = { "signature": "https://w3id.org/security#signature" };
+const signatureDefiningContexts = new Set(["https://w3id.org/identity/v1", "https://w3id.org/security/v1"]);
+const signatureFreeContexts = getSignatureFreeContexts();
+function getSignatureFreeContexts() {
+	const urls = /* @__PURE__ */ new Set();
+	for (const [url, document] of globalThis.Object.entries(preloadedContexts)) {
+		if (typeof document !== "object" || document == null) continue;
+		const context = document["@context"];
+		if (typeof context !== "object" || context == null || Array.isArray(context)) continue;
+		const record = context;
+		if (!globalThis.Object.prototype.hasOwnProperty.call(record, "signature")) urls.add(url);
+	}
+	return urls;
+}
+function getContextEntryEffect(entry) {
+	if (entry == null) return "resets";
+	if (typeof entry === "string") {
+		if (signatureDefiningContexts.has(entry)) return "defines";
+		if (signatureFreeContexts.has(entry)) return "absent";
+		return "unknown";
+	}
+	if (typeof entry !== "object") return "absent";
+	const record = entry;
+	if (globalThis.Object.prototype.hasOwnProperty.call(record, "signature")) {
+		const definition = record["signature"];
+		const contextProtected = record["@protected"] === true;
+		const imported = globalThis.Object.prototype.hasOwnProperty.call(record, "@import");
+		if (definition == null) {
+			if (contextProtected) return "defines";
+			return imported ? "unknown" : "resets";
+		}
+		if (typeof definition === "object" && !Array.isArray(definition)) {
+			const term = definition;
+			const protectedTerm = contextProtected || term["@protected"] === true;
+			if (globalThis.Object.prototype.hasOwnProperty.call(term, "@id") && term["@id"] == null) {
+				if (protectedTerm) return "defines";
+				return imported ? "unknown" : "resets";
+			}
+		}
+		return "defines";
+	}
+	if (globalThis.Object.prototype.hasOwnProperty.call(record, "@import")) return "unknown";
+	return "absent";
+}
+function getSignatureTermState(context) {
+	if (context == null) return "absent";
+	if (!Array.isArray(context)) {
+		const effect = getContextEntryEffect(context);
+		return effect === "defines" ? "defined" : effect === "unknown" ? "unknown" : "absent";
+	}
+	let state = "absent";
+	for (const entry of context) {
+		const effect = getContextEntryEffect(entry);
+		if (effect === "defines") state = "defined";
+		else if (effect === "resets") state = "absent";
+		else if (effect === "unknown" && state !== "defined") state = "unknown";
+	}
+	return state;
+}
+function prepareSignatureDocument(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null || Array.isArray(jsonLd)) return jsonLd;
+	const document = jsonLd;
+	if (document["proof"] != null) return { ...document };
+	const context = document["@context"];
+	if (getSignatureTermState(context) !== "absent") return { ...document };
+	const definition = { ...signatureTermDefinition };
+	return {
+		...document,
+		"@context": context == null ? [definition] : Array.isArray(context) ? [...context, definition] : [context, definition]
+	};
+}
 /**
 * Attaches a LD signature to the given JSON-LD document.
+*
+* When the document's context does not already define the `signature`
+* property, the returned document adds a minimal inline context for it.
+* Without that definition, expanding the attached signature would produce a
+* blank node predicate, which is not valid RDF.  Documents that already carry
+* a `proof` are left unchanged, since a new context definition would invalidate
+* the proof.  Documents whose context includes an unrecognized remote context
+* are also left unchanged, since that context may already define `signature`.
 * @param jsonLd The JSON-LD document to attach the signature to.  It is not
 *               modified.
 * @param signature The signature to attach.
 * @returns The JSON-LD document with the attached signature.
 * @throws {TypeError} If the input document is not a valid JSON-LD document.
+*                    Top-level arrays are rejected, since a Linked Data
+*                    Signature is attached to a single node.
 * @since 1.0.0
 */
 function attachSignature(jsonLd, signature) {
-	if (typeof jsonLd !== "object" || jsonLd == null) throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
-	return {
-		...jsonLd,
-		signature
-	};
+	if (typeof jsonLd !== "object" || jsonLd == null || Array.isArray(jsonLd)) throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
+	const output = prepareSignatureDocument(jsonLd);
+	output.signature = signature;
+	return output;
 }
 /**
 * Creates a LD signature for the given JSON-LD document.
+*
+* If the document's context does not define the `signature` property, the
+* signature is computed over the document with a minimal inline definition
+* added.  Use {@link attachSignature} to attach the signature to that exact
+* document.  Documents that already carry a `proof`, or whose context includes
+* an unrecognized remote context, are hashed unchanged.
 * @param jsonLd The JSON-LD document to sign.
 * @param privateKey The private key to sign the document.
 * @param keyId The ID of the public key that corresponds to the private key.
@@ -328,14 +414,17 @@ async function createSignature(jsonLd, privateKey, keyId, { contextLoader, creat
 	validateCryptoKey(privateKey, "private");
 	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
 	const options = {
-		"@context": "https://w3id.org/identity/v1",
 		creator: keyId.href,
 		created: created?.toString() ?? (/* @__PURE__ */ new Date()).toISOString()
 	};
-	const message = await hashJsonLd(options, contextLoader) + await hashJsonLd(jsonLd, contextLoader);
+	const message = await hashJsonLd({
+		"@context": "https://w3id.org/identity/v1",
+		...options
+	}, contextLoader) + await hashJsonLd(prepareSignatureDocument(jsonLd), contextLoader);
 	const messageBytes = new TextEncoder().encode(message);
 	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, messageBytes);
 	return {
+		"@context": "https://w3id.org/security/v1",
 		...options,
 		type: "RsaSignature2017",
 		signatureValue: encodeBase64(signature)
@@ -727,7 +816,10 @@ const logger = getLogger([
 * @throws {TypeError} If the private key is invalid or unsupported.
 * @since 0.10.0
 */
-async function createProof(object, privateKey, keyId, { contextLoader, context, created } = {}) {
+async function createProof(object, privateKey, keyId, options = {}) {
+	return (await createProofInternal(object, privateKey, keyId, options)).proof;
+}
+async function createProofInternal(object, privateKey, keyId, { contextLoader, context, created } = {}) {
 	validateCryptoKey(privateKey, "private");
 	if (privateKey.algorithm.name !== "Ed25519") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
 	const compactMsg = await object.clone({ proofs: [] }).toJsonLd({
@@ -754,13 +846,25 @@ async function createProof(object, privateKey, keyId, { contextLoader, context,
 	digest.set(new Uint8Array(proofDigest), 0);
 	digest.set(new Uint8Array(msgDigest), proofDigest.byteLength);
 	const sig = await crypto.subtle.sign("Ed25519", privateKey, digest);
-	return new DataIntegrityProof({
-		cryptosuite: "eddsa-jcs-2022",
-		verificationMethod: keyId,
-		proofPurpose: "assertionMethod",
-		created: created ?? Temporal.Now.instant(),
-		proofValue: new Uint8Array(sig)
-	});
+	return {
+		proof: new DataIntegrityProof({
+			cryptosuite: "eddsa-jcs-2022",
+			verificationMethod: keyId,
+			proofPurpose: "assertionMethod",
+			created: created ?? Temporal.Now.instant(),
+			proofValue: new Uint8Array(sig)
+		}),
+		jsonLd: compactMsg
+	};
+}
+function getJsonLdContextKey(value) {
+	const context = typeof value === "object" && value != null && !Array.isArray(value) ? value["@context"] ?? null : null;
+	return JSON.stringify(sortJsonKeys(context));
+}
+function sortJsonKeys(value) {
+	if (Array.isArray(value)) return value.map(sortJsonKeys);
+	if (typeof value !== "object" || value == null) return value;
+	return globalThis.Object.fromEntries(globalThis.Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => [key, sortJsonKeys(item)]));
 }
 /**
 * Signs the given object with the private key and returns the signed object.
@@ -776,9 +880,18 @@ async function signObject(object, privateKey, keyId, options = {}) {
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.sign", { attributes: { "activitypub.object.type": getTypeId(object).href } }, async (span) => {
 		try {
 			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
+			const { proof, jsonLd } = await createProofInternal(object, privateKey, keyId, options);
 			const existingProofs = [];
-			for await (const proof of object.getProofs(options)) existingProofs.push(proof);
-			const proof = await createProof(object, privateKey, keyId, options);
+			let hasProofs = object.proofIds.length > 0;
+			if (!hasProofs) for await (const _ of object.getProofs(options)) {
+				hasProofs = true;
+				break;
+			}
+			if (hasProofs) {
+				let sameContext = true;
+				if (options.context == null) sameContext = getJsonLdContextKey(await object.toJsonLd({ contextLoader: options.contextLoader })) === getJsonLdContextKey(jsonLd);
+				if (sameContext) for await (const existingProof of object.getProofs(options)) existingProofs.push(existingProof);
+			}
 			if (span.isRecording()) {
 				if (proof.cryptosuite != null) span.setAttribute("object_integrity_proofs.cryptosuite", proof.cryptosuite);
 				if (proof.verificationMethodId != null) span.setAttribute("object_integrity_proofs.key_id", proof.verificationMethodId.href);

package/dist/{proof-Bf8rYD7r.mjs → proof-CiBs9Q4l.mjs}

@@ -1,8 +1,8 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CtG6TwTB.mjs";
-import { o as validateCryptoKey, r as fetchKey } from "./key-QamJxksu.mjs";
+import { n as version, t as name } from "./deno--OYa_lxj.mjs";
+import { o as validateCryptoKey, r as fetchKey } from "./key-D5e9c_yV.mjs";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";
@@ -24,7 +24,10 @@ const logger = getLogger([
 * @throws {TypeError} If the private key is invalid or unsupported.
 * @since 0.10.0
 */
-async function createProof(object, privateKey, keyId, { contextLoader, context, created } = {}) {
+async function createProof(object, privateKey, keyId, options = {}) {
+	return (await createProofInternal(object, privateKey, keyId, options)).proof;
+}
+async function createProofInternal(object, privateKey, keyId, { contextLoader, context, created } = {}) {
 	validateCryptoKey(privateKey, "private");
 	if (privateKey.algorithm.name !== "Ed25519") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
 	const compactMsg = await object.clone({ proofs: [] }).toJsonLd({
@@ -51,13 +54,25 @@ async function createProof(object, privateKey, keyId, { contextLoader, context,
 	digest.set(new Uint8Array(proofDigest), 0);
 	digest.set(new Uint8Array(msgDigest), proofDigest.byteLength);
 	const sig = await crypto.subtle.sign("Ed25519", privateKey, digest);
-	return new DataIntegrityProof({
-		cryptosuite: "eddsa-jcs-2022",
-		verificationMethod: keyId,
-		proofPurpose: "assertionMethod",
-		created: created ?? Temporal.Now.instant(),
-		proofValue: new Uint8Array(sig)
-	});
+	return {
+		proof: new DataIntegrityProof({
+			cryptosuite: "eddsa-jcs-2022",
+			verificationMethod: keyId,
+			proofPurpose: "assertionMethod",
+			created: created ?? Temporal.Now.instant(),
+			proofValue: new Uint8Array(sig)
+		}),
+		jsonLd: compactMsg
+	};
+}
+function getJsonLdContextKey(value) {
+	const context = typeof value === "object" && value != null && !Array.isArray(value) ? value["@context"] ?? null : null;
+	return JSON.stringify(sortJsonKeys(context));
+}
+function sortJsonKeys(value) {
+	if (Array.isArray(value)) return value.map(sortJsonKeys);
+	if (typeof value !== "object" || value == null) return value;
+	return globalThis.Object.fromEntries(globalThis.Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => [key, sortJsonKeys(item)]));
 }
 /**
 * Signs the given object with the private key and returns the signed object.
@@ -73,9 +88,18 @@ async function signObject(object, privateKey, keyId, options = {}) {
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.sign", { attributes: { "activitypub.object.type": getTypeId(object).href } }, async (span) => {
 		try {
 			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
+			const { proof, jsonLd } = await createProofInternal(object, privateKey, keyId, options);
 			const existingProofs = [];
-			for await (const proof of object.getProofs(options)) existingProofs.push(proof);
-			const proof = await createProof(object, privateKey, keyId, options);
+			let hasProofs = object.proofIds.length > 0;
+			if (!hasProofs) for await (const _ of object.getProofs(options)) {
+				hasProofs = true;
+				break;
+			}
+			if (hasProofs) {
+				let sameContext = true;
+				if (options.context == null) sameContext = getJsonLdContextKey(await object.toJsonLd({ contextLoader: options.contextLoader })) === getJsonLdContextKey(jsonLd);
+				if (sameContext) for await (const existingProof of object.getProofs(options)) existingProofs.push(existingProof);
+			}
 			if (span.isRecording()) {
 				if (proof.cryptosuite != null) span.setAttribute("object_integrity_proofs.cryptosuite", proof.cryptosuite);
 				if (proof.verificationMethodId != null) span.setAttribute("object_integrity_proofs.key_id", proof.verificationMethodId.href);

package/dist/{send-1tVKmxvT.mjs → send-DpvZgVSA.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CtG6TwTB.mjs";
-import { r as doubleKnockScoped } from "./http-CUOxcDgn.mjs";
+import { n as version, t as name } from "./deno--OYa_lxj.mjs";
+import { r as doubleKnockScoped } from "./http-C3d2DXwF.mjs";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";
 import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";

package/dist/sig/http.test.mjs

@@ -7,8 +7,8 @@ import { i as assertExists, t as assertStringIncludes } from "../std__assert-Dfl
 import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { t as exportJwk } from "../key-QamJxksu.mjs";
-import { a as formatRfc9421SignatureParameters, c as signRequest, i as formatRfc9421Signature, l as timingSafeEqual, n as doubleKnock, o as parseRfc9421Signature, r as doubleKnockScoped, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as verifyRequest } from "../http-CUOxcDgn.mjs";
+import { t as exportJwk } from "../key-D5e9c_yV.mjs";
+import { a as formatRfc9421SignatureParameters, c as signRequest, i as formatRfc9421Signature, l as timingSafeEqual, n as doubleKnock, o as parseRfc9421Signature, r as doubleKnockScoped, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as verifyRequest } from "../http-C3d2DXwF.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-CCxRJhWa.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";

package/dist/sig/key.test.mjs

@@ -6,9 +6,9 @@ import { n as assertStrictEquals } from "../std__assert-DflMZha5.mjs";
 import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { a as importJwk, i as generateCryptoKeyPair, o as validateCryptoKey, r as fetchKey, t as exportJwk } from "../key-QamJxksu.mjs";
+import { a as importJwk, i as generateCryptoKeyPair, o as validateCryptoKey, r as fetchKey, t as exportJwk } from "../key-D5e9c_yV.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { g as wrapContextLoaderForJsonLd } from "../ld-B0eNy8WK.mjs";
+import { g as wrapContextLoaderForJsonLd } from "../ld-9qfz9rP_.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { CryptographicKey, Multikey, Person } from "@fedify/vocab";
 import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";

package/dist/sig/ld.test.mjs

@@ -5,12 +5,13 @@ import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { i as generateCryptoKeyPair } from "../key-QamJxksu.mjs";
+import { i as generateCryptoKeyPair } from "../key-D5e9c_yV.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { a as compactJsonLd, d as isInvalidUrlTypeError, f as signJsonLd, h as verifySignature, i as attachSignature, m as verifyJsonLd, n as UnsafeJsonLdError, o as createSignature, s as detachSignature } from "../ld-B0eNy8WK.mjs";
+import { a as compactJsonLd, d as isInvalidUrlTypeError, f as signJsonLd, h as verifySignature, i as attachSignature, m as verifyJsonLd, n as UnsafeJsonLdError, o as createSignature, s as detachSignature } from "../ld-9qfz9rP_.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { CryptographicKey } from "@fedify/vocab";
 import { encodeBase64 } from "byte-encodings/base64";
+import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/sig/ld.test.ts
 test("isInvalidUrlTypeError()", () => {
 	assert(isInvalidUrlTypeError(/* @__PURE__ */ new TypeError("Invalid URL string.")));
@@ -25,22 +26,84 @@ test("isInvalidUrlTypeError()", () => {
 });
 test("attachSignature()", () => {
 	const sig = {
-		"@context": "https://w3id.org/identity/v1",
+		"@context": "https://w3id.org/security/v1",
 		type: "RsaSignature2017",
 		creator: "https://activitypub.academy/users/brauca_darradiul#main-key",
 		created: "2024-09-12T16:50:46Z",
 		signatureValue: "asdf"
 	};
+	const signatureTerm = { "signature": "https://w3id.org/security#signature" };
 	const doc = {
 		"@context": "https://www.w3.org/ns/activitystreams",
 		id: "https://example.com/1"
 	};
 	assertEquals(attachSignature(doc, sig), {
 		...doc,
+		"@context": ["https://www.w3.org/ns/activitystreams", signatureTerm],
+		signature: sig
+	});
+	const arrayDoc = {
+		"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+		id: "https://example.com/1"
+	};
+	assertEquals(attachSignature(arrayDoc, sig), {
+		...arrayDoc,
+		"@context": [...arrayDoc["@context"], signatureTerm],
+		signature: sig
+	});
+	for (const context of [
+		["https://w3id.org/identity/v1", "https://www.w3.org/ns/activitystreams"],
+		["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+		["https://www.w3.org/ns/activitystreams", signatureTerm],
+		{ "signature": "https://w3id.org/security#signature" }
+	]) {
+		const contextDoc = {
+			"@context": context,
+			id: "https://example.com/1"
+		};
+		assertEquals(attachSignature(contextDoc, sig), {
+			...contextDoc,
+			signature: sig
+		});
+	}
+	assertEquals(attachSignature({
+		"@context": null,
+		id: "https://example.com/1"
+	}, sig), {
+		"@context": [signatureTerm],
+		id: "https://example.com/1",
+		signature: sig
+	});
+	const resetDoc = {
+		"@context": [
+			"https://w3id.org/security/v1",
+			null,
+			"https://www.w3.org/ns/activitystreams"
+		],
+		id: "https://example.com/1"
+	};
+	assertEquals(attachSignature(resetDoc, sig), {
+		...resetDoc,
+		"@context": [...resetDoc["@context"], signatureTerm],
+		signature: sig
+	});
+	const disabledTermDoc = {
+		"@context": [{ "signature": { "@id": null } }, "https://www.w3.org/ns/activitystreams"],
+		id: "https://example.com/1"
+	};
+	assertEquals(attachSignature(disabledTermDoc, sig), {
+		...disabledTermDoc,
+		"@context": [...disabledTermDoc["@context"], signatureTerm],
+		signature: sig
+	});
+	assertEquals(attachSignature({ id: "https://example.com/1" }, sig), {
+		id: "https://example.com/1",
+		"@context": [signatureTerm],
 		signature: sig
 	});
 	assertThrows(() => attachSignature(null, sig), TypeError);
 	assertThrows(() => attachSignature(1234, sig), TypeError);
+	assertThrows(() => attachSignature([], sig), TypeError);
 });
 test("createSignature()", async () => {
 	const doc = {
@@ -48,7 +111,9 @@ test("createSignature()", async () => {
 		id: "https://example.com/1",
 		type: "Create"
 	};
-	assertEquals(await verifySignature(attachSignature(doc, await createSignature(doc, rsaPrivateKey2, rsaPublicKey2.id, { contextLoader: mockDocumentLoader })), {
+	const sig = await createSignature(doc, rsaPrivateKey2, rsaPublicKey2.id, { contextLoader: mockDocumentLoader });
+	assertEquals(sig["@context"], "https://w3id.org/security/v1");
+	assertEquals(await verifySignature(attachSignature(doc, sig), {
 		documentLoader: mockDocumentLoader,
 		contextLoader: mockDocumentLoader
 	}), rsaPublicKey2);
@@ -66,6 +131,135 @@ test("signJsonLd()", async () => {
 		contextLoader: mockDocumentLoader
 	}));
 });
+test("signJsonLd() defines the signature term when the context lacks it", async () => {
+	const signed = await signJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/notes/1",
+		type: "Note",
+		content: "Hello"
+	}, rsaPrivateKey2, rsaPublicKey2.id, { contextLoader: mockDocumentLoader });
+	assert(Array.isArray(signed["@context"]));
+	assertEquals(signed["@context"][1], { "signature": "https://w3id.org/security#signature" });
+	assert((await jsonld.canonize(signed, {
+		format: "application/n-quads",
+		documentLoader: mockDocumentLoader
+	})).includes("<https://w3id.org/security#signature>"));
+	assertEquals(await verifySignature(signed, {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	}), rsaPublicKey2);
+});
+test("signJsonLd() signs documents that use the signature term", async () => {
+	const signatureTerm = { "signature": "https://w3id.org/security#signature" };
+	for (const object of [{
+		type: "Note",
+		signature: "nested value"
+	}, { type: "signature" }]) {
+		const doc = {
+			"@context": ["https://www.w3.org/ns/activitystreams", { "@vocab": "https://example.com/" }],
+			id: "https://example.com/1",
+			type: "Create",
+			object
+		};
+		const signed = await signJsonLd(doc, rsaPrivateKey2, rsaPublicKey2.id, { contextLoader: mockDocumentLoader });
+		assertEquals(signed["@context"], [...doc["@context"], signatureTerm]);
+		assertEquals(signed["object"], object);
+		assertEquals(await verifySignature(signed, {
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader
+		}), rsaPublicKey2);
+	}
+});
+test("signJsonLd() does not share the inline signature definition", async () => {
+	const doc = {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/notes/1",
+		type: "Note"
+	};
+	const firstContext = (await signJsonLd(doc, rsaPrivateKey2, rsaPublicKey2.id, { contextLoader: mockDocumentLoader }))["@context"];
+	firstContext[1]["signature"] = "https://example.com/signature";
+	assertEquals((await signJsonLd(doc, rsaPrivateKey2, rsaPublicKey2.id, { contextLoader: mockDocumentLoader }))["@context"][1], { "signature": "https://w3id.org/security#signature" });
+});
+test("signJsonLd() respects a protected null signature definition", async () => {
+	for (const context of [{
+		"@protected": true,
+		"signature": { "@id": null }
+	}, { "signature": {
+		"@id": null,
+		"@protected": true
+	} }]) {
+		const doc = {
+			"@context": ["https://www.w3.org/ns/activitystreams", context],
+			id: "https://example.com/1",
+			type: "Note"
+		};
+		const signed = await signJsonLd(doc, rsaPrivateKey2, rsaPublicKey2.id, { contextLoader: mockDocumentLoader });
+		assertEquals(signed["@context"], doc["@context"]);
+		assertEquals(await verifySignature(signed, {
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader
+		}), rsaPublicKey2);
+	}
+});
+test("signJsonLd() respects protection from imported contexts", async () => {
+	const importUrl = "https://example.com/contexts/imported-protected";
+	const contextLoader = async (url) => {
+		if (new URL(url).href === importUrl) return {
+			contextUrl: null,
+			documentUrl: url,
+			document: { "@context": {
+				"@protected": true,
+				"name": "https://example.com/name"
+			} }
+		};
+		return await mockDocumentLoader(url);
+	};
+	for (const signature of [null, { "@id": null }]) {
+		const doc = {
+			"@context": ["https://www.w3.org/ns/activitystreams", {
+				"@import": importUrl,
+				signature
+			}],
+			id: "https://example.com/1",
+			type: "Note",
+			name: "Alice"
+		};
+		const signed = await signJsonLd(doc, rsaPrivateKey2, rsaPublicKey2.id, { contextLoader });
+		assertEquals(signed["@context"], doc["@context"]);
+		assertEquals(await verifySignature(signed, {
+			documentLoader: mockDocumentLoader,
+			contextLoader
+		}), rsaPublicKey2);
+	}
+});
+test("signJsonLd() leaves unrecognized remote contexts unchanged", async () => {
+	const contextUrl = "https://example.com/contexts/custom";
+	const contextLoader = async (url) => {
+		if (new URL(url).href === contextUrl) return {
+			contextUrl: null,
+			documentUrl: url,
+			document: { "@context": {
+				"@protected": true,
+				"signature": {
+					"@id": "https://w3id.org/security#signature",
+					"@type": "@id"
+				}
+			} }
+		};
+		return await mockDocumentLoader(url);
+	};
+	const doc = {
+		"@context": ["https://www.w3.org/ns/activitystreams", contextUrl],
+		id: "https://example.com/1",
+		type: "Note"
+	};
+	const signed = await signJsonLd(doc, rsaPrivateKey2, rsaPublicKey2.id, { contextLoader });
+	assertEquals(signed["@context"], doc["@context"]);
+	assertEquals(await verifySignature(signed, {
+		documentLoader: mockDocumentLoader,
+		contextLoader
+	}), rsaPublicKey2);
+});
 const document = {
 	"@context": ["https://www.w3.org/ns/activitystreams", {
 		"ostatus": "http://ostatus.org#",

package/dist/sig/mod.cjs

@@ -1,8 +1,8 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-DMRapH1d.cjs");
-const require_proof = require("../proof-CqOINd75.cjs");
+const require_http = require("../http-CO_IVq7x.cjs");
+const require_proof = require("../proof-BrreJTRF.cjs");
 exports.attachSignature = require_proof.attachSignature;
 exports.createProof = require_proof.createProof;
 exports.createSignature = require_proof.createSignature;

package/dist/sig/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
 import { a as signRequest, c as FetchKeyResult, d as fetchKey, f as generateCryptoKeyPair, i as VerifyRequestOptions, l as KeyCache, n as HttpMessageSignaturesSpecDeterminer, o as verifyRequest, p as importJwk, r as SignRequestOptions, s as FetchKeyOptions, t as HttpMessageSignaturesSpec, u as exportJwk } from "../http-DFqAb11b.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-B3hNQCG8.cjs";
-import { _ as verifyJsonLd, a as createProof, c as verifyProof, d as VerifyJsonLdOptions, f as VerifySignatureOptions, g as signJsonLd, h as detachSignature, i as VerifyProofOptions, l as CreateSignatureOptions, m as createSignature, n as SignObjectOptions, o as signObject, p as attachSignature, r as VerifyObjectOptions, s as verifyObject, t as CreateProofOptions, u as SignJsonLdOptions, v as verifySignature } from "../mod-DVPS4yam.cjs";
+import { _ as verifyJsonLd, a as createProof, c as verifyProof, d as VerifyJsonLdOptions, f as VerifySignatureOptions, g as signJsonLd, h as detachSignature, i as VerifyProofOptions, l as CreateSignatureOptions, m as createSignature, n as SignObjectOptions, o as signObject, p as attachSignature, r as VerifyObjectOptions, s as verifyObject, t as CreateProofOptions, u as SignJsonLdOptions, v as verifySignature } from "../mod-BA6vqC2S.cjs";
 export { CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyOptions, FetchKeyResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyProofOptions, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, generateCryptoKeyPair, getKeyOwner, importJwk, signJsonLd, signObject, signRequest, verifyJsonLd, verifyObject, verifyProof, verifyRequest, verifySignature };

package/dist/sig/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
 import { a as signRequest, c as FetchKeyResult, d as fetchKey, f as generateCryptoKeyPair, i as VerifyRequestOptions, l as KeyCache, n as HttpMessageSignaturesSpecDeterminer, o as verifyRequest, p as importJwk, r as SignRequestOptions, s as FetchKeyOptions, t as HttpMessageSignaturesSpec, u as exportJwk } from "../http-Cd8UD1ym.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-CiBPcC6F.js";
-import { _ as verifyJsonLd, a as createProof, c as verifyProof, d as VerifyJsonLdOptions, f as VerifySignatureOptions, g as signJsonLd, h as detachSignature, i as VerifyProofOptions, l as CreateSignatureOptions, m as createSignature, n as SignObjectOptions, o as signObject, p as attachSignature, r as VerifyObjectOptions, s as verifyObject, t as CreateProofOptions, u as SignJsonLdOptions, v as verifySignature } from "../mod-BS-jg3Wx.js";
+import { _ as verifyJsonLd, a as createProof, c as verifyProof, d as VerifyJsonLdOptions, f as VerifySignatureOptions, g as signJsonLd, h as detachSignature, i as VerifyProofOptions, l as CreateSignatureOptions, m as createSignature, n as SignObjectOptions, o as signObject, p as attachSignature, r as VerifyObjectOptions, s as verifyObject, t as CreateProofOptions, u as SignJsonLdOptions, v as verifySignature } from "../mod-CL9Ep0uo.js";
 export { CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyOptions, FetchKeyResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyProofOptions, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, generateCryptoKeyPair, getKeyOwner, importJwk, signJsonLd, signObject, signRequest, verifyJsonLd, verifyObject, verifyProof, verifyRequest, verifySignature };

package/dist/sig/mod.js

@@ -1,5 +1,5 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { c as importJwk, i as exportJwk, n as signRequest, o as fetchKey, r as verifyRequest, s as generateCryptoKeyPair } from "../http-YAfhvSad.js";
-import { _ as signJsonLd, a as doesActorOwnKey, b as verifySignature, d as createSignature, f as detachSignature, i as verifyProof, l as attachSignature, n as signObject, o as getKeyOwner, r as verifyObject, t as createProof, y as verifyJsonLd } from "../proof-DMYwiD7d.js";
+import { c as importJwk, i as exportJwk, n as signRequest, o as fetchKey, r as verifyRequest, s as generateCryptoKeyPair } from "../http-CfyVeGgF.js";
+import { _ as signJsonLd, a as doesActorOwnKey, b as verifySignature, d as createSignature, f as detachSignature, i as verifyProof, l as attachSignature, n as signObject, o as getKeyOwner, r as verifyObject, t as createProof, y as verifyJsonLd } from "../proof-CE8nwTF6.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, generateCryptoKeyPair, getKeyOwner, importJwk, signJsonLd, signObject, signRequest, verifyJsonLd, verifyObject, verifyProof, verifyRequest, verifySignature };

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import "../std__assert-DflMZha5.mjs";
 import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-CCxRJhWa.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-lqq4KXYV.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-R4ffU9Ht.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 //#region src/sig/owner.test.ts