@fedify/fedify 2.4.0-dev.1964 → 2.4.0-dev.1995

package/dist/{proof-BO_esQii.js → owner-BIPEZGiU.js}

@@ -1,1115 +1,1004 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { F as version, P as name, _ as measureSignatureKeyFetch, d as validateCryptoKey, f as getDurationMs, p as getFederationMetrics, s as fetchKey } from "./http-Dj4s1UQ0.js";
+import { I as name, L as version, c as fetchKey, f as validateCryptoKey, h as getFederationMetrics, m as getDurationMs, o as exportJwk, p as verifyKeyOwnership, s as fetchActorDocument, y as measureSignatureKeyFetch } from "./http-9WyuldYh.js";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, PUBLIC_COLLECTION, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { encodeHex } from "byte-encodings/hex";
 import { formatIri, getDocumentLoader, getFe34Origin, haveSameFe34Origin, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
-import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import serialize from "json-canon";
-//#region src/sig/ld.ts
-const logger$3 = getLogger([
+import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
+//#region src/compat/preloaded-context-loader.ts
+/**
+* A restricted JSON-LD document loader that resolves only contexts bundled
+* with Fedify.
+*
+* This is intentionally narrower than `getDocumentLoader()`: normalization
+* helpers are also reached from verification paths that operate on inbound,
+* attacker-controlled JSON-LD, so the default fallback must never fetch
+* attacker-supplied context URLs.
+*/
+const preloadedOnlyDocumentLoader = (url) => {
+	if (Object.hasOwn(preloadedContexts, url)) return Promise.resolve({
+		contextUrl: null,
+		documentUrl: url,
+		document: preloadedContexts[url]
+	});
+	return Promise.reject(/* @__PURE__ */ new Error("Refusing to fetch a non-preloaded JSON-LD context: " + url));
+};
+//#endregion
+//#region src/compat/public-audience.ts
+const logger$4 = getLogger([
 	"fedify",
-	"sig",
-	"ld"
+	"compat",
+	"public-audience"
 ]);
-const localContext = [
-	"https://w3id.org/identity/v1",
-	"https://www.w3.org/ns/activitystreams",
-	"https://w3id.org/security/v1",
-	"https://w3id.org/security/data-integrity/v1"
-];
-const localContextUrls = new Set(localContext);
-const builtInContextLoader = getDocumentLoader();
-const disallowedJsonLdKeywords = /* @__PURE__ */ new Set([
-	"@graph",
-	"@included",
-	"@reverse"
+const PUBLIC_ADDRESSING_FIELDS = /* @__PURE__ */ new Set([
+	"to",
+	"cc",
+	"bto",
+	"bcc",
+	"audience"
 ]);
-/** @internal */
-var UnsafeJsonLdError = class extends TypeError {
-	keyword;
-	constructor(keyword) {
-		super(`Unsupported JSON-LD keyword: ${keyword}.`);
-		this.keyword = keyword;
-		this.name = "UnsafeJsonLdError";
-	}
-};
-/** @internal */
-var InvalidContextReferenceError = class extends TypeError {
-	reference;
-	constructor(reference) {
-		super(`Invalid JSON-LD context reference: ${reference}.`);
-		this.reference = reference;
-		this.name = "InvalidContextReferenceError";
+const AS_CONTEXT_URL$1 = "https://www.w3.org/ns/activitystreams";
+const MAX_TRAVERSAL_DEPTH$1 = 64;
+const KNOWN_SAFE_CONTEXT_URLS$1 = new Set(Object.keys(preloadedContexts));
+function hasPublicCurieInAddressing(value, parentKey, depth = 0) {
+	if (typeof value === "string") return parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public");
+	if (depth >= MAX_TRAVERSAL_DEPTH$1) return false;
+	if (Array.isArray(value)) return value.some((item) => hasPublicCurieInAddressing(item, parentKey, depth + 1));
+	if (typeof value !== "object" || value == null) return false;
+	const record = value;
+	for (const key of Object.keys(record)) {
+		if (record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public")) return true;
+		if (key === "@context") continue;
+		if (hasPublicCurieInAddressing(record[key], key, depth + 1)) return true;
 	}
-};
-function createLoadingRemoteContextFailedError(reference, cause) {
-	const message = cause instanceof Error ? cause.message : String(cause);
-	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a valid JSON-LD context: ${reference}. ${message}`);
-	error.name = "jsonld.InvalidUrl";
-	error.details = {
-		code: "loading remote context failed",
-		url: reference
-	};
-	error.cause = cause;
-	return error;
+	return false;
 }
-/** @internal */
-function isClearlyMalformedContextReference(reference) {
-	for (const char of reference) {
-		const code = char.charCodeAt(0);
-		if (code <= 32 || code === 127) return true;
+function rewritePublicAudience(value, parentKey, depth = 0) {
+	if (typeof value === "string" && parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public")) return PUBLIC_COLLECTION.href;
+	if (depth >= MAX_TRAVERSAL_DEPTH$1) return value;
+	if (Array.isArray(value)) {
+		let changed = false;
+		const mapped = value.map((item) => {
+			const rewritten = rewritePublicAudience(item, parentKey, depth + 1);
+			if (rewritten !== item) changed = true;
+			return rewritten;
+		});
+		return changed ? mapped : value;
 	}
-	if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(reference) && !URL.canParse(reference)) return true;
-	for (let i = 0; i < reference.length; i++) {
-		if (reference[i] !== "%") continue;
-		if (i + 2 >= reference.length || !/[0-9A-Fa-f]/.test(reference[i + 1]) || !/[0-9A-Fa-f]/.test(reference[i + 2])) return true;
-		i += 2;
+	if (typeof value !== "object" || value == null) return value;
+	const record = value;
+	let changed = false;
+	const normalized = Object.create(null);
+	for (const key of Object.keys(record)) {
+		const rewritten = key === "@context" ? record[key] : record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public") ? PUBLIC_COLLECTION.href : rewritePublicAudience(record[key], key, depth + 1);
+		if (rewritten !== record[key]) changed = true;
+		normalized[key] = rewritten;
 	}
-	if (reference.startsWith("./") || reference.startsWith("../") || reference.startsWith("/") || reference.startsWith("//")) {
-		for (const char of reference) if ("[]<>\"\\^`{|}".includes(char)) return true;
+	return changed ? normalized : value;
+}
+/**
+* Reports whether `value` carries an `@context` property anywhere inside
+* its subtree (not counting the value itself).  A nested `@context` can
+* introduce a local term-definition scope that redefines `as:` or `Public`
+* even when the top-level `@context` is safe, so the fast path must defer
+* to the URDNA2015 equivalence check whenever one is present.
+*/
+function hasNestedContext$1(value, depth = 0) {
+	if (depth >= MAX_TRAVERSAL_DEPTH$1) return true;
+	if (Array.isArray(value)) return value.some((item) => hasNestedContext$1(item, depth + 1));
+	if (typeof value !== "object" || value == null) return false;
+	const record = value;
+	for (const key of Object.keys(record)) {
+		if (key === "@context") return true;
+		if (hasNestedContext$1(record[key], depth + 1)) return true;
 	}
 	return false;
 }
-function cloneRemoteDocument(remoteDocument) {
-	return structuredClone(remoteDocument);
-}
-function createMemoizedDocumentLoader(documentLoader) {
-	const cache = /* @__PURE__ */ new Map();
-	return async (url, options) => {
-		const cacheKey = URL.canParse(url) ? new URL(url).href : url;
-		let remoteDocument = cache.get(cacheKey);
-		if (remoteDocument == null) {
-			remoteDocument = Promise.resolve(documentLoader(url, options)).then(cloneRemoteDocument);
-			remoteDocument.catch(() => {
-				if (cache.get(cacheKey) === remoteDocument) cache.delete(cacheKey);
-			});
-			cache.set(cacheKey, remoteDocument);
-		}
-		return cloneRemoteDocument(await remoteDocument);
-	};
+/**
+* Checks whether the `@context` of a JSON-LD document is guaranteed not
+* to redefine the `as:` prefix or the bare `Public` term.  Only documents
+* whose `@context` is a string, or an array of strings, drawn from Fedify's
+* preloaded context set AND including the ActivityStreams URL qualify,
+* AND no nested subtree carries its own `@context` that might redefine
+* those terms within a local scope.  When all of that holds the rewrite
+* is provably semantics-preserving and the URDNA2015 equivalence check
+* can be skipped.  Any other shape (unknown external URLs, inline
+* objects at the top level, nested `@context` blocks) is treated as
+* potentially unsafe.
+*/
+function hasKnownSafeContext$1(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	const record = jsonLd;
+	if (!Object.hasOwn(record, "@context")) return false;
+	const ctx = record["@context"];
+	const entries = typeof ctx === "string" ? [ctx] : Array.isArray(ctx) ? ctx : null;
+	if (entries == null || entries.length === 0) return false;
+	let hasAs = false;
+	for (const entry of entries) {
+		if (typeof entry !== "string") return false;
+		if (!KNOWN_SAFE_CONTEXT_URLS$1.has(entry)) return false;
+		if (entry === AS_CONTEXT_URL$1) hasAs = true;
+	}
+	if (!hasAs) return false;
+	for (const key of Object.keys(record)) {
+		if (key === "@context") continue;
+		if (hasNestedContext$1(record[key])) return false;
+	}
+	return true;
 }
-/** @internal */
-function wrapContextLoaderForJsonLd(contextLoader) {
-	const loader = contextLoader ?? builtInContextLoader;
-	return async (url, options) => {
-		try {
-			return await loader(url, options);
-		} catch (error) {
-			if (!isInvalidUrlTypeError(error)) throw error;
-			if (isClearlyMalformedContextReference(url)) throw new InvalidContextReferenceError(url);
-			throw createLoadingRemoteContextFailedError(url, error);
-		}
-	};
+/**
+* Rewrites the compact `as:Public` / `Public` CURIE appearing in activity
+* addressing fields (`to`, `cc`, `bto`, `bcc`, `audience`) to the fully
+* expanded `https://www.w3.org/ns/activitystreams#Public` URI.
+*
+* Several ActivityPub implementations, Lemmy among them, match these
+* fields as plain URLs without running JSON-LD expansion, and silently
+* drop activities whose public addressing appears in CURIE form.  This
+* helper works around that gap.
+*
+* For documents whose `@context` is drawn entirely from Fedify's
+* preloaded context set and includes the ActivityStreams URL, the
+* rewrite is applied directly: the content of every preloaded non-AS
+* context is known not to redefine the `as:` prefix or the bare `Public`
+* term, so the semantics are preserved by construction.  Any other
+* shape (an inline object, an unknown external URL, and so on) is
+* treated as potentially unsafe and gated on a JSON-LD equivalence
+* check; both forms are canonicalized with URDNA2015 and the resulting
+* N-Quads are compared.  When they differ, the original document is
+* returned unchanged.  Canonicalization failures also fall back to the
+* original document.
+*
+* When no `contextLoader` is supplied the helper falls back to an
+* internal loader that resolves only the URLs in Fedify's
+* preloaded-contexts set and rejects every other URL without issuing a
+* network request.  That behaviour is deliberately narrower than
+* `@fedify/vocab-runtime`'s `getDocumentLoader()`, which after its
+* `validatePublicUrl` check will happily fetch non-preloaded URLs: the
+* helper is reached from verification paths (`verifyProof()` /
+* `verifyObject()`) that operate on inbound, potentially adversarial
+* JSON-LD, and a default loader that fetches attacker-supplied
+* `@context` URLs on the caller's behalf would be an SSRF vector.
+* Canonicalization failures against the restricted loader fall back to
+* the original document, same as any other canonicalization error.
+* Callers that genuinely need the remote-fetch loader (for example
+* applications that sign local JSON-LD against a custom vocabulary)
+* should pass a `contextLoader` explicitly.
+*
+* Must be called before any signing step that canonicalizes the
+* compact form byte-for-byte (for example, Object Integrity Proofs
+* using the `eddsa-jcs-2022` cryptosuite), so the signed payload
+* matches what is sent on the wire.
+*/
+async function normalizePublicAudience(jsonLd, contextLoader) {
+	if (!hasPublicCurieInAddressing(jsonLd)) return jsonLd;
+	const normalized = rewritePublicAudience(jsonLd);
+	if (hasKnownSafeContext$1(jsonLd)) return normalized;
+	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
+	try {
+		const [before, after] = await Promise.all([jsonld.canonize(jsonLd, {
+			format: "application/n-quads",
+			documentLoader: loader
+		}), jsonld.canonize(normalized, {
+			format: "application/n-quads",
+			documentLoader: loader
+		})]);
+		if (before === after) return normalized;
+		logger$4.warn("Expanding the public audience CURIE to its full URI would change the canonical form of the activity; sending the activity as is.  This usually means the active JSON-LD context redefines the `as:` prefix or the bare `Public` term.");
+	} catch (error) {
+		logger$4.debug("Failed to verify public audience normalization equivalence via JSON-LD canonicalization; sending the activity as is.\n{error}", { error });
+	}
+	return jsonLd;
 }
-/** @internal */
-function getNormalizationContextLoader(contextLoader) {
-	const loader = wrapContextLoaderForJsonLd(contextLoader);
-	return createMemoizedDocumentLoader(async (url, options) => {
-		if (URL.canParse(url)) {
-			const normalizedUrl = new URL(url).href;
-			if (localContextUrls.has(normalizedUrl)) return await builtInContextLoader(normalizedUrl, options);
-		}
-		return await loader(url, options);
-	});
-}
-/** @internal */
-async function compactJsonLd(jsonLd, contextLoader) {
-	const hasLds = typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
-	const signature = hasLds ? jsonLd.signature : void 0;
-	const normalizationContextLoader = getNormalizationContextLoader(contextLoader);
-	const document = hasLds ? detachSignature(jsonLd) : jsonLd;
-	await assertNoGraphBeforeCompaction(document, normalizationContextLoader);
-	const compacted = await jsonld.compact(document, localContext, { documentLoader: normalizationContextLoader });
-	if (hasLds && typeof compacted === "object" && compacted != null) compacted.signature = signature;
-	assertSafeJsonLd(compacted);
-	return compacted;
-}
-function createInvalidRemoteContextError(reference) {
-	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a JSON object. The response was valid JSON, but it was not a JSON object. URL: "${reference}".`);
-	error.name = "jsonld.InvalidUrl";
-	error.details = {
-		code: "invalid remote context",
-		url: reference
-	};
-	return error;
-}
-function getRemoteContext(remoteDocument, reference) {
-	const { contextUrl, documentUrl } = remoteDocument;
-	let { document } = remoteDocument;
-	if (typeof document === "string") document = JSON.parse(document);
-	if (typeof document !== "object" || document == null || Array.isArray(document)) throw createInvalidRemoteContextError(reference);
-	let context = "@context" in document ? document["@context"] : {};
-	if (contextUrl != null) context = Array.isArray(context) ? [...context, contextUrl] : [context, contextUrl];
-	return {
-		context,
-		baseUrl: documentUrl ?? reference
-	};
-}
-function createGraphAliasContextState() {
-	return {
-		graphTerms: /* @__PURE__ */ new Set(),
-		jsonTerms: /* @__PURE__ */ new Set(),
-		propertyContexts: /* @__PURE__ */ new Map(),
-		termTargets: /* @__PURE__ */ new Map()
-	};
-}
-function cloneGraphAliasContextState(state) {
-	return {
-		graphTerms: new Set(state.graphTerms),
-		jsonTerms: new Set(state.jsonTerms),
-		propertyContexts: new Map(state.propertyContexts),
-		termTargets: new Map(state.termTargets)
-	};
+//#endregion
+//#region src/compat/outgoing-jsonld.ts
+const logger$3 = getLogger([
+	"fedify",
+	"compat",
+	"outgoing-jsonld"
+]);
+const ATTACHMENT_FIELDS = /* @__PURE__ */ new Set(["attachment", "https://www.w3.org/ns/activitystreams#attachment"]);
+const AS_CONTEXT_URL = "https://www.w3.org/ns/activitystreams";
+const KNOWN_SAFE_CONTEXT_URLS = getKnownSafeContextUrls();
+const MAX_TRAVERSAL_DEPTH = 64;
+function isJsonLdListObject(value) {
+	return typeof value === "object" && value != null && Object.hasOwn(value, "@list");
 }
-function resolveContextTarget(target, state) {
-	if (target === "@graph") return target;
-	const mapped = state.termTargets.get(target);
-	if (mapped == null) return target;
-	return mapped;
+function isJsonLdValueObject(value) {
+	return typeof value === "object" && value != null && Object.hasOwn(value, "@value");
 }
-function getDirectContextTarget(definition) {
-	if (definition === null) return null;
-	if (typeof definition === "string") return definition;
-	if (typeof definition === "object" && definition != null && "@id" in definition) {
-		const id = definition["@id"];
-		if (id === null) return null;
-		if (typeof id === "string") return id;
+function* getContextObjects(value, seen = /* @__PURE__ */ new WeakSet()) {
+	if (Array.isArray(value)) {
+		if (seen.has(value)) return;
+		seen.add(value);
+		for (const item of value) yield* getContextObjects(item, seen);
+		return;
 	}
-}
-function isJsonTypedDefinition(definition) {
-	return typeof definition === "object" && definition != null && "@type" in definition && definition["@type"] === "@json";
-}
-function resolveLocalContextTarget(target, state, localTargets, seen = /* @__PURE__ */ new Set()) {
-	if (target === "@graph") return target;
-	if (seen.has(target)) return target;
-	seen.add(target);
-	if (localTargets.has(target)) {
-		const localTarget = localTargets.get(target);
-		return localTarget == null ? target : resolveLocalContextTarget(localTarget, state, localTargets, seen);
+	if (typeof value === "object" && value != null) {
+		if (seen.has(value)) return;
+		seen.add(value);
+		const record = value;
+		yield record;
+		for (const definition of Object.values(record)) {
+			if (typeof definition !== "object" || definition == null) continue;
+			const nestedContext = definition["@context"];
+			if (nestedContext == null) continue;
+			yield* getContextObjects(nestedContext, seen);
+		}
 	}
-	return resolveContextTarget(target, state);
-}
-function refreshGraphAliases(state) {
-	state.graphTerms.clear();
-	for (const [term, target] of state.termTargets) if (target === "@graph") state.graphTerms.add(term);
 }
-function normalizeContextReference(reference, baseUrl) {
-	if (baseUrl != null) return new URL(reference, baseUrl).href;
-	return URL.canParse(reference) ? new URL(reference).href : reference;
+function isActivityStreamsAttachmentTerm(value) {
+	return typeof value === "object" && value != null && value["@id"] === "as:attachment" && value["@type"] === "@id";
 }
 /** @internal */
-function isInvalidUrlTypeError(error) {
-	const code = error.code;
-	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
-}
-async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
-	if (context === null) return createGraphAliasContextState();
-	let nextState = cloneGraphAliasContextState(state);
-	if (Array.isArray(context)) {
-		for (const item of context) nextState = await applyGraphAliasContext(nextState, item, documentLoader, remoteContextCache, baseUrl, processingContexts);
-		return nextState;
+function isPreloadedContextAttachmentSafe(document) {
+	if (typeof document !== "object" || document == null) return true;
+	const context = document["@context"];
+	for (const contextObject of getContextObjects(context)) {
+		if (!Object.hasOwn(contextObject, "attachment")) continue;
+		if (isActivityStreamsAttachmentTerm(contextObject.attachment)) continue;
+		return false;
 	}
-	if (typeof context === "string") {
-		const reference = normalizeContextReference(context, baseUrl);
-		const cacheKey = `${baseUrl ?? ""}\n${reference}`;
-		if (processingContexts.has(cacheKey)) return nextState;
-		processingContexts.add(cacheKey);
-		try {
-			let remoteContext = remoteContextCache.get(cacheKey);
-			if (remoteContext == null) {
-				remoteContext = (async () => {
-					try {
-						return getRemoteContext(await documentLoader(reference), reference);
-					} catch (error) {
-						if (reference === context && isInvalidUrlTypeError(error) && isClearlyMalformedContextReference(context)) throw new InvalidContextReferenceError(context);
-						throw error;
-					}
-				})();
-				remoteContextCache.set(cacheKey, remoteContext);
-			}
-			const loadedRemoteContext = await remoteContext;
-			return await applyGraphAliasContext(nextState, loadedRemoteContext.context, documentLoader, remoteContextCache, loadedRemoteContext.baseUrl, processingContexts);
-		} finally {
-			processingContexts.delete(cacheKey);
+	return true;
+}
+function getKnownSafeContextUrls() {
+	const urls = /* @__PURE__ */ new Set();
+	for (const [url, document] of Object.entries(preloadedContexts)) if (isPreloadedContextAttachmentSafe(document)) urls.add(url);
+	else logger$3.warn("Preloaded JSON-LD context {contextUrl} redefines the `attachment` term incompatibly; attachment array normalization will require canonicalization for documents using it.", { contextUrl: url });
+	return urls;
+}
+/**
+* Wraps scalar ActivityStreams attachment properties in arrays.
+*/
+function wrapScalarAttachments(jsonLd, depth = 0) {
+	if (depth >= MAX_TRAVERSAL_DEPTH) return jsonLd;
+	if (Array.isArray(jsonLd)) {
+		let normalized = null;
+		for (let i = 0; i < jsonLd.length; i++) {
+			const item = jsonLd[i];
+			const next = wrapScalarAttachments(item, depth + 1);
+			if (normalized == null && next !== item) normalized = jsonLd.slice(0, i);
+			if (normalized != null) normalized[i] = next;
 		}
+		return normalized ?? jsonLd;
 	}
-	if (typeof context === "object" && context != null) {
-		if ("@import" in context && typeof context["@import"] === "string") nextState = await applyGraphAliasContext(nextState, context["@import"], documentLoader, remoteContextCache, baseUrl, processingContexts);
-		const localTargets = /* @__PURE__ */ new Map();
-		for (const [term, definition] of globalThis.Object.entries(context)) {
-			if (term.startsWith("@")) continue;
-			const target = getDirectContextTarget(definition);
-			if (target == null) localTargets.set(term, null);
-			else if (typeof target === "string") localTargets.set(term, target);
-			else localTargets.delete(term);
-		}
-		for (const [term, definition] of globalThis.Object.entries(context)) {
-			if (term.startsWith("@")) continue;
-			if (localTargets.has(term)) {
-				const directTarget = localTargets.get(term);
-				if (directTarget == null) nextState.termTargets.set(term, null);
-				else nextState.termTargets.set(term, resolveLocalContextTarget(directTarget, nextState, localTargets));
-			} else nextState.termTargets.delete(term);
-			if (typeof definition === "object" && definition != null && "@context" in definition) nextState.propertyContexts.set(term, {
-				context: definition["@context"],
-				baseUrl
-			});
-			else nextState.propertyContexts.delete(term);
-			if (isJsonTypedDefinition(definition)) nextState.jsonTerms.add(term);
-			else nextState.jsonTerms.delete(term);
+	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
+	const record = jsonLd;
+	const keys = Object.keys(record);
+	let normalized = null;
+	for (let i = 0; i < keys.length; i++) {
+		const key = keys[i];
+		const value = record[key];
+		const next = key === "@context" || key === "@value" && isJsonLdValueObject(jsonLd) ? value : wrapScalarAttachments(value, depth + 1);
+		const output = ATTACHMENT_FIELDS.has(key) && next != null && !Array.isArray(next) && !isJsonLdListObject(next) ? [next] : next;
+		if (normalized == null && output !== value) {
+			const cloned = Object.create(null);
+			for (let j = 0; j < i; j++) {
+				const previousKey = keys[j];
+				cloned[previousKey] = record[previousKey];
+			}
+			normalized = cloned;
 		}
-		refreshGraphAliases(nextState);
+		if (normalized != null) normalized[key] = output;
 	}
-	return nextState;
+	return normalized ?? jsonLd;
 }
-async function assertNoGraphBeforeCompaction(jsonLd, documentLoader, inheritedState = createGraphAliasContextState(), propertyContext, remoteContextCache = /* @__PURE__ */ new Map()) {
-	if (Array.isArray(jsonLd)) {
-		for (const item of jsonLd) await assertNoGraphBeforeCompaction(item, documentLoader, inheritedState, propertyContext, remoteContextCache);
-		return;
-	}
-	if (typeof jsonLd !== "object" || jsonLd == null) return;
-	const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
-	let state = inheritedState;
-	if (propertyContext !== void 0) state = await applyGraphAliasContext(state, propertyContext.context, documentLoader, remoteContextCache, propertyContext.baseUrl);
-	if ("@context" in jsonLd) state = await applyGraphAliasContext(state, jsonLd["@context"], documentLoader, remoteContextCache);
-	for (const [key, value] of globalThis.Object.entries(jsonLd)) {
-		if (key === "@context") continue;
-		if (jsonLiteralWrapper && key === "@value") continue;
-		if (key === "@graph" || state.graphTerms.has(key)) throw new UnsafeJsonLdError("@graph");
-		if (state.jsonTerms.has(key)) continue;
-		await assertNoGraphBeforeCompaction(value, documentLoader, state, state.propertyContexts.get(key), remoteContextCache);
+function hasNestedContext(value, depth = 0) {
+	if (depth >= MAX_TRAVERSAL_DEPTH) return true;
+	if (Array.isArray(value)) return value.some((item) => hasNestedContext(item, depth + 1));
+	if (typeof value !== "object" || value == null) return false;
+	const record = value;
+	for (const key of Object.keys(record)) {
+		if (key === "@context") return true;
+		if (key === "@value" && isJsonLdValueObject(value)) continue;
+		if (hasNestedContext(record[key], depth + 1)) return true;
 	}
+	return false;
 }
-function isJsonLiteralWrapper(value) {
-	return "@value" in value && (value["@type"] === "@json" || value.type === "@json");
-}
-/** @internal */
-function assertSafeJsonLd(jsonLd) {
-	if (Array.isArray(jsonLd)) for (const item of jsonLd) assertSafeJsonLd(item);
-	else if (typeof jsonLd === "object" && jsonLd != null) {
-		const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
-		for (const [key, value] of globalThis.Object.entries(jsonLd)) {
-			if (disallowedJsonLdKeywords.has(key)) throw new UnsafeJsonLdError(key);
-			if (jsonLiteralWrapper && key === "@value") continue;
-			assertSafeJsonLd(value);
-		}
+function exceedsTraversalDepth(value, depth = 0) {
+	if (depth >= MAX_TRAVERSAL_DEPTH) return true;
+	if (Array.isArray(value)) return value.some((item) => exceedsTraversalDepth(item, depth + 1));
+	if (typeof value !== "object" || value == null) return false;
+	const record = value;
+	for (const key of Object.keys(record)) {
+		if (key === "@context" || key === "@value" && isJsonLdValueObject(value)) continue;
+		if (exceedsTraversalDepth(record[key], depth + 1)) return true;
 	}
+	return false;
 }
-/**
-* Attaches a LD signature to the given JSON-LD document.
-* @param jsonLd The JSON-LD document to attach the signature to.  It is not
-*               modified.
-* @param signature The signature to attach.
-* @returns The JSON-LD document with the attached signature.
-* @throws {TypeError} If the input document is not a valid JSON-LD document.
-* @since 1.0.0
-*/
-function attachSignature(jsonLd, signature) {
-	if (typeof jsonLd !== "object" || jsonLd == null) throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
-	return {
-		...jsonLd,
-		signature
-	};
+function hasKnownSafeContext(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	const record = jsonLd;
+	if (!Object.hasOwn(record, "@context")) return false;
+	const context = record["@context"];
+	const entries = typeof context === "string" ? [context] : Array.isArray(context) ? context : null;
+	if (entries == null || entries.length < 1) return false;
+	let hasActivityStreamsContext = false;
+	for (const entry of entries) {
+		if (typeof entry !== "string") return false;
+		if (!KNOWN_SAFE_CONTEXT_URLS.has(entry)) return false;
+		if (entry === AS_CONTEXT_URL) hasActivityStreamsContext = true;
+	}
+	if (!hasActivityStreamsContext) return false;
+	for (const key of Object.keys(record)) {
+		if (key === "@context") continue;
+		if (hasNestedContext(record[key])) return false;
+	}
+	return true;
 }
-/**
-* Creates a LD signature for the given JSON-LD document.
-* @param jsonLd The JSON-LD document to sign.
-* @param privateKey The private key to sign the document.
-* @param keyId The ID of the public key that corresponds to the private key.
-* @param options Additional options for creating the signature.
-*                See also {@link CreateSignatureOptions}.
-* @return The created signature.
-* @throws {TypeError} If the private key is invalid or unsupported.
-* @since 1.0.0
-*/
-async function createSignature(jsonLd, privateKey, keyId, { contextLoader, created } = {}) {
-	validateCryptoKey(privateKey, "private");
-	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
-	const options = {
-		"@context": "https://w3id.org/identity/v1",
-		creator: keyId.href,
-		created: created?.toString() ?? (/* @__PURE__ */ new Date()).toISOString()
-	};
-	const message = await hashJsonLd(options, contextLoader) + await hashJsonLd(jsonLd, contextLoader);
-	const messageBytes = new TextEncoder().encode(message);
-	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, messageBytes);
+function getLogSafeJsonLdMetadata(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return {};
+	const record = jsonLd;
+	const context = record["@context"];
 	return {
-		...options,
-		type: "RsaSignature2017",
-		signatureValue: encodeBase64(signature)
+		id: typeof record.id === "string" ? record.id : typeof record["@id"] === "string" ? record["@id"] : void 0,
+		type: typeof record.type === "string" ? record.type : typeof record["@type"] === "string" ? record["@type"] : void 0,
+		context: typeof context === "string" ? context : Array.isArray(context) ? context.filter((entry) => typeof entry === "string").slice(0, 4) : context == null ? void 0 : "[inline context]"
 	};
 }
 /**
-* Signs the given JSON-LD document with the private key and returns the signed
-* JSON-LD document.
-* @param jsonLd The JSON-LD document to sign.
-* @param privateKey The private key to sign the document.
-* @param keyId The key ID to use in the signature.  It will be used by the
-*              verifier to fetch the corresponding public key.
-* @param options Additional options for signing the document.
-*                See also {@link SignJsonLdOptions}.
-* @returns The signed JSON-LD document.
-* @throws {TypeError} If the private key is invalid or unsupported.
-* @since 1.0.0
+* Ensures ActivityStreams attachment properties are represented as arrays
+* when doing so preserves the JSON-LD semantics.
+*
+* JSON-LD compaction collapses single-item arrays into scalar values by
+* default.  Some ActivityPub implementations, Pixelfed among them, parse
+* `attachment` as a plain JSON array rather than a JSON-LD property and reject
+* otherwise valid objects whose single attachment is emitted as a scalar.
+*
+* When no `contextLoader` is supplied, the helper falls back to a restricted
+* loader that resolves only Fedify's preloaded JSON-LD contexts and rejects
+* every other URL without network access.  Documents with custom, inline, or
+* otherwise uncached contexts should pass a real `contextLoader` if they need
+* the semantic-preservation check to succeed; otherwise canonicalization
+* failures leave the original document unchanged.
 */
-async function signJsonLd(jsonLd, privateKey, keyId, options) {
-	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.sign", { attributes: { "ld_signatures.key_id": keyId.href } }, async (span) => {
-		try {
-			const signature = await createSignature(jsonLd, privateKey, keyId, options);
-			if (span.isRecording()) {
-				span.setAttribute("ld_signatures.type", signature.type);
-				span.setAttribute("ld_signatures.signature", encodeHex(decodeBase64(signature.signatureValue)));
-			}
-			return attachSignature(jsonLd, signature);
-		} catch (error) {
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
-		}
-	});
+async function normalizeAttachmentArrays(jsonLd, contextLoader) {
+	const normalized = wrapScalarAttachments(jsonLd);
+	if (normalized === jsonLd) return jsonLd;
+	if (exceedsTraversalDepth(jsonLd)) {
+		logger$3.debug("Skipping attachment array normalization because the JSON-LD document exceeds the safe traversal depth; leaving it unchanged.");
+		return jsonLd;
+	}
+	if (hasKnownSafeContext(jsonLd)) return normalized;
+	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
+	try {
+		const [before, after] = await Promise.all([jsonld.canonize(jsonLd, {
+			format: "application/n-quads",
+			documentLoader: loader
+		}), jsonld.canonize(normalized, {
+			format: "application/n-quads",
+			documentLoader: loader
+		})]);
+		if (before === after) return normalized;
+		logger$3.warn("Wrapping scalar attachment values in arrays would change the canonical form of the JSON-LD document; leaving it unchanged.  This usually means the active JSON-LD context redefines the `attachment` term.  Document: {id}; type: {type}; context: {context}.", getLogSafeJsonLdMetadata(jsonLd));
+	} catch (error) {
+		logger$3.debug("Failed to verify attachment array normalization equivalence via JSON-LD canonicalization; leaving the JSON-LD document unchanged.\n{error}", { error });
+	}
+	return jsonLd;
 }
 /**
-* Checks if the given JSON-LD document has a Linked Data Signature-like
-* object, without restricting it to a single suite-specific shape.
-* @param jsonLd The JSON-LD document to check.
-* @returns `true` if the document has a signature-like object; `false`
-*          otherwise.
-* @since 2.2.0
+* Applies Fedify's internal JSON-LD wire-format interoperability workarounds
+* to locally generated outgoing activities before they are signed, enqueued,
+* or sent.
 */
-function hasSignatureLike(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	const signature = jsonLd.signature;
-	const hasReference = (value) => {
-		if (typeof value === "string") return true;
-		if (Array.isArray(value)) return value.some(hasReference);
-		return typeof value === "object" && value != null && ("id" in value && typeof value.id === "string" || "@id" in value && typeof value["@id"] === "string");
-	};
-	const hasSignatureObject = (value) => {
-		if (typeof value !== "object" || value == null) return false;
-		const signatureRecord = value;
-		return (typeof signatureRecord.type === "string" || Array.isArray(signatureRecord.type) && signatureRecord.type.some((item) => typeof item === "string")) && (hasReference(signatureRecord.creator) || hasReference(signatureRecord.verificationMethod)) && (typeof signatureRecord.signatureValue === "string" || typeof signatureRecord.jws === "string");
+async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader) {
+	jsonLd = await normalizePublicAudience(jsonLd, contextLoader);
+	return await normalizeAttachmentArrays(jsonLd, contextLoader);
+}
+//#endregion
+//#region src/sig/ld.ts
+const logger$2 = getLogger([
+	"fedify",
+	"sig",
+	"ld"
+]);
+const localContext = [
+	"https://w3id.org/identity/v1",
+	"https://www.w3.org/ns/activitystreams",
+	"https://w3id.org/security/v1",
+	"https://w3id.org/security/data-integrity/v1"
+];
+const localContextUrls = new Set(localContext);
+const builtInContextLoader = getDocumentLoader();
+const disallowedJsonLdKeywords = /* @__PURE__ */ new Set([
+	"@graph",
+	"@included",
+	"@reverse"
+]);
+/** @internal */
+var UnsafeJsonLdError = class extends TypeError {
+	keyword;
+	constructor(keyword) {
+		super(`Unsupported JSON-LD keyword: ${keyword}.`);
+		this.keyword = keyword;
+		this.name = "UnsafeJsonLdError";
+	}
+};
+/** @internal */
+var InvalidContextReferenceError = class extends TypeError {
+	reference;
+	constructor(reference) {
+		super(`Invalid JSON-LD context reference: ${reference}.`);
+		this.reference = reference;
+		this.name = "InvalidContextReferenceError";
+	}
+};
+function createLoadingRemoteContextFailedError(reference, cause) {
+	const message = cause instanceof Error ? cause.message : String(cause);
+	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a valid JSON-LD context: ${reference}. ${message}`);
+	error.name = "jsonld.InvalidUrl";
+	error.details = {
+		code: "loading remote context failed",
+		url: reference
 	};
-	return Array.isArray(signature) ? signature.some(hasSignatureObject) : hasSignatureObject(signature);
+	error.cause = cause;
+	return error;
 }
-/**
-* Checks if the given JSON-LD document has a Linked Data Signature.
-* @param jsonLd The JSON-LD document to check.
-* @returns `true` if the document has a signature; `false` otherwise.
-* @since 1.0.0
-*/
-function hasSignature(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	if ("signature" in jsonLd) {
-		const signature = jsonLd.signature;
-		if (typeof signature !== "object" || signature == null) return false;
-		return "type" in signature && signature.type === "RsaSignature2017" && "creator" in signature && typeof signature.creator === "string" && "created" in signature && typeof signature.created === "string" && "signatureValue" in signature && typeof signature.signatureValue === "string";
+/** @internal */
+function isClearlyMalformedContextReference(reference) {
+	for (const char of reference) {
+		const code = char.charCodeAt(0);
+		if (code <= 32 || code === 127) return true;
+	}
+	if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(reference) && !URL.canParse(reference)) return true;
+	for (let i = 0; i < reference.length; i++) {
+		if (reference[i] !== "%") continue;
+		if (i + 2 >= reference.length || !/[0-9A-Fa-f]/.test(reference[i + 1]) || !/[0-9A-Fa-f]/.test(reference[i + 2])) return true;
+		i += 2;
+	}
+	if (reference.startsWith("./") || reference.startsWith("../") || reference.startsWith("/") || reference.startsWith("//")) {
+		for (const char of reference) if ("[]<>\"\\^`{|}".includes(char)) return true;
 	}
 	return false;
 }
-/**
-* Detaches Linked Data Signatures from the given JSON-LD document.
-* @param jsonLd The JSON-LD document to modify.
-* @returns The modified JSON-LD document.  If the input document does not
-*          contain a signature, the original document is returned.
-* @since 1.0.0
-*/
-function detachSignature(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
-	const doc = { ...jsonLd };
-	delete doc.signature;
-	return doc;
+function cloneRemoteDocument(remoteDocument) {
+	return structuredClone(remoteDocument);
 }
-/**
-* Verifies Linked Data Signatures of the given JSON-LD document.
-*
-* This is a low-level utility that only checks the cryptographic signature
-* and (optionally) the cached key.  It does not run the JSON-LD parsing,
-* attribution, and owner checks that a complete inbound LD verification
-* needs.  For incoming activities, prefer {@link verifyJsonLd}, which is
-* the public verification entry point and the one that emits the
-* `activitypub.signature.verification.duration` metric for the LD path.
-* `verifySignature` itself only emits
-* `activitypub.signature.key_fetch.duration`, since the rest of the work
-* that the verification-duration metric is meant to cover happens in
-* `verifyJsonLd`.
-* @param jsonLd The JSON-LD document to verify.
-* @param options Options for verifying the signature.
-* @returns The public key that signed the document or `null` if the signature
-*          is invalid or the key is not found.
-* @since 1.0.0
-*/
-async function verifySignature(jsonLd, options = {}) {
-	if (!hasSignature(jsonLd)) return null;
-	const sig = jsonLd.signature;
-	let signature;
-	try {
-		signature = decodeBase64(sig.signatureValue);
-	} catch (error) {
-		logger$3.debug("Failed to verify; invalid base64 signatureValue: {signatureValue}", {
-			...sig,
-			error
-		});
-		return null;
-	}
-	const { key, cached } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), CryptographicKey, options));
-	if (key == null) return null;
-	const sigOpts = {
-		...sig,
-		"@context": "https://w3id.org/identity/v1"
+function createMemoizedDocumentLoader(documentLoader) {
+	const cache = /* @__PURE__ */ new Map();
+	return async (url, options) => {
+		const cacheKey = URL.canParse(url) ? new URL(url).href : url;
+		let remoteDocument = cache.get(cacheKey);
+		if (remoteDocument == null) {
+			remoteDocument = Promise.resolve(documentLoader(url, options)).then(cloneRemoteDocument);
+			remoteDocument.catch(() => {
+				if (cache.get(cacheKey) === remoteDocument) cache.delete(cacheKey);
+			});
+			cache.set(cacheKey, remoteDocument);
+		}
+		return cloneRemoteDocument(await remoteDocument);
 	};
-	delete sigOpts.type;
-	delete sigOpts.id;
-	delete sigOpts.signatureValue;
-	let sigOptsHash;
-	try {
-		sigOptsHash = await hashJsonLd(sigOpts, options.contextLoader);
-	} catch (error) {
-		logger$3.warn("Failed to verify; failed to hash the signature options: {signatureOptions}\n{error}", {
-			signatureOptions: sigOpts,
-			error
-		});
-		return null;
-	}
-	const document = { ...jsonLd };
-	delete document.signature;
-	let docHash;
-	try {
-		docHash = await hashJsonLd(document, options.contextLoader);
-	} catch (error) {
-		logger$3.warn("Failed to verify; failed to hash the document: {document}\n{error}", {
-			document,
-			error
-		});
-		return null;
-	}
-	const encoder = new TextEncoder();
-	const message = sigOptsHash + docHash;
-	const messageBytes = encoder.encode(message);
-	if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes)) return key;
-	if (cached) {
-		logger$3.debug("Failed to verify with the cached key {keyId}; signature {signatureValue} is invalid.  Retrying with the freshly fetched key...", {
-			keyId: sig.creator,
-			...sig
-		});
-		const { key } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), CryptographicKey, {
-			...options,
-			keyCache: {
-				get: () => Promise.resolve(void 0),
-				set: async (keyId, key) => await options.keyCache?.set(keyId, key)
-			}
-		}));
-		if (key == null) return null;
-		return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes) ? key : null;
-	}
-	logger$3.debug("Failed to verify with the fetched key {keyId}; signature {signatureValue} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
-		keyId: sig.creator,
-		...sig,
-		message
-	});
-	return null;
-}
-/**
-* Known Linked Data Signature `type` values, used to keep
-* `ld_signatures.type` on a bounded set of spec-defined string values.
-* Fedify only signs and verifies `RsaSignature2017`; other values come in
-* only from external documents and are dropped from the metric attribute to
-* avoid attacker-controlled cardinality.
-*/
-const LD_KNOWN_SIGNATURE_TYPES = /* @__PURE__ */ new Set(["RsaSignature2017"]);
-/**
-* Reports only whether a `signature` key is present on the document, with
-* no shape check on its value.  This is intentionally looser than
-* {@link hasSignature} (which validates a full `RsaSignature2017` shape)
-* and {@link hasSignatureLike} (which structurally accepts several known
-* suites): `verifyJsonLd` needs to tell a document with a malformed or
-* unsupported signature payload (classified as `rejected`) apart from a
-* truly unsigned document (classified as `missing`), and only this
-* presence-only check captures both cases.
-*/
-function hasLdSignatureProperty(jsonLd) {
-	return typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
-}
-function getLdSignatureObject(jsonLd) {
-	if (!hasLdSignatureProperty(jsonLd)) return void 0;
-	const { signature } = jsonLd;
-	if (typeof signature !== "object" || signature == null || Array.isArray(signature)) return;
-	return signature;
-}
-/**
-* Verify the authenticity of the given JSON-LD document using Linked Data
-* Signatures.  If the document is signed, this function verifies the signature
-* and checks if the document is attributed to the owner of the public key.
-* If the document is not signed, this function returns `false`.
-* @param jsonLd The JSON-LD document to verify.
-* @param options Options for verifying the document.
-* @returns `true` if the document is authentic; `false` otherwise.
-*/
-async function verifyJsonLd(jsonLd, options = {}) {
-	return await verifyJsonLdInternal(jsonLd, options, true);
 }
 /** @internal */
-async function verifyCompactJsonLd(jsonLd, options = {}) {
-	return await verifyJsonLdInternal(jsonLd, options, false);
-}
-async function verifyJsonLdInternal(jsonLd, options, compact) {
-	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
-		const start = performance.now();
-		let verified = false;
-		let threw = false;
-		let signatureType;
+function wrapContextLoaderForJsonLd(contextLoader) {
+	const loader = contextLoader ?? builtInContextLoader;
+	return async (url, options) => {
 		try {
-			const verificationOptions = hasSignature(jsonLd) ? {
-				...options,
-				contextLoader: getNormalizationContextLoader(options.contextLoader)
-			} : options;
-			const compacted = compact ? hasSignature(jsonLd) ? await compactJsonLd(jsonLd, options.contextLoader) : jsonLd : jsonLd;
-			const object = await Object$1.fromJsonLd(compacted, verificationOptions);
-			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
-			span.setAttribute("activitypub.object.type", getTypeId(object).href);
-			const sig = getLdSignatureObject(jsonLd);
-			if (sig != null) {
-				if (typeof sig.creator === "string") span.setAttribute("ld_signatures.key_id", sig.creator);
-				if (typeof sig.signatureValue === "string") span.setAttribute("ld_signatures.signature", sig.signatureValue);
-				if (typeof sig.type === "string") {
-					span.setAttribute("ld_signatures.type", sig.type);
-					if (LD_KNOWN_SIGNATURE_TYPES.has(sig.type)) signatureType = sig.type;
-				}
-			}
-			const attributions = new Set(object.attributionIds.map((uri) => uri.href));
-			if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
-			const key = await verifySignature(compacted, verificationOptions);
-			if (key == null) return false;
-			if (key.ownerId == null) {
-				logger$3.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
-				return false;
-			}
-			attributions.delete(key.ownerId.href);
-			if (attributions.size > 0) {
-				logger$3.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
-				return false;
-			}
-			verified = true;
-			return true;
+			return await loader(url, options);
 		} catch (error) {
-			threw = true;
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			const classified = threw ? "error" : verified ? "verified" : hasLdSignatureProperty(jsonLd) ? "rejected" : "missing";
-			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "linked_data", classified, { ldType: signatureType });
-			span.end();
+			if (!isInvalidUrlTypeError(error)) throw error;
+			if (isClearlyMalformedContextReference(url)) throw new InvalidContextReferenceError(url);
+			throw createLoadingRemoteContextFailedError(url, error);
 		}
-	});
-}
-async function hashJsonLd(jsonLd, contextLoader) {
-	const canon = await jsonld.canonize(jsonLd, {
-		format: "application/n-quads",
-		documentLoader: contextLoader ?? getDocumentLoader()
-	});
-	const encoder = new TextEncoder();
-	return encodeHex(await crypto.subtle.digest("SHA-256", encoder.encode(canon)));
+	};
 }
-//#endregion
-//#region src/sig/owner.ts
-/**
-* Checks if the actor of the given activity owns the specified key.
-* @param activity The activity to check.
-* @param key The public key to check.
-* @param options Options for checking the key ownership.
-* @returns Whether the actor is the owner of the key.
-*/
-async function doesActorOwnKey(activity, key, options) {
-	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("activitypub.verify_key_ownership", {
-		kind: SpanKind.INTERNAL,
-		attributes: {
-			"activitypub.actor.id": activity.actorId?.href ?? "",
-			"activitypub.key.id": key.id?.href ?? ""
-		}
-	}, async (span) => {
-		try {
-			if (key.ownerId != null) {
-				const owns = key.ownerId.href === activity.actorId?.href;
-				span.setAttribute("activitypub.key_ownership.verified", owns);
-				span.setAttribute("activitypub.key_ownership.method", "owner_id");
-				return owns;
-			}
-			const actor = await activity.getActor(options);
-			if (actor == null || !isActor(actor)) {
-				span.setAttribute("activitypub.key_ownership.verified", false);
-				span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
-				return false;
-			}
-			for (const publicKeyId of actor.publicKeyIds) if (key.id != null && publicKeyId.href === key.id.href) {
-				span.setAttribute("activitypub.key_ownership.verified", true);
-				span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
-				return true;
-			}
-			span.setAttribute("activitypub.key_ownership.verified", false);
-			span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
-			return false;
-		} catch (error) {
-			span.recordException(error);
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
+/** @internal */
+function getNormalizationContextLoader(contextLoader) {
+	const loader = wrapContextLoaderForJsonLd(contextLoader);
+	return createMemoizedDocumentLoader(async (url, options) => {
+		if (URL.canParse(url)) {
+			const normalizedUrl = new URL(url).href;
+			if (localContextUrls.has(normalizedUrl)) return await builtInContextLoader(normalizedUrl, options);
 		}
+		return await loader(url, options);
 	});
 }
-/**
-* Gets the actor that owns the specified key.  Returns `null` if the key has no
-* known owner.
-*
-* @param keyId The ID of the key to check, or the key itself.
-* @param options Options for getting the key owner.
-* @returns The actor that owns the key, or `null` if the key has no known
-*          owner.
-* @since 0.7.0
-*/
-async function getKeyOwner(keyId, options) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const documentLoader = options.documentLoader ?? getDocumentLoader();
-	const contextLoader = options.contextLoader ?? getDocumentLoader();
-	let object;
-	if (keyId instanceof CryptographicKey) {
-		object = keyId;
-		if (object.id == null) return null;
-		keyId = object.id;
-	} else {
-		let keyDoc;
-		try {
-			const { document } = await documentLoader(keyId.href);
-			keyDoc = document;
-		} catch (_) {
-			return null;
-		}
-		try {
-			object = await Object$1.fromJsonLd(keyDoc, {
-				documentLoader,
-				contextLoader,
-				tracerProvider
-			});
-		} catch (e) {
-			if (!(e instanceof TypeError)) throw e;
-			try {
-				object = await CryptographicKey.fromJsonLd(keyDoc, {
-					documentLoader,
-					contextLoader,
-					tracerProvider
-				});
-			} catch (e) {
-				if (e instanceof TypeError) return null;
-				throw e;
-			}
-		}
-	}
-	let owner = null;
-	if (object instanceof CryptographicKey) {
-		if (object.ownerId == null) return null;
-		owner = await object.getOwner({
-			documentLoader,
-			contextLoader,
-			tracerProvider
-		});
-	} else if (isActor(object)) owner = object;
-	else return null;
-	if (owner == null) return null;
-	for (const kid of owner.publicKeyIds) if (kid.href === keyId.href) return owner;
-	return null;
+/** @internal */
+async function compactJsonLd(jsonLd, contextLoader) {
+	const hasLds = typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
+	const signature = hasLds ? jsonLd.signature : void 0;
+	const normalizationContextLoader = getNormalizationContextLoader(contextLoader);
+	const document = hasLds ? detachSignature(jsonLd) : jsonLd;
+	await assertNoGraphBeforeCompaction(document, normalizationContextLoader);
+	const compacted = await jsonld.compact(document, localContext, { documentLoader: normalizationContextLoader });
+	if (hasLds && typeof compacted === "object" && compacted != null) compacted.signature = signature;
+	assertSafeJsonLd(compacted);
+	return compacted;
 }
-//#endregion
-//#region src/compat/preloaded-context-loader.ts
-/**
-* A restricted JSON-LD document loader that resolves only contexts bundled
-* with Fedify.
-*
-* This is intentionally narrower than `getDocumentLoader()`: normalization
-* helpers are also reached from verification paths that operate on inbound,
-* attacker-controlled JSON-LD, so the default fallback must never fetch
-* attacker-supplied context URLs.
-*/
-const preloadedOnlyDocumentLoader = (url) => {
-	if (Object.hasOwn(preloadedContexts, url)) return Promise.resolve({
-		contextUrl: null,
-		documentUrl: url,
-		document: preloadedContexts[url]
-	});
-	return Promise.reject(/* @__PURE__ */ new Error("Refusing to fetch a non-preloaded JSON-LD context: " + url));
-};
-//#endregion
-//#region src/compat/public-audience.ts
-const logger$2 = getLogger([
-	"fedify",
-	"compat",
-	"public-audience"
-]);
-const PUBLIC_ADDRESSING_FIELDS = /* @__PURE__ */ new Set([
-	"to",
-	"cc",
-	"bto",
-	"bcc",
-	"audience"
-]);
-const AS_CONTEXT_URL$1 = "https://www.w3.org/ns/activitystreams";
-const MAX_TRAVERSAL_DEPTH$1 = 64;
-const KNOWN_SAFE_CONTEXT_URLS$1 = new Set(Object.keys(preloadedContexts));
-function hasPublicCurieInAddressing(value, parentKey, depth = 0) {
-	if (typeof value === "string") return parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public");
-	if (depth >= MAX_TRAVERSAL_DEPTH$1) return false;
-	if (Array.isArray(value)) return value.some((item) => hasPublicCurieInAddressing(item, parentKey, depth + 1));
-	if (typeof value !== "object" || value == null) return false;
-	const record = value;
-	for (const key of Object.keys(record)) {
-		if (record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public")) return true;
-		if (key === "@context") continue;
-		if (hasPublicCurieInAddressing(record[key], key, depth + 1)) return true;
-	}
-	return false;
+function createInvalidRemoteContextError(reference) {
+	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a JSON object. The response was valid JSON, but it was not a JSON object. URL: "${reference}".`);
+	error.name = "jsonld.InvalidUrl";
+	error.details = {
+		code: "invalid remote context",
+		url: reference
+	};
+	return error;
 }
-function rewritePublicAudience(value, parentKey, depth = 0) {
-	if (typeof value === "string" && parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public")) return PUBLIC_COLLECTION.href;
-	if (depth >= MAX_TRAVERSAL_DEPTH$1) return value;
-	if (Array.isArray(value)) {
-		let changed = false;
-		const mapped = value.map((item) => {
-			const rewritten = rewritePublicAudience(item, parentKey, depth + 1);
-			if (rewritten !== item) changed = true;
-			return rewritten;
-		});
-		return changed ? mapped : value;
-	}
-	if (typeof value !== "object" || value == null) return value;
-	const record = value;
-	let changed = false;
-	const normalized = Object.create(null);
-	for (const key of Object.keys(record)) {
-		const rewritten = key === "@context" ? record[key] : record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public") ? PUBLIC_COLLECTION.href : rewritePublicAudience(record[key], key, depth + 1);
-		if (rewritten !== record[key]) changed = true;
-		normalized[key] = rewritten;
-	}
-	return changed ? normalized : value;
+function getRemoteContext(remoteDocument, reference) {
+	const { contextUrl, documentUrl } = remoteDocument;
+	let { document } = remoteDocument;
+	if (typeof document === "string") document = JSON.parse(document);
+	if (typeof document !== "object" || document == null || Array.isArray(document)) throw createInvalidRemoteContextError(reference);
+	let context = "@context" in document ? document["@context"] : {};
+	if (contextUrl != null) context = Array.isArray(context) ? [...context, contextUrl] : [context, contextUrl];
+	return {
+		context,
+		baseUrl: documentUrl ?? reference
+	};
 }
-/**
-* Reports whether `value` carries an `@context` property anywhere inside
-* its subtree (not counting the value itself).  A nested `@context` can
-* introduce a local term-definition scope that redefines `as:` or `Public`
-* even when the top-level `@context` is safe, so the fast path must defer
-* to the URDNA2015 equivalence check whenever one is present.
-*/
-function hasNestedContext$1(value, depth = 0) {
-	if (depth >= MAX_TRAVERSAL_DEPTH$1) return true;
-	if (Array.isArray(value)) return value.some((item) => hasNestedContext$1(item, depth + 1));
-	if (typeof value !== "object" || value == null) return false;
-	const record = value;
-	for (const key of Object.keys(record)) {
-		if (key === "@context") return true;
-		if (hasNestedContext$1(record[key], depth + 1)) return true;
-	}
-	return false;
+function createGraphAliasContextState() {
+	return {
+		graphTerms: /* @__PURE__ */ new Set(),
+		jsonTerms: /* @__PURE__ */ new Set(),
+		propertyContexts: /* @__PURE__ */ new Map(),
+		termTargets: /* @__PURE__ */ new Map()
+	};
 }
-/**
-* Checks whether the `@context` of a JSON-LD document is guaranteed not
-* to redefine the `as:` prefix or the bare `Public` term.  Only documents
-* whose `@context` is a string, or an array of strings, drawn from Fedify's
-* preloaded context set AND including the ActivityStreams URL qualify,
-* AND no nested subtree carries its own `@context` that might redefine
-* those terms within a local scope.  When all of that holds the rewrite
-* is provably semantics-preserving and the URDNA2015 equivalence check
-* can be skipped.  Any other shape (unknown external URLs, inline
-* objects at the top level, nested `@context` blocks) is treated as
-* potentially unsafe.
-*/
-function hasKnownSafeContext$1(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	const record = jsonLd;
-	if (!Object.hasOwn(record, "@context")) return false;
-	const ctx = record["@context"];
-	const entries = typeof ctx === "string" ? [ctx] : Array.isArray(ctx) ? ctx : null;
-	if (entries == null || entries.length === 0) return false;
-	let hasAs = false;
-	for (const entry of entries) {
-		if (typeof entry !== "string") return false;
-		if (!KNOWN_SAFE_CONTEXT_URLS$1.has(entry)) return false;
-		if (entry === AS_CONTEXT_URL$1) hasAs = true;
-	}
-	if (!hasAs) return false;
-	for (const key of Object.keys(record)) {
-		if (key === "@context") continue;
-		if (hasNestedContext$1(record[key])) return false;
+function cloneGraphAliasContextState(state) {
+	return {
+		graphTerms: new Set(state.graphTerms),
+		jsonTerms: new Set(state.jsonTerms),
+		propertyContexts: new Map(state.propertyContexts),
+		termTargets: new Map(state.termTargets)
+	};
+}
+function resolveContextTarget(target, state) {
+	if (target === "@graph") return target;
+	const mapped = state.termTargets.get(target);
+	if (mapped == null) return target;
+	return mapped;
+}
+function getDirectContextTarget(definition) {
+	if (definition === null) return null;
+	if (typeof definition === "string") return definition;
+	if (typeof definition === "object" && definition != null && "@id" in definition) {
+		const id = definition["@id"];
+		if (id === null) return null;
+		if (typeof id === "string") return id;
 	}
-	return true;
 }
-/**
-* Rewrites the compact `as:Public` / `Public` CURIE appearing in activity
-* addressing fields (`to`, `cc`, `bto`, `bcc`, `audience`) to the fully
-* expanded `https://www.w3.org/ns/activitystreams#Public` URI.
-*
-* Several ActivityPub implementations, Lemmy among them, match these
-* fields as plain URLs without running JSON-LD expansion, and silently
-* drop activities whose public addressing appears in CURIE form.  This
-* helper works around that gap.
-*
-* For documents whose `@context` is drawn entirely from Fedify's
-* preloaded context set and includes the ActivityStreams URL, the
-* rewrite is applied directly: the content of every preloaded non-AS
-* context is known not to redefine the `as:` prefix or the bare `Public`
-* term, so the semantics are preserved by construction.  Any other
-* shape (an inline object, an unknown external URL, and so on) is
-* treated as potentially unsafe and gated on a JSON-LD equivalence
-* check; both forms are canonicalized with URDNA2015 and the resulting
-* N-Quads are compared.  When they differ, the original document is
-* returned unchanged.  Canonicalization failures also fall back to the
-* original document.
-*
-* When no `contextLoader` is supplied the helper falls back to an
-* internal loader that resolves only the URLs in Fedify's
-* preloaded-contexts set and rejects every other URL without issuing a
-* network request.  That behaviour is deliberately narrower than
-* `@fedify/vocab-runtime`'s `getDocumentLoader()`, which after its
-* `validatePublicUrl` check will happily fetch non-preloaded URLs: the
-* helper is reached from verification paths (`verifyProof()` /
-* `verifyObject()`) that operate on inbound, potentially adversarial
-* JSON-LD, and a default loader that fetches attacker-supplied
-* `@context` URLs on the caller's behalf would be an SSRF vector.
-* Canonicalization failures against the restricted loader fall back to
-* the original document, same as any other canonicalization error.
-* Callers that genuinely need the remote-fetch loader (for example
-* applications that sign local JSON-LD against a custom vocabulary)
-* should pass a `contextLoader` explicitly.
-*
-* Must be called before any signing step that canonicalizes the
-* compact form byte-for-byte (for example, Object Integrity Proofs
-* using the `eddsa-jcs-2022` cryptosuite), so the signed payload
-* matches what is sent on the wire.
-*/
-async function normalizePublicAudience(jsonLd, contextLoader) {
-	if (!hasPublicCurieInAddressing(jsonLd)) return jsonLd;
-	const normalized = rewritePublicAudience(jsonLd);
-	if (hasKnownSafeContext$1(jsonLd)) return normalized;
-	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
-	try {
-		const [before, after] = await Promise.all([jsonld.canonize(jsonLd, {
-			format: "application/n-quads",
-			documentLoader: loader
-		}), jsonld.canonize(normalized, {
-			format: "application/n-quads",
-			documentLoader: loader
-		})]);
-		if (before === after) return normalized;
-		logger$2.warn("Expanding the public audience CURIE to its full URI would change the canonical form of the activity; sending the activity as is.  This usually means the active JSON-LD context redefines the `as:` prefix or the bare `Public` term.");
-	} catch (error) {
-		logger$2.debug("Failed to verify public audience normalization equivalence via JSON-LD canonicalization; sending the activity as is.\n{error}", { error });
+function isJsonTypedDefinition(definition) {
+	return typeof definition === "object" && definition != null && "@type" in definition && definition["@type"] === "@json";
+}
+function resolveLocalContextTarget(target, state, localTargets, seen = /* @__PURE__ */ new Set()) {
+	if (target === "@graph") return target;
+	if (seen.has(target)) return target;
+	seen.add(target);
+	if (localTargets.has(target)) {
+		const localTarget = localTargets.get(target);
+		return localTarget == null ? target : resolveLocalContextTarget(localTarget, state, localTargets, seen);
 	}
-	return jsonLd;
+	return resolveContextTarget(target, state);
 }
-//#endregion
-//#region src/compat/outgoing-jsonld.ts
-const logger$1 = getLogger([
-	"fedify",
-	"compat",
-	"outgoing-jsonld"
-]);
-const ATTACHMENT_FIELDS = /* @__PURE__ */ new Set(["attachment", "https://www.w3.org/ns/activitystreams#attachment"]);
-const AS_CONTEXT_URL = "https://www.w3.org/ns/activitystreams";
-const KNOWN_SAFE_CONTEXT_URLS = getKnownSafeContextUrls();
-const MAX_TRAVERSAL_DEPTH = 64;
-function isJsonLdListObject(value) {
-	return typeof value === "object" && value != null && Object.hasOwn(value, "@list");
+function refreshGraphAliases(state) {
+	state.graphTerms.clear();
+	for (const [term, target] of state.termTargets) if (target === "@graph") state.graphTerms.add(term);
 }
-function isJsonLdValueObject(value) {
-	return typeof value === "object" && value != null && Object.hasOwn(value, "@value");
+function normalizeContextReference(reference, baseUrl) {
+	if (baseUrl != null) return new URL(reference, baseUrl).href;
+	return URL.canParse(reference) ? new URL(reference).href : reference;
 }
-function* getContextObjects(value, seen = /* @__PURE__ */ new WeakSet()) {
-	if (Array.isArray(value)) {
-		if (seen.has(value)) return;
-		seen.add(value);
-		for (const item of value) yield* getContextObjects(item, seen);
-		return;
+/** @internal */
+function isInvalidUrlTypeError(error) {
+	const code = error.code;
+	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+}
+async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
+	if (context === null) return createGraphAliasContextState();
+	let nextState = cloneGraphAliasContextState(state);
+	if (Array.isArray(context)) {
+		for (const item of context) nextState = await applyGraphAliasContext(nextState, item, documentLoader, remoteContextCache, baseUrl, processingContexts);
+		return nextState;
 	}
-	if (typeof value === "object" && value != null) {
-		if (seen.has(value)) return;
-		seen.add(value);
-		const record = value;
-		yield record;
-		for (const definition of Object.values(record)) {
-			if (typeof definition !== "object" || definition == null) continue;
-			const nestedContext = definition["@context"];
-			if (nestedContext == null) continue;
-			yield* getContextObjects(nestedContext, seen);
+	if (typeof context === "string") {
+		const reference = normalizeContextReference(context, baseUrl);
+		const cacheKey = `${baseUrl ?? ""}\n${reference}`;
+		if (processingContexts.has(cacheKey)) return nextState;
+		processingContexts.add(cacheKey);
+		try {
+			let remoteContext = remoteContextCache.get(cacheKey);
+			if (remoteContext == null) {
+				remoteContext = (async () => {
+					try {
+						return getRemoteContext(await documentLoader(reference), reference);
+					} catch (error) {
+						if (reference === context && isInvalidUrlTypeError(error) && isClearlyMalformedContextReference(context)) throw new InvalidContextReferenceError(context);
+						throw error;
+					}
+				})();
+				remoteContextCache.set(cacheKey, remoteContext);
+			}
+			const loadedRemoteContext = await remoteContext;
+			return await applyGraphAliasContext(nextState, loadedRemoteContext.context, documentLoader, remoteContextCache, loadedRemoteContext.baseUrl, processingContexts);
+		} finally {
+			processingContexts.delete(cacheKey);
+		}
+	}
+	if (typeof context === "object" && context != null) {
+		if ("@import" in context && typeof context["@import"] === "string") nextState = await applyGraphAliasContext(nextState, context["@import"], documentLoader, remoteContextCache, baseUrl, processingContexts);
+		const localTargets = /* @__PURE__ */ new Map();
+		for (const [term, definition] of globalThis.Object.entries(context)) {
+			if (term.startsWith("@")) continue;
+			const target = getDirectContextTarget(definition);
+			if (target == null) localTargets.set(term, null);
+			else if (typeof target === "string") localTargets.set(term, target);
+			else localTargets.delete(term);
+		}
+		for (const [term, definition] of globalThis.Object.entries(context)) {
+			if (term.startsWith("@")) continue;
+			if (localTargets.has(term)) {
+				const directTarget = localTargets.get(term);
+				if (directTarget == null) nextState.termTargets.set(term, null);
+				else nextState.termTargets.set(term, resolveLocalContextTarget(directTarget, nextState, localTargets));
+			} else nextState.termTargets.delete(term);
+			if (typeof definition === "object" && definition != null && "@context" in definition) nextState.propertyContexts.set(term, {
+				context: definition["@context"],
+				baseUrl
+			});
+			else nextState.propertyContexts.delete(term);
+			if (isJsonTypedDefinition(definition)) nextState.jsonTerms.add(term);
+			else nextState.jsonTerms.delete(term);
 		}
+		refreshGraphAliases(nextState);
 	}
+	return nextState;
 }
-function isActivityStreamsAttachmentTerm(value) {
-	return typeof value === "object" && value != null && value["@id"] === "as:attachment" && value["@type"] === "@id";
+async function assertNoGraphBeforeCompaction(jsonLd, documentLoader, inheritedState = createGraphAliasContextState(), propertyContext, remoteContextCache = /* @__PURE__ */ new Map()) {
+	if (Array.isArray(jsonLd)) {
+		for (const item of jsonLd) await assertNoGraphBeforeCompaction(item, documentLoader, inheritedState, propertyContext, remoteContextCache);
+		return;
+	}
+	if (typeof jsonLd !== "object" || jsonLd == null) return;
+	const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
+	let state = inheritedState;
+	if (propertyContext !== void 0) state = await applyGraphAliasContext(state, propertyContext.context, documentLoader, remoteContextCache, propertyContext.baseUrl);
+	if ("@context" in jsonLd) state = await applyGraphAliasContext(state, jsonLd["@context"], documentLoader, remoteContextCache);
+	for (const [key, value] of globalThis.Object.entries(jsonLd)) {
+		if (key === "@context") continue;
+		if (jsonLiteralWrapper && key === "@value") continue;
+		if (key === "@graph" || state.graphTerms.has(key)) throw new UnsafeJsonLdError("@graph");
+		if (state.jsonTerms.has(key)) continue;
+		await assertNoGraphBeforeCompaction(value, documentLoader, state, state.propertyContexts.get(key), remoteContextCache);
+	}
+}
+function isJsonLiteralWrapper(value) {
+	return "@value" in value && (value["@type"] === "@json" || value.type === "@json");
 }
 /** @internal */
-function isPreloadedContextAttachmentSafe(document) {
-	if (typeof document !== "object" || document == null) return true;
-	const context = document["@context"];
-	for (const contextObject of getContextObjects(context)) {
-		if (!Object.hasOwn(contextObject, "attachment")) continue;
-		if (isActivityStreamsAttachmentTerm(contextObject.attachment)) continue;
-		return false;
+function assertSafeJsonLd(jsonLd) {
+	if (Array.isArray(jsonLd)) for (const item of jsonLd) assertSafeJsonLd(item);
+	else if (typeof jsonLd === "object" && jsonLd != null) {
+		const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
+		for (const [key, value] of globalThis.Object.entries(jsonLd)) {
+			if (disallowedJsonLdKeywords.has(key)) throw new UnsafeJsonLdError(key);
+			if (jsonLiteralWrapper && key === "@value") continue;
+			assertSafeJsonLd(value);
+		}
 	}
-	return true;
 }
-function getKnownSafeContextUrls() {
-	const urls = /* @__PURE__ */ new Set();
-	for (const [url, document] of Object.entries(preloadedContexts)) if (isPreloadedContextAttachmentSafe(document)) urls.add(url);
-	else logger$1.warn("Preloaded JSON-LD context {contextUrl} redefines the `attachment` term incompatibly; attachment array normalization will require canonicalization for documents using it.", { contextUrl: url });
-	return urls;
+/**
+* Attaches a LD signature to the given JSON-LD document.
+* @param jsonLd The JSON-LD document to attach the signature to.  It is not
+*               modified.
+* @param signature The signature to attach.
+* @returns The JSON-LD document with the attached signature.
+* @throws {TypeError} If the input document is not a valid JSON-LD document.
+* @since 1.0.0
+*/
+function attachSignature(jsonLd, signature) {
+	if (typeof jsonLd !== "object" || jsonLd == null) throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
+	return {
+		...jsonLd,
+		signature
+	};
 }
 /**
-* Wraps scalar ActivityStreams attachment properties in arrays.
+* Creates a LD signature for the given JSON-LD document.
+* @param jsonLd The JSON-LD document to sign.
+* @param privateKey The private key to sign the document.
+* @param keyId The ID of the public key that corresponds to the private key.
+* @param options Additional options for creating the signature.
+*                See also {@link CreateSignatureOptions}.
+* @return The created signature.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 1.0.0
 */
-function wrapScalarAttachments(jsonLd, depth = 0) {
-	if (depth >= MAX_TRAVERSAL_DEPTH) return jsonLd;
-	if (Array.isArray(jsonLd)) {
-		let normalized = null;
-		for (let i = 0; i < jsonLd.length; i++) {
-			const item = jsonLd[i];
-			const next = wrapScalarAttachments(item, depth + 1);
-			if (normalized == null && next !== item) normalized = jsonLd.slice(0, i);
-			if (normalized != null) normalized[i] = next;
-		}
-		return normalized ?? jsonLd;
-	}
-	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
-	const record = jsonLd;
-	const keys = Object.keys(record);
-	let normalized = null;
-	for (let i = 0; i < keys.length; i++) {
-		const key = keys[i];
-		const value = record[key];
-		const next = key === "@context" || key === "@value" && isJsonLdValueObject(jsonLd) ? value : wrapScalarAttachments(value, depth + 1);
-		const output = ATTACHMENT_FIELDS.has(key) && next != null && !Array.isArray(next) && !isJsonLdListObject(next) ? [next] : next;
-		if (normalized == null && output !== value) {
-			const cloned = Object.create(null);
-			for (let j = 0; j < i; j++) {
-				const previousKey = keys[j];
-				cloned[previousKey] = record[previousKey];
+async function createSignature(jsonLd, privateKey, keyId, { contextLoader, created } = {}) {
+	validateCryptoKey(privateKey, "private");
+	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
+	const options = {
+		"@context": "https://w3id.org/identity/v1",
+		creator: keyId.href,
+		created: created?.toString() ?? (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const message = await hashJsonLd(options, contextLoader) + await hashJsonLd(jsonLd, contextLoader);
+	const messageBytes = new TextEncoder().encode(message);
+	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, messageBytes);
+	return {
+		...options,
+		type: "RsaSignature2017",
+		signatureValue: encodeBase64(signature)
+	};
+}
+/**
+* Signs the given JSON-LD document with the private key and returns the signed
+* JSON-LD document.
+* @param jsonLd The JSON-LD document to sign.
+* @param privateKey The private key to sign the document.
+* @param keyId The key ID to use in the signature.  It will be used by the
+*              verifier to fetch the corresponding public key.
+* @param options Additional options for signing the document.
+*                See also {@link SignJsonLdOptions}.
+* @returns The signed JSON-LD document.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 1.0.0
+*/
+async function signJsonLd(jsonLd, privateKey, keyId, options) {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.sign", { attributes: { "ld_signatures.key_id": keyId.href } }, async (span) => {
+		try {
+			const signature = await createSignature(jsonLd, privateKey, keyId, options);
+			if (span.isRecording()) {
+				span.setAttribute("ld_signatures.type", signature.type);
+				span.setAttribute("ld_signatures.signature", encodeHex(decodeBase64(signature.signatureValue)));
 			}
-			normalized = cloned;
+			return attachSignature(jsonLd, signature);
+		} catch (error) {
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
 		}
-		if (normalized != null) normalized[key] = output;
-	}
-	return normalized ?? jsonLd;
-}
-function hasNestedContext(value, depth = 0) {
-	if (depth >= MAX_TRAVERSAL_DEPTH) return true;
-	if (Array.isArray(value)) return value.some((item) => hasNestedContext(item, depth + 1));
-	if (typeof value !== "object" || value == null) return false;
-	const record = value;
-	for (const key of Object.keys(record)) {
-		if (key === "@context") return true;
-		if (key === "@value" && isJsonLdValueObject(value)) continue;
-		if (hasNestedContext(record[key], depth + 1)) return true;
-	}
-	return false;
+	});
 }
-function exceedsTraversalDepth(value, depth = 0) {
-	if (depth >= MAX_TRAVERSAL_DEPTH) return true;
-	if (Array.isArray(value)) return value.some((item) => exceedsTraversalDepth(item, depth + 1));
-	if (typeof value !== "object" || value == null) return false;
-	const record = value;
-	for (const key of Object.keys(record)) {
-		if (key === "@context" || key === "@value" && isJsonLdValueObject(value)) continue;
-		if (exceedsTraversalDepth(record[key], depth + 1)) return true;
-	}
-	return false;
+/**
+* Checks if the given JSON-LD document has a Linked Data Signature-like
+* object, without restricting it to a single suite-specific shape.
+* @param jsonLd The JSON-LD document to check.
+* @returns `true` if the document has a signature-like object; `false`
+*          otherwise.
+* @since 2.2.0
+*/
+function hasSignatureLike(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	const signature = jsonLd.signature;
+	const hasReference = (value) => {
+		if (typeof value === "string") return true;
+		if (Array.isArray(value)) return value.some(hasReference);
+		return typeof value === "object" && value != null && ("id" in value && typeof value.id === "string" || "@id" in value && typeof value["@id"] === "string");
+	};
+	const hasSignatureObject = (value) => {
+		if (typeof value !== "object" || value == null) return false;
+		const signatureRecord = value;
+		return (typeof signatureRecord.type === "string" || Array.isArray(signatureRecord.type) && signatureRecord.type.some((item) => typeof item === "string")) && (hasReference(signatureRecord.creator) || hasReference(signatureRecord.verificationMethod)) && (typeof signatureRecord.signatureValue === "string" || typeof signatureRecord.jws === "string");
+	};
+	return Array.isArray(signature) ? signature.some(hasSignatureObject) : hasSignatureObject(signature);
 }
-function hasKnownSafeContext(jsonLd) {
+/**
+* Checks if the given JSON-LD document has a Linked Data Signature.
+* @param jsonLd The JSON-LD document to check.
+* @returns `true` if the document has a signature; `false` otherwise.
+* @since 1.0.0
+*/
+function hasSignature(jsonLd) {
 	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	const record = jsonLd;
-	if (!Object.hasOwn(record, "@context")) return false;
-	const context = record["@context"];
-	const entries = typeof context === "string" ? [context] : Array.isArray(context) ? context : null;
-	if (entries == null || entries.length < 1) return false;
-	let hasActivityStreamsContext = false;
-	for (const entry of entries) {
-		if (typeof entry !== "string") return false;
-		if (!KNOWN_SAFE_CONTEXT_URLS.has(entry)) return false;
-		if (entry === AS_CONTEXT_URL) hasActivityStreamsContext = true;
-	}
-	if (!hasActivityStreamsContext) return false;
-	for (const key of Object.keys(record)) {
-		if (key === "@context") continue;
-		if (hasNestedContext(record[key])) return false;
+	if ("signature" in jsonLd) {
+		const signature = jsonLd.signature;
+		if (typeof signature !== "object" || signature == null) return false;
+		return "type" in signature && signature.type === "RsaSignature2017" && "creator" in signature && typeof signature.creator === "string" && "created" in signature && typeof signature.created === "string" && "signatureValue" in signature && typeof signature.signatureValue === "string";
 	}
-	return true;
+	return false;
 }
-function getLogSafeJsonLdMetadata(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return {};
-	const record = jsonLd;
-	const context = record["@context"];
-	return {
-		id: typeof record.id === "string" ? record.id : typeof record["@id"] === "string" ? record["@id"] : void 0,
-		type: typeof record.type === "string" ? record.type : typeof record["@type"] === "string" ? record["@type"] : void 0,
-		context: typeof context === "string" ? context : Array.isArray(context) ? context.filter((entry) => typeof entry === "string").slice(0, 4) : context == null ? void 0 : "[inline context]"
-	};
+/**
+* Detaches Linked Data Signatures from the given JSON-LD document.
+* @param jsonLd The JSON-LD document to modify.
+* @returns The modified JSON-LD document.  If the input document does not
+*          contain a signature, the original document is returned.
+* @since 1.0.0
+*/
+function detachSignature(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
+	const doc = { ...jsonLd };
+	delete doc.signature;
+	return doc;
 }
 /**
-* Ensures ActivityStreams attachment properties are represented as arrays
-* when doing so preserves the JSON-LD semantics.
-*
-* JSON-LD compaction collapses single-item arrays into scalar values by
-* default.  Some ActivityPub implementations, Pixelfed among them, parse
-* `attachment` as a plain JSON array rather than a JSON-LD property and reject
-* otherwise valid objects whose single attachment is emitted as a scalar.
+* Verifies Linked Data Signatures of the given JSON-LD document.
 *
-* When no `contextLoader` is supplied, the helper falls back to a restricted
-* loader that resolves only Fedify's preloaded JSON-LD contexts and rejects
-* every other URL without network access.  Documents with custom, inline, or
-* otherwise uncached contexts should pass a real `contextLoader` if they need
-* the semantic-preservation check to succeed; otherwise canonicalization
-* failures leave the original document unchanged.
+* This is a low-level utility that only checks the cryptographic signature
+* and (optionally) the cached key.  It does not run the JSON-LD parsing,
+* attribution, and owner checks that a complete inbound LD verification
+* needs.  For incoming activities, prefer {@link verifyJsonLd}, which is
+* the public verification entry point and the one that emits the
+* `activitypub.signature.verification.duration` metric for the LD path.
+* `verifySignature` itself only emits
+* `activitypub.signature.key_fetch.duration`, since the rest of the work
+* that the verification-duration metric is meant to cover happens in
+* `verifyJsonLd`.
+* @param jsonLd The JSON-LD document to verify.
+* @param options Options for verifying the signature.
+* @returns The public key that signed the document or `null` if the signature
+*          is invalid or the key is not found.
+* @since 1.0.0
 */
-async function normalizeAttachmentArrays(jsonLd, contextLoader) {
-	const normalized = wrapScalarAttachments(jsonLd);
-	if (normalized === jsonLd) return jsonLd;
-	if (exceedsTraversalDepth(jsonLd)) {
-		logger$1.debug("Skipping attachment array normalization because the JSON-LD document exceeds the safe traversal depth; leaving it unchanged.");
-		return jsonLd;
+async function verifySignature(jsonLd, options = {}) {
+	if (!hasSignature(jsonLd)) return null;
+	const sig = jsonLd.signature;
+	let signature;
+	try {
+		signature = decodeBase64(sig.signatureValue);
+	} catch (error) {
+		logger$2.debug("Failed to verify; invalid base64 signatureValue: {signatureValue}", {
+			...sig,
+			error
+		});
+		return null;
 	}
-	if (hasKnownSafeContext(jsonLd)) return normalized;
-	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
+	const { key, cached } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), CryptographicKey, options));
+	if (key == null) return null;
+	const sigOpts = {
+		...sig,
+		"@context": "https://w3id.org/identity/v1"
+	};
+	delete sigOpts.type;
+	delete sigOpts.id;
+	delete sigOpts.signatureValue;
+	let sigOptsHash;
 	try {
-		const [before, after] = await Promise.all([jsonld.canonize(jsonLd, {
-			format: "application/n-quads",
-			documentLoader: loader
-		}), jsonld.canonize(normalized, {
-			format: "application/n-quads",
-			documentLoader: loader
-		})]);
-		if (before === after) return normalized;
-		logger$1.warn("Wrapping scalar attachment values in arrays would change the canonical form of the JSON-LD document; leaving it unchanged.  This usually means the active JSON-LD context redefines the `attachment` term.  Document: {id}; type: {type}; context: {context}.", getLogSafeJsonLdMetadata(jsonLd));
+		sigOptsHash = await hashJsonLd(sigOpts, options.contextLoader);
 	} catch (error) {
-		logger$1.debug("Failed to verify attachment array normalization equivalence via JSON-LD canonicalization; leaving the JSON-LD document unchanged.\n{error}", { error });
+		logger$2.warn("Failed to verify; failed to hash the signature options: {signatureOptions}\n{error}", {
+			signatureOptions: sigOpts,
+			error
+		});
+		return null;
 	}
-	return jsonLd;
+	const document = { ...jsonLd };
+	delete document.signature;
+	let docHash;
+	try {
+		docHash = await hashJsonLd(document, options.contextLoader);
+	} catch (error) {
+		logger$2.warn("Failed to verify; failed to hash the document: {document}\n{error}", {
+			document,
+			error
+		});
+		return null;
+	}
+	const encoder = new TextEncoder();
+	const message = sigOptsHash + docHash;
+	const messageBytes = encoder.encode(message);
+	if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes)) return key;
+	if (cached) {
+		logger$2.debug("Failed to verify with the cached key {keyId}; signature {signatureValue} is invalid.  Retrying with the freshly fetched key...", {
+			keyId: sig.creator,
+			...sig
+		});
+		const { key } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), CryptographicKey, {
+			...options,
+			keyCache: {
+				get: () => Promise.resolve(void 0),
+				set: async (keyId, key) => await options.keyCache?.set(keyId, key)
+			}
+		}));
+		if (key == null) return null;
+		return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes) ? key : null;
+	}
+	logger$2.debug("Failed to verify with the fetched key {keyId}; signature {signatureValue} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
+		keyId: sig.creator,
+		...sig,
+		message
+	});
+	return null;
+}
+/**
+* Known Linked Data Signature `type` values, used to keep
+* `ld_signatures.type` on a bounded set of spec-defined string values.
+* Fedify only signs and verifies `RsaSignature2017`; other values come in
+* only from external documents and are dropped from the metric attribute to
+* avoid attacker-controlled cardinality.
+*/
+const LD_KNOWN_SIGNATURE_TYPES = /* @__PURE__ */ new Set(["RsaSignature2017"]);
+/**
+* Reports only whether a `signature` key is present on the document, with
+* no shape check on its value.  This is intentionally looser than
+* {@link hasSignature} (which validates a full `RsaSignature2017` shape)
+* and {@link hasSignatureLike} (which structurally accepts several known
+* suites): `verifyJsonLd` needs to tell a document with a malformed or
+* unsupported signature payload (classified as `rejected`) apart from a
+* truly unsigned document (classified as `missing`), and only this
+* presence-only check captures both cases.
+*/
+function hasLdSignatureProperty(jsonLd) {
+	return typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
+}
+function getLdSignatureObject(jsonLd) {
+	if (!hasLdSignatureProperty(jsonLd)) return void 0;
+	const { signature } = jsonLd;
+	if (typeof signature !== "object" || signature == null || Array.isArray(signature)) return;
+	return signature;
+}
+/**
+* Verify the authenticity of the given JSON-LD document using Linked Data
+* Signatures.  If the document is signed, this function verifies the signature
+* and checks if the document is attributed to the owner of the public key.
+* If the document is not signed, this function returns `false`.
+* @param jsonLd The JSON-LD document to verify.
+* @param options Options for verifying the document.
+* @returns `true` if the document is authentic; `false` otherwise.
+*/
+async function verifyJsonLd(jsonLd, options = {}) {
+	return await verifyJsonLdInternal(jsonLd, options, true);
+}
+/** @internal */
+async function verifyCompactJsonLd(jsonLd, options = {}) {
+	return await verifyJsonLdInternal(jsonLd, options, false);
+}
+async function verifyJsonLdInternal(jsonLd, options, compact) {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
+		const start = performance.now();
+		let verified = false;
+		let threw = false;
+		let signatureType;
+		try {
+			const verificationOptions = hasSignature(jsonLd) ? {
+				...options,
+				contextLoader: getNormalizationContextLoader(options.contextLoader)
+			} : options;
+			const compacted = compact ? hasSignature(jsonLd) ? await compactJsonLd(jsonLd, options.contextLoader) : jsonLd : jsonLd;
+			const object = await Object$1.fromJsonLd(compacted, verificationOptions);
+			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
+			span.setAttribute("activitypub.object.type", getTypeId(object).href);
+			const sig = getLdSignatureObject(jsonLd);
+			if (sig != null) {
+				if (typeof sig.creator === "string") span.setAttribute("ld_signatures.key_id", sig.creator);
+				if (typeof sig.signatureValue === "string") span.setAttribute("ld_signatures.signature", sig.signatureValue);
+				if (typeof sig.type === "string") {
+					span.setAttribute("ld_signatures.type", sig.type);
+					if (LD_KNOWN_SIGNATURE_TYPES.has(sig.type)) signatureType = sig.type;
+				}
+			}
+			const attributions = new Set(object.attributionIds.map((uri) => uri.href));
+			if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
+			const key = await verifySignature(compacted, verificationOptions);
+			if (key == null) return false;
+			if (key.ownerId == null) {
+				logger$2.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
+				return false;
+			}
+			attributions.delete(key.ownerId.href);
+			if (attributions.size > 0) {
+				logger$2.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
+				return false;
+			}
+			verified = true;
+			return true;
+		} catch (error) {
+			threw = true;
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			const classified = threw ? "error" : verified ? "verified" : hasLdSignatureProperty(jsonLd) ? "rejected" : "missing";
+			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "linked_data", classified, { ldType: signatureType });
+			span.end();
+		}
+	});
 }
-/**
-* Applies Fedify's internal JSON-LD wire-format interoperability workarounds
-* to locally generated outgoing activities before they are signed, enqueued,
-* or sent.
-*/
-async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader) {
-	jsonLd = await normalizePublicAudience(jsonLd, contextLoader);
-	return await normalizeAttachmentArrays(jsonLd, contextLoader);
+async function hashJsonLd(jsonLd, contextLoader) {
+	const canon = await jsonld.canonize(jsonLd, {
+		format: "application/n-quads",
+		documentLoader: contextLoader ?? getDocumentLoader()
+	});
+	const encoder = new TextEncoder();
+	return encodeHex(await crypto.subtle.digest("SHA-256", encoder.encode(canon)));
 }
 //#endregion
 //#region src/sig/proof.ts
@@ -1122,7 +1011,7 @@ async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader) {
 * cardinality.
 */
 const OIP_KNOWN_CRYPTOSUITES = /* @__PURE__ */ new Set(["eddsa-jcs-2022"]);
-const logger = getLogger([
+const logger$1 = getLogger([
 	"fedify",
 	"sig",
 	"proof"
@@ -1262,7 +1151,31 @@ async function signObject(object, privateKey, keyId, options = {}) {
 async function verifyProof(jsonLd, proof, options = {}) {
 	return await verifyProofWithMessageDigestCache(jsonLd, proof, options);
 }
-async function verifyProofWithMessageDigestCache(jsonLd, proof, options, messageDigestCache = {}, rawProofCandidate) {
+/**
+* Verifies the one direct literal proof on a map-local secured document.
+*
+* Unlike {@link verifyProof}, this removes only the literal `proof` member
+* from the message digest.  JSON-LD aliases remain part of the signed input,
+* and the document's received `@context` is not replaced by the proof
+* configuration context.
+*
+* @internal
+*/
+async function verifyMapLocalProof(jsonLd, options = {}) {
+	if (!isJsonLdNode(jsonLd) || !globalThis.Object.hasOwn(jsonLd, "proof") || !isJsonLdNode(jsonLd.proof)) return null;
+	const proofContextLoader = getNormalizationContextLoader(preloadedOnlyDocumentLoader);
+	try {
+		const [candidate] = await parseRawProofCandidates(jsonLd, [jsonLd.proof], options, proofContextLoader);
+		if (candidate.proof == null) return null;
+		return await verifyProofWithMessageDigestCache(jsonLd, candidate.proof, options, {
+			proofContextLoader,
+			proofPropertyMode: "literal"
+		}, candidate);
+	} catch {
+		return null;
+	}
+}
+async function verifyProofWithMessageDigestCache(jsonLd, proof, options, messageDigestCache = {}, rawProofCandidate, keyIdBoundByCaller = false) {
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.verify", async (span) => {
 		const start = performance.now();
 		let verified = false;
@@ -1274,7 +1187,7 @@ async function verifyProofWithMessageDigestCache(jsonLd, proof, options, message
 			if (proof.proofValue != null) span.setAttribute("object_integrity_proofs.signature", encodeHex(proof.proofValue));
 		}
 		try {
-			const key = await verifyProofInternal(jsonLd, proof, options, messageDigestCache, rawProofCandidate);
+			const key = await verifyProofInternal(jsonLd, proof, options, messageDigestCache, rawProofCandidate, keyIdBoundByCaller);
 			if (key == null) span.setStatus({ code: SpanStatusCode.ERROR });
 			else verified = true;
 			return key;
@@ -1332,10 +1245,11 @@ async function getJsonLdPropertyNames(jsonLd, propertyIri, defaults, documentLoa
 async function getProofPropertyNames(jsonLd, documentLoader = preloadedOnlyDocumentLoader) {
 	return await getJsonLdPropertyNames(jsonLd, SECURITY_PROOF, ["proof", SECURITY_PROOF], documentLoader) ?? /* @__PURE__ */ new Set(["proof", SECURITY_PROOF]);
 }
-async function createProofMessageDigests(jsonLd, proofContextLoader, context) {
+async function createProofMessageDigests(jsonLd, proofContextLoader, context, proofPropertyMode = "jsonLd") {
 	const msg = { ...jsonLd };
-	for (const property of await getProofPropertyNames(msg, proofContextLoader)) delete msg[property];
-	if (context != null) msg["@context"] = structuredClone(context);
+	if (proofPropertyMode === "literal") delete msg.proof;
+	else for (const property of await getProofPropertyNames(msg, proofContextLoader)) delete msg[property];
+	if (proofPropertyMode === "jsonLd" && context != null) msg["@context"] = structuredClone(context);
 	const encoder = new TextEncoder();
 	const digest = async (value) => {
 		const bytes = encoder.encode(serialize(value));
@@ -1591,19 +1505,22 @@ async function hasValidProofOptions(proofConfig, options, documentLoader) {
 	if (previousProof == null || previousProof.present && typeof previousProof.value !== "string" && (!Array.isArray(previousProof.value) || previousProof.value.some((item) => typeof item !== "string"))) return false;
 	return true;
 }
-async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, rawProofCandidate) {
+async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, rawProofCandidate, keyIdBoundByCaller = false) {
 	if (!isJsonLdNode(jsonLd) || proof.cryptosuite !== "eddsa-jcs-2022" || proof.verificationMethodId == null || proof.proofPurpose !== "assertionMethod" || proof.proofValue == null || proof.created == null) return null;
 	const proofContextLoader = messageDigestCache.proofContextLoader ?? preloadedOnlyDocumentLoader;
 	const proofConfiguration = await createProofConfiguration(jsonLd, proof, options, proofContextLoader, rawProofCandidate);
 	if (proofConfiguration == null || !await hasValidProofOptions(proofConfiguration.value, options, proofContextLoader)) return null;
-	const publicKeyPromise = measureSignatureKeyFetch(options.meterProvider, "object_integrity", () => fetchKey(proof.verificationMethodId, Multikey, options));
+	const publicKeyPromise = measureSignatureKeyFetch(options.meterProvider, "object_integrity", () => fetchKey(proof.verificationMethodId, Multikey, {
+		...options,
+		keyIdBoundByCaller
+	}));
 	const proofBytes = new TextEncoder().encode(serialize(proofConfiguration.value));
 	const proofDigest = await crypto.subtle.digest("SHA-256", proofBytes);
 	let fetchedKey;
 	try {
 		fetchedKey = await publicKeyPromise;
 	} catch (error) {
-		logger.debug("Failed to get the key (verificationMethod) for the proof:\n{proof}", {
+		logger$1.debug("Failed to get the key (verificationMethod) for the proof:\n{proof}", {
 			proof,
 			keyId: proof.verificationMethodId.href,
 			error
@@ -1612,7 +1529,7 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 	}
 	const publicKey = fetchedKey.key;
 	if (publicKey == null) {
-		logger.debug("Failed to get the key (verificationMethod) for the proof:\n{proof}", {
+		logger$1.debug("Failed to get the key (verificationMethod) for the proof:\n{proof}", {
 			proof,
 			keyId: proof.verificationMethodId.href
 		});
@@ -1620,7 +1537,7 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 	}
 	if (publicKey.publicKey.algorithm.name !== "Ed25519") {
 		if (fetchedKey.cached) {
-			logger.debug("The cached key (verificationMethod) for the proof is not a valid Ed25519 key:\n{keyId}; retrying with the freshly fetched key...", {
+			logger$1.debug("The cached key (verificationMethod) for the proof is not a valid Ed25519 key:\n{keyId}; retrying with the freshly fetched key...", {
 				proof,
 				keyId: proof.verificationMethodId.href
 			});
@@ -1630,9 +1547,9 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 					get: () => Promise.resolve(void 0),
 					set: async (keyId, key) => await options.keyCache?.set(keyId, key)
 				}
-			}, messageDigestCache, rawProofCandidate);
+			}, messageDigestCache, rawProofCandidate, keyIdBoundByCaller);
 		}
-		logger.debug("The fetched key (verificationMethod) for the proof is not a valid Ed25519 key:\n{keyId}", {
+		logger$1.debug("The fetched key (verificationMethod) for the proof is not a valid Ed25519 key:\n{keyId}", {
 			proof,
 			keyId: proof.verificationMethodId.href
 		});
@@ -1649,15 +1566,17 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 	const messageDigestValues = messageDigestCache.values ??= /* @__PURE__ */ new Map();
 	let messageDigestsPromise = messageDigestValues.get(messageDigestKey);
 	if (messageDigestsPromise == null) {
-		messageDigestsPromise = createProofMessageDigests(jsonLd, messageDigestCache.proofContextLoader, proofConfiguration.context);
+		messageDigestsPromise = createProofMessageDigests(jsonLd, messageDigestCache.proofContextLoader, proofConfiguration.context, messageDigestCache.proofPropertyMode);
 		messageDigestValues.set(messageDigestKey, messageDigestsPromise);
 	}
 	const messageDigests = await messageDigestsPromise;
 	if (await verifyCandidate(messageDigests.onWire)) return publicKey;
-	const normalizedDigest = await messageDigests.normalized();
-	if (normalizedDigest != null && await verifyCandidate(normalizedDigest)) return publicKey;
+	if (messageDigestCache.proofPropertyMode !== "literal") {
+		const normalizedDigest = await messageDigests.normalized();
+		if (normalizedDigest != null && await verifyCandidate(normalizedDigest)) return publicKey;
+	}
 	if (fetchedKey.cached) {
-		logger.debug("Failed to verify the proof with the cached key {keyId}; retrying with the freshly fetched key...", {
+		logger$1.debug("Failed to verify the proof with the cached key {keyId}; retrying with the freshly fetched key...", {
 			keyId: proof.verificationMethodId.href,
 			proof
 		});
@@ -1667,9 +1586,9 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 				get: () => Promise.resolve(void 0),
 				set: async (keyId, key) => await options.keyCache?.set(keyId, key)
 			}
-		}, messageDigestCache, rawProofCandidate);
+		}, messageDigestCache, rawProofCandidate, keyIdBoundByCaller);
 	}
-	logger.debug("Failed to verify the proof with the fetched key {keyId}:\n{proof}", {
+	logger$1.debug("Failed to verify the proof with the fetched key {keyId}:\n{proof}", {
 		keyId: proof.verificationMethodId.href,
 		proof
 	});
@@ -1747,59 +1666,55 @@ async function expandPortableObjectRoot(jsonLd, contextLoader) {
 		}
 	};
 }
-/**
-* Verifies the FEP-ef61 Object Integrity Proof policy for a portable object.
-*
-* This applies the FEP-2277 core-type classification to the top-level JSON-LD
-* node.  Portable actors, activities, and objects require proofs.  A portable
-* collection without a proof is reported separately so a caller can apply a
-* gateway trust policy.  Embedded portable objects are not traversed.
-*
-* Every proof must use a DID URL whose DID matches the portable object's
-* authority, and every proof must pass {@link verifyProof}.
-*
-* @param jsonLd The JSON-LD document to verify.
-* @param options Additional options.  See also
-*                {@link VerifyPortableObjectProofOptions}.
-* @returns The detailed portable proof-policy result.
-* @throws {TypeError} If the input is not a single JSON-LD object or has a
-*                     malformed portable ID.
-* @since 2.4.0
-*/
-async function verifyPortableObjectProof(jsonLd, options = {}) {
+async function preparePortableObjectProof(jsonLd, options) {
 	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !PORTABLE_OBJECT_ID_PATTERN.test(jsonLd["@id"])) return {
-		verified: false,
-		reason: { type: "notPortableObject" }
+		prepared: false,
+		result: {
+			verified: false,
+			reason: { type: "notPortableObject" }
+		}
 	};
 	const { root, proofContextLoader } = await expandPortableObjectRoot(jsonLd, options.contextLoader);
 	const id = root["@id"];
 	if (typeof id !== "string" || !PORTABLE_OBJECT_ID_PATTERN.test(id)) return {
-		verified: false,
-		reason: { type: "notPortableObject" }
+		prepared: false,
+		result: {
+			verified: false,
+			reason: { type: "notPortableObject" }
+		}
 	};
 	const objectId = parseIri(id);
 	getFe34Origin(objectId);
 	const objectType = classifyFep2277CoreType(root);
 	if (objectType === "verificationMethod" || objectType === "publicKey" || objectType === "link") return {
-		verified: false,
-		reason: {
-			type: "unsupportedObjectType",
-			objectType
+		prepared: false,
+		result: {
+			verified: false,
+			reason: {
+				type: "unsupportedObjectType",
+				objectType
+			}
 		}
 	};
 	const proofValues = root[SECURITY_PROOF];
-	if (proofValues == null || Array.isArray(proofValues) && proofValues.length < 1) return objectType === "collection" ? {
-		verified: false,
-		reason: { type: "unsecuredCollection" }
-	} : {
-		verified: false,
-		reason: { type: "missingProof" }
+	if (proofValues == null || Array.isArray(proofValues) && proofValues.length < 1) return {
+		prepared: false,
+		result: objectType === "collection" ? {
+			verified: false,
+			reason: { type: "unsecuredCollection" }
+		} : {
+			verified: false,
+			reason: { type: "missingProof" }
+		}
 	};
 	if (!Array.isArray(proofValues)) return {
-		verified: false,
-		reason: {
-			type: "invalidProof",
-			proofIndex: 0
+		prepared: false,
+		result: {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex: 0
+			}
 		}
 	};
 	const rawProofValues = isJsonLdNode(jsonLd) ? await getRawProofValues(jsonLd, proofContextLoader) : [];
@@ -1807,10 +1722,13 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 	for (let proofIndex = 0; proofIndex < proofValues.length; proofIndex++) {
 		const proofValue = proofValues[proofIndex];
 		if (!hasValidPortableProofShape(proofValue)) return {
-			verified: false,
-			reason: {
-				type: "invalidProof",
-				proofIndex
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "invalidProof",
+					proofIndex
+				}
 			}
 		};
 		let proof;
@@ -1818,10 +1736,13 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 			proof = await DataIntegrityProof.fromJsonLd(proofValue, options);
 		} catch {
 			return {
-				verified: false,
-				reason: {
-					type: "invalidProof",
-					proofIndex
+				prepared: false,
+				result: {
+					verified: false,
+					reason: {
+						type: "invalidProof",
+						proofIndex
+					}
 				}
 			};
 		}
@@ -1830,18 +1751,24 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 	for (let proofIndex = 0; proofIndex < proofs.length; proofIndex++) {
 		const verificationMethod = proofs[proofIndex].verificationMethodId;
 		if (verificationMethod == null) return {
-			verified: false,
-			reason: {
-				type: "invalidProof",
-				proofIndex
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "invalidProof",
+					proofIndex
+				}
 			}
 		};
 		if (verificationMethod.protocol !== "did:") return {
-			verified: false,
-			reason: {
-				type: "unsupportedVerificationMethod",
-				proofIndex,
-				verificationMethod
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "unsupportedVerificationMethod",
+					proofIndex,
+					verificationMethod
+				}
 			}
 		};
 		try {
@@ -1849,24 +1776,89 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 		} catch (error) {
 			if (!(error instanceof TypeError)) throw error;
 			return {
+				prepared: false,
+				result: {
+					verified: false,
+					reason: {
+						type: "unsupportedVerificationMethod",
+						proofIndex,
+						verificationMethod
+					}
+				}
+			};
+		}
+		if (!haveSameFe34Origin(objectId, verificationMethod)) return {
+			prepared: false,
+			result: {
 				verified: false,
 				reason: {
-					type: "unsupportedVerificationMethod",
+					type: "verificationMethodMismatch",
 					proofIndex,
+					objectId,
 					verificationMethod
 				}
-			};
-		}
-		if (!haveSameFe34Origin(objectId, verificationMethod)) return {
-			verified: false,
-			reason: {
-				type: "verificationMethodMismatch",
-				proofIndex,
-				objectId,
-				verificationMethod
 			}
 		};
 	}
+	return {
+		prepared: true,
+		objectId,
+		proofs,
+		rawProofValues,
+		proofContextLoader
+	};
+}
+/**
+* Applies portable-object proof policy to one map-local cryptographic result.
+*
+* @internal
+*/
+async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
+	const policyOptions = {
+		...options,
+		contextLoader: preloadedOnlyDocumentLoader
+	};
+	const prepared = await preparePortableObjectProof(jsonLd, policyOptions);
+	if (!prepared.prepared) return prepared.result;
+	const policyProof = prepared.proofs[0];
+	const literalProof = isJsonLdNode(jsonLd) && isJsonLdNode(jsonLd.proof) ? (await parseRawProofCandidates(jsonLd, [jsonLd.proof], policyOptions, prepared.proofContextLoader))[0]?.proof : null;
+	const verificationMethod = policyProof?.verificationMethodId;
+	if (prepared.proofs.length !== 1 || key == null || policyProof == null || literalProof == null || !sameProof(policyProof, literalProof) || verificationMethod == null || key.id?.href !== verificationMethod.href) return {
+		verified: false,
+		reason: {
+			type: "invalidProof",
+			proofIndex: prepared.proofs.length > 1 ? 1 : 0
+		}
+	};
+	return {
+		verified: true,
+		keys: [key],
+		objectId: formatIri(prepared.objectId)
+	};
+}
+/**
+* Verifies the FEP-ef61 Object Integrity Proof policy for a portable object.
+*
+* This applies the FEP-2277 core-type classification to the top-level JSON-LD
+* node.  Portable actors, activities, and objects require proofs.  A portable
+* collection without a proof is reported separately so a caller can apply a
+* gateway trust policy.  Embedded portable objects are not traversed.
+*
+* Every proof must use a DID URL whose DID matches the portable object's
+* authority, and every proof must pass {@link verifyProof}.
+*
+* @param jsonLd The JSON-LD document to verify.
+* @param options Additional options.  See also
+*                {@link VerifyPortableObjectProofOptions}.
+* @returns The detailed portable proof-policy result.
+* @throws {TypeError} If the input is not a single JSON-LD object or has a
+*                     malformed portable ID.
+* @since 2.4.0
+*/
+async function verifyPortableObjectProof(jsonLd, options = {}) {
+	const prepared = await preparePortableObjectProof(jsonLd, options);
+	if (!prepared.prepared) return prepared.result;
+	const { proofs, rawProofValues, proofContextLoader } = prepared;
 	const keys = [];
 	const rawProofCandidatePool = {
 		candidates: await parseRawProofCandidates(jsonLd, rawProofValues, options, proofContextLoader),
@@ -1882,7 +1874,7 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 				proofIndex
 			}
 		};
-		const key = await verifyProofWithMessageDigestCache(jsonLd, proofs[proofIndex], options, messageDigestCache, rawProofCandidate);
+		const key = await verifyProofWithMessageDigestCache(jsonLd, proofs[proofIndex], options, messageDigestCache, rawProofCandidate, true);
 		if (key == null) return {
 			verified: false,
 			reason: {
@@ -1985,4 +1977,169 @@ function hasCryptographicOrigin(iri) {
 	return /^did:/i.test(iri) || /^ap(?:\+ef61)?:\/\//i.test(iri);
 }
 //#endregion
-export { verifyJsonLd as C, verifyCompactJsonLd as S, wrapContextLoaderForJsonLd as T, hasSignature as _, verifyPortableObjectProof as a, isInvalidUrlTypeError as b, doesActorOwnKey as c, assertSafeJsonLd as d, attachSignature as f, getNormalizationContextLoader as g, detachSignature as h, verifyObject as i, getKeyOwner as l, createSignature as m, hasProofLike as n, verifyProof as o, compactJsonLd as p, signObject as r, normalizeOutgoingActivityJsonLd as s, createProof as t, InvalidContextReferenceError as u, hasSignatureLike as v, verifySignature as w, signJsonLd as x, isClearlyMalformedContextReference as y };
+//#region src/sig/owner.ts
+const logger = getLogger([
+	"fedify",
+	"sig",
+	"owner"
+]);
+/**
+* Checks if the actor of the given activity owns the specified key.
+*
+* Ownership is never taken from what the activity or the key say about
+* themselves, as both are written by whoever sent the activity.  It is
+* established from a document that the owner itself serves: either the key's
+* claimed owner links back to the key, or the actor the activity claims lists
+* the key as its own.
+*
+* @param activity The activity to check.
+* @param key The public key to check.
+* @param options Options for checking the key ownership.
+* @returns Whether the actor is the owner of the key.
+*/
+async function doesActorOwnKey(activity, key, options) {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("activitypub.verify_key_ownership", {
+		kind: SpanKind.INTERNAL,
+		attributes: {
+			"activitypub.actor.id": activity.actorId?.href ?? "",
+			"activitypub.key.id": key.id?.href ?? ""
+		}
+	}, async (span) => {
+		try {
+			const actorId = activity.actorId;
+			if (actorId == null) {
+				span.setAttribute("activitypub.key_ownership.verified", false);
+				span.setAttribute("activitypub.key_ownership.method", "none");
+				return false;
+			}
+			if (key.ownerId != null) {
+				const owner = await verifyKeyOwnership(key, options);
+				if (owner?.id != null && owner.id.href === actorId.href) {
+					span.setAttribute("activitypub.key_ownership.verified", true);
+					span.setAttribute("activitypub.key_ownership.method", "key_owner");
+					return true;
+				}
+			}
+			const actor = await fetchActorDocument(actorId, options);
+			if (actor != null && await doesActorListKey(actor, key, options)) {
+				span.setAttribute("activitypub.key_ownership.verified", true);
+				span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
+				return true;
+			}
+			logger.debug("The actor {actorId} does not own key {keyId}: neither the owner the key claims nor the actor's own document links the two to each other.", {
+				actorId: actorId.href,
+				keyId: key.id?.href
+			});
+			span.setAttribute("activitypub.key_ownership.verified", false);
+			span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
+			return false;
+		} catch (error) {
+			span.recordException(error);
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
+/**
+* Determines whether the given actor's own document lists the given key among
+* its public keys.
+*
+* Keys are matched by id, which is what an actor document links to.  A key
+* document may leave its id implicit, though, and then there is no id for the
+* actor to link to; the key material itself is the only thing the two can
+* have in common, so that is what gets compared.
+*/
+async function doesActorListKey(actor, key, options) {
+	if (key.id != null) {
+		for (const publicKeyId of actor.publicKeyIds) if (publicKeyId.href === key.id.href) return true;
+		return false;
+	}
+	if (key.publicKey == null) return false;
+	const publicKeys = actor.getPublicKeys({
+		...options,
+		suppressError: true
+	});
+	for await (const publicKey of publicKeys) {
+		if (publicKey.publicKey == null) continue;
+		if (await isSamePublicKey(publicKey.publicKey, key.publicKey)) return true;
+	}
+	return false;
+}
+/**
+* Compares two public keys by their key material, ignoring the metadata that
+* surrounds it.
+*/
+async function isSamePublicKey(a, b) {
+	const [x, y] = await Promise.all([exportJwk(a), exportJwk(b)]);
+	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
+}
+/**
+* Gets the actor that owns the specified key.  Returns `null` if the key has no
+* known owner.
+*
+* The owner is only returned when the key and the owner link to each other:
+* a document that merely claims to own a key is not enough, as the claim and
+* the key can come from the same host.
+*
+* @param keyId The ID of the key to check, or the key itself.
+* @param options Options for getting the key owner.
+* @returns The actor that owns the key, or `null` if the key has no known
+*          owner.
+* @since 0.7.0
+*/
+async function getKeyOwner(keyId, options) {
+	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const fetchOptions = {
+		documentLoader,
+		contextLoader: options.contextLoader ?? getDocumentLoader(),
+		tracerProvider
+	};
+	if (keyId instanceof CryptographicKey) return await verifyKeyOwnership(keyId, fetchOptions);
+	let keyDoc;
+	let documentUrl = keyId;
+	try {
+		const remoteDocument = await documentLoader(keyId.href);
+		keyDoc = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", keyId);
+	} catch (_) {
+		return null;
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(keyDoc, {
+			...fetchOptions,
+			baseUrl: documentUrl
+		});
+	} catch (e) {
+		if (!(e instanceof TypeError)) throw e;
+		try {
+			object = await CryptographicKey.fromJsonLd(keyDoc, fetchOptions);
+		} catch (e) {
+			if (e instanceof TypeError) return null;
+			throw e;
+		}
+	}
+	if (object instanceof CryptographicKey) {
+		if (object.id != null && object.id.href !== keyId.href) return null;
+		return await verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
+	}
+	if (!isActor(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href,
+			keyId: keyId.href
+		});
+		return null;
+	}
+	for (const kid of object.publicKeyIds) if (kid.href === keyId.href) return object;
+	return null;
+}
+//#endregion
+export { verifyCompactJsonLd as C, normalizeOutgoingActivityJsonLd as D, wrapContextLoaderForJsonLd as E, signJsonLd as S, verifySignature as T, getNormalizationContextLoader as _, signObject as a, isClearlyMalformedContextReference as b, verifyPortableObjectProof as c, InvalidContextReferenceError as d, assertSafeJsonLd as f, detachSignature as g, createSignature as h, hasProofLike as i, verifyPortableObjectProofPolicy as l, compactJsonLd as m, getKeyOwner as n, verifyMapLocalProof as o, attachSignature as p, createProof as r, verifyObject as s, doesActorOwnKey as t, verifyProof as u, hasSignature as v, verifyJsonLd as w, isInvalidUrlTypeError as x, hasSignatureLike as y };