@fedify/fedify 2.4.0-dev.1668 → 2.4.0-dev.1740

package/dist/{proof-CqA-2nfW.js → proof-BBLQXRWw.js}

@@ -1,11 +1,11 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { F as version, P as name, _ as measureSignatureKeyFetch, d as validateCryptoKey, f as getDurationMs, p as getFederationMetrics, s as fetchKey } from "./http-BbnOMQoy.js";
+import { F as version, P as name, _ as measureSignatureKeyFetch, d as validateCryptoKey, f as getDurationMs, p as getFederationMetrics, s as fetchKey } from "./http-BIxGa6AG.js";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, PUBLIC_COLLECTION, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { encodeHex } from "byte-encodings/hex";
-import { getDocumentLoader, haveSameFe34Origin, preloadedContexts } from "@fedify/vocab-runtime";
+import { formatIri, getDocumentLoader, getFe34Origin, haveSameFe34Origin, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import serialize from "json-canon";
@@ -23,7 +23,7 @@ const localContext = [
 ];
 const localContextUrls = new Set(localContext);
 const builtInContextLoader = getDocumentLoader();
-const disallowedJsonLdKeywords = new Set([
+const disallowedJsonLdKeywords = /* @__PURE__ */ new Set([
 	"@graph",
 	"@included",
 	"@reverse"
@@ -523,7 +523,7 @@ async function verifySignature(jsonLd, options = {}) {
 * only from external documents and are dropped from the metric attribute to
 * avoid attacker-controlled cardinality.
 */
-const LD_KNOWN_SIGNATURE_TYPES = new Set(["RsaSignature2017"]);
+const LD_KNOWN_SIGNATURE_TYPES = /* @__PURE__ */ new Set(["RsaSignature2017"]);
 /**
 * Reports only whether a `signature` key is present on the document, with
 * no shape check on its value.  This is intentionally looser than
@@ -757,7 +757,7 @@ const logger$2 = getLogger([
 	"compat",
 	"public-audience"
 ]);
-const PUBLIC_ADDRESSING_FIELDS = new Set([
+const PUBLIC_ADDRESSING_FIELDS = /* @__PURE__ */ new Set([
 	"to",
 	"cc",
 	"bto",
@@ -922,7 +922,7 @@ const logger$1 = getLogger([
 	"compat",
 	"outgoing-jsonld"
 ]);
-const ATTACHMENT_FIELDS = new Set(["attachment", "https://www.w3.org/ns/activitystreams#attachment"]);
+const ATTACHMENT_FIELDS = /* @__PURE__ */ new Set(["attachment", "https://www.w3.org/ns/activitystreams#attachment"]);
 const AS_CONTEXT_URL = "https://www.w3.org/ns/activitystreams";
 const KNOWN_SAFE_CONTEXT_URLS = getKnownSafeContextUrls();
 const MAX_TRAVERSAL_DEPTH = 64;
@@ -1120,12 +1120,22 @@ async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader) {
 * dropped from the metric attribute to avoid attacker-controlled
 * cardinality.
 */
-const OIP_KNOWN_CRYPTOSUITES = new Set(["eddsa-jcs-2022"]);
+const OIP_KNOWN_CRYPTOSUITES = /* @__PURE__ */ new Set(["eddsa-jcs-2022"]);
 const logger = getLogger([
 	"fedify",
 	"sig",
 	"proof"
 ]);
+const SECURITY_NAMESPACE = "https://w3id.org/security#";
+const SECURITY_PROOF = `${SECURITY_NAMESPACE}proof`;
+const SECURITY_PROOF_VALUE = `${SECURITY_NAMESPACE}proofValue`;
+const DATA_INTEGRITY_PROOF = `${SECURITY_NAMESPACE}DataIntegrityProof`;
+const SECURITY_VERIFICATION_METHOD = `${SECURITY_NAMESPACE}verificationMethod`;
+const SECURITY_EXPIRATION = `${SECURITY_NAMESPACE}expiration`;
+const SECURITY_DOMAIN = `${SECURITY_NAMESPACE}domain`;
+const SECURITY_CHALLENGE = `${SECURITY_NAMESPACE}challenge`;
+const SECURITY_NONCE = `${SECURITY_NAMESPACE}nonce`;
+const SECURITY_PREVIOUS_PROOF = `${SECURITY_NAMESPACE}previousProof`;
 /**
 * Checks if the given JSON-LD document has a DataIntegrityProof-like object,
 * without fully deserializing it into vocabulary classes.
@@ -1237,15 +1247,21 @@ async function signObject(object, privateKey, keyId, options = {}) {
 }
 /**
 * Verifies the given proof for the object.
-* @param jsonLd The JSON-LD object to verify the proof for.  If it contains
-*               any proofs, they will be ignored.
+* @param jsonLd The JSON-LD object to verify the proof for.  Its proof
+*               properties are excluded from the message, but matching proof
+*               occurrences are used to authenticate the received proof
+*               configuration.
 * @param proof The proof to verify.
 * @param options Additional options.  See also {@link VerifyProofOptions}.
 * @returns The public key that was used to sign the proof, or `null` if the
 *          proof is invalid.
 * @since 0.10.0
+* @since 2.4.0 Matching proof configurations are authenticated.
 */
 async function verifyProof(jsonLd, proof, options = {}) {
+	return await verifyProofWithMessageDigestCache(jsonLd, proof, options);
+}
+async function verifyProofWithMessageDigestCache(jsonLd, proof, options, messageDigestCache = {}, rawProofCandidate) {
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.verify", async (span) => {
 		const start = performance.now();
 		let verified = false;
@@ -1257,7 +1273,7 @@ async function verifyProof(jsonLd, proof, options = {}) {
 			if (proof.proofValue != null) span.setAttribute("object_integrity_proofs.signature", encodeHex(proof.proofValue));
 		}
 		try {
-			const key = await verifyProofInternal(jsonLd, proof, options);
+			const key = await verifyProofInternal(jsonLd, proof, options, messageDigestCache, rawProofCandidate);
 			if (key == null) span.setStatus({ code: SpanStatusCode.ERROR });
 			else verified = true;
 			return key;
@@ -1275,23 +1291,313 @@ async function verifyProof(jsonLd, proof, options = {}) {
 		}
 	});
 }
-async function verifyProofInternal(jsonLd, proof, options) {
-	if (typeof jsonLd !== "object" || jsonLd == null || Array.isArray(jsonLd) || proof.cryptosuite !== "eddsa-jcs-2022" || proof.verificationMethodId == null || proof.proofPurpose !== "assertionMethod" || proof.proofValue == null || proof.created == null) return null;
-	const publicKeyPromise = measureSignatureKeyFetch(options.meterProvider, "object_integrity", () => fetchKey(proof.verificationMethodId, Multikey, options));
-	const proofConfig = {
-		"@context": jsonLd["@context"],
-		type: "DataIntegrityProof",
-		cryptosuite: proof.cryptosuite,
-		verificationMethod: proof.verificationMethodId.href,
-		proofPurpose: proof.proofPurpose,
-		created: proof.created.toString()
-	};
+function expandContextPropertyIri(activeContext, key) {
+	const termId = jsonld.getContextValue(activeContext, key, "@id");
+	if (termId != null) return termId;
+	const colon = key.indexOf(":");
+	if (colon < 1) return key;
+	const prefix = key.substring(0, colon);
+	const suffix = key.substring(colon + 1);
+	if (prefix === "_" || suffix.startsWith("//")) return key;
+	const mapping = jsonld.getContextValue(activeContext, prefix);
+	if (typeof mapping === "object" && mapping != null && mapping._prefix === true && typeof mapping["@id"] === "string") return mapping["@id"] + suffix;
+	return key;
+}
+async function getJsonLdPropertyNames(jsonLd, propertyIri, defaults, documentLoader = preloadedOnlyDocumentLoader, inheritedContext, rejectOnContextError = false) {
+	const names = new Set(defaults);
+	const context = jsonLd["@context"] ?? inheritedContext;
+	if (context == null) return names;
+	try {
+		const options = { documentLoader };
+		let activeContext = await jsonld.processContext(null, null, options);
+		activeContext = await jsonld.processContext(activeContext, context, options);
+		const typeScopedContext = activeContext;
+		for (const key of globalThis.Object.keys(jsonLd).sort()) {
+			if (key !== "@type" && expandContextPropertyIri(activeContext, key) !== "@type") continue;
+			const value = jsonLd[key];
+			const types = Array.isArray(value) ? value.slice().sort() : [value];
+			for (const type of types) {
+				if (typeof type !== "string") continue;
+				const scopedContext = jsonld.getContextValue(typeScopedContext, type, "@context");
+				if (scopedContext != null) activeContext = await jsonld.processContext(activeContext, scopedContext, options);
+			}
+		}
+		for (const key of globalThis.Object.keys(jsonLd)) if (expandContextPropertyIri(activeContext, key) === propertyIri) names.add(key);
+	} catch {
+		if (rejectOnContextError) return null;
+	}
+	return names;
+}
+async function getProofPropertyNames(jsonLd, documentLoader = preloadedOnlyDocumentLoader) {
+	return await getJsonLdPropertyNames(jsonLd, SECURITY_PROOF, ["proof", SECURITY_PROOF], documentLoader) ?? /* @__PURE__ */ new Set(["proof", SECURITY_PROOF]);
+}
+async function createProofMessageDigests(jsonLd, proofContextLoader, context) {
+	const msg = { ...jsonLd };
+	for (const property of await getProofPropertyNames(msg, proofContextLoader)) delete msg[property];
+	if (context != null) msg["@context"] = structuredClone(context);
 	const encoder = new TextEncoder();
-	const proofBytes = encoder.encode(serialize(proofConfig));
+	const digest = async (value) => {
+		const bytes = encoder.encode(serialize(value));
+		return await crypto.subtle.digest("SHA-256", bytes);
+	};
+	const onWire = await digest(msg);
+	let normalizedPromise;
+	return {
+		onWire,
+		normalized() {
+			normalizedPromise ??= (async () => {
+				const normalized = await normalizeOutgoingActivityJsonLd(msg, preloadedOnlyDocumentLoader);
+				return normalized === msg ? null : await digest(normalized);
+			})();
+			return normalizedPromise;
+		}
+	};
+}
+function contextValues(context) {
+	return Array.isArray(context) ? context : [context];
+}
+function equalJsonValues(left, right) {
+	try {
+		return serialize(left) === serialize(right);
+	} catch {
+		return false;
+	}
+}
+function contextStartsWith(documentContext, proofContext) {
+	if (documentContext == null) return false;
+	const documentValues = contextValues(documentContext);
+	const proofValues = contextValues(proofContext);
+	return proofValues.length <= documentValues.length && proofValues.every((value, index) => equalJsonValues(value, documentValues[index]));
+}
+function appendProofValues(values, value) {
+	if (Array.isArray(value)) for (const item of value) appendProofValues(values, item);
+	else if (isJsonLdNode(value) && Array.isArray(value["@graph"])) for (const item of value["@graph"]) appendProofValues(values, item);
+	else values.push(value);
+}
+async function getRawProofValues(jsonLd, documentLoader) {
+	const propertyNames = await getProofPropertyNames(jsonLd, documentLoader);
+	const values = [];
+	for (const [property, value] of globalThis.Object.entries(jsonLd)) if (propertyNames.has(property)) appendProofValues(values, value);
+	return values;
+}
+function sameBytes(left, right) {
+	if (left == null || right == null) return left === right;
+	return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function sameProof(left, right) {
+	return left.cryptosuite === right.cryptosuite && left.verificationMethodId?.href === right.verificationMethodId?.href && left.proofPurpose === right.proofPurpose && sameBytes(left.proofValue, right.proofValue) && left.created?.toString() === right.created?.toString();
+}
+function normalizeDocumentUrl(url) {
+	try {
+		return formatIri(parseIri(url));
+	} catch {
+		return URL.canParse(url) ? new URL(url).href : url;
+	}
+}
+function getRawProofReference(value) {
+	const node = Array.isArray(value) && value.length === 1 ? value[0] : value;
+	if (typeof node === "string") return normalizeDocumentUrl(node);
+	if (!isJsonLdNode(node)) return void 0;
+	const id = node["@id"] ?? node.id;
+	return typeof id === "string" ? normalizeDocumentUrl(id) : void 0;
+}
+async function parseRawProofCandidates(jsonLd, values, options, documentLoader) {
+	const candidates = [];
+	for (const value of values) {
+		let parsed = null;
+		if (isJsonLdNode(value)) {
+			const proofJsonLd = value["@context"] == null && jsonLd["@context"] != null ? {
+				"@context": jsonLd["@context"],
+				...value
+			} : value;
+			try {
+				parsed = await DataIntegrityProof.fromJsonLd(proofJsonLd, {
+					...options,
+					contextLoader: documentLoader
+				});
+			} catch {}
+		}
+		candidates.push({
+			value,
+			proof: parsed,
+			reference: getRawProofReference(value) ?? parsed?.id?.href
+		});
+	}
+	return candidates;
+}
+async function findRawProofCandidate(jsonLd, proof, options, documentLoader) {
+	const candidates = await parseRawProofCandidates(jsonLd, await getRawProofValues(jsonLd, documentLoader), options, documentLoader);
+	const matches = [];
+	for (const candidate of candidates) if (candidate.proof != null && sameProof(candidate.proof, proof)) matches.push(candidate);
+	if (matches.length < 1) return void 0;
+	const first = matches[0];
+	const configurations = await Promise.all(matches.map((candidate) => normalizeProofConfiguration(candidate.value, jsonLd["@context"], documentLoader)));
+	const firstConfiguration = configurations[0];
+	return firstConfiguration != null && configurations.every((configuration) => configuration != null && equalJsonValues(configuration.value, firstConfiguration.value)) ? first : null;
+}
+function takeRawProofCandidate(pool, proof) {
+	for (let index = 0; index < pool.candidates.length; index++) {
+		if (pool.used.has(index)) continue;
+		const candidate = pool.candidates[index];
+		if (candidate.proof != null && sameProof(candidate.proof, proof)) {
+			pool.used.add(index);
+			return candidate;
+		}
+	}
+}
+const STANDARD_COMPACT_PROOF_PROPERTIES = /* @__PURE__ */ new Set([
+	"@context",
+	"type",
+	"cryptosuite",
+	"verificationMethod",
+	"proofPurpose",
+	"proofValue",
+	"created"
+]);
+const STANDARD_EXPANDED_PROOF_PROPERTIES = /* @__PURE__ */ new Set([
+	"@context",
+	"@type",
+	`${SECURITY_NAMESPACE}cryptosuite`,
+	SECURITY_VERIFICATION_METHOD,
+	`${SECURITY_NAMESPACE}proofPurpose`,
+	`${SECURITY_NAMESPACE}proofValue`,
+	"http://purl.org/dc/terms/created"
+]);
+function hasAdditionalProofOptions(value) {
+	const node = Array.isArray(value) && value.length === 1 ? value[0] : value;
+	return isJsonLdNode(node) && globalThis.Object.keys(node).some((property) => !STANDARD_COMPACT_PROOF_PROPERTIES.has(property) && !STANDARD_EXPANDED_PROOF_PROPERTIES.has(property));
+}
+function isExpandedJsonLdNode(value) {
+	const properties = globalThis.Object.keys(value).filter((key) => !key.startsWith("@"));
+	return properties.length > 0 && properties.every((property) => URL.canParse(property));
+}
+async function normalizeProofConfiguration(rawProof, documentContext, documentLoader) {
+	let node = Array.isArray(rawProof) && rawProof.length === 1 ? rawProof[0] : rawProof;
+	if (!isJsonLdNode(node)) return null;
+	if (isExpandedJsonLdNode(node)) {
+		if (documentContext == null) return null;
+		node = await jsonld.compact(node, documentContext, { documentLoader });
+		if (!isJsonLdNode(node)) return null;
+	} else node = structuredClone(node);
+	const receivedContext = node["@context"];
+	if (receivedContext != null && !contextStartsWith(documentContext, receivedContext)) return null;
+	const context = receivedContext ?? documentContext;
+	if (context != null) node["@context"] = structuredClone(context);
+	const proofValueProperties = await getJsonLdPropertyNames(node, SECURITY_PROOF_VALUE, ["proofValue", SECURITY_PROOF_VALUE], documentLoader, context) ?? /* @__PURE__ */ new Set(["proofValue", SECURITY_PROOF_VALUE]);
+	for (const property of proofValueProperties) delete node[property];
+	return {
+		value: node,
+		context
+	};
+}
+async function createProofConfiguration(jsonLd, proof, options, documentLoader, rawProofCandidate) {
+	let rawProof;
+	if (rawProofCandidate == null) {
+		const match = await findRawProofCandidate(jsonLd, proof, options, documentLoader);
+		if (match === null) return null;
+		rawProof = match?.value;
+	} else rawProof = rawProofCandidate.value;
+	if (rawProof == null) {
+		const serializedProof = await proof.toJsonLd();
+		if (hasAdditionalProofOptions(serializedProof)) rawProof = serializedProof;
+	}
+	if (rawProof != null) return await normalizeProofConfiguration(rawProof, jsonLd["@context"], documentLoader);
+	const context = jsonLd["@context"];
+	return {
+		value: {
+			...context == null ? {} : { "@context": context },
+			type: "DataIntegrityProof",
+			cryptosuite: proof.cryptosuite,
+			verificationMethod: proof.verificationMethodId.href,
+			proofPurpose: proof.proofPurpose,
+			created: proof.created.toString()
+		},
+		context
+	};
+}
+const KNOWN_PROOF_CONFIGURATION_PROPERTIES = /* @__PURE__ */ new Set([
+	"@context",
+	"@id",
+	"@type",
+	"id",
+	"type",
+	"cryptosuite",
+	`${SECURITY_NAMESPACE}cryptosuite`,
+	"verificationMethod",
+	SECURITY_VERIFICATION_METHOD,
+	"proofPurpose",
+	`${SECURITY_NAMESPACE}proofPurpose`,
+	"created",
+	"http://purl.org/dc/terms/created",
+	"expires",
+	SECURITY_EXPIRATION,
+	"domain",
+	SECURITY_DOMAIN,
+	"challenge",
+	SECURITY_CHALLENGE,
+	"nonce",
+	SECURITY_NONCE,
+	"previousProof",
+	SECURITY_PREVIOUS_PROOF
+]);
+async function getProofOption(proofConfig, propertyIri, defaults, documentLoader) {
+	let names = await getJsonLdPropertyNames(proofConfig, propertyIri, defaults, documentLoader, proofConfig["@context"], true);
+	if (names == null) {
+		if (globalThis.Object.keys(proofConfig).some((property) => !KNOWN_PROOF_CONFIGURATION_PROPERTIES.has(property))) return null;
+		names = new Set(defaults);
+	}
+	const present = globalThis.Object.keys(proofConfig).filter((property) => names.has(property));
+	if (present.length > 1) return null;
+	return present.length < 1 ? { present: false } : {
+		present: true,
+		value: proofConfig[present[0]]
+	};
+}
+function parseStringSet(value) {
+	if (typeof value === "string") return /* @__PURE__ */ new Set([value]);
+	if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) return null;
+	return new Set(value);
+}
+function equalStringSets(left, right) {
+	return left.size === right.size && [...left].every((value) => right.has(value));
+}
+async function hasValidProofOptions(proofConfig, options, documentLoader) {
+	const expires = await getProofOption(proofConfig, SECURITY_EXPIRATION, ["expires", SECURITY_EXPIRATION], documentLoader);
+	if (expires == null) return false;
+	if (expires.present) {
+		if (typeof expires.value !== "string") return false;
+		let expiration;
+		try {
+			expiration = Temporal.Instant.from(expires.value);
+		} catch {
+			return false;
+		}
+		if (Temporal.Instant.compare(Temporal.Now.instant(), expiration) >= 0) return false;
+	}
+	const domain = await getProofOption(proofConfig, SECURITY_DOMAIN, ["domain", SECURITY_DOMAIN], documentLoader);
+	if (domain == null) return false;
+	const proofDomains = domain.present ? parseStringSet(domain.value) : null;
+	if (domain.present && proofDomains == null) return false;
+	if (options.domain != null) {
+		const expectedDomains = parseStringSet(options.domain);
+		if (expectedDomains == null || proofDomains == null || !equalStringSets(proofDomains, expectedDomains)) return false;
+	}
+	const challenge = await getProofOption(proofConfig, SECURITY_CHALLENGE, ["challenge", SECURITY_CHALLENGE], documentLoader);
+	if (challenge == null || challenge.present && typeof challenge.value !== "string" || options.challenge != null && (!challenge.present || challenge.value !== options.challenge)) return false;
+	const nonce = await getProofOption(proofConfig, SECURITY_NONCE, ["nonce", SECURITY_NONCE], documentLoader);
+	if (nonce == null || nonce.present && typeof nonce.value !== "string") return false;
+	const previousProof = await getProofOption(proofConfig, SECURITY_PREVIOUS_PROOF, ["previousProof", SECURITY_PREVIOUS_PROOF], documentLoader);
+	if (previousProof == null || previousProof.present && typeof previousProof.value !== "string" && (!Array.isArray(previousProof.value) || previousProof.value.some((item) => typeof item !== "string"))) return false;
+	return true;
+}
+async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, rawProofCandidate) {
+	if (!isJsonLdNode(jsonLd) || proof.cryptosuite !== "eddsa-jcs-2022" || proof.verificationMethodId == null || proof.proofPurpose !== "assertionMethod" || proof.proofValue == null || proof.created == null) return null;
+	const proofContextLoader = messageDigestCache.proofContextLoader ?? preloadedOnlyDocumentLoader;
+	const proofConfiguration = await createProofConfiguration(jsonLd, proof, options, proofContextLoader, rawProofCandidate);
+	if (proofConfiguration == null || !await hasValidProofOptions(proofConfiguration.value, options, proofContextLoader)) return null;
+	const publicKeyPromise = measureSignatureKeyFetch(options.meterProvider, "object_integrity", () => fetchKey(proof.verificationMethodId, Multikey, options));
+	const proofBytes = new TextEncoder().encode(serialize(proofConfiguration.value));
 	const proofDigest = await crypto.subtle.digest("SHA-256", proofBytes);
-	const msg = { ...jsonLd };
-	if ("proof" in msg) delete msg.proof;
-	if ("https://w3id.org/security#proof" in msg) delete msg["https://w3id.org/security#proof"];
 	let fetchedKey;
 	try {
 		fetchedKey = await publicKeyPromise;
@@ -1323,7 +1629,7 @@ async function verifyProofInternal(jsonLd, proof, options) {
 					get: () => Promise.resolve(void 0),
 					set: async (keyId, key) => await options.keyCache?.set(keyId, key)
 				}
-			});
+			}, messageDigestCache, rawProofCandidate);
 		}
 		logger.debug("The fetched key (verificationMethod) for the proof is not a valid Ed25519 key:\n{keyId}", {
 			proof,
@@ -1334,15 +1640,21 @@ async function verifyProofInternal(jsonLd, proof, options) {
 	const digest = new Uint8Array(proofDigest.byteLength + 32);
 	digest.set(new Uint8Array(proofDigest), 0);
 	const proofValue = proof.proofValue;
-	const verifyCandidate = async (candidate) => {
-		const msgBytes = encoder.encode(serialize(candidate));
-		const msgDigest = await crypto.subtle.digest("SHA-256", msgBytes);
+	const verifyCandidate = async (msgDigest) => {
 		digest.set(new Uint8Array(msgDigest), proofDigest.byteLength);
 		return await crypto.subtle.verify("Ed25519", publicKey.publicKey, proofValue.slice(), digest);
 	};
-	if (await verifyCandidate(msg)) return publicKey;
-	const normalized = await normalizeOutgoingActivityJsonLd(msg, preloadedOnlyDocumentLoader);
-	if (normalized !== msg && await verifyCandidate(normalized)) return publicKey;
+	const messageDigestKey = serialize(proofConfiguration.context ?? null);
+	const messageDigestValues = messageDigestCache.values ??= /* @__PURE__ */ new Map();
+	let messageDigestsPromise = messageDigestValues.get(messageDigestKey);
+	if (messageDigestsPromise == null) {
+		messageDigestsPromise = createProofMessageDigests(jsonLd, messageDigestCache.proofContextLoader, proofConfiguration.context);
+		messageDigestValues.set(messageDigestKey, messageDigestsPromise);
+	}
+	const messageDigests = await messageDigestsPromise;
+	if (await verifyCandidate(messageDigests.onWire)) return publicKey;
+	const normalizedDigest = await messageDigests.normalized();
+	if (normalizedDigest != null && await verifyCandidate(normalizedDigest)) return publicKey;
 	if (fetchedKey.cached) {
 		logger.debug("Failed to verify the proof with the cached key {keyId}; retrying with the freshly fetched key...", {
 			keyId: proof.verificationMethodId.href,
@@ -1354,7 +1666,7 @@ async function verifyProofInternal(jsonLd, proof, options) {
 				get: () => Promise.resolve(void 0),
 				set: async (keyId, key) => await options.keyCache?.set(keyId, key)
 			}
-		});
+		}, messageDigestCache, rawProofCandidate);
 	}
 	logger.debug("Failed to verify the proof with the fetched key {keyId}:\n{proof}", {
 		keyId: proof.verificationMethodId.href,
@@ -1362,6 +1674,228 @@ async function verifyProofInternal(jsonLd, proof, options) {
 	});
 	return null;
 }
+const AS_NAMESPACE = "https://www.w3.org/ns/activitystreams#";
+const FEP_2277_ACTOR_PROPERTIES = ["http://www.w3.org/ns/ldp#inbox", `${AS_NAMESPACE}outbox`];
+const FEP_2277_COLLECTION_PROPERTIES = [
+	"items",
+	"orderedItems",
+	"totalItems",
+	"partOf",
+	"first",
+	"last",
+	"next",
+	"prev",
+	"current"
+].map((property) => AS_NAMESPACE + property);
+const PORTABLE_OBJECT_ID_PATTERN = /^ap(?:\+ef61)?:\/\//i;
+const FUNCTIONAL_PROOF_PROPERTIES = [
+	`${SECURITY_NAMESPACE}cryptosuite`,
+	SECURITY_VERIFICATION_METHOD,
+	`${SECURITY_NAMESPACE}proofPurpose`,
+	`${SECURITY_NAMESPACE}proofValue`,
+	"http://purl.org/dc/terms/created"
+];
+function isJsonLdNode(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
+function hasValidPortableProofShape(proofValue) {
+	if (!isJsonLdNode(proofValue)) return false;
+	let proofNode = proofValue;
+	if ("@graph" in proofNode) {
+		const graph = proofNode["@graph"];
+		if (!Array.isArray(graph) || graph.length !== 1 || !isJsonLdNode(graph[0])) return false;
+		proofNode = graph[0];
+	}
+	const types = proofNode["@type"];
+	return Array.isArray(types) && types.length === 1 && types[0] === DATA_INTEGRITY_PROOF && FUNCTIONAL_PROOF_PROPERTIES.every((property) => {
+		const values = proofNode[property];
+		return Array.isArray(values) && values.length === 1 && !(isJsonLdNode(values[0]) && "@list" in values[0]);
+	});
+}
+function classifyFep2277CoreType(node) {
+	if (FEP_2277_ACTOR_PROPERTIES.every((property) => property in node)) return "actor";
+	if (`${SECURITY_NAMESPACE}publicKeyMultibase` in node) return "verificationMethod";
+	if (`${SECURITY_NAMESPACE}publicKeyPem` in node) return "publicKey";
+	if (`${AS_NAMESPACE}href` in node) return "link";
+	if (`${AS_NAMESPACE}actor` in node) return "activity";
+	if (FEP_2277_COLLECTION_PROPERTIES.some((property) => property in node)) return "collection";
+	return "object";
+}
+async function expandPortableObjectRoot(jsonLd, contextLoader) {
+	if (!isJsonLdNode(jsonLd)) throw new TypeError("Expected a single JSON-LD object.");
+	const loadedContexts = /* @__PURE__ */ new Map();
+	const loader = getNormalizationContextLoader(contextLoader);
+	const recordingLoader = async (url, options) => {
+		const remoteDocument = await loader(url, options);
+		const key = URL.canParse(url) ? new URL(url).href : url;
+		loadedContexts.set(key, structuredClone(remoteDocument));
+		return remoteDocument;
+	};
+	const expanded = await jsonld.expand(jsonLd, {
+		documentLoader: recordingLoader,
+		keepFreeFloatingNodes: true
+	});
+	if (expanded.length !== 1 || !isJsonLdNode(expanded[0])) throw new TypeError("Expected a single JSON-LD object.");
+	return {
+		root: expanded[0],
+		proofContextLoader: async (url, options) => {
+			const key = URL.canParse(url) ? new URL(url).href : url;
+			const remoteDocument = loadedContexts.get(key);
+			if (remoteDocument != null) return structuredClone(remoteDocument);
+			return await preloadedOnlyDocumentLoader(url, options);
+		}
+	};
+}
+/**
+* Verifies the FEP-ef61 Object Integrity Proof policy for a portable object.
+*
+* This applies the FEP-2277 core-type classification to the top-level JSON-LD
+* node.  Portable actors, activities, and objects require proofs.  A portable
+* collection without a proof is reported separately so a caller can apply a
+* gateway trust policy.  Embedded portable objects are not traversed.
+*
+* Every proof must use a DID URL whose DID matches the portable object's
+* authority, and every proof must pass {@link verifyProof}.
+*
+* @param jsonLd The JSON-LD document to verify.
+* @param options Additional options.  See also
+*                {@link VerifyPortableObjectProofOptions}.
+* @returns The detailed portable proof-policy result.
+* @throws {TypeError} If the input is not a single JSON-LD object or has a
+*                     malformed portable ID.
+* @since 2.4.0
+*/
+async function verifyPortableObjectProof(jsonLd, options = {}) {
+	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !PORTABLE_OBJECT_ID_PATTERN.test(jsonLd["@id"])) return {
+		verified: false,
+		reason: { type: "notPortableObject" }
+	};
+	const { root, proofContextLoader } = await expandPortableObjectRoot(jsonLd, options.contextLoader);
+	const id = root["@id"];
+	if (typeof id !== "string" || !PORTABLE_OBJECT_ID_PATTERN.test(id)) return {
+		verified: false,
+		reason: { type: "notPortableObject" }
+	};
+	const objectId = parseIri(id);
+	getFe34Origin(objectId);
+	const objectType = classifyFep2277CoreType(root);
+	if (objectType === "verificationMethod" || objectType === "publicKey" || objectType === "link") return {
+		verified: false,
+		reason: {
+			type: "unsupportedObjectType",
+			objectType
+		}
+	};
+	const proofValues = root[SECURITY_PROOF];
+	if (proofValues == null || Array.isArray(proofValues) && proofValues.length < 1) return objectType === "collection" ? {
+		verified: false,
+		reason: { type: "unsecuredCollection" }
+	} : {
+		verified: false,
+		reason: { type: "missingProof" }
+	};
+	if (!Array.isArray(proofValues)) return {
+		verified: false,
+		reason: {
+			type: "invalidProof",
+			proofIndex: 0
+		}
+	};
+	const rawProofValues = isJsonLdNode(jsonLd) ? await getRawProofValues(jsonLd, proofContextLoader) : [];
+	const proofs = [];
+	for (let proofIndex = 0; proofIndex < proofValues.length; proofIndex++) {
+		const proofValue = proofValues[proofIndex];
+		if (!hasValidPortableProofShape(proofValue)) return {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex
+			}
+		};
+		let proof;
+		try {
+			proof = await DataIntegrityProof.fromJsonLd(proofValue, options);
+		} catch {
+			return {
+				verified: false,
+				reason: {
+					type: "invalidProof",
+					proofIndex
+				}
+			};
+		}
+		proofs.push(proof);
+	}
+	for (let proofIndex = 0; proofIndex < proofs.length; proofIndex++) {
+		const verificationMethod = proofs[proofIndex].verificationMethodId;
+		if (verificationMethod == null) return {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex
+			}
+		};
+		if (verificationMethod.protocol !== "did:") return {
+			verified: false,
+			reason: {
+				type: "unsupportedVerificationMethod",
+				proofIndex,
+				verificationMethod
+			}
+		};
+		try {
+			getFe34Origin(verificationMethod);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			return {
+				verified: false,
+				reason: {
+					type: "unsupportedVerificationMethod",
+					proofIndex,
+					verificationMethod
+				}
+			};
+		}
+		if (!haveSameFe34Origin(objectId, verificationMethod)) return {
+			verified: false,
+			reason: {
+				type: "verificationMethodMismatch",
+				proofIndex,
+				objectId,
+				verificationMethod
+			}
+		};
+	}
+	const keys = [];
+	const rawProofCandidatePool = {
+		candidates: await parseRawProofCandidates(jsonLd, rawProofValues, options, proofContextLoader),
+		used: /* @__PURE__ */ new Set()
+	};
+	const messageDigestCache = { proofContextLoader };
+	for (let proofIndex = 0; proofIndex < proofs.length; proofIndex++) {
+		const rawProofCandidate = takeRawProofCandidate(rawProofCandidatePool, proofs[proofIndex]);
+		if (rawProofCandidate == null) return {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex
+			}
+		};
+		const key = await verifyProofWithMessageDigestCache(jsonLd, proofs[proofIndex], options, messageDigestCache, rawProofCandidate);
+		if (key == null) return {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex
+			}
+		};
+		keys.push(key);
+	}
+	return {
+		verified: true,
+		keys
+	};
+}
 /**
 * Verifies the given object.  It will verify all the proofs in the object,
 * and succeed only if all the proofs are valid and all attributions and
@@ -1383,10 +1917,48 @@ async function verifyObject(cls, jsonLd, options = {}) {
 		"proof"
 	]);
 	const object = await cls.fromJsonLd(jsonLd, options);
+	const defaultDocumentLoader = getDocumentLoader();
+	const proofContextLoader = options.contextLoader ?? defaultDocumentLoader;
 	const attributions = new Set(object.attributionIds.map((uri) => uri.href));
 	if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
-	for await (const proof of object.getProofs(options)) {
-		const key = await verifyProof(jsonLd, proof, options);
+	const rawProofValues = isJsonLdNode(jsonLd) ? await getRawProofValues(jsonLd, proofContextLoader) : [];
+	const rawProofCandidates = isJsonLdNode(jsonLd) ? await parseRawProofCandidates(jsonLd, rawProofValues, options, proofContextLoader) : [];
+	const rawProofCandidatePool = {
+		candidates: rawProofCandidates,
+		used: /* @__PURE__ */ new Set()
+	};
+	const baseDocumentLoader = options.documentLoader ?? defaultDocumentLoader;
+	const hydratedCandidates = /* @__PURE__ */ new Set();
+	const proofDocumentLoader = async (url, loaderOptions) => {
+		const remoteDocument = await baseDocumentLoader(url, loaderOptions);
+		const reference = normalizeDocumentUrl(url);
+		const candidateIndex = rawProofCandidates.findIndex((candidate, index) => !hydratedCandidates.has(index) && !rawProofCandidatePool.used.has(index) && candidate.reference === reference);
+		if (candidateIndex >= 0) {
+			hydratedCandidates.add(candidateIndex);
+			let parsed = null;
+			try {
+				parsed = await DataIntegrityProof.fromJsonLd(remoteDocument.document, {
+					documentLoader: baseDocumentLoader,
+					contextLoader: proofContextLoader,
+					tracerProvider: options.tracerProvider,
+					baseUrl: parseIri(remoteDocument.documentUrl)
+				});
+			} catch {}
+			rawProofCandidates[candidateIndex] = {
+				value: structuredClone(remoteDocument.document),
+				proof: parsed,
+				reference
+			};
+		}
+		return remoteDocument;
+	};
+	for await (const proof of object.getProofs({
+		...options,
+		documentLoader: proofDocumentLoader
+	})) {
+		const rawProofCandidate = takeRawProofCandidate(rawProofCandidatePool, proof);
+		if (rawProofCandidate == null) return null;
+		const key = await verifyProofWithMessageDigestCache(jsonLd, proof, options, { proofContextLoader }, rawProofCandidate);
 		if (key === null) return null;
 		if (proof.verificationMethodId == null) return null;
 		if (key.controllerId == null) {
@@ -1412,4 +1984,4 @@ function hasCryptographicOrigin(iri) {
 	return /^did:/i.test(iri) || /^ap(?:\+ef61)?:\/\//i.test(iri);
 }
 //#endregion
-export { verifySignature as C, verifyJsonLd as S, hasSignatureLike as _, verifyProof as a, signJsonLd as b, getKeyOwner as c, attachSignature as d, compactJsonLd as f, hasSignature as g, getNormalizationContextLoader as h, verifyObject as i, InvalidContextReferenceError as l, detachSignature as m, hasProofLike as n, normalizeOutgoingActivityJsonLd as o, createSignature as p, signObject as r, doesActorOwnKey as s, createProof as t, assertSafeJsonLd as u, isClearlyMalformedContextReference as v, wrapContextLoaderForJsonLd as w, verifyCompactJsonLd as x, isInvalidUrlTypeError as y };
+export { verifyJsonLd as C, verifyCompactJsonLd as S, wrapContextLoaderForJsonLd as T, hasSignature as _, verifyPortableObjectProof as a, isInvalidUrlTypeError as b, doesActorOwnKey as c, assertSafeJsonLd as d, attachSignature as f, getNormalizationContextLoader as g, detachSignature as h, verifyObject as i, getKeyOwner as l, createSignature as m, hasProofLike as n, verifyProof as o, compactJsonLd as p, signObject as r, normalizeOutgoingActivityJsonLd as s, createProof as t, InvalidContextReferenceError as u, hasSignatureLike as v, verifySignature as w, signJsonLd as x, isClearlyMalformedContextReference as y };