@fedify/fedify 2.4.0-dev.2010 → 2.4.0-dev.2030

package/dist/mod.js

@@ -3,11 +3,11 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./rolldown-runtime-BC-Eo5Mj.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-DAtXl_Kc.js";
 import "./compat/mod.js";
-import { F as validateAcceptSignature, M as formatAcceptSignature, N as fulfillAcceptSignature, P as parseAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, i as verifyRequest, l as fetchKeyDetailed, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "./http-DQA2JOEJ.js";
-import { a as respondWithObject, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as SendActivityError, l as CircuitBreaker, n as handleWebFinger, o as respondWithObjectIfAcceptable, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-U0OIuqwD.js";
+import { F as validateAcceptSignature, M as formatAcceptSignature, N as fulfillAcceptSignature, P as parseAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, i as verifyRequest, l as fetchKeyDetailed, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "./http-By8tnmEr.js";
+import { a as respondWithObject, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as SendActivityError, l as CircuitBreaker, n as handleWebFinger, o as respondWithObjectIfAcceptable, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-Cxto6Bq2.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { S as signJsonLd, T as verifySignature, a as signObject, c as verifyPortableObjectProof, g as detachSignature, h as createSignature, i as hasProofLike, n as getKeyOwner, p as attachSignature, r as createProof, s as verifyObject, t as doesActorOwnKey, u as verifyProof, w as verifyJsonLd, y as hasSignatureLike } from "./owner-BNKC3s6G.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-BBoePTOJ.js";
+import { S as signJsonLd, T as verifySignature, a as signObject, c as verifyPortableObjectProof, g as detachSignature, h as createSignature, i as hasProofLike, n as getKeyOwner, p as attachSignature, r as createProof, s as verifyObject, t as doesActorOwnKey, u as verifyProof, w as verifyJsonLd, y as hasSignatureLike } from "./owner-D-E0bT2O.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-BswMKQjC.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";

package/dist/nodeinfo/client.test.mjs

@@ -2,8 +2,8 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
-import { t as assertEquals } from "../assert_equals-CBlRfA-_.mjs";
-import "../std__assert-CxFT0MNt.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import "../std__assert-DvMDRPes.mjs";
 import { a as parseProtocol, c as parseUsage, i as parseOutboundService, n as parseInboundService, o as parseServices, r as parseNodeInfo, s as parseSoftware, t as getNodeInfo } from "../client-DpnpgjyX.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/client.test.ts

package/dist/nodeinfo/handler.test.mjs

@@ -3,9 +3,9 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { r as createRequestContext } from "../context-CbS35fLr.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
-import { t as assertEquals } from "../assert_equals-CBlRfA-_.mjs";
-import "../std__assert-CxFT0MNt.mjs";
-import { _ as handleNodeInfo, o as createFederation, v as handleNodeInfoJrd } from "../middleware-pHwDTAnq.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { _ as handleNodeInfo, o as createFederation, v as handleNodeInfoJrd } from "../middleware-C7_hqDnl.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {

package/dist/nodeinfo/types.test.mjs

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { t as assertEquals } from "../assert_equals-CBlRfA-_.mjs";
-import { t as assertThrows } from "../assert_throws-BJ5wuvR2.mjs";
-import "../std__assert-CxFT0MNt.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
+import "../std__assert-DvMDRPes.mjs";
 import { t as nodeInfoToJson } from "../types-DE_LV1JB.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/types.test.ts

package/dist/otel/exporter.test.mjs

@@ -2,8 +2,8 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
-import { t as assertEquals } from "../assert_equals-CBlRfA-_.mjs";
-import "../std__assert-CxFT0MNt.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import "../std__assert-DvMDRPes.mjs";
 import { getLogger } from "@logtape/logtape";
 import { ExportResultCode } from "@opentelemetry/core";
 import { SpanKind, SpanStatusCode, TraceFlags } from "@opentelemetry/api";

package/dist/{outgoing-jsonld-B5Ne7JoL.mjs → outgoing-jsonld-4IJqPYos.mjs}

@@ -1,7 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as preloadedOnlyDocumentLoader, t as normalizePublicAudience } from "./public-audience-Cc2YJ3ip.mjs";
+import { n as preloadedOnlyDocumentLoader, t as normalizePublicAudience } from "./public-audience--klBIOk1.mjs";
+import { t as isSelfContainedSecuredDocument } from "./secured-document-CxzZZ9nL.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 import jsonld from "@fedify/vocab-runtime/jsonld";
@@ -64,13 +65,14 @@ function getKnownSafeContextUrls() {
 /**
 * Wraps scalar ActivityStreams attachment properties in arrays.
 */
-function wrapScalarAttachments(jsonLd, depth = 0) {
+function wrapScalarAttachments(jsonLd, preserveSecured, depth = 0) {
 	if (depth >= MAX_TRAVERSAL_DEPTH) return jsonLd;
+	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(jsonLd)) return jsonLd;
 	if (Array.isArray(jsonLd)) {
 		let normalized = null;
 		for (let i = 0; i < jsonLd.length; i++) {
 			const item = jsonLd[i];
-			const next = wrapScalarAttachments(item, depth + 1);
+			const next = wrapScalarAttachments(item, preserveSecured, depth + 1);
 			if (normalized == null && next !== item) normalized = jsonLd.slice(0, i);
 			if (normalized != null) normalized[i] = next;
 		}
@@ -83,7 +85,7 @@ function wrapScalarAttachments(jsonLd, depth = 0) {
 	for (let i = 0; i < keys.length; i++) {
 		const key = keys[i];
 		const value = record[key];
-		const next = key === "@context" || key === "@value" && isJsonLdValueObject(jsonLd) ? value : wrapScalarAttachments(value, depth + 1);
+		const next = key === "@context" || key === "@value" && isJsonLdValueObject(jsonLd) ? value : wrapScalarAttachments(value, preserveSecured, depth + 1);
 		const output = ATTACHMENT_FIELDS.has(key) && next != null && !Array.isArray(next) && !isJsonLdListObject(next) ? [next] : next;
 		if (normalized == null && output !== value) {
 			const cloned = Object.create(null);
@@ -166,8 +168,8 @@ function getLogSafeJsonLdMetadata(jsonLd) {
 * the semantic-preservation check to succeed; otherwise canonicalization
 * failures leave the original document unchanged.
 */
-async function normalizeAttachmentArrays(jsonLd, contextLoader) {
-	const normalized = wrapScalarAttachments(jsonLd);
+async function normalizeAttachmentArrays(jsonLd, contextLoader, options = {}) {
+	const normalized = wrapScalarAttachments(jsonLd, options.preserveNestedSecuredDocuments ?? false);
 	if (normalized === jsonLd) return jsonLd;
 	if (exceedsTraversalDepth(jsonLd)) {
 		logger.debug("Skipping attachment array normalization because the JSON-LD document exceeds the safe traversal depth; leaving it unchanged.");
@@ -195,9 +197,9 @@ async function normalizeAttachmentArrays(jsonLd, contextLoader) {
 * to locally generated outgoing activities before they are signed, enqueued,
 * or sent.
 */
-async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader) {
-	jsonLd = await normalizePublicAudience(jsonLd, contextLoader);
-	return await normalizeAttachmentArrays(jsonLd, contextLoader);
+async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, options = {}) {
+	jsonLd = await normalizePublicAudience(jsonLd, contextLoader, options);
+	return await normalizeAttachmentArrays(jsonLd, contextLoader, options);
 }
 //#endregion
 export { normalizeAttachmentArrays as n, normalizeOutgoingActivityJsonLd as r, isPreloadedContextAttachmentSafe as t };

package/dist/{owner-u3IJRhVx.mjs → owner-BIOIhZoM.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Ckq9TwCv.mjs";
-import { c as verifyKeyOwnership, n as fetchActorDocument, t as exportJwk } from "./key-zxzx01Ec.mjs";
+import { n as version, t as name } from "./deno-Vj_9wePq.mjs";
+import { c as verifyKeyOwnership, n as fetchActorDocument, t as exportJwk } from "./key-B_Zc5Jbd.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{owner-BNKC3s6G.js → owner-D-E0bT2O.js}

@@ -1,11 +1,12 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { I as name, L as version, c as fetchKey, f as validateCryptoKey, h as getFederationMetrics, m as getDurationMs, o as exportJwk, p as verifyKeyOwnership, s as fetchActorDocument, y as measureSignatureKeyFetch } from "./http-DQA2JOEJ.js";
+import { I as name, L as version, c as fetchKey, f as validateCryptoKey, h as getFederationMetrics, m as getDurationMs, o as exportJwk, p as verifyKeyOwnership, s as fetchActorDocument, y as measureSignatureKeyFetch } from "./http-By8tnmEr.js";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, PUBLIC_COLLECTION, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { encodeHex } from "byte-encodings/hex";
-import { formatIri, getDocumentLoader, getFe34Origin, haveSameFe34Origin, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
+import { encodeMultibase, formatIri, getDocumentLoader, getFe34Origin, haveSameFe34Origin, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
+import { isPlainJsonTree, retainSignedRepresentation } from "@fedify/vocab-runtime/internal/signed-representation";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import serialize from "json-canon";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
@@ -28,6 +29,37 @@ const preloadedOnlyDocumentLoader = (url) => {
 	return Promise.reject(/* @__PURE__ */ new Error("Refusing to fetch a non-preloaded JSON-LD context: " + url));
 };
 //#endregion
+//#region src/compat/secured-document.ts
+function isJsonMap$1(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.length > 0;
+}
+function hasDataIntegrityProofType(value) {
+	return (Array.isArray(value) ? value : [value]).some((type) => type === "DataIntegrityProof" || type === "https://w3id.org/security#DataIntegrityProof");
+}
+/**
+* Checks whether a JSON value is a complete, self-contained secured document:
+* a map with its own `@context` and exactly one direct, map-valued `proof`
+* that carries every member `eddsa-jcs-2022` proof generation produces.
+*
+* This is deliberately stricter than {@link hasProofLike}, which exists to
+* decide whether a document is worth verifying.  Here a false positive would
+* silently suppress a wire-compatibility fix on an ordinary document, so a
+* partial or malformed proof does not qualify.
+*
+* @internal
+*/
+function isSelfContainedSecuredDocument(value) {
+	if (!isJsonMap$1(value)) return false;
+	if (!Object.hasOwn(value, "@context") || value["@context"] == null) return false;
+	if (!Object.hasOwn(value, "proof")) return false;
+	const proof = value.proof;
+	if (!isJsonMap$1(proof)) return false;
+	return hasDataIntegrityProofType(proof.type) && isNonEmptyString(proof.cryptosuite) && isNonEmptyString(proof.created) && isNonEmptyString(proof.verificationMethod) && isNonEmptyString(proof.proofPurpose) && isNonEmptyString(proof.proofValue);
+}
+//#endregion
 //#region src/compat/public-audience.ts
 const logger$4 = getLogger([
 	"fedify",
@@ -44,37 +76,39 @@ const PUBLIC_ADDRESSING_FIELDS = /* @__PURE__ */ new Set([
 const AS_CONTEXT_URL$1 = "https://www.w3.org/ns/activitystreams";
 const MAX_TRAVERSAL_DEPTH$1 = 64;
 const KNOWN_SAFE_CONTEXT_URLS$1 = new Set(Object.keys(preloadedContexts));
-function hasPublicCurieInAddressing(value, parentKey, depth = 0) {
+function hasPublicCurieInAddressing(value, preserveSecured, parentKey, depth = 0) {
 	if (typeof value === "string") return parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public");
 	if (depth >= MAX_TRAVERSAL_DEPTH$1) return false;
-	if (Array.isArray(value)) return value.some((item) => hasPublicCurieInAddressing(item, parentKey, depth + 1));
+	if (Array.isArray(value)) return value.some((item) => hasPublicCurieInAddressing(item, preserveSecured, parentKey, depth + 1));
 	if (typeof value !== "object" || value == null) return false;
+	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(value)) return false;
 	const record = value;
 	for (const key of Object.keys(record)) {
 		if (record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public")) return true;
 		if (key === "@context") continue;
-		if (hasPublicCurieInAddressing(record[key], key, depth + 1)) return true;
+		if (hasPublicCurieInAddressing(record[key], preserveSecured, key, depth + 1)) return true;
 	}
 	return false;
 }
-function rewritePublicAudience(value, parentKey, depth = 0) {
+function rewritePublicAudience(value, preserveSecured, parentKey, depth = 0) {
 	if (typeof value === "string" && parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public")) return PUBLIC_COLLECTION.href;
 	if (depth >= MAX_TRAVERSAL_DEPTH$1) return value;
 	if (Array.isArray(value)) {
 		let changed = false;
 		const mapped = value.map((item) => {
-			const rewritten = rewritePublicAudience(item, parentKey, depth + 1);
+			const rewritten = rewritePublicAudience(item, preserveSecured, parentKey, depth + 1);
 			if (rewritten !== item) changed = true;
 			return rewritten;
 		});
 		return changed ? mapped : value;
 	}
 	if (typeof value !== "object" || value == null) return value;
+	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(value)) return value;
 	const record = value;
 	let changed = false;
 	const normalized = Object.create(null);
 	for (const key of Object.keys(record)) {
-		const rewritten = key === "@context" ? record[key] : record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public") ? PUBLIC_COLLECTION.href : rewritePublicAudience(record[key], key, depth + 1);
+		const rewritten = key === "@context" ? record[key] : record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public") ? PUBLIC_COLLECTION.href : rewritePublicAudience(record[key], preserveSecured, key, depth + 1);
 		if (rewritten !== record[key]) changed = true;
 		normalized[key] = rewritten;
 	}
@@ -173,9 +207,10 @@ function hasKnownSafeContext$1(jsonLd) {
 * using the `eddsa-jcs-2022` cryptosuite), so the signed payload
 * matches what is sent on the wire.
 */
-async function normalizePublicAudience(jsonLd, contextLoader) {
-	if (!hasPublicCurieInAddressing(jsonLd)) return jsonLd;
-	const normalized = rewritePublicAudience(jsonLd);
+async function normalizePublicAudience(jsonLd, contextLoader, options = {}) {
+	const preserveSecured = options.preserveNestedSecuredDocuments ?? false;
+	if (!hasPublicCurieInAddressing(jsonLd, preserveSecured)) return jsonLd;
+	const normalized = rewritePublicAudience(jsonLd, preserveSecured);
 	if (hasKnownSafeContext$1(jsonLd)) return normalized;
 	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
 	try {
@@ -253,13 +288,14 @@ function getKnownSafeContextUrls() {
 /**
 * Wraps scalar ActivityStreams attachment properties in arrays.
 */
-function wrapScalarAttachments(jsonLd, depth = 0) {
+function wrapScalarAttachments(jsonLd, preserveSecured, depth = 0) {
 	if (depth >= MAX_TRAVERSAL_DEPTH) return jsonLd;
+	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(jsonLd)) return jsonLd;
 	if (Array.isArray(jsonLd)) {
 		let normalized = null;
 		for (let i = 0; i < jsonLd.length; i++) {
 			const item = jsonLd[i];
-			const next = wrapScalarAttachments(item, depth + 1);
+			const next = wrapScalarAttachments(item, preserveSecured, depth + 1);
 			if (normalized == null && next !== item) normalized = jsonLd.slice(0, i);
 			if (normalized != null) normalized[i] = next;
 		}
@@ -272,7 +308,7 @@ function wrapScalarAttachments(jsonLd, depth = 0) {
 	for (let i = 0; i < keys.length; i++) {
 		const key = keys[i];
 		const value = record[key];
-		const next = key === "@context" || key === "@value" && isJsonLdValueObject(jsonLd) ? value : wrapScalarAttachments(value, depth + 1);
+		const next = key === "@context" || key === "@value" && isJsonLdValueObject(jsonLd) ? value : wrapScalarAttachments(value, preserveSecured, depth + 1);
 		const output = ATTACHMENT_FIELDS.has(key) && next != null && !Array.isArray(next) && !isJsonLdListObject(next) ? [next] : next;
 		if (normalized == null && output !== value) {
 			const cloned = Object.create(null);
@@ -355,8 +391,8 @@ function getLogSafeJsonLdMetadata(jsonLd) {
 * the semantic-preservation check to succeed; otherwise canonicalization
 * failures leave the original document unchanged.
 */
-async function normalizeAttachmentArrays(jsonLd, contextLoader) {
-	const normalized = wrapScalarAttachments(jsonLd);
+async function normalizeAttachmentArrays(jsonLd, contextLoader, options = {}) {
+	const normalized = wrapScalarAttachments(jsonLd, options.preserveNestedSecuredDocuments ?? false);
 	if (normalized === jsonLd) return jsonLd;
 	if (exceedsTraversalDepth(jsonLd)) {
 		logger$3.debug("Skipping attachment array normalization because the JSON-LD document exceeds the safe traversal depth; leaving it unchanged.");
@@ -384,9 +420,9 @@ async function normalizeAttachmentArrays(jsonLd, contextLoader) {
 * to locally generated outgoing activities before they are signed, enqueued,
 * or sent.
 */
-async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader) {
-	jsonLd = await normalizePublicAudience(jsonLd, contextLoader);
-	return await normalizeAttachmentArrays(jsonLd, contextLoader);
+async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, options = {}) {
+	jsonLd = await normalizePublicAudience(jsonLd, contextLoader, options);
+	return await normalizeAttachmentArrays(jsonLd, contextLoader, options);
 }
 //#endregion
 //#region src/sig/ld.ts
@@ -1055,17 +1091,49 @@ function hasProofLike(jsonLd) {
 	};
 	return Array.isArray(proof) ? proof.some(isProofLike) : isProofLike(proof);
 }
+function isJsonMap(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
 /**
-* Creates a proof for the given object.
-* @param object The object to create a proof for.
-* @param privateKey The private key to sign the proof with.
-* @param keyId The key ID to use in the proof. It will be used by the verifier.
-* @param options Additional options.  See also {@link CreateProofOptions}.
-* @returns The created proof.
-* @throws {TypeError} If the private key is invalid or unsupported.
-* @since 0.10.0
+* Assembles the secured JSON document from the bytes that were just signed.
+*
+* The document is not re-derived from the vocabulary object: it is
+* `compactMsg`, the value whose JCS form was hashed, with the serialized
+* proof added.  Every part of it is then checked against the digests and the
+* signature that {@link createProofInternal} produced, so a document that is
+* returned verifies under the map-local compound-proof profile by
+* construction.  Anything that does not check out yields `null`, and the
+* caller simply does not retain a representation.
 */
-async function createProof(object, privateKey, keyId, { contextLoader, context, created } = {}) {
+async function captureSecuredDocument(proof, compactMsg, msgCanon, proofCanon, proofValue, contextLoader) {
+	if (!isJsonMap(compactMsg)) return null;
+	const documentContext = compactMsg["@context"];
+	if (documentContext == null) return null;
+	if (globalThis.Object.hasOwn(compactMsg, "proof")) return null;
+	try {
+		const proofJson = await proof.toJsonLd({
+			format: "compact",
+			contextLoader,
+			context: documentContext
+		});
+		if (!isJsonMap(proofJson)) return null;
+		const { proofValue: serializedProofValue, ...proofConfiguration } = proofJson;
+		if (serializedProofValue !== proofValue) return null;
+		if (serialize(proofConfiguration) !== proofCanon) return null;
+		const securedDocument = {
+			...structuredClone(compactMsg),
+			proof: structuredClone(proofJson)
+		};
+		const { proof: _embeddedProof, ...unsecuredDocument } = securedDocument;
+		if (serialize(unsecuredDocument) !== msgCanon) return null;
+		if (!isPlainJsonTree(securedDocument)) return null;
+		return securedDocument;
+	} catch (error) {
+		logger$1.debug("Failed to capture the secured JSON document for a created proof; the signed object will not preserve its representation when it is embedded in another object.\n{error}", { error });
+		return null;
+	}
+}
+async function createProofInternal(object, privateKey, keyId, { contextLoader, context, created } = {}, capture = false) {
 	validateCryptoKey(privateKey, "private");
 	if (privateKey.algorithm.name !== "Ed25519") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
 	let compactMsg = await object.clone({ proofs: [] }).toJsonLd({
@@ -1073,7 +1141,7 @@ async function createProof(object, privateKey, keyId, { contextLoader, context,
 		contextLoader,
 		context
 	});
-	compactMsg = await normalizeOutgoingActivityJsonLd(compactMsg, contextLoader);
+	compactMsg = await normalizeOutgoingActivityJsonLd(compactMsg, contextLoader, { preserveNestedSecuredDocuments: true });
 	const msgCanon = serialize(compactMsg);
 	const encoder = new TextEncoder();
 	const msgBytes = encoder.encode(msgCanon);
@@ -1092,14 +1160,32 @@ async function createProof(object, privateKey, keyId, { contextLoader, context,
 	const digest = new Uint8Array(proofDigest.byteLength + msgDigest.byteLength);
 	digest.set(new Uint8Array(proofDigest), 0);
 	digest.set(new Uint8Array(msgDigest), proofDigest.byteLength);
-	const sig = await crypto.subtle.sign("Ed25519", privateKey, digest);
-	return new DataIntegrityProof({
+	const sig = new Uint8Array(await crypto.subtle.sign("Ed25519", privateKey, digest));
+	const proof = new DataIntegrityProof({
 		cryptosuite: "eddsa-jcs-2022",
 		verificationMethod: keyId,
 		proofPurpose: "assertionMethod",
-		created: created ?? Temporal.Now.instant(),
-		proofValue: new Uint8Array(sig)
+		created,
+		proofValue: sig
 	});
+	return {
+		proof,
+		securedDocument: capture ? await captureSecuredDocument(proof, compactMsg, msgCanon, proofCanon, new TextDecoder().decode(encodeMultibase("base58btc", sig)), contextLoader) : null
+	};
+}
+/**
+* Creates a proof for the given object.
+* @param object The object to create a proof for.
+* @param privateKey The private key to sign the proof with.
+* @param keyId The key ID to use in the proof. It will be used by the verifier.
+* @param options Additional options.  See also {@link CreateProofOptions}.
+* @returns The created proof.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 0.10.0
+*/
+async function createProof(object, privateKey, keyId, options = {}) {
+	const { proof } = await createProofInternal(object, privateKey, keyId, options);
+	return proof;
 }
 /**
 * Signs the given object with the private key and returns the signed object.
@@ -1117,13 +1203,19 @@ async function signObject(object, privateKey, keyId, options = {}) {
 			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
 			const existingProofs = [];
 			for await (const proof of object.getProofs(options)) existingProofs.push(proof);
-			const proof = await createProof(object, privateKey, keyId, options);
+			const { proof, securedDocument } = await createProofInternal(object, privateKey, keyId, options, existingProofs.length < 1);
 			if (span.isRecording()) {
 				if (proof.cryptosuite != null) span.setAttribute("object_integrity_proofs.cryptosuite", proof.cryptosuite);
 				if (proof.verificationMethodId != null) span.setAttribute("object_integrity_proofs.key_id", proof.verificationMethodId.href);
 				if (proof.proofValue != null) span.setAttribute("object_integrity_proofs.signature", encodeHex(proof.proofValue));
 			}
-			return object.clone({ proofs: [...existingProofs, proof] });
+			const signed = object.clone({ proofs: [...existingProofs, proof] });
+			if (securedDocument != null) retainSignedRepresentation(signed, securedDocument);
+			else if (existingProofs.length > 0) logger$1.debug("The object {objectId} already had {proofCount} proof(s), so its signed representation is not retained for embedding; the map-local compound-proof profile accepts exactly one direct proof per map.", {
+				objectId: object.id?.href,
+				proofCount: existingProofs.length
+			});
+			return signed;
 		} catch (error) {
 			span.setStatus({
 				code: SpanStatusCode.ERROR,