@fedify/fedify 2.4.0-dev.1988 → 2.4.0-dev.1995

package/dist/{proof-DL8Iid3a.mjs → proof-BDxNVZ3E.mjs}

@@ -1,12 +1,12 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BgMEefEr.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CrqsHP0l.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-Cwbg5ggV.mjs";
+import { n as version, t as name } from "./deno-CABhzCb_.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CISXCvB1.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-Ccs8cnd7.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience-Cc2YJ3ip.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-B5Ne7JoL.mjs";
-import { c as getNormalizationContextLoader } from "./ld-CzhdWyTt.mjs";
+import { c as getNormalizationContextLoader } from "./ld-qup__MAW.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -164,6 +164,30 @@ async function signObject(object, privateKey, keyId, options = {}) {
 async function verifyProof(jsonLd, proof, options = {}) {
 	return await verifyProofWithMessageDigestCache(jsonLd, proof, options);
 }
+/**
+* Verifies the one direct literal proof on a map-local secured document.
+*
+* Unlike {@link verifyProof}, this removes only the literal `proof` member
+* from the message digest.  JSON-LD aliases remain part of the signed input,
+* and the document's received `@context` is not replaced by the proof
+* configuration context.
+*
+* @internal
+*/
+async function verifyMapLocalProof(jsonLd, options = {}) {
+	if (!isJsonLdNode(jsonLd) || !globalThis.Object.hasOwn(jsonLd, "proof") || !isJsonLdNode(jsonLd.proof)) return null;
+	const proofContextLoader = getNormalizationContextLoader(preloadedOnlyDocumentLoader);
+	try {
+		const [candidate] = await parseRawProofCandidates(jsonLd, [jsonLd.proof], options, proofContextLoader);
+		if (candidate.proof == null) return null;
+		return await verifyProofWithMessageDigestCache(jsonLd, candidate.proof, options, {
+			proofContextLoader,
+			proofPropertyMode: "literal"
+		}, candidate);
+	} catch {
+		return null;
+	}
+}
 async function verifyProofWithMessageDigestCache(jsonLd, proof, options, messageDigestCache = {}, rawProofCandidate, keyIdBoundByCaller = false) {
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.verify", async (span) => {
 		const start = performance.now();
@@ -234,10 +258,11 @@ async function getJsonLdPropertyNames(jsonLd, propertyIri, defaults, documentLoa
 async function getProofPropertyNames(jsonLd, documentLoader = preloadedOnlyDocumentLoader) {
 	return await getJsonLdPropertyNames(jsonLd, SECURITY_PROOF, ["proof", SECURITY_PROOF], documentLoader) ?? /* @__PURE__ */ new Set(["proof", SECURITY_PROOF]);
 }
-async function createProofMessageDigests(jsonLd, proofContextLoader, context) {
+async function createProofMessageDigests(jsonLd, proofContextLoader, context, proofPropertyMode = "jsonLd") {
 	const msg = { ...jsonLd };
-	for (const property of await getProofPropertyNames(msg, proofContextLoader)) delete msg[property];
-	if (context != null) msg["@context"] = structuredClone(context);
+	if (proofPropertyMode === "literal") delete msg.proof;
+	else for (const property of await getProofPropertyNames(msg, proofContextLoader)) delete msg[property];
+	if (proofPropertyMode === "jsonLd" && context != null) msg["@context"] = structuredClone(context);
 	const encoder = new TextEncoder();
 	const digest = async (value) => {
 		const bytes = encoder.encode(serialize(value));
@@ -554,13 +579,15 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 	const messageDigestValues = messageDigestCache.values ??= /* @__PURE__ */ new Map();
 	let messageDigestsPromise = messageDigestValues.get(messageDigestKey);
 	if (messageDigestsPromise == null) {
-		messageDigestsPromise = createProofMessageDigests(jsonLd, messageDigestCache.proofContextLoader, proofConfiguration.context);
+		messageDigestsPromise = createProofMessageDigests(jsonLd, messageDigestCache.proofContextLoader, proofConfiguration.context, messageDigestCache.proofPropertyMode);
 		messageDigestValues.set(messageDigestKey, messageDigestsPromise);
 	}
 	const messageDigests = await messageDigestsPromise;
 	if (await verifyCandidate(messageDigests.onWire)) return publicKey;
-	const normalizedDigest = await messageDigests.normalized();
-	if (normalizedDigest != null && await verifyCandidate(normalizedDigest)) return publicKey;
+	if (messageDigestCache.proofPropertyMode !== "literal") {
+		const normalizedDigest = await messageDigests.normalized();
+		if (normalizedDigest != null && await verifyCandidate(normalizedDigest)) return publicKey;
+	}
 	if (fetchedKey.cached) {
 		logger.debug("Failed to verify the proof with the cached key {keyId}; retrying with the freshly fetched key...", {
 			keyId: proof.verificationMethodId.href,
@@ -652,59 +679,55 @@ async function expandPortableObjectRoot(jsonLd, contextLoader) {
 		}
 	};
 }
-/**
-* Verifies the FEP-ef61 Object Integrity Proof policy for a portable object.
-*
-* This applies the FEP-2277 core-type classification to the top-level JSON-LD
-* node.  Portable actors, activities, and objects require proofs.  A portable
-* collection without a proof is reported separately so a caller can apply a
-* gateway trust policy.  Embedded portable objects are not traversed.
-*
-* Every proof must use a DID URL whose DID matches the portable object's
-* authority, and every proof must pass {@link verifyProof}.
-*
-* @param jsonLd The JSON-LD document to verify.
-* @param options Additional options.  See also
-*                {@link VerifyPortableObjectProofOptions}.
-* @returns The detailed portable proof-policy result.
-* @throws {TypeError} If the input is not a single JSON-LD object or has a
-*                     malformed portable ID.
-* @since 2.4.0
-*/
-async function verifyPortableObjectProof(jsonLd, options = {}) {
+async function preparePortableObjectProof(jsonLd, options) {
 	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !PORTABLE_OBJECT_ID_PATTERN.test(jsonLd["@id"])) return {
-		verified: false,
-		reason: { type: "notPortableObject" }
+		prepared: false,
+		result: {
+			verified: false,
+			reason: { type: "notPortableObject" }
+		}
 	};
 	const { root, proofContextLoader } = await expandPortableObjectRoot(jsonLd, options.contextLoader);
 	const id = root["@id"];
 	if (typeof id !== "string" || !PORTABLE_OBJECT_ID_PATTERN.test(id)) return {
-		verified: false,
-		reason: { type: "notPortableObject" }
+		prepared: false,
+		result: {
+			verified: false,
+			reason: { type: "notPortableObject" }
+		}
 	};
 	const objectId = parseIri(id);
 	getFe34Origin(objectId);
 	const objectType = classifyFep2277CoreType(root);
 	if (objectType === "verificationMethod" || objectType === "publicKey" || objectType === "link") return {
-		verified: false,
-		reason: {
-			type: "unsupportedObjectType",
-			objectType
+		prepared: false,
+		result: {
+			verified: false,
+			reason: {
+				type: "unsupportedObjectType",
+				objectType
+			}
 		}
 	};
 	const proofValues = root[SECURITY_PROOF];
-	if (proofValues == null || Array.isArray(proofValues) && proofValues.length < 1) return objectType === "collection" ? {
-		verified: false,
-		reason: { type: "unsecuredCollection" }
-	} : {
-		verified: false,
-		reason: { type: "missingProof" }
+	if (proofValues == null || Array.isArray(proofValues) && proofValues.length < 1) return {
+		prepared: false,
+		result: objectType === "collection" ? {
+			verified: false,
+			reason: { type: "unsecuredCollection" }
+		} : {
+			verified: false,
+			reason: { type: "missingProof" }
+		}
 	};
 	if (!Array.isArray(proofValues)) return {
-		verified: false,
-		reason: {
-			type: "invalidProof",
-			proofIndex: 0
+		prepared: false,
+		result: {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex: 0
+			}
 		}
 	};
 	const rawProofValues = isJsonLdNode(jsonLd) ? await getRawProofValues(jsonLd, proofContextLoader) : [];
@@ -712,10 +735,13 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 	for (let proofIndex = 0; proofIndex < proofValues.length; proofIndex++) {
 		const proofValue = proofValues[proofIndex];
 		if (!hasValidPortableProofShape(proofValue)) return {
-			verified: false,
-			reason: {
-				type: "invalidProof",
-				proofIndex
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "invalidProof",
+					proofIndex
+				}
 			}
 		};
 		let proof;
@@ -723,10 +749,13 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 			proof = await DataIntegrityProof.fromJsonLd(proofValue, options);
 		} catch {
 			return {
-				verified: false,
-				reason: {
-					type: "invalidProof",
-					proofIndex
+				prepared: false,
+				result: {
+					verified: false,
+					reason: {
+						type: "invalidProof",
+						proofIndex
+					}
 				}
 			};
 		}
@@ -735,18 +764,24 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 	for (let proofIndex = 0; proofIndex < proofs.length; proofIndex++) {
 		const verificationMethod = proofs[proofIndex].verificationMethodId;
 		if (verificationMethod == null) return {
-			verified: false,
-			reason: {
-				type: "invalidProof",
-				proofIndex
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "invalidProof",
+					proofIndex
+				}
 			}
 		};
 		if (verificationMethod.protocol !== "did:") return {
-			verified: false,
-			reason: {
-				type: "unsupportedVerificationMethod",
-				proofIndex,
-				verificationMethod
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "unsupportedVerificationMethod",
+					proofIndex,
+					verificationMethod
+				}
 			}
 		};
 		try {
@@ -754,24 +789,89 @@ async function verifyPortableObjectProof(jsonLd, options = {}) {
 		} catch (error) {
 			if (!(error instanceof TypeError)) throw error;
 			return {
+				prepared: false,
+				result: {
+					verified: false,
+					reason: {
+						type: "unsupportedVerificationMethod",
+						proofIndex,
+						verificationMethod
+					}
+				}
+			};
+		}
+		if (!haveSameFe34Origin(objectId, verificationMethod)) return {
+			prepared: false,
+			result: {
 				verified: false,
 				reason: {
-					type: "unsupportedVerificationMethod",
+					type: "verificationMethodMismatch",
 					proofIndex,
+					objectId,
 					verificationMethod
 				}
-			};
-		}
-		if (!haveSameFe34Origin(objectId, verificationMethod)) return {
-			verified: false,
-			reason: {
-				type: "verificationMethodMismatch",
-				proofIndex,
-				objectId,
-				verificationMethod
 			}
 		};
 	}
+	return {
+		prepared: true,
+		objectId,
+		proofs,
+		rawProofValues,
+		proofContextLoader
+	};
+}
+/**
+* Applies portable-object proof policy to one map-local cryptographic result.
+*
+* @internal
+*/
+async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
+	const policyOptions = {
+		...options,
+		contextLoader: preloadedOnlyDocumentLoader
+	};
+	const prepared = await preparePortableObjectProof(jsonLd, policyOptions);
+	if (!prepared.prepared) return prepared.result;
+	const policyProof = prepared.proofs[0];
+	const literalProof = isJsonLdNode(jsonLd) && isJsonLdNode(jsonLd.proof) ? (await parseRawProofCandidates(jsonLd, [jsonLd.proof], policyOptions, prepared.proofContextLoader))[0]?.proof : null;
+	const verificationMethod = policyProof?.verificationMethodId;
+	if (prepared.proofs.length !== 1 || key == null || policyProof == null || literalProof == null || !sameProof(policyProof, literalProof) || verificationMethod == null || key.id?.href !== verificationMethod.href) return {
+		verified: false,
+		reason: {
+			type: "invalidProof",
+			proofIndex: prepared.proofs.length > 1 ? 1 : 0
+		}
+	};
+	return {
+		verified: true,
+		keys: [key],
+		objectId: formatIri(prepared.objectId)
+	};
+}
+/**
+* Verifies the FEP-ef61 Object Integrity Proof policy for a portable object.
+*
+* This applies the FEP-2277 core-type classification to the top-level JSON-LD
+* node.  Portable actors, activities, and objects require proofs.  A portable
+* collection without a proof is reported separately so a caller can apply a
+* gateway trust policy.  Embedded portable objects are not traversed.
+*
+* Every proof must use a DID URL whose DID matches the portable object's
+* authority, and every proof must pass {@link verifyProof}.
+*
+* @param jsonLd The JSON-LD document to verify.
+* @param options Additional options.  See also
+*                {@link VerifyPortableObjectProofOptions}.
+* @returns The detailed portable proof-policy result.
+* @throws {TypeError} If the input is not a single JSON-LD object or has a
+*                     malformed portable ID.
+* @since 2.4.0
+*/
+async function verifyPortableObjectProof(jsonLd, options = {}) {
+	const prepared = await preparePortableObjectProof(jsonLd, options);
+	if (!prepared.prepared) return prepared.result;
+	const { proofs, rawProofValues, proofContextLoader } = prepared;
 	const keys = [];
 	const rawProofCandidatePool = {
 		candidates: await parseRawProofCandidates(jsonLd, rawProofValues, options, proofContextLoader),
@@ -890,4 +990,4 @@ function hasCryptographicOrigin(iri) {
 	return /^did:/i.test(iri) || /^ap(?:\+ef61)?:\/\//i.test(iri);
 }
 //#endregion
-export { verifyPortableObjectProof as a, verifyObject as i, hasProofLike as n, verifyProof as o, signObject as r, createProof as t };
+export { verifyObject as a, verifyProof as c, verifyMapLocalProof as i, hasProofLike as n, verifyPortableObjectProof as o, signObject as r, verifyPortableObjectProofPolicy as s, createProof as t };

package/dist/{send-6jS4xFsX.mjs → send-BzM5GLyn.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BgMEefEr.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-CrqsHP0l.mjs";
-import { n as doubleKnock } from "./http-CtidZS_t.mjs";
+import { n as version, t as name } from "./deno-CABhzCb_.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-CISXCvB1.mjs";
+import { n as doubleKnock } from "./http-D9urSO2D.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/sig/compound-proof-discovery.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/sig/compound-proof-discovery.test.mjs

@@ -0,0 +1,331 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as assertEquals } from "../assert_equals-CBlRfA-_.mjs";
+import "../std__assert-CxFT0MNt.mjs";
+import { n as inspectCompoundPortableObjectApplicability, t as discoverCompoundProofDocuments } from "../compound-proof-CJnWc6c-.mjs";
+import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
+import { test } from "@fedify/fixture";
+//#region src/sig/compound-proof-discovery.test.ts
+const limits = {
+	maxDepth: 16,
+	maxMaps: 32,
+	maxProofs: 8,
+	maxBytes: 16384
+};
+test("portable applicability is bounded and ignores metadata", () => {
+	assertEquals(inspectCompoundPortableObjectApplicability({
+		"@context": { id: "ap://did:key:context/object" },
+		proof: { id: "ap://did:key:proof/object" },
+		object: { id: "https://example.com/objects/1" }
+	}, limits), "absent");
+	assertEquals(inspectCompoundPortableObjectApplicability({ object: [{ "@id": "AP+EF61://did:key:child/objects/1" }] }, limits), "present");
+	assertEquals(inspectCompoundPortableObjectApplicability({ values: new Array(2e4).fill(0) }, {
+		...limits,
+		maxBytes: 1e3
+	}), "indeterminate");
+});
+test("discoverCompoundProofDocuments() returns immutable deepest-first candidates", () => {
+	const input = {
+		id: "ap://example.test/activities/1",
+		object: {
+			id: "ap://example.test/objects/1",
+			content: "one",
+			proof: {
+				type: "DataIntegrityProof",
+				proofValue: "zInner"
+			}
+		},
+		items: [{
+			id: "ap://example.test/objects/2",
+			content: "two",
+			proof: {
+				type: "DataIntegrityProof",
+				proofValue: "zArray"
+			}
+		}],
+		"a/b~c": {
+			"@id": "ap://example.test/objects/3",
+			proof: {
+				type: "DataIntegrityProof",
+				proofValue: "zEscaped"
+			}
+		},
+		proof: {
+			type: "DataIntegrityProof",
+			proofValue: "zOuter",
+			proof: {
+				type: "DataIntegrityProof",
+				proofValue: "zNotADocument"
+			}
+		}
+	};
+	const before = structuredClone(input);
+	const result = discoverCompoundProofDocuments(input, limits);
+	assertEquals(input, before);
+	assertEquals(result.status, "ok");
+	if (result.status !== "ok") return;
+	assertEquals(result.documents.map(({ path, id, depth }) => ({
+		path,
+		id,
+		depth
+	})), [
+		{
+			path: "/items/0",
+			id: "ap://example.test/objects/2",
+			depth: 2
+		},
+		{
+			path: "/a~1b~0c",
+			id: "ap://example.test/objects/3",
+			depth: 1
+		},
+		{
+			path: "/object",
+			id: "ap://example.test/objects/1",
+			depth: 1
+		},
+		{
+			path: "",
+			id: "ap://example.test/activities/1",
+			depth: 0
+		}
+	]);
+	assertEquals(result.documents[0].securedDocument, input.items[0]);
+	assertEquals(result.documents[0].proof, input.items[0].proof);
+	assertEquals(result.statistics.proofCount, 4);
+	input.items[0].content = "mutated after discovery";
+	assertEquals(result.documents[0].securedDocument.content, "two");
+	assertEquals(result.snapshot.items[0].content, "two");
+});
+test("discoverCompoundProofDocuments() is independent of member order", () => {
+	const first = {
+		z: {
+			id: "z",
+			proof: { proofValue: "z" }
+		},
+		a: {
+			id: "a",
+			proof: { proofValue: "a" }
+		},
+		proof: { proofValue: "root" }
+	};
+	const second = {
+		proof: { proofValue: "root" },
+		a: {
+			proof: { proofValue: "a" },
+			id: "a"
+		},
+		z: {
+			proof: { proofValue: "z" },
+			id: "z"
+		}
+	};
+	const firstResult = discoverCompoundProofDocuments(first, limits);
+	const secondResult = discoverCompoundProofDocuments(second, limits);
+	assertEquals(firstResult.status, "ok");
+	assertEquals(secondResult.status, "ok");
+	if (firstResult.status !== "ok" || secondResult.status !== "ok") return;
+	assertEquals(firstResult.documents.map((candidate) => candidate.path), [
+		"/a",
+		"/z",
+		""
+	]);
+	assertEquals(secondResult.documents.map((candidate) => candidate.path), [
+		"/a",
+		"/z",
+		""
+	]);
+});
+test("discoverCompoundProofDocuments() does not inspect context definitions", () => {
+	const result = discoverCompoundProofDocuments({
+		"@context": {
+			proof: "https://w3id.org/security#proof",
+			portable: {
+				"@id": "ap://did:key:z6MkContext/objects/1",
+				"@context": { proof: "https://example.com/nested-proof" }
+			}
+		},
+		id: "https://social.example/objects/1",
+		type: "Note"
+	}, limits);
+	assertEquals(result.status, "ok");
+	if (result.status !== "ok") return;
+	assertEquals(result.documents, []);
+	assertEquals(result.statistics.proofCount, 0);
+});
+test("discoverCompoundProofDocuments() preserves the recorded compound vector", () => {
+	const result = discoverCompoundProofDocuments(map_local_create_note_default.documents.finalSecuredCompound, limits);
+	assertEquals(result.status, "ok");
+	if (result.status !== "ok") return;
+	assertEquals(result.documents.map(({ path }) => path), ["/object", ""]);
+	assertEquals(result.documents[0].securedDocument, map_local_create_note_default.documents.securedInner);
+	assertEquals(result.documents[1].securedDocument, map_local_create_note_default.documents.finalSecuredCompound);
+});
+test("discoverCompoundProofDocuments() rejects unsupported proof shapes atomically", () => {
+	for (const proof of [
+		null,
+		"remote-proof",
+		[{ proofValue: "z" }]
+	]) assertEquals(discoverCompoundProofDocuments({
+		object: { proof: { proofValue: "valid candidate" } },
+		other: { proof }
+	}, limits), {
+		status: "unsupported",
+		reason: {
+			type: "unsupportedProofShape",
+			path: "/other/proof"
+		}
+	});
+});
+test("discoverCompoundProofDocuments() applies resource limits atomically", () => {
+	const cases = [
+		{
+			input: { child: { child: { proof: {} } } },
+			limits: {
+				...limits,
+				maxDepth: 1
+			},
+			limit: "depth",
+			maximum: 1
+		},
+		{
+			input: {
+				first: {},
+				second: { proof: {} }
+			},
+			limits: {
+				...limits,
+				maxMaps: 2
+			},
+			limit: "maps",
+			maximum: 2
+		},
+		{
+			input: {
+				first: { proof: {} },
+				second: { proof: {} }
+			},
+			limits: {
+				...limits,
+				maxProofs: 1
+			},
+			limit: "proofs",
+			maximum: 1
+		},
+		{
+			input: {
+				content: "too large",
+				proof: {}
+			},
+			limits: {
+				...limits,
+				maxBytes: 8
+			},
+			limit: "bytes",
+			maximum: 8
+		}
+	];
+	for (const fixture of cases) {
+		const result = discoverCompoundProofDocuments(fixture.input, fixture.limits);
+		assertEquals(result.status, "unsupported");
+		if (result.status !== "unsupported") continue;
+		assertEquals(result.reason.type, "limitExceeded");
+		if (result.reason.type !== "limitExceeded") continue;
+		assertEquals(result.reason.limit, fixture.limit);
+		assertEquals(result.reason.maximum, fixture.maximum);
+	}
+});
+test("discoverCompoundProofDocuments() rejects values that are not JSON trees", () => {
+	const cyclic = { proof: {} };
+	cyclic.self = cyclic;
+	const shared = { proof: {} };
+	const symbolKeyed = { [Symbol("hidden")]: { proof: {} } };
+	for (const input of [
+		[],
+		{ value: void 0 },
+		{ value: NaN },
+		cyclic,
+		{
+			first: shared,
+			second: shared
+		},
+		symbolKeyed
+	]) {
+		const result = discoverCompoundProofDocuments(input, limits);
+		assertEquals(result.status, "unsupported");
+		if (result.status !== "unsupported") continue;
+		assertEquals(result.reason.type, "invalidJsonTree");
+	}
+});
+test("discoverCompoundProofDocuments() handles wide JSON containers", () => {
+	const input = { values: new Array(2e5).fill(0) };
+	const result = discoverCompoundProofDocuments(input, {
+		maxDepth: 2,
+		maxMaps: 1,
+		maxProofs: 0,
+		maxBytes: 1048576
+	});
+	assertEquals(result.status, "ok");
+	if (result.status !== "ok") return;
+	assertEquals(result.statistics.byteLength, JSON.stringify(input).length);
+});
+test("discoverCompoundProofDocuments() rejects accessors without invoking them", () => {
+	let getterCalls = 0;
+	const accessorMap = {};
+	Object.defineProperty(accessorMap, "object", {
+		enumerable: true,
+		get() {
+			getterCalls++;
+			return { proof: {} };
+		}
+	});
+	const accessorArray = [{}];
+	Object.defineProperty(accessorArray, 0, {
+		enumerable: true,
+		get() {
+			getterCalls++;
+			return { proof: {} };
+		}
+	});
+	for (const input of [accessorMap, { items: accessorArray }]) {
+		const result = discoverCompoundProofDocuments(input, limits);
+		assertEquals(result.status, "unsupported");
+		if (result.status !== "unsupported") continue;
+		assertEquals(result.reason.type, "invalidJsonTree");
+	}
+	assertEquals(getterCalls, 0);
+});
+test("discoverCompoundProofDocuments() rejects non-enumerable map properties", () => {
+	const input = {};
+	Object.defineProperty(input, "proof", {
+		value: {},
+		enumerable: false
+	});
+	const result = discoverCompoundProofDocuments(input, limits);
+	assertEquals(result.status, "unsupported");
+	if (result.status !== "unsupported") return;
+	assertEquals(result.reason.type, "invalidJsonTree");
+});
+test("discoverCompoundProofDocuments() rejects non-JSON array properties", () => {
+	const namedProperty = Object.assign([], { extra: { proof: {} } });
+	const sparse = new Array(2);
+	sparse[1] = null;
+	const nonEnumerableIndex = [];
+	Object.defineProperty(nonEnumerableIndex, 0, {
+		value: { proof: {} },
+		enumerable: false
+	});
+	for (const input of [
+		{ items: namedProperty },
+		{ items: sparse },
+		{ items: nonEnumerableIndex }
+	]) {
+		const result = discoverCompoundProofDocuments(input, limits);
+		assertEquals(result.status, "unsupported");
+		if (result.status !== "unsupported") continue;
+		assertEquals(result.reason.type, "invalidJsonTree");
+	}
+});
+//#endregion
+export {};