@fedify/fedify 2.4.0-dev.2056 → 2.4.0-dev.2063

package/dist/{mod-CNRAxXEb.d.ts → mod-Dhm7SqyE.d.ts}

@@ -2,7 +2,7 @@
 import { S as KeyCache } from "./http-65PYi9jY.js";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
-import { DocumentLoader } from "@fedify/vocab-runtime";
+import { DocumentLoader, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
 
 //#region src/sig/ld.d.ts
 /**
@@ -382,4 +382,152 @@ declare function verifyObject<T extends Object$1>(cls: (new (...args: any[]) =>
   fromJsonLd(jsonLd: unknown, options: VerifyObjectOptions): Promise<T>;
 }, jsonLd: unknown, options?: VerifyObjectOptions): Promise<T | null>;
 //#endregion
-export { verifyJsonLd as C, signJsonLd as S, VerifySignatureOptions as _, VerifyPortableObjectProofOptions as a, detachSignature as b, createProof as c, verifyObject as d, verifyPortableObjectProof as f, VerifyJsonLdOptions as g, SignJsonLdOptions as h, VerifyPortableObjectProofFailureReason as i, hasProofLike as l, CreateSignatureOptions as m, SignObjectOptions as n, VerifyPortableObjectProofResult as o, verifyProof as p, VerifyObjectOptions as r, VerifyProofOptions as s, CreateProofOptions as t, signObject as u, attachSignature as v, verifySignature as w, hasSignatureLike as x, createSignature as y };
+//#region src/sig/portable-collection.d.ts
+/**
+* Options for {@link verifyPortableObject}.
+*
+* Besides the options for {@link verifyPortableObjectProof}, it takes where
+* the document came from, which property accessors pass automatically when
+* `verifyPortableObject()` is used as their `verifyPortableObject` option.
+* @since 2.4.0
+*/
+interface VerifyPortableObjectOptions extends VerifyPortableObjectProofOptions, Omit<PortableObjectVerifierOptions, "documentLoader" | "contextLoader" | "tracerProvider"> {}
+/**
+* The reason why {@link verifyPortableObject} did not accept a document.
+*
+* Besides the reasons of {@link verifyPortableObjectProof}, it describes why
+* an unsecured portable collection was not trusted.  The
+* `unsecuredCollection` reason itself never appears, since such collections
+* are judged by the gateway trust policy instead.
+* @since 2.4.0
+*/
+type VerifyPortableObjectFailureReason = Exclude<VerifyPortableObjectProofFailureReason, {
+  readonly type: "unsecuredCollection";
+}> | {
+  /**
+  * The unsecured collection was not retrieved from a gateway, i.e., the
+  * document's final URL is missing or is not a compatible identifier for
+  * the same portable collection.
+  */
+  readonly type: "unknownCollectionSource"; /** The final URL of the document, if known. */
+  readonly documentUrl: URL | null;
+} | {
+  /**
+  * The actor that owns the unsecured collection cannot be determined
+  * unambiguously.
+  */
+  readonly type: "unknownCollectionOwner";
+} | {
+  /** The collection, its pages, or its referrer disagree on its owner. */readonly type: "conflictingCollectionOwners"; /** The owner candidates that disagree. */
+  readonly candidates: readonly URL[];
+} | {
+  /**
+  * A collection page does not belong to the collection it was reached
+  * from: its `partOf` names another collection, or its cryptographic
+  * origin differs.
+  */
+  readonly type: "collectionPageMismatch"; /** The page. */
+  readonly pageId: URL; /** The collection that the page was reached from. */
+  readonly collectionId: URL; /** The mismatching `partOf`, or `null` if the origin differs. */
+  readonly partOf: URL | null;
+} | {
+  /**
+  * The owner's actor document could not be retrieved or verified, or it
+  * lists no gateways.
+  */
+  readonly type: "collectionOwnerUnavailable"; /** The owner candidate. */
+  readonly owner: URL;
+} | {
+  /**
+  * The owner's actor document does not list the collection as its
+  * `inbox`, `outbox`, `followers`, `following`, or `liked`.
+  */
+  readonly type: "collectionNotListedByOwner"; /** The owner. */
+  readonly owner: URL; /** The collection. */
+  readonly collectionId: URL;
+} | {
+  /**
+  * The unsecured collection was retrieved from a gateway that its owner
+  * does not list in its `gateways`.
+  */
+  readonly type: "untrustedGateway"; /** The owner. */
+  readonly owner: URL; /** The gateway that served the collection. */
+  readonly gateway: URL; /** The owner's gateways. */
+  readonly gateways: readonly URL[];
+};
+/**
+* The result of {@link verifyPortableObject}.
+* @since 2.4.0
+*/
+type VerifyPortableObjectResult = {
+  /** Whether the document is accepted. */readonly verified: true; /** The document carries valid Object Integrity Proofs. */
+  readonly method: "proof"; /** The public keys used by the verified proofs, in proof order. */
+  readonly keys: readonly Multikey[];
+  /**
+  * Opaque state for verifying the pages of a portable collection.  Do not
+  * inspect it; property accessors pass it back automatically.
+  */
+  readonly collectionContext?: unknown;
+} | {
+  /** Whether the document is accepted. */readonly verified: true;
+  /**
+  * The document is an unsecured portable collection served by a gateway
+  * that its owner lists.
+  */
+  readonly method: "gateway"; /** The document has no integrity proof. */
+  readonly unsecured: true; /** The actor that owns the collection. */
+  readonly owner: URL; /** The gateway that served the collection. */
+  readonly gateway: URL;
+  /**
+  * Opaque state for verifying the pages of a portable collection.  Do not
+  * inspect it; property accessors pass it back automatically.
+  */
+  readonly collectionContext: unknown;
+} | {
+  /** Whether the document is accepted. */readonly verified: false; /** Why the document was not accepted. */
+  readonly reason: VerifyPortableObjectFailureReason;
+};
+/**
+* Applies the [FEP-ef61] trust policy to a portable object fetched through
+* a gateway.
+*
+* Portable actors, activities, objects, and collections with proofs are
+* verified by {@link verifyPortableObjectProof}.  A portable collection or
+* collection page without a proof is accepted only if all of the following
+* hold:
+*
+*  -  It was retrieved from a gateway: its final URL (`documentUrl`) is
+*     a compatible identifier for the same portable collection.
+*  -  Its owner is determined unambiguously: the actor whose `inbox`,
+*     `outbox`, `followers`, `following`, or `liked` property referred to
+*     the collection, or the single actor in its `attributedTo`.  A page
+*     inherits the owner of the collection it was reached from through
+*     `first`, `last`, `current`, `next`, or `prev`, and must not name
+*     another collection in `partOf`.
+*  -  The owner's actor document is verified by its proof and lists the
+*     collection as its `inbox`, `outbox`, `followers`, `following`, or
+*     `liked`.
+*  -  The gateway that served the collection is in the owner's `gateways`.
+*
+* Where the document came from and which object referred to it are passed
+* by property accessors when this function is used as their
+* `verifyPortableObject` option.  Objects embedded in an unsecured
+* collection accepted this way are not trusted: accessors dereference and
+* verify them one by one.
+*
+* Note that acceptance through the gateway policy does not verify anything
+* cryptographically; it only means that the owner trusts the gateway.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param jsonLd The JSON-LD document to verify.
+* @param options Additional options.  See also
+*                {@link VerifyPortableObjectOptions}.
+* @returns The detailed result.
+* @throws {TypeError} If the input is not a single JSON-LD object or has a
+*                     malformed portable ID.
+* @since 2.4.0
+*/
+declare function verifyPortableObject(jsonLd: unknown, options?: VerifyPortableObjectOptions): Promise<VerifyPortableObjectResult>;
+//#endregion
+export { createSignature as C, verifyJsonLd as D, signJsonLd as E, verifySignature as O, attachSignature as S, hasSignatureLike as T, verifyProof as _, CreateProofOptions as a, VerifyJsonLdOptions as b, VerifyPortableObjectProofFailureReason as c, VerifyProofOptions as d, createProof as f, verifyPortableObjectProof as g, verifyObject as h, verifyPortableObject as i, VerifyPortableObjectProofOptions as l, signObject as m, VerifyPortableObjectOptions as n, SignObjectOptions as o, hasProofLike as p, VerifyPortableObjectResult as r, VerifyObjectOptions as s, VerifyPortableObjectFailureReason as t, VerifyPortableObjectProofResult as u, CreateSignatureOptions as v, detachSignature as w, VerifySignatureOptions as x, SignJsonLdOptions as y };

package/dist/{mod-CVQFWefn.d.cts → mod-pLbeNwcC.d.cts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { S as KeyCache } from "./http-CP-7OdSq.cjs";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
-import { DocumentLoader } from "@fedify/vocab-runtime";
+import { DocumentLoader, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 
 //#region src/sig/ld.d.ts
@@ -382,4 +382,152 @@ declare function verifyObject<T extends Object$1>(cls: (new (...args: any[]) =>
   fromJsonLd(jsonLd: unknown, options: VerifyObjectOptions): Promise<T>;
 }, jsonLd: unknown, options?: VerifyObjectOptions): Promise<T | null>;
 //#endregion
-export { verifyJsonLd as C, signJsonLd as S, VerifySignatureOptions as _, VerifyPortableObjectProofOptions as a, detachSignature as b, createProof as c, verifyObject as d, verifyPortableObjectProof as f, VerifyJsonLdOptions as g, SignJsonLdOptions as h, VerifyPortableObjectProofFailureReason as i, hasProofLike as l, CreateSignatureOptions as m, SignObjectOptions as n, VerifyPortableObjectProofResult as o, verifyProof as p, VerifyObjectOptions as r, VerifyProofOptions as s, CreateProofOptions as t, signObject as u, attachSignature as v, verifySignature as w, hasSignatureLike as x, createSignature as y };
+//#region src/sig/portable-collection.d.ts
+/**
+* Options for {@link verifyPortableObject}.
+*
+* Besides the options for {@link verifyPortableObjectProof}, it takes where
+* the document came from, which property accessors pass automatically when
+* `verifyPortableObject()` is used as their `verifyPortableObject` option.
+* @since 2.4.0
+*/
+interface VerifyPortableObjectOptions extends VerifyPortableObjectProofOptions, Omit<PortableObjectVerifierOptions, "documentLoader" | "contextLoader" | "tracerProvider"> {}
+/**
+* The reason why {@link verifyPortableObject} did not accept a document.
+*
+* Besides the reasons of {@link verifyPortableObjectProof}, it describes why
+* an unsecured portable collection was not trusted.  The
+* `unsecuredCollection` reason itself never appears, since such collections
+* are judged by the gateway trust policy instead.
+* @since 2.4.0
+*/
+type VerifyPortableObjectFailureReason = Exclude<VerifyPortableObjectProofFailureReason, {
+  readonly type: "unsecuredCollection";
+}> | {
+  /**
+  * The unsecured collection was not retrieved from a gateway, i.e., the
+  * document's final URL is missing or is not a compatible identifier for
+  * the same portable collection.
+  */
+  readonly type: "unknownCollectionSource"; /** The final URL of the document, if known. */
+  readonly documentUrl: URL | null;
+} | {
+  /**
+  * The actor that owns the unsecured collection cannot be determined
+  * unambiguously.
+  */
+  readonly type: "unknownCollectionOwner";
+} | {
+  /** The collection, its pages, or its referrer disagree on its owner. */readonly type: "conflictingCollectionOwners"; /** The owner candidates that disagree. */
+  readonly candidates: readonly URL[];
+} | {
+  /**
+  * A collection page does not belong to the collection it was reached
+  * from: its `partOf` names another collection, or its cryptographic
+  * origin differs.
+  */
+  readonly type: "collectionPageMismatch"; /** The page. */
+  readonly pageId: URL; /** The collection that the page was reached from. */
+  readonly collectionId: URL; /** The mismatching `partOf`, or `null` if the origin differs. */
+  readonly partOf: URL | null;
+} | {
+  /**
+  * The owner's actor document could not be retrieved or verified, or it
+  * lists no gateways.
+  */
+  readonly type: "collectionOwnerUnavailable"; /** The owner candidate. */
+  readonly owner: URL;
+} | {
+  /**
+  * The owner's actor document does not list the collection as its
+  * `inbox`, `outbox`, `followers`, `following`, or `liked`.
+  */
+  readonly type: "collectionNotListedByOwner"; /** The owner. */
+  readonly owner: URL; /** The collection. */
+  readonly collectionId: URL;
+} | {
+  /**
+  * The unsecured collection was retrieved from a gateway that its owner
+  * does not list in its `gateways`.
+  */
+  readonly type: "untrustedGateway"; /** The owner. */
+  readonly owner: URL; /** The gateway that served the collection. */
+  readonly gateway: URL; /** The owner's gateways. */
+  readonly gateways: readonly URL[];
+};
+/**
+* The result of {@link verifyPortableObject}.
+* @since 2.4.0
+*/
+type VerifyPortableObjectResult = {
+  /** Whether the document is accepted. */readonly verified: true; /** The document carries valid Object Integrity Proofs. */
+  readonly method: "proof"; /** The public keys used by the verified proofs, in proof order. */
+  readonly keys: readonly Multikey[];
+  /**
+  * Opaque state for verifying the pages of a portable collection.  Do not
+  * inspect it; property accessors pass it back automatically.
+  */
+  readonly collectionContext?: unknown;
+} | {
+  /** Whether the document is accepted. */readonly verified: true;
+  /**
+  * The document is an unsecured portable collection served by a gateway
+  * that its owner lists.
+  */
+  readonly method: "gateway"; /** The document has no integrity proof. */
+  readonly unsecured: true; /** The actor that owns the collection. */
+  readonly owner: URL; /** The gateway that served the collection. */
+  readonly gateway: URL;
+  /**
+  * Opaque state for verifying the pages of a portable collection.  Do not
+  * inspect it; property accessors pass it back automatically.
+  */
+  readonly collectionContext: unknown;
+} | {
+  /** Whether the document is accepted. */readonly verified: false; /** Why the document was not accepted. */
+  readonly reason: VerifyPortableObjectFailureReason;
+};
+/**
+* Applies the [FEP-ef61] trust policy to a portable object fetched through
+* a gateway.
+*
+* Portable actors, activities, objects, and collections with proofs are
+* verified by {@link verifyPortableObjectProof}.  A portable collection or
+* collection page without a proof is accepted only if all of the following
+* hold:
+*
+*  -  It was retrieved from a gateway: its final URL (`documentUrl`) is
+*     a compatible identifier for the same portable collection.
+*  -  Its owner is determined unambiguously: the actor whose `inbox`,
+*     `outbox`, `followers`, `following`, or `liked` property referred to
+*     the collection, or the single actor in its `attributedTo`.  A page
+*     inherits the owner of the collection it was reached from through
+*     `first`, `last`, `current`, `next`, or `prev`, and must not name
+*     another collection in `partOf`.
+*  -  The owner's actor document is verified by its proof and lists the
+*     collection as its `inbox`, `outbox`, `followers`, `following`, or
+*     `liked`.
+*  -  The gateway that served the collection is in the owner's `gateways`.
+*
+* Where the document came from and which object referred to it are passed
+* by property accessors when this function is used as their
+* `verifyPortableObject` option.  Objects embedded in an unsecured
+* collection accepted this way are not trusted: accessors dereference and
+* verify them one by one.
+*
+* Note that acceptance through the gateway policy does not verify anything
+* cryptographically; it only means that the owner trusts the gateway.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param jsonLd The JSON-LD document to verify.
+* @param options Additional options.  See also
+*                {@link VerifyPortableObjectOptions}.
+* @returns The detailed result.
+* @throws {TypeError} If the input is not a single JSON-LD object or has a
+*                     malformed portable ID.
+* @since 2.4.0
+*/
+declare function verifyPortableObject(jsonLd: unknown, options?: VerifyPortableObjectOptions): Promise<VerifyPortableObjectResult>;
+//#endregion
+export { createSignature as C, verifyJsonLd as D, signJsonLd as E, verifySignature as O, attachSignature as S, hasSignatureLike as T, verifyProof as _, CreateProofOptions as a, VerifyJsonLdOptions as b, VerifyPortableObjectProofFailureReason as c, VerifyProofOptions as d, createProof as f, verifyPortableObjectProof as g, verifyObject as h, verifyPortableObject as i, VerifyPortableObjectProofOptions as l, signObject as m, VerifyPortableObjectOptions as n, SignObjectOptions as o, hasProofLike as p, VerifyPortableObjectResult as r, VerifyObjectOptions as s, VerifyPortableObjectFailureReason as t, VerifyPortableObjectProofResult as u, CreateSignatureOptions as v, detachSignature as w, VerifySignatureOptions as x, SignJsonLdOptions as y };

package/dist/mod.cjs

@@ -3,14 +3,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-DW5mt8FG.cjs");
-const require_federation = require("./federation-DDwszIrk.cjs");
+const require_http = require("./http-CVjwUCCu.cjs");
+const require_federation = require("./federation-BrsIzNK5.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-C2ER4VD7.cjs");
-const require_kv_cache = require("./kv-cache-LOyq_Ty6.cjs");
+const require_owner = require("./owner-CHBQ0sSj.cjs");
+const require_kv_cache = require("./kv-cache-D2O0JspA.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
-require("./sig/mod.cjs");
+const require_sig = require("./sig-dut4BzEW.cjs");
 require("./utils/mod.cjs");
 //#endregion
 exports.CircuitBreaker = require_federation.CircuitBreaker;
@@ -60,6 +60,7 @@ exports.signRequest = require_http.signRequest;
 exports.validateAcceptSignature = require_http.validateAcceptSignature;
 exports.verifyJsonLd = require_owner.verifyJsonLd;
 exports.verifyObject = require_owner.verifyObject;
+exports.verifyPortableObject = require_sig.verifyPortableObject;
 exports.verifyPortableObjectProof = require_owner.verifyPortableObjectProof;
 exports.verifyProof = require_owner.verifyProof;
 exports.verifyRequest = require_http.verifyRequest;

package/dist/mod.d.cts

@@ -6,13 +6,13 @@ import { $ as MessageQueue, A as ObjectCallbackSetters, At as InboxListener, B a
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-BhNbN8Ed.cjs";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.cjs";
 import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-Bfenkg_c.cjs";
-import { C as verifyJsonLd, S as signJsonLd, _ as VerifySignatureOptions, a as VerifyPortableObjectProofOptions, b as detachSignature, c as createProof, d as verifyObject, f as verifyPortableObjectProof, g as VerifyJsonLdOptions, h as SignJsonLdOptions, i as VerifyPortableObjectProofFailureReason, l as hasProofLike, m as CreateSignatureOptions, n as SignObjectOptions, o as VerifyPortableObjectProofResult, p as verifyProof, r as VerifyObjectOptions, s as VerifyProofOptions, t as CreateProofOptions, u as signObject, v as attachSignature, w as verifySignature, x as hasSignatureLike, y as createSignature } from "./mod-CVQFWefn.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-pLbeNwcC.cjs";
 import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-CyiSjRkk.cjs";
 export * from "@fedify/vocab-runtime";
 
 //#region src/mod.d.ts
 declare namespace mod_d_exports {
-  export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
+  export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
 }
 //#endregion
-export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
+export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/mod.d.ts

@@ -6,13 +6,13 @@ import { $ as MessageQueue, A as ObjectCallbackSetters, At as InboxListener, B a
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-BhNbN8Ed.js";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.js";
 import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-BhMvsgdF.js";
-import { C as verifyJsonLd, S as signJsonLd, _ as VerifySignatureOptions, a as VerifyPortableObjectProofOptions, b as detachSignature, c as createProof, d as verifyObject, f as verifyPortableObjectProof, g as VerifyJsonLdOptions, h as SignJsonLdOptions, i as VerifyPortableObjectProofFailureReason, l as hasProofLike, m as CreateSignatureOptions, n as SignObjectOptions, o as VerifyPortableObjectProofResult, p as verifyProof, r as VerifyObjectOptions, s as VerifyProofOptions, t as CreateProofOptions, u as signObject, v as attachSignature, w as verifySignature, x as hasSignatureLike, y as createSignature } from "./mod-CNRAxXEb.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-Dhm7SqyE.js";
 import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-C0BYc0OU.js";
 export * from "@fedify/vocab-runtime";
 
 //#region src/mod.d.ts
 declare namespace mod_d_exports {
-  export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
+  export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
 }
 //#endregion
-export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
+export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/mod.js

@@ -3,16 +3,16 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./rolldown-runtime-BC-Eo5Mj.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-DAtXl_Kc.js";
 import "./compat/mod.js";
-import { F as validateAcceptSignature, M as formatAcceptSignature, N as fulfillAcceptSignature, P as parseAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, i as verifyRequest, l as fetchKeyDetailed, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "./http-iLCx9vk-.js";
-import { a as respondWithObject, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as SendActivityError, l as CircuitBreaker, n as handleWebFinger, o as respondWithObjectIfAcceptable, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-1nes8_U-.js";
+import { F as validateAcceptSignature, M as formatAcceptSignature, N as fulfillAcceptSignature, P as parseAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, i as verifyRequest, l as fetchKeyDetailed, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "./http-99KVDtMr.js";
+import { a as respondWithObject, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as SendActivityError, l as CircuitBreaker, n as handleWebFinger, o as respondWithObjectIfAcceptable, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-CzYM4cJI.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { S as signJsonLd, T as verifySignature, a as signObject, c as verifyPortableObjectProof, g as detachSignature, h as createSignature, i as hasProofLike, n as getKeyOwner, p as attachSignature, r as createProof, s as verifyObject, t as doesActorOwnKey, u as verifyProof, w as verifyJsonLd, y as hasSignatureLike } from "./owner-SBgt2USF.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-bXLDSaRu.js";
+import { C as signJsonLd, E as verifySignature, T as verifyJsonLd, _ as detachSignature, a as signObject, b as hasSignatureLike, c as verifyPortableObjectProof, d as verifyProof, g as createSignature, i as hasProofLike, m as attachSignature, n as getKeyOwner, r as createProof, s as verifyObject, t as doesActorOwnKey } from "./owner-Cu_KMvQN.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-aijDx_jN.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";
-import "./sig/mod.js";
+import { t as verifyPortableObject } from "./sig-B8WDBV-h.js";
 import "./utils/mod.js";
 export * from "@fedify/vocab-runtime";
 //#endregion
-export { CircuitBreaker, InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError, SendActivityError, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
+export { CircuitBreaker, InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError, SendActivityError, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/nodeinfo/handler.test.mjs

@@ -5,7 +5,7 @@ import { r as createRequestContext } from "../context-DG5QeQ8W.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { b as handleNodeInfoJrd, o as createFederation, y as handleNodeInfo } from "../middleware-DohUu-Tz.mjs";
+import { b as handleNodeInfoJrd, o as createFederation, y as handleNodeInfo } from "../middleware-Cw8EWwAT.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {

package/dist/{owner-C2ER4VD7.cjs → owner-CHBQ0sSj.cjs}

@@ -1,6 +1,6 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
-const require_http = require("./http-DW5mt8FG.cjs");
+const require_http = require("./http-CVjwUCCu.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
@@ -1794,6 +1794,8 @@ async function preparePortableObjectProof(jsonLd, options) {
 	const proofValues = root[SECURITY_PROOF];
 	if (proofValues == null || Array.isArray(proofValues) && proofValues.length < 1) return {
 		prepared: false,
+		root,
+		objectType,
 		result: objectType === "collection" ? {
 			verified: false,
 			reason: { type: "unsecuredCollection" }
@@ -1897,6 +1899,8 @@ async function preparePortableObjectProof(jsonLd, options) {
 	}
 	return {
 		prepared: true,
+		root,
+		objectType,
 		objectId,
 		proofs,
 		rawProofValues,
@@ -1951,8 +1955,30 @@ async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
 * @since 2.4.0
 */
 async function verifyPortableObjectProof(jsonLd, options = {}) {
+	return (await verifyPortableObjectProofWithRoot(jsonLd, options)).result;
+}
+/**
+* Same as {@link verifyPortableObjectProof}, but also returns the expanded
+* root node and its FEP-2277 core type, so that a caller can apply further
+* policy, such as the gateway trust policy for unsecured collections, to the
+* same interpretation of the document.
+* @internal
+*/
+async function verifyPortableObjectProofWithRoot(jsonLd, options = {}) {
 	const prepared = await preparePortableObjectProof(jsonLd, options);
-	if (!prepared.prepared) return prepared.result;
+	if (!prepared.prepared) return {
+		result: prepared.result,
+		...prepared.root == null ? {} : { root: prepared.root },
+		...prepared.objectType == null ? {} : { objectType: prepared.objectType }
+	};
+	const { root, objectType } = prepared;
+	return {
+		result: await verifyPreparedPortableObjectProof(jsonLd, prepared, options),
+		root,
+		objectType
+	};
+}
+async function verifyPreparedPortableObjectProof(jsonLd, prepared, options) {
 	const { proofs, rawProofValues, proofContextLoader } = prepared;
 	const keys = [];
 	const rawProofCandidatePool = {
@@ -2394,6 +2420,12 @@ Object.defineProperty(exports, "verifyPortableObjectProofPolicy", {
 		return verifyPortableObjectProofPolicy;
 	}
 });
+Object.defineProperty(exports, "verifyPortableObjectProofWithRoot", {
+	enumerable: true,
+	get: function() {
+		return verifyPortableObjectProofWithRoot;
+	}
+});
 Object.defineProperty(exports, "verifyProof", {
 	enumerable: true,
 	get: function() {

package/dist/{owner-SBgt2USF.js → owner-Cu_KMvQN.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { I as name, L as version, c as fetchKey, f as validateCryptoKey, h as getFederationMetrics, m as getDurationMs, o as exportJwk, p as verifyKeyOwnership, s as fetchActorDocument, y as measureSignatureKeyFetch } from "./http-iLCx9vk-.js";
+import { I as name, L as version, c as fetchKey, f as validateCryptoKey, h as getFederationMetrics, m as getDurationMs, o as exportJwk, p as verifyKeyOwnership, s as fetchActorDocument, y as measureSignatureKeyFetch } from "./http-99KVDtMr.js";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, PUBLIC_COLLECTION, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
@@ -1791,6 +1791,8 @@ async function preparePortableObjectProof(jsonLd, options) {
 	const proofValues = root[SECURITY_PROOF];
 	if (proofValues == null || Array.isArray(proofValues) && proofValues.length < 1) return {
 		prepared: false,
+		root,
+		objectType,
 		result: objectType === "collection" ? {
 			verified: false,
 			reason: { type: "unsecuredCollection" }
@@ -1894,6 +1896,8 @@ async function preparePortableObjectProof(jsonLd, options) {
 	}
 	return {
 		prepared: true,
+		root,
+		objectType,
 		objectId,
 		proofs,
 		rawProofValues,
@@ -1948,8 +1952,30 @@ async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
 * @since 2.4.0
 */
 async function verifyPortableObjectProof(jsonLd, options = {}) {
+	return (await verifyPortableObjectProofWithRoot(jsonLd, options)).result;
+}
+/**
+* Same as {@link verifyPortableObjectProof}, but also returns the expanded
+* root node and its FEP-2277 core type, so that a caller can apply further
+* policy, such as the gateway trust policy for unsecured collections, to the
+* same interpretation of the document.
+* @internal
+*/
+async function verifyPortableObjectProofWithRoot(jsonLd, options = {}) {
 	const prepared = await preparePortableObjectProof(jsonLd, options);
-	if (!prepared.prepared) return prepared.result;
+	if (!prepared.prepared) return {
+		result: prepared.result,
+		...prepared.root == null ? {} : { root: prepared.root },
+		...prepared.objectType == null ? {} : { objectType: prepared.objectType }
+	};
+	const { root, objectType } = prepared;
+	return {
+		result: await verifyPreparedPortableObjectProof(jsonLd, prepared, options),
+		root,
+		objectType
+	};
+}
+async function verifyPreparedPortableObjectProof(jsonLd, prepared, options) {
 	const { proofs, rawProofValues, proofContextLoader } = prepared;
 	const keys = [];
 	const rawProofCandidatePool = {
@@ -2247,4 +2273,4 @@ async function getKeyOwner(keyId, options) {
 	return null;
 }
 //#endregion
-export { verifyCompactJsonLd as C, normalizeOutgoingActivityJsonLd as D, wrapContextLoaderForJsonLd as E, signJsonLd as S, verifySignature as T, getNormalizationContextLoader as _, signObject as a, isClearlyMalformedContextReference as b, verifyPortableObjectProof as c, InvalidContextReferenceError as d, assertSafeJsonLd as f, detachSignature as g, createSignature as h, hasProofLike as i, verifyPortableObjectProofPolicy as l, compactJsonLd as m, getKeyOwner as n, verifyMapLocalProof as o, attachSignature as p, createProof as r, verifyObject as s, doesActorOwnKey as t, verifyProof as u, hasSignature as v, verifyJsonLd as w, isInvalidUrlTypeError as x, hasSignatureLike as y };
+export { signJsonLd as C, wrapContextLoaderForJsonLd as D, verifySignature as E, normalizeOutgoingActivityJsonLd as O, isInvalidUrlTypeError as S, verifyJsonLd as T, detachSignature as _, signObject as a, hasSignatureLike as b, verifyPortableObjectProof as c, verifyProof as d, InvalidContextReferenceError as f, createSignature as g, compactJsonLd as h, hasProofLike as i, verifyPortableObjectProofPolicy as l, attachSignature as m, getKeyOwner as n, verifyMapLocalProof as o, assertSafeJsonLd as p, createProof as r, verifyObject as s, doesActorOwnKey as t, verifyPortableObjectProofWithRoot as u, getNormalizationContextLoader as v, verifyCompactJsonLd as w, isClearlyMalformedContextReference as x, hasSignature as y };