@fedify/fedify 2.4.0-dev.1964 → 2.4.0-dev.1995

package/dist/{key-BVjgbs_9.mjs → key-Ccs8cnd7.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CtG93ohj.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-B9N27cCB.mjs";
+import { n as version, t as name } from "./deno-CABhzCb_.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-CISXCvB1.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
@@ -86,6 +86,118 @@ async function importJwk(jwk, type) {
 	validateCryptoKey(key, type);
 	return key;
 }
+/**
+* Fetches the document that the given actor URI dereferences to, and returns
+* the actor only if the host that served the document is authoritative for
+* the id the document claims.
+*
+* Only the origin that serves an actor id can speak for it.  Without that
+* rule any host could serve a document describing somebody else's actor—and
+* listing its own keys as that actor's.
+*
+* @param actorId The URI of the actor to fetch.
+* @param options Options for fetching the document.
+* @returns The actor, or `null` if the document cannot be fetched, is not an
+*          actor, or belongs to another origin.
+* @internal
+*/
+async function fetchActorDocument(actorId, options = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	const { tracerProvider } = options;
+	let document;
+	let documentUrl = actorId;
+	try {
+		const remoteDocument = await documentLoader(actorId.href);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", actorId);
+	} catch (error) {
+		logger.debug("Failed to fetch the actor {actorId}: {error}", {
+			actorId: actorId.href,
+			error
+		});
+		return null;
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider,
+			baseUrl: documentUrl
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+			documentUrl: documentUrl.href,
+			error
+		});
+		return null;
+	}
+	if (!isActor(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
+	return object;
+}
+/**
+* Resolves the owner that the given key claims, and returns it only if the
+* claim holds.
+*
+* The `owner` of a {@link CryptographicKey}, like the `controller` of
+* a {@link Multikey}, proves nothing on its own: the key document and the
+* claim inside it are served by the same host, so anyone able to serve a key
+* document can name any actor in the world as its owner.  The claim becomes
+* meaningful only once the named actor's own document is fetched and turns
+* out to link back to the key.  This function performs that mutual-link
+* check, which is the only sound way to learn a fetched key's owner.
+*
+* The claimed owner is always dereferenced, never read out of the key
+* document: an owner embedded there is written by whoever wrote the key.
+*
+* @param key The key whose ownership claim is to be verified.  It must carry
+*            an `id`, as that is what the owner has to link back to.
+* @param options Options for fetching the claimed owner.
+* @returns The verified owner, or `null` if the key claims no owner, the
+*          owner cannot be fetched, or the owner does not link back to
+*          the key.
+* @internal
+*/
+async function verifyKeyOwnership(key, options = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const keyId = key.id;
+	if (keyId == null) return null;
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (claimedOwnerId == null) return null;
+	const owner = await fetchActorDocument(claimedOwnerId, options);
+	if (owner == null) {
+		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
+			keyId: keyId.href,
+			claimedOwnerId: claimedOwnerId.href
+		});
+		return null;
+	}
+	const linkedKeyIds = key instanceof CryptographicKey ? owner.publicKeyIds : owner.assertionMethodIds;
+	for (const linkedKeyId of linkedKeyIds) if (linkedKeyId.href === keyId.href) return owner;
+	logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims does not list the key as its own.", {
+		keyId: keyId.href,
+		claimedOwnerId: claimedOwnerId.href
+	});
+	return null;
+}
 async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 	tracerProvider ??= trace.getTracerProvider();
 	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
@@ -219,6 +331,18 @@ function checkCachedKeyHit(cachedKey, keyId, cls, logger) {
 async function clearFetchErrorMetadata(keyId, keyCache) {
 	await keyCache?.setFetchError?.(keyId, null);
 }
+/**
+* Returns the identifier a fragment-bearing DID URL is a fragment of, or
+* `null` if the URL is not a DID URL.  `did:web:example.com#key` is thereby
+* traced back to `did:web:example.com`, the DID that resolving the key went
+* through in the first place.
+*/
+function stripFragment(keyId) {
+	if (keyId.protocol !== "did:") return null;
+	const did = new URL(keyId.href);
+	did.hash = "";
+	return did;
+}
 function isDidKeyUrl(keyId) {
 	return keyId.protocol === "did:" && keyId.pathname.startsWith("key:");
 }
@@ -274,7 +398,7 @@ async function resolveDidKey(cacheKey, cls, keyCache, logger) {
 		cached: false
 	};
 }
-async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller }, logger) {
 	let object;
 	try {
 		object = await Object$1.fromJsonLd(document, {
@@ -304,8 +428,22 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 		}
 	}
 	let key = null;
-	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object;
+	let ownerDocument = null;
+	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
 	else if (isActor(object)) {
+		if (object.id == null || object.id.origin !== documentUrl.origin) {
+			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
+				keyId,
+				documentUrl: documentUrl.href,
+				actorId: object.id?.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		ownerDocument = object;
 		const keys = cls === CryptographicKey ? object.getPublicKeys({
 			documentLoader,
 			contextLoader,
@@ -367,6 +505,27 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 			cached: false
 		};
 	}
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (!(keyIdBoundByCaller && claimedOwnerId != null && claimedOwnerId.href === stripFragment(cacheKey)?.href)) {
+		if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
+		else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
+			if (await verifyKeyOwnership(key, {
+				documentLoader,
+				contextLoader,
+				tracerProvider
+			}) == null) {
+				logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
+					keyId,
+					claimedOwnerId: claimedOwnerId.href
+				});
+				await keyCache?.set(cacheKey, null);
+				return {
+					key: null,
+					cached: false
+				};
+			}
+		}
+	}
 	if (keyCache != null) {
 		await keyCache.set(cacheKey, key);
 		logger.debug("Key {keyId} cached.", { keyId });
@@ -405,15 +564,18 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 		}
 		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 		let document;
+		let documentUrl = cacheKey;
 		try {
-			document = (await (options.documentLoader ?? getDocumentLoader())(keyId)).document;
+			const remoteDocument = await (options.documentLoader ?? getDocumentLoader())(keyId);
+			document = remoteDocument.document;
+			documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
 		} catch (error) {
 			const classified = classifyFetchError(error);
 			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
 			outcome = classified;
 			return errored;
 		}
-		const resolved = await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
+		const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
 		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
 		return resolved;
 	} finally {
@@ -450,4 +612,4 @@ async function fetchKeyInternal(keyId, cls, options = {}) {
 	});
 }
 //#endregion
-export { importJwk as a, generateCryptoKeyPair as i, fetchKey as n, validateCryptoKey as o, fetchKeyDetailed as r, exportJwk as t };
+export { generateCryptoKeyPair as a, verifyKeyOwnership as c, fetchKeyDetailed as i, fetchActorDocument as n, importJwk as o, fetchKey as r, validateCryptoKey as s, exportJwk as t };

package/dist/{keycache-ZLqIfrkL.mjs → keycache-BUDHB5rY.mjs}

@@ -3,6 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 //#region src/federation/keycache.ts
+const KEY_CACHE_GENERATION = "2";
 var KvKeyCache = class {
 	kv;
 	prefix;
@@ -25,13 +26,20 @@ var KvKeyCache = class {
 			keyId.href
 		];
 	}
+	#entryKey(keyId) {
+		return [
+			...this.prefix,
+			KEY_CACHE_GENERATION,
+			keyId.href
+		];
+	}
 	async get(keyId) {
 		const negativeExpiration = this.nullKeys.get(keyId.href);
 		if (negativeExpiration != null) {
 			if (Temporal.Now.instant().until(negativeExpiration).sign >= 0) return null;
 			this.nullKeys.delete(keyId.href);
 		}
-		const serialized = await this.kv.get([...this.prefix, keyId.href]);
+		const serialized = await this.kv.get(this.#entryKey(keyId));
 		if (serialized === void 0) return void 0;
 		if (serialized === null) {
 			this.nullKeys.set(keyId.href, Temporal.Now.instant().add(this.unavailableKeyTtl));
@@ -43,7 +51,7 @@ var KvKeyCache = class {
 			try {
 				return await Multikey.fromJsonLd(serialized, this.options);
 			} catch {
-				await this.kv.delete([...this.prefix, keyId.href]);
+				await this.kv.delete(this.#entryKey(keyId));
 				return;
 			}
 		}
@@ -51,12 +59,12 @@ var KvKeyCache = class {
 	async set(keyId, key) {
 		if (key == null) {
 			this.nullKeys.set(keyId.href, Temporal.Now.instant().add(this.unavailableKeyTtl));
-			await this.kv.set([...this.prefix, keyId.href], null, { ttl: this.unavailableKeyTtl });
+			await this.kv.set(this.#entryKey(keyId), null, { ttl: this.unavailableKeyTtl });
 			return;
 		}
 		this.nullKeys.delete(keyId.href);
 		const serialized = await key.toJsonLd(this.options);
-		await this.kv.set([...this.prefix, keyId.href], serialized, { ttl: this.keyTtl });
+		await this.kv.set(this.#entryKey(keyId), serialized, { ttl: this.keyTtl });
 	}
 	async getFetchError(keyId) {
 		const cached = await this.kv.get(this.#getFetchErrorKey(keyId));

package/dist/{kv-cache-DtsjH_bY.cjs → kv-cache-DXT9vmIg.cjs}

@@ -1,8 +1,8 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-B3skRvGo.cjs");
+const require_http = require("./http-CRFns-UE.cjs");
 let _logtape_logtape = require("@logtape/logtape");
-let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let es_toolkit = require("es-toolkit");
 //#region src/utils/docloader.ts
 const logger$1 = (0, _logtape_logtape.getLogger)([
 	"fedify",

package/dist/{kv-cache-tGNbvDCF.js → kv-cache-DtmXhPXG.js}

@@ -1,9 +1,9 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { C as recordDocumentCache, d as validateCryptoKey, t as doubleKnock } from "./http-Dj4s1UQ0.js";
+import { T as recordDocumentCache, f as validateCryptoKey, t as doubleKnock } from "./http-9WyuldYh.js";
 import { getLogger } from "@logtape/logtape";
-import { curry } from "es-toolkit";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
+import { curry } from "es-toolkit";
 //#region src/utils/docloader.ts
 const logger$1 = getLogger([
 	"fedify",

package/dist/{kv-cache-xRcC_xxP.mjs → kv-cache-lKyFn_Dn.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-B9N27cCB.mjs";
+import { p as recordDocumentCache } from "./metrics-CISXCvB1.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{ld-OuCeQFny.mjs → ld-qup__MAW.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CtG93ohj.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B9N27cCB.mjs";
-import { n as fetchKey, o as validateCryptoKey } from "./key-BVjgbs_9.mjs";
+import { n as version, t as name } from "./deno-CABhzCb_.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CISXCvB1.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-Ccs8cnd7.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/map-local-context-conflict-DOYEEJ3u.mjs

@@ -0,0 +1,204 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+//#region test-vectors/fep-8b32/map-local-context-conflict.json
+var map_local_context_conflict_default = {
+	id: "fedify-fep-8b32-map-local-context-conflict-v1",
+	profile: "Fedify map-local compound proof profile",
+	cryptosuite: "eddsa-jcs-2022",
+	notes: [
+		"The parent sets a default language that the child's local context does not reset.",
+		"The inner proof authenticates the extracted standalone child JSON map.",
+		"The outer proof authenticates the complete compound JSON snapshot.",
+		"Both proofs can be valid even though standalone and in-parent JSON-LD expansions differ."
+	],
+	keys: {
+		"outer": {
+			"controller": "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+			"verificationMethod": "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2#z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+			"publicKeyMultibase": "z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+			"publicKeyJwk": {
+				"kty": "OKP",
+				"crv": "Ed25519",
+				"x": "sA2Nk45_dz1RVlqtNqYj9TRPf10ZYPnPPo4SYg6igQ8",
+				"key_ops": ["verify"],
+				"ext": true
+			},
+			"testPrivateKeyJwk": {
+				"kty": "OKP",
+				"crv": "Ed25519",
+				"d": "yW756hDF5BTEcXI6_53nLDX6W3D66X6IMuysfS4rjtY",
+				"x": "sA2Nk45_dz1RVlqtNqYj9TRPf10ZYPnPPo4SYg6igQ8",
+				"key_ops": ["sign"],
+				"ext": true
+			}
+		},
+		"inner": {
+			"controller": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"publicKeyMultibase": "z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"publicKeyJwk": {
+				"kty": "OKP",
+				"crv": "Ed25519",
+				"x": "LR8epAGDe-cVq5p2Tx49CCfphpk1rNhkNoY9i-XEUfg",
+				"key_ops": ["verify"],
+				"ext": true
+			},
+			"testPrivateKeyJwk": {
+				"kty": "OKP",
+				"crv": "Ed25519",
+				"d": "LledL195fP9TQGQrkE2l2Y2k48UvqCzYI9M1zXyh7zQ",
+				"x": "LR8epAGDe-cVq5p2Tx49CCfphpk1rNhkNoY9i-XEUfg",
+				"key_ops": ["sign"],
+				"ext": true
+			}
+		}
+	},
+	documents: {
+		"finalSecuredCompound": {
+			"@context": [
+				"https://www.w3.org/ns/activitystreams",
+				"https://w3id.org/security/data-integrity/v1",
+				{ "@language": "en" }
+			],
+			"id": "ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/activities/context-conflict",
+			"type": "Create",
+			"actor": "ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/actor",
+			"object": {
+				"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+				"id": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/context-conflict",
+				"type": "Note",
+				"attributedTo": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor",
+				"content": "A portable note with inherited language",
+				"proof": {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+					"type": "DataIntegrityProof",
+					"cryptosuite": "eddsa-jcs-2022",
+					"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+					"proofPurpose": "assertionMethod",
+					"created": "2023-02-24T23:36:38Z",
+					"proofValue": "z3arp9jZdt6kcLacoXxx5kb6QVM8GZFXD13nEisfna52uwMprZz2yJCXsbyMBvvBKZopCCNRq3o22UqYgudLum5eM"
+				}
+			},
+			"proof": {
+				"@context": [
+					"https://www.w3.org/ns/activitystreams",
+					"https://w3id.org/security/data-integrity/v1",
+					{ "@language": "en" }
+				],
+				"type": "DataIntegrityProof",
+				"cryptosuite": "eddsa-jcs-2022",
+				"verificationMethod": "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2#z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+				"proofPurpose": "assertionMethod",
+				"created": "2023-02-24T23:36:38Z",
+				"proofValue": "z33BeAxXEtbCKnt9mKodwoJFSDKqK2Q2zMrWN36TtpFhDn9K9FFX7rvyfY2jkFh8gcUo3iQvUutzqBKXZdsyKZAEz"
+			}
+		},
+		"securedInner": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"id": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/context-conflict",
+			"type": "Note",
+			"attributedTo": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor",
+			"content": "A portable note with inherited language",
+			"proof": {
+				"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+				"type": "DataIntegrityProof",
+				"cryptosuite": "eddsa-jcs-2022",
+				"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+				"proofPurpose": "assertionMethod",
+				"created": "2023-02-24T23:36:38Z",
+				"proofValue": "z3arp9jZdt6kcLacoXxx5kb6QVM8GZFXD13nEisfna52uwMprZz2yJCXsbyMBvvBKZopCCNRq3o22UqYgudLum5eM"
+			}
+		},
+		"outerUnsecuredDocument": {
+			"@context": [
+				"https://www.w3.org/ns/activitystreams",
+				"https://w3id.org/security/data-integrity/v1",
+				{ "@language": "en" }
+			],
+			"id": "ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/activities/context-conflict",
+			"type": "Create",
+			"actor": "ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/actor",
+			"object": {
+				"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+				"id": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/context-conflict",
+				"type": "Note",
+				"attributedTo": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor",
+				"content": "A portable note with inherited language",
+				"proof": {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+					"type": "DataIntegrityProof",
+					"cryptosuite": "eddsa-jcs-2022",
+					"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+					"proofPurpose": "assertionMethod",
+					"created": "2023-02-24T23:36:38Z",
+					"proofValue": "z3arp9jZdt6kcLacoXxx5kb6QVM8GZFXD13nEisfna52uwMprZz2yJCXsbyMBvvBKZopCCNRq3o22UqYgudLum5eM"
+				}
+			}
+		},
+		"innerUnsecuredDocument": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"id": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/context-conflict",
+			"type": "Note",
+			"attributedTo": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor",
+			"content": "A portable note with inherited language"
+		},
+		"outerProofConfiguration": {
+			"@context": [
+				"https://www.w3.org/ns/activitystreams",
+				"https://w3id.org/security/data-integrity/v1",
+				{ "@language": "en" }
+			],
+			"type": "DataIntegrityProof",
+			"cryptosuite": "eddsa-jcs-2022",
+			"verificationMethod": "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2#z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+			"proofPurpose": "assertionMethod",
+			"created": "2023-02-24T23:36:38Z"
+		},
+		"innerProofConfiguration": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"type": "DataIntegrityProof",
+			"cryptosuite": "eddsa-jcs-2022",
+			"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"proofPurpose": "assertionMethod",
+			"created": "2023-02-24T23:36:38Z"
+		}
+	},
+	canonicalization: {
+		"outer": {
+			"documentJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\",{\"@language\":\"en\"}],\"actor\":\"ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/actor\",\"id\":\"ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/activities/context-conflict\",\"object\":{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"attributedTo\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor\",\"content\":\"A portable note with inherited language\",\"id\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/context-conflict\",\"proof\":{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"created\":\"2023-02-24T23:36:38Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"proofValue\":\"z3arp9jZdt6kcLacoXxx5kb6QVM8GZFXD13nEisfna52uwMprZz2yJCXsbyMBvvBKZopCCNRq3o22UqYgudLum5eM\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3\"},\"type\":\"Note\"},\"type\":\"Create\"}",
+			"proofConfigurationJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\",{\"@language\":\"en\"}],\"created\":\"2023-02-24T23:36:38Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2#z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2\"}"
+		},
+		"inner": {
+			"documentJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"attributedTo\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor\",\"content\":\"A portable note with inherited language\",\"id\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/context-conflict\",\"type\":\"Note\"}",
+			"proofConfigurationJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"created\":\"2023-02-24T23:36:38Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3\"}"
+		}
+	},
+	hashes: {
+		"outer": {
+			"documentSha256": "7b0a0d3668e43492c8c54cb98d0227a1bf0aefd11da7adb48af6e31f6d5322df",
+			"proofConfigurationSha256": "94b98e0a2519065217496bad2936e6e892bfe12ccb176282ec274ce8eb98a6a3",
+			"combinedSigningInput": "94b98e0a2519065217496bad2936e6e892bfe12ccb176282ec274ce8eb98a6a37b0a0d3668e43492c8c54cb98d0227a1bf0aefd11da7adb48af6e31f6d5322df"
+		},
+		"inner": {
+			"documentSha256": "3772e3a906c7b49d195345b05d73c3156bb3d61a5d1c641d64f4f03d661f7eeb",
+			"proofConfigurationSha256": "1ebdc71cb480bd324b030f85c02dc6f8db879716faf0f7ee0f05df4c395d71b4",
+			"combinedSigningInput": "1ebdc71cb480bd324b030f85c02dc6f8db879716faf0f7ee0f05df4c395d71b43772e3a906c7b49d195345b05d73c3156bb3d61a5d1c641d64f4f03d661f7eeb"
+		}
+	},
+	proofValues: {
+		"outer": "z33BeAxXEtbCKnt9mKodwoJFSDKqK2Q2zMrWN36TtpFhDn9K9FFX7rvyfY2jkFh8gcUo3iQvUutzqBKXZdsyKZAEz",
+		"inner": "z3arp9jZdt6kcLacoXxx5kb6QVM8GZFXD13nEisfna52uwMprZz2yJCXsbyMBvvBKZopCCNRq3o22UqYgudLum5eM"
+	},
+	expectedVerification: { "original": {
+		"inner": true,
+		"outer": true
+	} },
+	expectedInterpretation: {
+		"standaloneAndInParentExpansionsEqual": false,
+		"standaloneContentLanguage": null,
+		"inParentContentLanguage": "en"
+	}
+};
+//#endregion
+export { map_local_context_conflict_default as t };