@fedify/fedify 2.4.0-dev.2077 → 2.4.0-dev.2093

package/dist/{http-Dvy_IwRa.cjs → http-DSaSAN7X.cjs}

@@ -3,19 +3,149 @@ const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
-let byte_encodings_hex = require("byte-encodings/hex");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let _fedify_vocab_runtime_internal_portable_dereference = require("@fedify/vocab-runtime/internal/portable-dereference");
+let byte_encodings_hex = require("byte-encodings/hex");
 let _fedify_vocab_runtime_jsonld = require("@fedify/vocab-runtime/jsonld");
 _fedify_vocab_runtime_jsonld = require_rolldown_runtime.__toESM(_fedify_vocab_runtime_jsonld, 1);
 let structured_field_values = require("structured-field-values");
+let byte_encodings_base64 = require("byte-encodings/base64");
 let _fedify_vocab_runtime_internal_signed_representation = require("@fedify/vocab-runtime/internal/signed-representation");
 let json_canon = require("json-canon");
 json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
-let byte_encodings_base64 = require("byte-encodings/base64");
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2077+c29a03d4";
+var version = "2.4.0-dev.2093+e9706a54";
+//#endregion
+//#region src/sig/portable-key-id.ts
+const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+/**
+* Checks whether the URL is an `ap:` or `ap+ef61:` URI.
+* @internal
+*/
+function isPortableUri(url) {
+	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
+}
+/**
+* Checks whether an ID identifies an [FEP-ef61] portable object, i.e., it is
+* an `ap:` or `ap+ef61:` URI, or looks like a compatible identifier.
+* A malformed compatible identifier counts too, so that it is rejected as
+* a portable object that no proof can match, rather than trusted by its web
+* origin.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isPortableId(id) {
+	if (typeof id === "string") {
+		if (/^ap(?:\+ef61)?:\/\//i.test(id)) return true;
+	} else if (isPortableUri(id)) return true;
+	return (0, _fedify_vocab_runtime_internal_portable_dereference.isCompatibleEf61Iri)(id);
+}
+/**
+* Gets the DID, i.e., the FEP-fe34 cryptographic origin, of an `ap:` or
+* `ap+ef61:` URI, a DID URL, or a compatible identifier.
+* @returns The DID, or `null` if the ID is none of them, or is malformed.
+* @internal
+*/
+function getPortableDid(id) {
+	try {
+		const raw = typeof id === "string" ? id : id.href;
+		if (/^(?:did:|ap(?:\+ef61)?:\/\/)/i.test(raw)) return (0, _fedify_vocab_runtime.getFe34Origin)(id);
+		const portable = (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(id);
+		return portable == null ? null : (0, _fedify_vocab_runtime.getFe34Origin)(portable);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Checks whether an activity is performed by an FEP-ef61 portable actor,
+* i.e., any of its actors has an `ap:` or `ap+ef61:` ID, or a compatible
+* identifier.
+* @internal
+*/
+function hasPortableActor(activity) {
+	return activity.actorIds.some((id) => isPortableId(id));
+}
+/**
+* Checks whether a key ID looks like an [FEP-ef61] compatible identifier,
+* i.e., an HTTP(S) URL under a gateway's `/.well-known/apgateway/did:` path.
+* Such a key ID names a key that a gateway holds for a portable actor, so it
+* is resolved only as a gateway key, and never cached in a key cache.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isCompatibleKeyId(keyId) {
+	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
+}
+/**
+* Gets the canonical portable ID of an actor ID that is either an `ap:` or
+* `ap+ef61:` URI or a compatible identifier.
+* @returns The canonical portable ID, or `null` if the ID is neither, or is
+*          malformed.
+* @internal
+*/
+function getCanonicalPortableId(id) {
+	try {
+		if (isPortableUri(id)) return (0, _fedify_vocab_runtime.canonicalizePortableUri)((0, _fedify_vocab_runtime.formatIri)(id));
+		const portable = (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(id);
+		if (portable == null) return null;
+		return (0, _fedify_vocab_runtime.canonicalizePortableUri)((0, _fedify_vocab_runtime.formatIri)(portable));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Builds the base of the key IDs of a gateway's keys for a portable actor:
+* the actor's compatible identifier on the gateway.
+* @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
+*                or a compatible identifier.  It must not have a fragment.
+* @param gateway The gateway's origin, e.g., `https://example.com`.
+* @returns The compatible identifier without query and fragment.
+* @throws {TypeError} If the actor ID is not a portable ID, or has
+*                     a fragment.
+* @internal
+*/
+function getGatewayKeyBase(actorId, gateway) {
+	let portable;
+	if (isPortableUri(actorId)) portable = actorId;
+	else try {
+		portable = (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(actorId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		portable = null;
+	}
+	if (portable == null) throw new TypeError(`The portable actor ID ${actorId.href} must be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier.`);
+	if (portable.hash !== "") throw new TypeError(`The portable actor ID ${actorId.href} must not have a fragment.`);
+	const base = (0, _fedify_vocab_runtime.toCompatibleEf61Id)(portable, gateway);
+	base.search = "";
+	base.hash = "";
+	return base;
+}
+/**
+* Tells whether a parsed document is a portable actor, i.e., an actor whose
+* ID is an `ap:` or `ap+ef61:` URI or a compatible identifier.  Such an actor
+* is never authenticated by the web origin that served it; at a compatible
+* key ID, it makes the key a gateway key that only
+* {@link verifyPortableGatewayKeyDocument} can vouch for.
+* @internal
+*/
+function isPortableActorDocument(object) {
+	return (0, _fedify_vocab.isActor)(object) && object.id != null && isPortableId(object.id);
+}
+/**
+* Compares two public keys by their key material.
+* @internal
+*/
+async function isSamePublicKey(a, b) {
+	if (a.algorithm.name !== b.algorithm.name) return false;
+	const [x, y] = await Promise.all([crypto.subtle.exportKey("jwk", a), crypto.subtle.exportKey("jwk", b)]);
+	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
+}
 //#endregion
 //#region ../../node_modules/.pnpm/temporal-polyfill@1.0.1/node_modules/temporal-polyfill/chunks/root.js
 const NativeTemporal = globalThis.Temporal;
@@ -3739,440 +3869,44 @@ const preloadedOnlyDocumentLoader = (url) => {
 	return Promise.reject(/* @__PURE__ */ new Error("Refusing to fetch a non-preloaded JSON-LD context: " + url));
 };
 //#endregion
-//#region src/compat/secured-document.ts
-function isJsonMap$1(value) {
-	return typeof value === "object" && value != null && !Array.isArray(value);
-}
-function isNonEmptyString(value) {
-	return typeof value === "string" && value.length > 0;
-}
-function hasDataIntegrityProofType(value) {
-	return (Array.isArray(value) ? value : [value]).some((type) => type === "DataIntegrityProof" || type === "https://w3id.org/security#DataIntegrityProof");
-}
-/**
-* Checks whether a JSON value is a complete, self-contained secured document:
-* a map with its own `@context` and exactly one direct, map-valued `proof`
-* that carries every member `eddsa-jcs-2022` proof generation produces.
-*
-* This is deliberately stricter than {@link hasProofLike}, which exists to
-* decide whether a document is worth verifying.  Here a false positive would
-* silently suppress a wire-compatibility fix on an ordinary document, so a
-* partial or malformed proof does not qualify.
-*
-* @internal
-*/
-function isSelfContainedSecuredDocument(value) {
-	if (!isJsonMap$1(value)) return false;
-	if (!Object.hasOwn(value, "@context") || value["@context"] == null) return false;
-	if (!Object.hasOwn(value, "proof")) return false;
-	const proof = value.proof;
-	if (!isJsonMap$1(proof)) return false;
-	return hasDataIntegrityProofType(proof.type) && isNonEmptyString(proof.cryptosuite) && isNonEmptyString(proof.created) && isNonEmptyString(proof.verificationMethod) && isNonEmptyString(proof.proofPurpose) && isNonEmptyString(proof.proofValue);
-}
-//#endregion
-//#region src/compat/public-audience.ts
-const logger$4 = (0, _logtape_logtape.getLogger)([
-	"fedify",
-	"compat",
-	"public-audience"
-]);
-const PUBLIC_ADDRESSING_FIELDS = /* @__PURE__ */ new Set([
-	"to",
-	"cc",
-	"bto",
-	"bcc",
-	"audience"
-]);
-const AS_CONTEXT_URL$1 = "https://www.w3.org/ns/activitystreams";
-const MAX_TRAVERSAL_DEPTH$1 = 64;
-const KNOWN_SAFE_CONTEXT_URLS$1 = new Set(Object.keys(_fedify_vocab_runtime.preloadedContexts));
-function hasPublicCurieInAddressing(value, preserveSecured, parentKey, depth = 0) {
-	if (typeof value === "string") return parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public");
-	if (depth >= MAX_TRAVERSAL_DEPTH$1) return false;
-	if (Array.isArray(value)) return value.some((item) => hasPublicCurieInAddressing(item, preserveSecured, parentKey, depth + 1));
-	if (typeof value !== "object" || value == null) return false;
-	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(value)) return false;
-	const record = value;
-	for (const key of Object.keys(record)) {
-		if (record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public")) return true;
-		if (key === "@context") continue;
-		if (hasPublicCurieInAddressing(record[key], preserveSecured, key, depth + 1)) return true;
-	}
-	return false;
-}
-function rewritePublicAudience(value, preserveSecured, parentKey, depth = 0) {
-	if (typeof value === "string" && parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public")) return _fedify_vocab.PUBLIC_COLLECTION.href;
-	if (depth >= MAX_TRAVERSAL_DEPTH$1) return value;
-	if (Array.isArray(value)) {
-		let changed = false;
-		const mapped = value.map((item) => {
-			const rewritten = rewritePublicAudience(item, preserveSecured, parentKey, depth + 1);
-			if (rewritten !== item) changed = true;
-			return rewritten;
-		});
-		return changed ? mapped : value;
-	}
-	if (typeof value !== "object" || value == null) return value;
-	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(value)) return value;
-	const record = value;
-	let changed = false;
-	const normalized = Object.create(null);
-	for (const key of Object.keys(record)) {
-		const rewritten = key === "@context" ? record[key] : record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public") ? _fedify_vocab.PUBLIC_COLLECTION.href : rewritePublicAudience(record[key], preserveSecured, key, depth + 1);
-		if (rewritten !== record[key]) changed = true;
-		normalized[key] = rewritten;
-	}
-	return changed ? normalized : value;
-}
-/**
-* Reports whether `value` carries an `@context` property anywhere inside
-* its subtree (not counting the value itself).  A nested `@context` can
-* introduce a local term-definition scope that redefines `as:` or `Public`
-* even when the top-level `@context` is safe, so the fast path must defer
-* to the URDNA2015 equivalence check whenever one is present.
-*/
-function hasNestedContext$1(value, depth = 0) {
-	if (depth >= MAX_TRAVERSAL_DEPTH$1) return true;
-	if (Array.isArray(value)) return value.some((item) => hasNestedContext$1(item, depth + 1));
-	if (typeof value !== "object" || value == null) return false;
-	const record = value;
-	for (const key of Object.keys(record)) {
-		if (key === "@context") return true;
-		if (hasNestedContext$1(record[key], depth + 1)) return true;
-	}
-	return false;
-}
-/**
-* Checks whether the `@context` of a JSON-LD document is guaranteed not
-* to redefine the `as:` prefix or the bare `Public` term.  Only documents
-* whose `@context` is a string, or an array of strings, drawn from Fedify's
-* preloaded context set AND including the ActivityStreams URL qualify,
-* AND no nested subtree carries its own `@context` that might redefine
-* those terms within a local scope.  When all of that holds the rewrite
-* is provably semantics-preserving and the URDNA2015 equivalence check
-* can be skipped.  Any other shape (unknown external URLs, inline
-* objects at the top level, nested `@context` blocks) is treated as
-* potentially unsafe.
-*/
-function hasKnownSafeContext$1(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	const record = jsonLd;
-	if (!Object.hasOwn(record, "@context")) return false;
-	const ctx = record["@context"];
-	const entries = typeof ctx === "string" ? [ctx] : Array.isArray(ctx) ? ctx : null;
-	if (entries == null || entries.length === 0) return false;
-	let hasAs = false;
-	for (const entry of entries) {
-		if (typeof entry !== "string") return false;
-		if (!KNOWN_SAFE_CONTEXT_URLS$1.has(entry)) return false;
-		if (entry === AS_CONTEXT_URL$1) hasAs = true;
-	}
-	if (!hasAs) return false;
-	for (const key of Object.keys(record)) {
-		if (key === "@context") continue;
-		if (hasNestedContext$1(record[key])) return false;
-	}
-	return true;
-}
-/**
-* Rewrites the compact `as:Public` / `Public` CURIE appearing in activity
-* addressing fields (`to`, `cc`, `bto`, `bcc`, `audience`) to the fully
-* expanded `https://www.w3.org/ns/activitystreams#Public` URI.
-*
-* Several ActivityPub implementations, Lemmy among them, match these
-* fields as plain URLs without running JSON-LD expansion, and silently
-* drop activities whose public addressing appears in CURIE form.  This
-* helper works around that gap.
-*
-* For documents whose `@context` is drawn entirely from Fedify's
-* preloaded context set and includes the ActivityStreams URL, the
-* rewrite is applied directly: the content of every preloaded non-AS
-* context is known not to redefine the `as:` prefix or the bare `Public`
-* term, so the semantics are preserved by construction.  Any other
-* shape (an inline object, an unknown external URL, and so on) is
-* treated as potentially unsafe and gated on a JSON-LD equivalence
-* check; both forms are canonicalized with URDNA2015 and the resulting
-* N-Quads are compared.  When they differ, the original document is
-* returned unchanged.  Canonicalization failures also fall back to the
-* original document.
-*
-* When no `contextLoader` is supplied the helper falls back to an
-* internal loader that resolves only the URLs in Fedify's
-* preloaded-contexts set and rejects every other URL without issuing a
-* network request.  That behaviour is deliberately narrower than
-* `@fedify/vocab-runtime`'s `getDocumentLoader()`, which after its
-* `validatePublicUrl` check will happily fetch non-preloaded URLs: the
-* helper is reached from verification paths (`verifyProof()` /
-* `verifyObject()`) that operate on inbound, potentially adversarial
-* JSON-LD, and a default loader that fetches attacker-supplied
-* `@context` URLs on the caller's behalf would be an SSRF vector.
-* Canonicalization failures against the restricted loader fall back to
-* the original document, same as any other canonicalization error.
-* Callers that genuinely need the remote-fetch loader (for example
-* applications that sign local JSON-LD against a custom vocabulary)
-* should pass a `contextLoader` explicitly.
-*
-* Must be called before any signing step that canonicalizes the
-* compact form byte-for-byte (for example, Object Integrity Proofs
-* using the `eddsa-jcs-2022` cryptosuite), so the signed payload
-* matches what is sent on the wire.
-*/
-async function normalizePublicAudience(jsonLd, contextLoader, options = {}) {
-	const preserveSecured = options.preserveNestedSecuredDocuments ?? false;
-	if (!hasPublicCurieInAddressing(jsonLd, preserveSecured)) return jsonLd;
-	const normalized = rewritePublicAudience(jsonLd, preserveSecured);
-	if (hasKnownSafeContext$1(jsonLd)) return normalized;
-	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
-	try {
-		const [before, after] = await Promise.all([_fedify_vocab_runtime_jsonld.default.canonize(jsonLd, {
-			format: "application/n-quads",
-			documentLoader: loader
-		}), _fedify_vocab_runtime_jsonld.default.canonize(normalized, {
-			format: "application/n-quads",
-			documentLoader: loader
-		})]);
-		if (before === after) return normalized;
-		logger$4.warn("Expanding the public audience CURIE to its full URI would change the canonical form of the activity; sending the activity as is.  This usually means the active JSON-LD context redefines the `as:` prefix or the bare `Public` term.");
-	} catch (error) {
-		logger$4.debug("Failed to verify public audience normalization equivalence via JSON-LD canonicalization; sending the activity as is.\n{error}", { error });
-	}
-	return jsonLd;
-}
-//#endregion
-//#region src/compat/outgoing-jsonld.ts
-const logger$3 = (0, _logtape_logtape.getLogger)([
-	"fedify",
-	"compat",
-	"outgoing-jsonld"
-]);
-const ATTACHMENT_FIELDS = /* @__PURE__ */ new Set(["attachment", "https://www.w3.org/ns/activitystreams#attachment"]);
-const AS_CONTEXT_URL = "https://www.w3.org/ns/activitystreams";
-const KNOWN_SAFE_CONTEXT_URLS = getKnownSafeContextUrls();
-const MAX_TRAVERSAL_DEPTH = 64;
-function isJsonLdListObject(value) {
-	return typeof value === "object" && value != null && Object.hasOwn(value, "@list");
-}
-function isJsonLdValueObject(value) {
-	return typeof value === "object" && value != null && Object.hasOwn(value, "@value");
-}
-function* getContextObjects(value, seen = /* @__PURE__ */ new WeakSet()) {
-	if (Array.isArray(value)) {
-		if (seen.has(value)) return;
-		seen.add(value);
-		for (const item of value) yield* getContextObjects(item, seen);
-		return;
-	}
-	if (typeof value === "object" && value != null) {
-		if (seen.has(value)) return;
-		seen.add(value);
-		const record = value;
-		yield record;
-		for (const definition of Object.values(record)) {
-			if (typeof definition !== "object" || definition == null) continue;
-			const nestedContext = definition["@context"];
-			if (nestedContext == null) continue;
-			yield* getContextObjects(nestedContext, seen);
-		}
-	}
-}
-function isActivityStreamsAttachmentTerm(value) {
-	return typeof value === "object" && value != null && value["@id"] === "as:attachment" && value["@type"] === "@id";
-}
-/** @internal */
-function isPreloadedContextAttachmentSafe(document) {
-	if (typeof document !== "object" || document == null) return true;
-	const context = document["@context"];
-	for (const contextObject of getContextObjects(context)) {
-		if (!Object.hasOwn(contextObject, "attachment")) continue;
-		if (isActivityStreamsAttachmentTerm(contextObject.attachment)) continue;
-		return false;
-	}
-	return true;
-}
-function getKnownSafeContextUrls() {
-	const urls = /* @__PURE__ */ new Set();
-	for (const [url, document] of Object.entries(_fedify_vocab_runtime.preloadedContexts)) if (isPreloadedContextAttachmentSafe(document)) urls.add(url);
-	else logger$3.warn("Preloaded JSON-LD context {contextUrl} redefines the `attachment` term incompatibly; attachment array normalization will require canonicalization for documents using it.", { contextUrl: url });
-	return urls;
-}
-/**
-* Wraps scalar ActivityStreams attachment properties in arrays.
-*/
-function wrapScalarAttachments(jsonLd, preserveSecured, depth = 0) {
-	if (depth >= MAX_TRAVERSAL_DEPTH) return jsonLd;
-	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(jsonLd)) return jsonLd;
-	if (Array.isArray(jsonLd)) {
-		let normalized = null;
-		for (let i = 0; i < jsonLd.length; i++) {
-			const item = jsonLd[i];
-			const next = wrapScalarAttachments(item, preserveSecured, depth + 1);
-			if (normalized == null && next !== item) normalized = jsonLd.slice(0, i);
-			if (normalized != null) normalized[i] = next;
-		}
-		return normalized ?? jsonLd;
-	}
-	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
-	const record = jsonLd;
-	const keys = Object.keys(record);
-	let normalized = null;
-	for (let i = 0; i < keys.length; i++) {
-		const key = keys[i];
-		const value = record[key];
-		const next = key === "@context" || key === "@value" && isJsonLdValueObject(jsonLd) ? value : wrapScalarAttachments(value, preserveSecured, depth + 1);
-		const output = ATTACHMENT_FIELDS.has(key) && next != null && !Array.isArray(next) && !isJsonLdListObject(next) ? [next] : next;
-		if (normalized == null && output !== value) {
-			const cloned = Object.create(null);
-			for (let j = 0; j < i; j++) {
-				const previousKey = keys[j];
-				cloned[previousKey] = record[previousKey];
-			}
-			normalized = cloned;
-		}
-		if (normalized != null) normalized[key] = output;
-	}
-	return normalized ?? jsonLd;
-}
-function hasNestedContext(value, depth = 0) {
-	if (depth >= MAX_TRAVERSAL_DEPTH) return true;
-	if (Array.isArray(value)) return value.some((item) => hasNestedContext(item, depth + 1));
-	if (typeof value !== "object" || value == null) return false;
-	const record = value;
-	for (const key of Object.keys(record)) {
-		if (key === "@context") return true;
-		if (key === "@value" && isJsonLdValueObject(value)) continue;
-		if (hasNestedContext(record[key], depth + 1)) return true;
-	}
-	return false;
-}
-function exceedsTraversalDepth(value, depth = 0) {
-	if (depth >= MAX_TRAVERSAL_DEPTH) return true;
-	if (Array.isArray(value)) return value.some((item) => exceedsTraversalDepth(item, depth + 1));
-	if (typeof value !== "object" || value == null) return false;
-	const record = value;
-	for (const key of Object.keys(record)) {
-		if (key === "@context" || key === "@value" && isJsonLdValueObject(value)) continue;
-		if (exceedsTraversalDepth(record[key], depth + 1)) return true;
-	}
-	return false;
-}
-function hasKnownSafeContext(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	const record = jsonLd;
-	if (!Object.hasOwn(record, "@context")) return false;
-	const context = record["@context"];
-	const entries = typeof context === "string" ? [context] : Array.isArray(context) ? context : null;
-	if (entries == null || entries.length < 1) return false;
-	let hasActivityStreamsContext = false;
-	for (const entry of entries) {
-		if (typeof entry !== "string") return false;
-		if (!KNOWN_SAFE_CONTEXT_URLS.has(entry)) return false;
-		if (entry === AS_CONTEXT_URL) hasActivityStreamsContext = true;
-	}
-	if (!hasActivityStreamsContext) return false;
-	for (const key of Object.keys(record)) {
-		if (key === "@context") continue;
-		if (hasNestedContext(record[key])) return false;
-	}
-	return true;
-}
-function getLogSafeJsonLdMetadata(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return {};
-	const record = jsonLd;
-	const context = record["@context"];
-	return {
-		id: typeof record.id === "string" ? record.id : typeof record["@id"] === "string" ? record["@id"] : void 0,
-		type: typeof record.type === "string" ? record.type : typeof record["@type"] === "string" ? record["@type"] : void 0,
-		context: typeof context === "string" ? context : Array.isArray(context) ? context.filter((entry) => typeof entry === "string").slice(0, 4) : context == null ? void 0 : "[inline context]"
-	};
-}
-/**
-* Ensures ActivityStreams attachment properties are represented as arrays
-* when doing so preserves the JSON-LD semantics.
-*
-* JSON-LD compaction collapses single-item arrays into scalar values by
-* default.  Some ActivityPub implementations, Pixelfed among them, parse
-* `attachment` as a plain JSON array rather than a JSON-LD property and reject
-* otherwise valid objects whose single attachment is emitted as a scalar.
-*
-* When no `contextLoader` is supplied, the helper falls back to a restricted
-* loader that resolves only Fedify's preloaded JSON-LD contexts and rejects
-* every other URL without network access.  Documents with custom, inline, or
-* otherwise uncached contexts should pass a real `contextLoader` if they need
-* the semantic-preservation check to succeed; otherwise canonicalization
-* failures leave the original document unchanged.
-*/
-async function normalizeAttachmentArrays(jsonLd, contextLoader, options = {}) {
-	const normalized = wrapScalarAttachments(jsonLd, options.preserveNestedSecuredDocuments ?? false);
-	if (normalized === jsonLd) return jsonLd;
-	if (exceedsTraversalDepth(jsonLd)) {
-		logger$3.debug("Skipping attachment array normalization because the JSON-LD document exceeds the safe traversal depth; leaving it unchanged.");
-		return jsonLd;
-	}
-	if (hasKnownSafeContext(jsonLd)) return normalized;
-	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
-	try {
-		const [before, after] = await Promise.all([_fedify_vocab_runtime_jsonld.default.canonize(jsonLd, {
-			format: "application/n-quads",
-			documentLoader: loader
-		}), _fedify_vocab_runtime_jsonld.default.canonize(normalized, {
-			format: "application/n-quads",
-			documentLoader: loader
-		})]);
-		if (before === after) return normalized;
-		logger$3.warn("Wrapping scalar attachment values in arrays would change the canonical form of the JSON-LD document; leaving it unchanged.  This usually means the active JSON-LD context redefines the `attachment` term.  Document: {id}; type: {type}; context: {context}.", getLogSafeJsonLdMetadata(jsonLd));
-	} catch (error) {
-		logger$3.debug("Failed to verify attachment array normalization equivalence via JSON-LD canonicalization; leaving the JSON-LD document unchanged.\n{error}", { error });
-	}
-	return jsonLd;
-}
-/**
-* Applies Fedify's internal JSON-LD wire-format interoperability workarounds
-* to locally generated outgoing activities before they are signed, enqueued,
-* or sent.
-*/
-async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, options = {}) {
-	jsonLd = await normalizePublicAudience(jsonLd, contextLoader, options);
-	return await normalizeAttachmentArrays(jsonLd, contextLoader, options);
-}
-//#endregion
-//#region src/federation/metrics.ts
-var FederationMetrics = class {
-	deliverySent;
-	deliveryPermanentFailure;
-	signatureVerificationFailure;
-	signatureVerificationDuration;
-	signatureKeyFetchDuration;
-	deliveryDuration;
-	inboxProcessingDuration;
-	httpServerRequestCount;
-	httpServerRequestDuration;
-	queueTaskEnqueued;
-	queueTaskStarted;
-	queueTaskCompleted;
-	queueTaskFailed;
-	queueTaskDuration;
-	queueTaskInFlight;
-	queueDepth;
-	fanoutRecipients;
-	inboxActivity;
-	outboxActivity;
-	circuitBreakerStateChange;
-	keyLookup;
-	keyLookupDuration;
-	documentFetch;
-	documentFetchDuration;
-	documentCache;
-	webFingerHandle;
-	webFingerHandleDuration;
-	collectionRequest;
-	collectionDispatchDuration;
-	collectionPageItems;
-	collectionTotalItems;
-	constructor(meterProvider) {
-		const meter = meterProvider.getMeter(name, version);
-		this.deliverySent = meter.createCounter("activitypub.delivery.sent", {
-			description: "ActivityPub delivery attempts.",
-			unit: "{attempt}"
+//#region src/federation/metrics.ts
+var FederationMetrics = class {
+	deliverySent;
+	deliveryPermanentFailure;
+	signatureVerificationFailure;
+	signatureVerificationDuration;
+	signatureKeyFetchDuration;
+	deliveryDuration;
+	inboxProcessingDuration;
+	httpServerRequestCount;
+	httpServerRequestDuration;
+	queueTaskEnqueued;
+	queueTaskStarted;
+	queueTaskCompleted;
+	queueTaskFailed;
+	queueTaskDuration;
+	queueTaskInFlight;
+	queueDepth;
+	fanoutRecipients;
+	inboxActivity;
+	outboxActivity;
+	circuitBreakerStateChange;
+	keyLookup;
+	keyLookupDuration;
+	documentFetch;
+	documentFetchDuration;
+	documentCache;
+	webFingerHandle;
+	webFingerHandleDuration;
+	collectionRequest;
+	collectionDispatchDuration;
+	collectionPageItems;
+	collectionTotalItems;
+	constructor(meterProvider) {
+		const meter = meterProvider.getMeter(name, version);
+		this.deliverySent = meter.createCounter("activitypub.delivery.sent", {
+			description: "ActivityPub delivery attempts.",
+			unit: "{attempt}"
 		});
 		this.deliveryPermanentFailure = meter.createCounter("activitypub.delivery.permanent_failure", {
 			description: "ActivityPub deliveries abandoned as permanent failures.",
@@ -4945,99 +4679,6 @@ function getDurationMs(start) {
 	return Math.max(0, performance.now() - start);
 }
 //#endregion
-//#region src/sig/portable-key-id.ts
-const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
-/**
-* Checks whether the URL is an `ap:` or `ap+ef61:` URI.
-* @internal
-*/
-function isPortableUri(url) {
-	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
-}
-/**
-* Checks whether an activity is performed by an FEP-ef61 portable actor,
-* i.e., any of its actors has an `ap:` or `ap+ef61:` ID.
-* @internal
-*/
-function hasPortableActor(activity) {
-	return activity.actorIds.some(isPortableUri);
-}
-/**
-* Checks whether a key ID looks like an [FEP-ef61] compatible identifier,
-* i.e., an HTTP(S) URL under a gateway's `/.well-known/apgateway/did:` path.
-* Such a key ID names a key that a gateway holds for a portable actor, so it
-* is resolved only as a gateway key, and never cached in a key cache.
-*
-* [FEP-ef61]: https://w3id.org/fep/ef61
-* @internal
-*/
-function isCompatibleKeyId(keyId) {
-	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
-}
-/**
-* Gets the canonical portable ID of an actor ID that is either an `ap:` or
-* `ap+ef61:` URI or a compatible identifier.
-* @returns The canonical portable ID, or `null` if the ID is neither, or is
-*          malformed.
-* @internal
-*/
-function getCanonicalPortableId(id) {
-	try {
-		if (isPortableUri(id)) return (0, _fedify_vocab_runtime.canonicalizePortableUri)((0, _fedify_vocab_runtime.formatIri)(id));
-		const portable = (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(id);
-		if (portable == null) return null;
-		return (0, _fedify_vocab_runtime.canonicalizePortableUri)((0, _fedify_vocab_runtime.formatIri)(portable));
-	} catch (error) {
-		if (error instanceof TypeError) return null;
-		throw error;
-	}
-}
-/**
-* Builds the base of the key IDs of a gateway's keys for a portable actor:
-* the actor's compatible identifier on the gateway.
-* @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
-*                or a compatible identifier.  It must not have a fragment.
-* @param gateway The gateway's origin, e.g., `https://example.com`.
-* @returns The compatible identifier without query and fragment.
-* @throws {TypeError} If the actor ID is not a portable ID, or has
-*                     a fragment.
-* @internal
-*/
-function getGatewayKeyBase(actorId, gateway) {
-	let portable;
-	if (isPortableUri(actorId)) portable = actorId;
-	else try {
-		portable = (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(actorId);
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		portable = null;
-	}
-	if (portable == null) throw new TypeError(`The portable actor ID ${actorId.href} must be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier.`);
-	if (portable.hash !== "") throw new TypeError(`The portable actor ID ${actorId.href} must not have a fragment.`);
-	const base = (0, _fedify_vocab_runtime.toCompatibleEf61Id)(portable, gateway);
-	base.search = "";
-	base.hash = "";
-	return base;
-}
-/**
-* Tells whether a parsed document at a compatible key ID is a portable actor,
-* which makes the key a gateway key that only
-* {@link verifyPortableGatewayKeyDocument} can vouch for.
-* @internal
-*/
-function isPortableActorDocument(object) {
-	return (0, _fedify_vocab.isActor)(object) && object.id != null && isPortableUri(object.id);
-}
-/**
-* Compares two public keys by their key material.
-* @internal
-*/
-async function isSamePublicKey(a, b) {
-	if (a.algorithm.name !== b.algorithm.name) return false;
-	const [x, y] = await Promise.all([crypto.subtle.exportKey("jwk", a), crypto.subtle.exportKey("jwk", b)]);
-	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
-}
-//#endregion
 //#region src/sig/key.ts
 /**
 * Checks if the given key is valid and supported.  No-op if the key is valid,
@@ -5138,6 +4779,10 @@ async function fetchActorDocument(actorId, options = {}) {
 		"sig",
 		"key"
 	]);
+	if (isPortableId(actorId)) {
+		logger.debug("The actor {actorId} is a portable actor, which is not authenticated by the web origin that serves it.", { actorId: actorId.href });
+		return null;
+	}
 	const documentLoader = options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
 	const contextLoader = options.contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
 	const { tracerProvider } = options;
@@ -5171,6 +4816,13 @@ async function fetchActorDocument(actorId, options = {}) {
 		return null;
 	}
 	if (!(0, _fedify_vocab.isActor)(object)) return null;
+	if (object.id != null && isPortableId(object.id)) {
+		logger.debug("The document served at {documentUrl} claims to be the portable actor {actorId}, which is not authenticated by the web origin that serves it.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
 	if (object.id == null || object.id.origin !== documentUrl.origin) {
 		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
 			documentUrl: documentUrl.href,
@@ -5314,992 +4966,1409 @@ async function fetchKeyDetailed(keyId, cls, options = {}) {
 				logger.debug("Entry {keyId} found in cache with preserved fetch failure details.", { keyId });
 				return {
 					key: null,
-					cached: true,
-					fetchError
+					cached: true,
+					fetchError
+				};
+			}
+			logger.debug("Entry {keyId} found in cache, but no fetch failure details are available.", { keyId });
+			return {
+				key: null,
+				cached: true
+			};
+		}, async (error, cacheKey, keyId, keyCache, logger) => {
+			logger.debug("Failed to fetch key {keyId}.", {
+				keyId,
+				error
+			});
+			await keyCache?.set(cacheKey, null);
+			if (error instanceof _fedify_vocab_runtime.FetchError && error.response != null) {
+				const fetchError = {
+					status: error.response.status,
+					response: error.response.clone()
+				};
+				await keyCache?.setFetchError?.(cacheKey, fetchError);
+				return {
+					key: null,
+					cached: false,
+					fetchError
+				};
+			}
+			const fetchError = { error: error instanceof Error ? error : new Error(String(error)) };
+			await keyCache?.setFetchError?.(cacheKey, fetchError);
+			return {
+				key: null,
+				cached: false,
+				fetchError
+			};
+		});
+	});
+}
+async function getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger) {
+	if (keyCache == null) return null;
+	const cachedKey = await keyCache.get(cacheKey);
+	const hit = checkCachedKeyHit(cachedKey, keyId, cls, logger);
+	if (hit != null) return hit;
+	if (cachedKey === null) {
+		logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
+		return {
+			key: null,
+			cached: true
+		};
+	}
+	return null;
+}
+function checkCachedKeyHit(cachedKey, keyId, cls, logger) {
+	if (cachedKey instanceof cls && cachedKey.publicKey != null) {
+		logger.debug("Key {keyId} found in cache.", { keyId });
+		return {
+			key: cachedKey,
+			cached: true
+		};
+	}
+	return null;
+}
+async function clearFetchErrorMetadata(keyId, keyCache) {
+	await keyCache?.setFetchError?.(keyId, null);
+}
+/**
+* Returns the identifier a fragment-bearing DID URL is a fragment of, or
+* `null` if the URL is not a DID URL.  `did:web:example.com#key` is thereby
+* traced back to `did:web:example.com`, the DID that resolving the key went
+* through in the first place.
+*/
+function stripFragment(keyId) {
+	if (keyId.protocol !== "did:") return null;
+	const did = new URL(keyId.href);
+	did.hash = "";
+	return did;
+}
+function isDidKeyUrl(keyId) {
+	return keyId.protocol === "did:" && keyId.pathname.startsWith("key:");
+}
+async function doRawKeysMatch(left, right) {
+	const [leftRaw, rightRaw] = await Promise.all([crypto.subtle.exportKey("raw", left), crypto.subtle.exportKey("raw", right)]);
+	if (leftRaw.byteLength !== rightRaw.byteLength) return false;
+	const leftBytes = new Uint8Array(leftRaw);
+	const rightBytes = new Uint8Array(rightRaw);
+	return leftBytes.every((byte, index) => byte === rightBytes[index]);
+}
+async function isCachedDidKeyValid(key, verificationMethod) {
+	try {
+		return key.id?.href === verificationMethod.id.href && key.controllerId?.href === verificationMethod.controller.href && await doRawKeysMatch(key.publicKey, verificationMethod.publicKey);
+	} catch {
+		return false;
+	}
+}
+async function resolveDidKey(cacheKey, cls, keyCache, logger) {
+	if (!isDidKeyUrl(cacheKey)) return null;
+	const keyId = cacheKey.href;
+	if (!(cls === _fedify_vocab.Multikey)) {
+		logger.debug("Failed to resolve did:key {keyId}; did:key verification methods are only supported as Multikey values.", { keyId });
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	let verificationMethod;
+	try {
+		verificationMethod = await (0, _fedify_vocab_runtime.parseDidKeyVerificationMethod)(cacheKey);
+	} catch (error) {
+		logger.debug("Failed to resolve did:key verification method {keyId}: {error}", {
+			keyId,
+			error
+		});
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	const hit = checkCachedKeyHit(await keyCache?.get(cacheKey), keyId, cls, logger);
+	if (hit?.key instanceof _fedify_vocab.Multikey && await isCachedDidKeyValid(hit.key, verificationMethod)) return hit;
+	const key = new _fedify_vocab.Multikey({
+		id: verificationMethod.id,
+		controller: verificationMethod.controller,
+		publicKey: verificationMethod.publicKey
+	});
+	await keyCache?.set(cacheKey, key);
+	await clearFetchErrorMetadata(cacheKey, keyCache);
+	logger.debug("Resolved did:key verification method {keyId}.", { keyId });
+	return {
+		key,
+		cached: false
+	};
+}
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableGatewayKeyResolver }, logger) {
+	let object;
+	try {
+		object = await _fedify_vocab.Object.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		});
+	} catch (e) {
+		if (!(e instanceof TypeError)) throw e;
+		try {
+			object = await cls.fromJsonLd(document, {
+				documentLoader,
+				contextLoader,
+				tracerProvider
+			});
+		} catch (e) {
+			if (e instanceof TypeError) {
+				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+				await keyCache?.set(cacheKey, null);
+				await clearFetchErrorMetadata(cacheKey, keyCache);
+				return {
+					key: null,
+					cached: false
 				};
 			}
-			logger.debug("Entry {keyId} found in cache, but no fetch failure details are available.", { keyId });
+			throw e;
+		}
+	}
+	if (isCompatibleKeyId(cacheKey) && isPortableActorDocument(object)) {
+		if (portableGatewayKeyResolver == null || cls !== _fedify_vocab.CryptographicKey) {
+			logger.debug("Failed to verify; key {keyId} is a gateway key of the portable actor {actorId}, which is only accepted for HTTP Signatures.", {
+				keyId,
+				actorId: object.id?.href
+			});
 			return {
 				key: null,
-				cached: true
+				cached: false
 			};
-		}, async (error, cacheKey, keyId, keyCache, logger) => {
-			logger.debug("Failed to fetch key {keyId}.", {
+		}
+		const resolution = await portableGatewayKeyResolver(document, object, cacheKey);
+		if (resolution.type !== "verified") {
+			logger.debug("Failed to verify; the portable actor {actorId} does not vouch for its gateway key {keyId}.", {
 				keyId,
-				error
+				actorId: object.id?.href
+			});
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		return {
+			key: resolution.key,
+			cached: false
+		};
+	}
+	let key = null;
+	let ownerDocument = null;
+	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
+	else if ((0, _fedify_vocab.isActor)(object)) {
+		if (object.id == null || isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
+			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
+				keyId,
+				documentUrl: documentUrl.href,
+				actorId: object.id?.href
 			});
 			await keyCache?.set(cacheKey, null);
-			if (error instanceof _fedify_vocab_runtime.FetchError && error.response != null) {
-				const fetchError = {
-					status: error.response.status,
-					response: error.response.clone()
-				};
-				await keyCache?.setFetchError?.(cacheKey, fetchError);
-				return {
-					key: null,
-					cached: false,
-					fetchError
-				};
-			}
-			const fetchError = { error: error instanceof Error ? error : new Error(String(error)) };
-			await keyCache?.setFetchError?.(cacheKey, fetchError);
 			return {
 				key: null,
-				cached: false,
-				fetchError
+				cached: false
 			};
+		}
+		ownerDocument = object;
+		const keys = cls === _fedify_vocab.CryptographicKey ? object.getPublicKeys({
+			documentLoader,
+			contextLoader,
+			suppressError: true,
+			tracerProvider
+		}) : object.getAssertionMethods({
+			documentLoader,
+			contextLoader,
+			suppressError: true,
+			tracerProvider
 		});
-	});
-}
-async function getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger) {
-	if (keyCache == null) return null;
-	const cachedKey = await keyCache.get(cacheKey);
-	const hit = checkCachedKeyHit(cachedKey, keyId, cls, logger);
-	if (hit != null) return hit;
-	if (cachedKey === null) {
-		logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
+		let length = 0;
+		let lastKey = null;
+		try {
+			for await (const k of keys) {
+				length++;
+				lastKey = k;
+				if (k.id?.href === keyId) {
+					key = k;
+					break;
+				}
+			}
+		} catch (e) {
+			if (!(e instanceof TypeError)) throw e;
+			logger.debug("Failed to verify; a malformed key was encountered while iterating the keys of {keyId}; treating it as a missing key: {error}", {
+				keyId,
+				error: e
+			});
+		}
+		const keyIdUrl = new URL(keyId);
+		if (key == null && keyIdUrl.hash === "" && length === 1) key = lastKey;
+		if (key == null) {
+			logger.debug("Failed to verify; object {keyId} returned an {actorType}, but has no key matching {keyId}.", {
+				keyId,
+				actorType: object.constructor.name
+			});
+			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	} else {
+		logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		await clearFetchErrorMetadata(cacheKey, keyCache);
 		return {
 			key: null,
-			cached: true
+			cached: false
 		};
 	}
-	return null;
-}
-function checkCachedKeyHit(cachedKey, keyId, cls, logger) {
-	if (cachedKey instanceof cls && cachedKey.publicKey != null) {
-		logger.debug("Key {keyId} found in cache.", { keyId });
+	if (key.publicKey == null) {
+		logger.debug("Failed to verify; key {keyId} has no publicKeyPem field.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		await clearFetchErrorMetadata(cacheKey, keyCache);
 		return {
-			key: cachedKey,
-			cached: true
+			key: null,
+			cached: false
 		};
 	}
-	return null;
-}
-async function clearFetchErrorMetadata(keyId, keyCache) {
-	await keyCache?.setFetchError?.(keyId, null);
+	const claimedOwnerId = key instanceof _fedify_vocab.CryptographicKey ? key.ownerId : key.controllerId;
+	if (!(keyIdBoundByCaller && claimedOwnerId != null && claimedOwnerId.href === stripFragment(cacheKey)?.href)) {
+		if (claimedOwnerId != null && isPortableId(claimedOwnerId)) {
+			logger.debug("Failed to verify; key {keyId} claims the portable actor {claimedOwnerId} as its owner, but is not its gateway key.", {
+				keyId,
+				claimedOwnerId: claimedOwnerId.href
+			});
+			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		if (ownerDocument != null && claimedOwnerId == null) key = key instanceof _fedify_vocab.CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
+		else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
+			if (await verifyKeyOwnership(key, {
+				documentLoader,
+				contextLoader,
+				tracerProvider
+			}) == null) {
+				logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
+					keyId,
+					claimedOwnerId: claimedOwnerId.href
+				});
+				await keyCache?.set(cacheKey, null);
+				return {
+					key: null,
+					cached: false
+				};
+			}
+		}
+	}
+	if (keyCache != null) {
+		await keyCache.set(cacheKey, key);
+		logger.debug("Key {keyId} cached.", { keyId });
+	}
+	await clearFetchErrorMetadata(cacheKey, keyCache);
+	return {
+		key,
+		cached: false
+	};
 }
 /**
-* Returns the identifier a fragment-bearing DID URL is a fragment of, or
-* `null` if the URL is not a DID URL.  `did:web:example.com#key` is thereby
-* traced back to `did:web:example.com`, the DID that resolving the key went
-* through in the first place.
+* Tells whether a key claims a portable actor as its owner.  Such a key can
+* only be a gateway key, which is never cached, so a cached one was cached
+* by an older version that trusted web origins, and is fetched again.
 */
-function stripFragment(keyId) {
-	if (keyId.protocol !== "did:") return null;
-	const did = new URL(keyId.href);
-	did.hash = "";
-	return did;
-}
-function isDidKeyUrl(keyId) {
-	return keyId.protocol === "did:" && keyId.pathname.startsWith("key:");
-}
-async function doRawKeysMatch(left, right) {
-	const [leftRaw, rightRaw] = await Promise.all([crypto.subtle.exportKey("raw", left), crypto.subtle.exportKey("raw", right)]);
-	if (leftRaw.byteLength !== rightRaw.byteLength) return false;
-	const leftBytes = new Uint8Array(leftRaw);
-	const rightBytes = new Uint8Array(rightRaw);
-	return leftBytes.every((byte, index) => byte === rightBytes[index]);
+function claimsPortableOwner(key) {
+	const ownerId = key instanceof _fedify_vocab.CryptographicKey ? key.ownerId : key?.controllerId;
+	return ownerId != null && isPortableId(ownerId);
 }
-async function isCachedDidKeyValid(key, verificationMethod) {
+async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, onFetchError) {
+	const start = performance.now();
+	let outcome = { result: "error" };
 	try {
-		return key.id?.href === verificationMethod.id.href && key.controllerId?.href === verificationMethod.controller.href && await doRawKeysMatch(key.publicKey, verificationMethod.publicKey);
-	} catch {
-		return false;
+		const logger = (0, _logtape_logtape.getLogger)([
+			"fedify",
+			"sig",
+			"key"
+		]);
+		const keyId = cacheKey.href;
+		if (isCompatibleKeyId(cacheKey)) options = {
+			...options,
+			keyCache: void 0
+		};
+		const keyCache = options.keyCache;
+		const didKey = await resolveDidKey(cacheKey, cls, keyCache, logger);
+		if (didKey != null) {
+			outcome = { result: didKey.key == null ? "invalid" : didKey.cached ? "hit" : "fetched" };
+			return didKey;
+		}
+		const cached = await getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger);
+		if (cached?.key === null && cached.cached) {
+			const cachedUnavailable = await onCachedUnavailable(cacheKey, keyId, keyCache, logger);
+			outcome = { result: "hit" };
+			return cachedUnavailable;
+		}
+		if (cached != null && !claimsPortableOwner(cached.key)) {
+			outcome = { result: "hit" };
+			return cached;
+		}
+		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
+		let document;
+		let documentUrl = cacheKey;
+		try {
+			const remoteDocument = await (options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)())(keyId);
+			document = remoteDocument.document;
+			documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
+		} catch (error) {
+			const classified = classifyFetchError(error);
+			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
+			outcome = classified;
+			return errored;
+		}
+		const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
+		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
+		return resolved;
+	} finally {
+		recordKeyLookup(options.meterProvider, {
+			durationMs: getDurationMs(start),
+			result: outcome.result,
+			remoteUrl: cacheKey,
+			cacheEnabled: options.keyCache != null,
+			statusCode: outcome.statusCode
+		});
 	}
 }
-async function resolveDidKey(cacheKey, cls, keyCache, logger) {
-	if (!isDidKeyUrl(cacheKey)) return null;
-	const keyId = cacheKey.href;
-	if (!(cls === _fedify_vocab.Multikey)) {
-		logger.debug("Failed to resolve did:key {keyId}; did:key verification methods are only supported as Multikey values.", { keyId });
+async function fetchKeyInternal(keyId, cls, options = {}) {
+	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
 		return {
 			key: null,
-			cached: false
+			cached: true
 		};
-	}
-	let verificationMethod;
-	try {
-		verificationMethod = await (0, _fedify_vocab_runtime.parseDidKeyVerificationMethod)(cacheKey);
-	} catch (error) {
-		logger.debug("Failed to resolve did:key verification method {keyId}: {error}", {
+	}, async (error, cacheKey, keyId, keyCache, logger) => {
+		logger.debug("Failed to fetch key {keyId}.", {
 			keyId,
 			error
 		});
+		await keyCache?.set(cacheKey, null);
+		if (error instanceof _fedify_vocab_runtime.FetchError && error.response != null) await keyCache?.setFetchError?.(cacheKey, {
+			status: error.response.status,
+			response: error.response.clone()
+		});
+		else await keyCache?.setFetchError?.(cacheKey, { error: error instanceof Error ? error : new Error(String(error)) });
 		return {
 			key: null,
 			cached: false
 		};
+	});
+}
+//#endregion
+//#region src/sig/ld.ts
+const logger$4 = (0, _logtape_logtape.getLogger)([
+	"fedify",
+	"sig",
+	"ld"
+]);
+const localContext = [
+	"https://w3id.org/identity/v1",
+	"https://www.w3.org/ns/activitystreams",
+	"https://w3id.org/security/v1",
+	"https://w3id.org/security/data-integrity/v1"
+];
+const localContextUrls = new Set(localContext);
+const builtInContextLoader = (0, _fedify_vocab_runtime.getDocumentLoader)();
+const disallowedJsonLdKeywords = /* @__PURE__ */ new Set([
+	"@graph",
+	"@included",
+	"@reverse"
+]);
+/** @internal */
+var UnsafeJsonLdError = class extends TypeError {
+	keyword;
+	constructor(keyword) {
+		super(`Unsupported JSON-LD keyword: ${keyword}.`);
+		this.keyword = keyword;
+		this.name = "UnsafeJsonLdError";
 	}
-	const hit = checkCachedKeyHit(await keyCache?.get(cacheKey), keyId, cls, logger);
-	if (hit?.key instanceof _fedify_vocab.Multikey && await isCachedDidKeyValid(hit.key, verificationMethod)) return hit;
-	const key = new _fedify_vocab.Multikey({
-		id: verificationMethod.id,
-		controller: verificationMethod.controller,
-		publicKey: verificationMethod.publicKey
+};
+/** @internal */
+var InvalidContextReferenceError = class extends TypeError {
+	reference;
+	constructor(reference) {
+		super(`Invalid JSON-LD context reference: ${reference}.`);
+		this.reference = reference;
+		this.name = "InvalidContextReferenceError";
+	}
+};
+function createLoadingRemoteContextFailedError(reference, cause) {
+	const message = cause instanceof Error ? cause.message : String(cause);
+	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a valid JSON-LD context: ${reference}. ${message}`);
+	error.name = "jsonld.InvalidUrl";
+	error.details = {
+		code: "loading remote context failed",
+		url: reference
+	};
+	error.cause = cause;
+	return error;
+}
+/** @internal */
+function isClearlyMalformedContextReference(reference) {
+	for (const char of reference) {
+		const code = char.charCodeAt(0);
+		if (code <= 32 || code === 127) return true;
+	}
+	if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(reference) && !URL.canParse(reference)) return true;
+	for (let i = 0; i < reference.length; i++) {
+		if (reference[i] !== "%") continue;
+		if (i + 2 >= reference.length || !/[0-9A-Fa-f]/.test(reference[i + 1]) || !/[0-9A-Fa-f]/.test(reference[i + 2])) return true;
+		i += 2;
+	}
+	if (reference.startsWith("./") || reference.startsWith("../") || reference.startsWith("/") || reference.startsWith("//")) {
+		for (const char of reference) if ("[]<>\"\\^`{|}".includes(char)) return true;
+	}
+	return false;
+}
+function cloneRemoteDocument(remoteDocument) {
+	return structuredClone(remoteDocument);
+}
+function createMemoizedDocumentLoader(documentLoader) {
+	const cache = /* @__PURE__ */ new Map();
+	return async (url, options) => {
+		const cacheKey = URL.canParse(url) ? new URL(url).href : url;
+		let remoteDocument = cache.get(cacheKey);
+		if (remoteDocument == null) {
+			remoteDocument = Promise.resolve(documentLoader(url, options)).then(cloneRemoteDocument);
+			remoteDocument.catch(() => {
+				if (cache.get(cacheKey) === remoteDocument) cache.delete(cacheKey);
+			});
+			cache.set(cacheKey, remoteDocument);
+		}
+		return cloneRemoteDocument(await remoteDocument);
+	};
+}
+/** @internal */
+function wrapContextLoaderForJsonLd(contextLoader) {
+	const loader = contextLoader ?? builtInContextLoader;
+	return async (url, options) => {
+		try {
+			return await loader(url, options);
+		} catch (error) {
+			if (!isInvalidUrlTypeError(error)) throw error;
+			if (isClearlyMalformedContextReference(url)) throw new InvalidContextReferenceError(url);
+			throw createLoadingRemoteContextFailedError(url, error);
+		}
+	};
+}
+/** @internal */
+function getNormalizationContextLoader(contextLoader) {
+	const loader = wrapContextLoaderForJsonLd(contextLoader);
+	return createMemoizedDocumentLoader(async (url, options) => {
+		if (URL.canParse(url)) {
+			const normalizedUrl = new URL(url).href;
+			if (localContextUrls.has(normalizedUrl)) return await builtInContextLoader(normalizedUrl, options);
+		}
+		return await loader(url, options);
 	});
-	await keyCache?.set(cacheKey, key);
-	await clearFetchErrorMetadata(cacheKey, keyCache);
-	logger.debug("Resolved did:key verification method {keyId}.", { keyId });
+}
+/** @internal */
+async function compactJsonLd(jsonLd, contextLoader) {
+	const hasLds = typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
+	const signature = hasLds ? jsonLd.signature : void 0;
+	const normalizationContextLoader = getNormalizationContextLoader(contextLoader);
+	const document = hasLds ? detachSignature(jsonLd) : jsonLd;
+	await assertNoGraphBeforeCompaction(document, normalizationContextLoader);
+	const compacted = await _fedify_vocab_runtime_jsonld.default.compact(document, localContext, { documentLoader: normalizationContextLoader });
+	if (hasLds && typeof compacted === "object" && compacted != null) compacted.signature = signature;
+	assertSafeJsonLd(compacted);
+	return compacted;
+}
+function createInvalidRemoteContextError(reference) {
+	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a JSON object. The response was valid JSON, but it was not a JSON object. URL: "${reference}".`);
+	error.name = "jsonld.InvalidUrl";
+	error.details = {
+		code: "invalid remote context",
+		url: reference
+	};
+	return error;
+}
+function getRemoteContext(remoteDocument, reference) {
+	const { contextUrl, documentUrl } = remoteDocument;
+	let { document } = remoteDocument;
+	if (typeof document === "string") document = JSON.parse(document);
+	if (typeof document !== "object" || document == null || Array.isArray(document)) throw createInvalidRemoteContextError(reference);
+	let context = "@context" in document ? document["@context"] : {};
+	if (contextUrl != null) context = Array.isArray(context) ? [...context, contextUrl] : [context, contextUrl];
 	return {
-		key,
-		cached: false
+		context,
+		baseUrl: documentUrl ?? reference
 	};
 }
-async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableGatewayKeyResolver }, logger) {
-	let object;
-	try {
-		object = await _fedify_vocab.Object.fromJsonLd(document, {
-			documentLoader,
-			contextLoader,
-			tracerProvider
-		});
-	} catch (e) {
-		if (!(e instanceof TypeError)) throw e;
-		try {
-			object = await cls.fromJsonLd(document, {
-				documentLoader,
-				contextLoader,
-				tracerProvider
-			});
-		} catch (e) {
-			if (e instanceof TypeError) {
-				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
-				await keyCache?.set(cacheKey, null);
-				await clearFetchErrorMetadata(cacheKey, keyCache);
-				return {
-					key: null,
-					cached: false
-				};
+function createGraphAliasContextState() {
+	return {
+		graphTerms: /* @__PURE__ */ new Set(),
+		jsonTerms: /* @__PURE__ */ new Set(),
+		propertyContexts: /* @__PURE__ */ new Map(),
+		termTargets: /* @__PURE__ */ new Map()
+	};
+}
+function cloneGraphAliasContextState(state) {
+	return {
+		graphTerms: new Set(state.graphTerms),
+		jsonTerms: new Set(state.jsonTerms),
+		propertyContexts: new Map(state.propertyContexts),
+		termTargets: new Map(state.termTargets)
+	};
+}
+function resolveContextTarget(target, state) {
+	if (target === "@graph") return target;
+	const mapped = state.termTargets.get(target);
+	if (mapped == null) return target;
+	return mapped;
+}
+function getDirectContextTarget(definition) {
+	if (definition === null) return null;
+	if (typeof definition === "string") return definition;
+	if (typeof definition === "object" && definition != null && "@id" in definition) {
+		const id = definition["@id"];
+		if (id === null) return null;
+		if (typeof id === "string") return id;
+	}
+}
+function isJsonTypedDefinition(definition) {
+	return typeof definition === "object" && definition != null && "@type" in definition && definition["@type"] === "@json";
+}
+function resolveLocalContextTarget(target, state, localTargets, seen = /* @__PURE__ */ new Set()) {
+	if (target === "@graph") return target;
+	if (seen.has(target)) return target;
+	seen.add(target);
+	if (localTargets.has(target)) {
+		const localTarget = localTargets.get(target);
+		return localTarget == null ? target : resolveLocalContextTarget(localTarget, state, localTargets, seen);
+	}
+	return resolveContextTarget(target, state);
+}
+function refreshGraphAliases(state) {
+	state.graphTerms.clear();
+	for (const [term, target] of state.termTargets) if (target === "@graph") state.graphTerms.add(term);
+}
+function normalizeContextReference(reference, baseUrl) {
+	if (baseUrl != null) return new URL(reference, baseUrl).href;
+	return URL.canParse(reference) ? new URL(reference).href : reference;
+}
+/** @internal */
+function isInvalidUrlTypeError(error) {
+	const code = error.code;
+	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+}
+async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
+	if (context === null) return createGraphAliasContextState();
+	let nextState = cloneGraphAliasContextState(state);
+	if (Array.isArray(context)) {
+		for (const item of context) nextState = await applyGraphAliasContext(nextState, item, documentLoader, remoteContextCache, baseUrl, processingContexts);
+		return nextState;
+	}
+	if (typeof context === "string") {
+		const reference = normalizeContextReference(context, baseUrl);
+		const cacheKey = `${baseUrl ?? ""}\n${reference}`;
+		if (processingContexts.has(cacheKey)) return nextState;
+		processingContexts.add(cacheKey);
+		try {
+			let remoteContext = remoteContextCache.get(cacheKey);
+			if (remoteContext == null) {
+				remoteContext = (async () => {
+					try {
+						return getRemoteContext(await documentLoader(reference), reference);
+					} catch (error) {
+						if (reference === context && isInvalidUrlTypeError(error) && isClearlyMalformedContextReference(context)) throw new InvalidContextReferenceError(context);
+						throw error;
+					}
+				})();
+				remoteContextCache.set(cacheKey, remoteContext);
 			}
-			throw e;
+			const loadedRemoteContext = await remoteContext;
+			return await applyGraphAliasContext(nextState, loadedRemoteContext.context, documentLoader, remoteContextCache, loadedRemoteContext.baseUrl, processingContexts);
+		} finally {
+			processingContexts.delete(cacheKey);
 		}
 	}
-	if (isCompatibleKeyId(cacheKey) && isPortableActorDocument(object)) {
-		if (portableGatewayKeyResolver == null || cls !== _fedify_vocab.CryptographicKey) {
-			logger.debug("Failed to verify; key {keyId} is a gateway key of the portable actor {actorId}, which is only accepted for HTTP Signatures.", {
-				keyId,
-				actorId: object.id?.href
-			});
-			return {
-				key: null,
-				cached: false
-			};
+	if (typeof context === "object" && context != null) {
+		if ("@import" in context && typeof context["@import"] === "string") nextState = await applyGraphAliasContext(nextState, context["@import"], documentLoader, remoteContextCache, baseUrl, processingContexts);
+		const localTargets = /* @__PURE__ */ new Map();
+		for (const [term, definition] of globalThis.Object.entries(context)) {
+			if (term.startsWith("@")) continue;
+			const target = getDirectContextTarget(definition);
+			if (target == null) localTargets.set(term, null);
+			else if (typeof target === "string") localTargets.set(term, target);
+			else localTargets.delete(term);
 		}
-		const resolution = await portableGatewayKeyResolver(document, object, cacheKey);
-		if (resolution.type !== "verified") {
-			logger.debug("Failed to verify; the portable actor {actorId} does not vouch for its gateway key {keyId}.", {
-				keyId,
-				actorId: object.id?.href
+		for (const [term, definition] of globalThis.Object.entries(context)) {
+			if (term.startsWith("@")) continue;
+			if (localTargets.has(term)) {
+				const directTarget = localTargets.get(term);
+				if (directTarget == null) nextState.termTargets.set(term, null);
+				else nextState.termTargets.set(term, resolveLocalContextTarget(directTarget, nextState, localTargets));
+			} else nextState.termTargets.delete(term);
+			if (typeof definition === "object" && definition != null && "@context" in definition) nextState.propertyContexts.set(term, {
+				context: definition["@context"],
+				baseUrl
 			});
-			return {
-				key: null,
-				cached: false
-			};
+			else nextState.propertyContexts.delete(term);
+			if (isJsonTypedDefinition(definition)) nextState.jsonTerms.add(term);
+			else nextState.jsonTerms.delete(term);
 		}
-		return {
-			key: resolution.key,
-			cached: false
-		};
+		refreshGraphAliases(nextState);
 	}
-	let key = null;
-	let ownerDocument = null;
-	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
-	else if ((0, _fedify_vocab.isActor)(object)) {
-		if (object.id == null || object.id.origin !== documentUrl.origin) {
-			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
-				keyId,
-				documentUrl: documentUrl.href,
-				actorId: object.id?.href
-			});
-			await keyCache?.set(cacheKey, null);
-			return {
-				key: null,
-				cached: false
-			};
-		}
-		ownerDocument = object;
-		const keys = cls === _fedify_vocab.CryptographicKey ? object.getPublicKeys({
-			documentLoader,
-			contextLoader,
-			suppressError: true,
-			tracerProvider
-		}) : object.getAssertionMethods({
-			documentLoader,
-			contextLoader,
-			suppressError: true,
-			tracerProvider
-		});
-		let length = 0;
-		let lastKey = null;
-		try {
-			for await (const k of keys) {
-				length++;
-				lastKey = k;
-				if (k.id?.href === keyId) {
-					key = k;
-					break;
-				}
-			}
-		} catch (e) {
-			if (!(e instanceof TypeError)) throw e;
-			logger.debug("Failed to verify; a malformed key was encountered while iterating the keys of {keyId}; treating it as a missing key: {error}", {
-				keyId,
-				error: e
-			});
-		}
-		const keyIdUrl = new URL(keyId);
-		if (key == null && keyIdUrl.hash === "" && length === 1) key = lastKey;
-		if (key == null) {
-			logger.debug("Failed to verify; object {keyId} returned an {actorType}, but has no key matching {keyId}.", {
-				keyId,
-				actorType: object.constructor.name
-			});
-			await keyCache?.set(cacheKey, null);
-			await clearFetchErrorMetadata(cacheKey, keyCache);
-			return {
-				key: null,
-				cached: false
-			};
-		}
-	} else {
-		logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
-		await keyCache?.set(cacheKey, null);
-		await clearFetchErrorMetadata(cacheKey, keyCache);
-		return {
-			key: null,
-			cached: false
-		};
+	return nextState;
+}
+async function assertNoGraphBeforeCompaction(jsonLd, documentLoader, inheritedState = createGraphAliasContextState(), propertyContext, remoteContextCache = /* @__PURE__ */ new Map()) {
+	if (Array.isArray(jsonLd)) {
+		for (const item of jsonLd) await assertNoGraphBeforeCompaction(item, documentLoader, inheritedState, propertyContext, remoteContextCache);
+		return;
 	}
-	if (key.publicKey == null) {
-		logger.debug("Failed to verify; key {keyId} has no publicKeyPem field.", { keyId });
-		await keyCache?.set(cacheKey, null);
-		await clearFetchErrorMetadata(cacheKey, keyCache);
-		return {
-			key: null,
-			cached: false
-		};
+	if (typeof jsonLd !== "object" || jsonLd == null) return;
+	const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
+	let state = inheritedState;
+	if (propertyContext !== void 0) state = await applyGraphAliasContext(state, propertyContext.context, documentLoader, remoteContextCache, propertyContext.baseUrl);
+	if ("@context" in jsonLd) state = await applyGraphAliasContext(state, jsonLd["@context"], documentLoader, remoteContextCache);
+	for (const [key, value] of globalThis.Object.entries(jsonLd)) {
+		if (key === "@context") continue;
+		if (jsonLiteralWrapper && key === "@value") continue;
+		if (key === "@graph" || state.graphTerms.has(key)) throw new UnsafeJsonLdError("@graph");
+		if (state.jsonTerms.has(key)) continue;
+		await assertNoGraphBeforeCompaction(value, documentLoader, state, state.propertyContexts.get(key), remoteContextCache);
 	}
-	const claimedOwnerId = key instanceof _fedify_vocab.CryptographicKey ? key.ownerId : key.controllerId;
-	if (!(keyIdBoundByCaller && claimedOwnerId != null && claimedOwnerId.href === stripFragment(cacheKey)?.href)) {
-		if (ownerDocument != null && claimedOwnerId == null) key = key instanceof _fedify_vocab.CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
-		else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
-			if (await verifyKeyOwnership(key, {
-				documentLoader,
-				contextLoader,
-				tracerProvider
-			}) == null) {
-				logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
-					keyId,
-					claimedOwnerId: claimedOwnerId.href
-				});
-				await keyCache?.set(cacheKey, null);
-				return {
-					key: null,
-					cached: false
-				};
+}
+function isJsonLiteralWrapper(value) {
+	return "@value" in value && (value["@type"] === "@json" || value.type === "@json");
+}
+/** @internal */
+function assertSafeJsonLd(jsonLd) {
+	if (Array.isArray(jsonLd)) for (const item of jsonLd) assertSafeJsonLd(item);
+	else if (typeof jsonLd === "object" && jsonLd != null) {
+		const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
+		for (const [key, value] of globalThis.Object.entries(jsonLd)) {
+			if (disallowedJsonLdKeywords.has(key)) throw new UnsafeJsonLdError(key);
+			if (jsonLiteralWrapper && key === "@value") continue;
+			assertSafeJsonLd(value);
+		}
+	}
+}
+/**
+* Attaches a LD signature to the given JSON-LD document.
+* @param jsonLd The JSON-LD document to attach the signature to.  It is not
+*               modified.
+* @param signature The signature to attach.
+* @returns The JSON-LD document with the attached signature.
+* @throws {TypeError} If the input document is not a valid JSON-LD document.
+* @since 1.0.0
+*/
+function attachSignature(jsonLd, signature) {
+	if (typeof jsonLd !== "object" || jsonLd == null) throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
+	return {
+		...jsonLd,
+		signature
+	};
+}
+/**
+* Creates a LD signature for the given JSON-LD document.
+* @param jsonLd The JSON-LD document to sign.
+* @param privateKey The private key to sign the document.
+* @param keyId The ID of the public key that corresponds to the private key.
+* @param options Additional options for creating the signature.
+*                See also {@link CreateSignatureOptions}.
+* @return The created signature.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 1.0.0
+*/
+async function createSignature(jsonLd, privateKey, keyId, { contextLoader, created } = {}) {
+	validateCryptoKey(privateKey, "private");
+	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
+	const options = {
+		"@context": "https://w3id.org/identity/v1",
+		creator: keyId.href,
+		created: created?.toString() ?? (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const message = await hashJsonLd(options, contextLoader) + await hashJsonLd(jsonLd, contextLoader);
+	const messageBytes = new TextEncoder().encode(message);
+	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, messageBytes);
+	return {
+		...options,
+		type: "RsaSignature2017",
+		signatureValue: (0, byte_encodings_base64.encodeBase64)(signature)
+	};
+}
+/**
+* Signs the given JSON-LD document with the private key and returns the signed
+* JSON-LD document.
+* @param jsonLd The JSON-LD document to sign.
+* @param privateKey The private key to sign the document.
+* @param keyId The key ID to use in the signature.  It will be used by the
+*              verifier to fetch the corresponding public key.
+* @param options Additional options for signing the document.
+*                See also {@link SignJsonLdOptions}.
+* @returns The signed JSON-LD document.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 1.0.0
+*/
+async function signJsonLd(jsonLd, privateKey, keyId, options) {
+	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.sign", { attributes: { "ld_signatures.key_id": keyId.href } }, async (span) => {
+		try {
+			const signature = await createSignature(jsonLd, privateKey, keyId, options);
+			if (span.isRecording()) {
+				span.setAttribute("ld_signatures.type", signature.type);
+				span.setAttribute("ld_signatures.signature", (0, byte_encodings_hex.encodeHex)((0, byte_encodings_base64.decodeBase64)(signature.signatureValue)));
 			}
+			return attachSignature(jsonLd, signature);
+		} catch (error) {
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
 		}
-	}
-	if (keyCache != null) {
-		await keyCache.set(cacheKey, key);
-		logger.debug("Key {keyId} cached.", { keyId });
-	}
-	await clearFetchErrorMetadata(cacheKey, keyCache);
-	return {
-		key,
-		cached: false
+	});
+}
+/**
+* Checks if the given JSON-LD document has a Linked Data Signature-like
+* object, without restricting it to a single suite-specific shape.
+* @param jsonLd The JSON-LD document to check.
+* @returns `true` if the document has a signature-like object; `false`
+*          otherwise.
+* @since 2.2.0
+*/
+function hasSignatureLike(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	const signature = jsonLd.signature;
+	const hasReference = (value) => {
+		if (typeof value === "string") return true;
+		if (Array.isArray(value)) return value.some(hasReference);
+		return typeof value === "object" && value != null && ("id" in value && typeof value.id === "string" || "@id" in value && typeof value["@id"] === "string");
+	};
+	const hasSignatureObject = (value) => {
+		if (typeof value !== "object" || value == null) return false;
+		const signatureRecord = value;
+		return (typeof signatureRecord.type === "string" || Array.isArray(signatureRecord.type) && signatureRecord.type.some((item) => typeof item === "string")) && (hasReference(signatureRecord.creator) || hasReference(signatureRecord.verificationMethod)) && (typeof signatureRecord.signatureValue === "string" || typeof signatureRecord.jws === "string");
 	};
+	return Array.isArray(signature) ? signature.some(hasSignatureObject) : hasSignatureObject(signature);
 }
-async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, onFetchError) {
-	const start = performance.now();
-	let outcome = { result: "error" };
-	try {
-		const logger = (0, _logtape_logtape.getLogger)([
-			"fedify",
-			"sig",
-			"key"
-		]);
-		const keyId = cacheKey.href;
-		if (isCompatibleKeyId(cacheKey)) options = {
-			...options,
-			keyCache: void 0
-		};
-		const keyCache = options.keyCache;
-		const didKey = await resolveDidKey(cacheKey, cls, keyCache, logger);
-		if (didKey != null) {
-			outcome = { result: didKey.key == null ? "invalid" : didKey.cached ? "hit" : "fetched" };
-			return didKey;
-		}
-		const cached = await getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger);
-		if (cached?.key === null && cached.cached) {
-			const cachedUnavailable = await onCachedUnavailable(cacheKey, keyId, keyCache, logger);
-			outcome = { result: "hit" };
-			return cachedUnavailable;
-		}
-		if (cached != null) {
-			outcome = { result: "hit" };
-			return cached;
-		}
-		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
-		let document;
-		let documentUrl = cacheKey;
-		try {
-			const remoteDocument = await (options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)())(keyId);
-			document = remoteDocument.document;
-			documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
-		} catch (error) {
-			const classified = classifyFetchError(error);
-			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
-			outcome = classified;
-			return errored;
-		}
-		const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
-		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
-		return resolved;
-	} finally {
-		recordKeyLookup(options.meterProvider, {
-			durationMs: getDurationMs(start),
-			result: outcome.result,
-			remoteUrl: cacheKey,
-			cacheEnabled: options.keyCache != null,
-			statusCode: outcome.statusCode
-		});
+/**
+* Checks if the given JSON-LD document has a Linked Data Signature.
+* @param jsonLd The JSON-LD document to check.
+* @returns `true` if the document has a signature; `false` otherwise.
+* @since 1.0.0
+*/
+function hasSignature(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	if ("signature" in jsonLd) {
+		const signature = jsonLd.signature;
+		if (typeof signature !== "object" || signature == null) return false;
+		return "type" in signature && signature.type === "RsaSignature2017" && "creator" in signature && typeof signature.creator === "string" && "created" in signature && typeof signature.created === "string" && "signatureValue" in signature && typeof signature.signatureValue === "string";
 	}
+	return false;
 }
-async function fetchKeyInternal(keyId, cls, options = {}) {
-	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
-		return {
-			key: null,
-			cached: true
-		};
-	}, async (error, cacheKey, keyId, keyCache, logger) => {
-		logger.debug("Failed to fetch key {keyId}.", {
-			keyId,
+/**
+* Detaches Linked Data Signatures from the given JSON-LD document.
+* @param jsonLd The JSON-LD document to modify.
+* @returns The modified JSON-LD document.  If the input document does not
+*          contain a signature, the original document is returned.
+* @since 1.0.0
+*/
+function detachSignature(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
+	const doc = { ...jsonLd };
+	delete doc.signature;
+	return doc;
+}
+/**
+* Verifies Linked Data Signatures of the given JSON-LD document.
+*
+* This is a low-level utility that only checks the cryptographic signature
+* and (optionally) the cached key.  It does not run the JSON-LD parsing,
+* attribution, and owner checks that a complete inbound LD verification
+* needs.  For incoming activities, prefer {@link verifyJsonLd}, which is
+* the public verification entry point and the one that emits the
+* `activitypub.signature.verification.duration` metric for the LD path.
+* `verifySignature` itself only emits
+* `activitypub.signature.key_fetch.duration`, since the rest of the work
+* that the verification-duration metric is meant to cover happens in
+* `verifyJsonLd`.
+* @param jsonLd The JSON-LD document to verify.
+* @param options Options for verifying the signature.
+* @returns The public key that signed the document or `null` if the signature
+*          is invalid or the key is not found.
+* @since 1.0.0
+*/
+async function verifySignature(jsonLd, options = {}) {
+	if (!hasSignature(jsonLd)) return null;
+	const sig = jsonLd.signature;
+	let signature;
+	try {
+		signature = (0, byte_encodings_base64.decodeBase64)(sig.signatureValue);
+	} catch (error) {
+		logger$4.debug("Failed to verify; invalid base64 signatureValue: {signatureValue}", {
+			...sig,
 			error
 		});
-		await keyCache?.set(cacheKey, null);
-		if (error instanceof _fedify_vocab_runtime.FetchError && error.response != null) await keyCache?.setFetchError?.(cacheKey, {
-			status: error.response.status,
-			response: error.response.clone()
-		});
-		else await keyCache?.setFetchError?.(cacheKey, { error: error instanceof Error ? error : new Error(String(error)) });
-		return {
-			key: null,
-			cached: false
-		};
-	});
-}
-//#endregion
-//#region src/sig/ld.ts
-const logger$2 = (0, _logtape_logtape.getLogger)([
-	"fedify",
-	"sig",
-	"ld"
-]);
-const localContext = [
-	"https://w3id.org/identity/v1",
-	"https://www.w3.org/ns/activitystreams",
-	"https://w3id.org/security/v1",
-	"https://w3id.org/security/data-integrity/v1"
-];
-const localContextUrls = new Set(localContext);
-const builtInContextLoader = (0, _fedify_vocab_runtime.getDocumentLoader)();
-const disallowedJsonLdKeywords = /* @__PURE__ */ new Set([
-	"@graph",
-	"@included",
-	"@reverse"
-]);
-/** @internal */
-var UnsafeJsonLdError = class extends TypeError {
-	keyword;
-	constructor(keyword) {
-		super(`Unsupported JSON-LD keyword: ${keyword}.`);
-		this.keyword = keyword;
-		this.name = "UnsafeJsonLdError";
-	}
-};
-/** @internal */
-var InvalidContextReferenceError = class extends TypeError {
-	reference;
-	constructor(reference) {
-		super(`Invalid JSON-LD context reference: ${reference}.`);
-		this.reference = reference;
-		this.name = "InvalidContextReferenceError";
+		return null;
 	}
-};
-function createLoadingRemoteContextFailedError(reference, cause) {
-	const message = cause instanceof Error ? cause.message : String(cause);
-	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a valid JSON-LD context: ${reference}. ${message}`);
-	error.name = "jsonld.InvalidUrl";
-	error.details = {
-		code: "loading remote context failed",
-		url: reference
+	const { key, cached } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), _fedify_vocab.CryptographicKey, options));
+	if (key == null) return null;
+	const sigOpts = {
+		...sig,
+		"@context": "https://w3id.org/identity/v1"
 	};
-	error.cause = cause;
-	return error;
-}
-/** @internal */
-function isClearlyMalformedContextReference(reference) {
-	for (const char of reference) {
-		const code = char.charCodeAt(0);
-		if (code <= 32 || code === 127) return true;
+	delete sigOpts.type;
+	delete sigOpts.id;
+	delete sigOpts.signatureValue;
+	let sigOptsHash;
+	try {
+		sigOptsHash = await hashJsonLd(sigOpts, options.contextLoader);
+	} catch (error) {
+		logger$4.warn("Failed to verify; failed to hash the signature options: {signatureOptions}\n{error}", {
+			signatureOptions: sigOpts,
+			error
+		});
+		return null;
 	}
-	if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(reference) && !URL.canParse(reference)) return true;
-	for (let i = 0; i < reference.length; i++) {
-		if (reference[i] !== "%") continue;
-		if (i + 2 >= reference.length || !/[0-9A-Fa-f]/.test(reference[i + 1]) || !/[0-9A-Fa-f]/.test(reference[i + 2])) return true;
-		i += 2;
+	const document = { ...jsonLd };
+	delete document.signature;
+	let docHash;
+	try {
+		docHash = await hashJsonLd(document, options.contextLoader);
+	} catch (error) {
+		logger$4.warn("Failed to verify; failed to hash the document: {document}\n{error}", {
+			document,
+			error
+		});
+		return null;
 	}
-	if (reference.startsWith("./") || reference.startsWith("../") || reference.startsWith("/") || reference.startsWith("//")) {
-		for (const char of reference) if ("[]<>\"\\^`{|}".includes(char)) return true;
+	const encoder = new TextEncoder();
+	const message = sigOptsHash + docHash;
+	const messageBytes = encoder.encode(message);
+	if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes)) return key;
+	if (cached) {
+		logger$4.debug("Failed to verify with the cached key {keyId}; signature {signatureValue} is invalid.  Retrying with the freshly fetched key...", {
+			keyId: sig.creator,
+			...sig
+		});
+		const { key } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), _fedify_vocab.CryptographicKey, {
+			...options,
+			keyCache: {
+				get: () => Promise.resolve(void 0),
+				set: async (keyId, key) => await options.keyCache?.set(keyId, key)
+			}
+		}));
+		if (key == null) return null;
+		return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes) ? key : null;
 	}
-	return false;
+	logger$4.debug("Failed to verify with the fetched key {keyId}; signature {signatureValue} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
+		keyId: sig.creator,
+		...sig,
+		message
+	});
+	return null;
 }
-function cloneRemoteDocument(remoteDocument) {
-	return structuredClone(remoteDocument);
+/**
+* Known Linked Data Signature `type` values, used to keep
+* `ld_signatures.type` on a bounded set of spec-defined string values.
+* Fedify only signs and verifies `RsaSignature2017`; other values come in
+* only from external documents and are dropped from the metric attribute to
+* avoid attacker-controlled cardinality.
+*/
+const LD_KNOWN_SIGNATURE_TYPES = /* @__PURE__ */ new Set(["RsaSignature2017"]);
+/**
+* Reports only whether a `signature` key is present on the document, with
+* no shape check on its value.  This is intentionally looser than
+* {@link hasSignature} (which validates a full `RsaSignature2017` shape)
+* and {@link hasSignatureLike} (which structurally accepts several known
+* suites): `verifyJsonLd` needs to tell a document with a malformed or
+* unsupported signature payload (classified as `rejected`) apart from a
+* truly unsigned document (classified as `missing`), and only this
+* presence-only check captures both cases.
+*/
+function hasLdSignatureProperty(jsonLd) {
+	return typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
 }
-function createMemoizedDocumentLoader(documentLoader) {
-	const cache = /* @__PURE__ */ new Map();
-	return async (url, options) => {
-		const cacheKey = URL.canParse(url) ? new URL(url).href : url;
-		let remoteDocument = cache.get(cacheKey);
-		if (remoteDocument == null) {
-			remoteDocument = Promise.resolve(documentLoader(url, options)).then(cloneRemoteDocument);
-			remoteDocument.catch(() => {
-				if (cache.get(cacheKey) === remoteDocument) cache.delete(cacheKey);
-			});
-			cache.set(cacheKey, remoteDocument);
-		}
-		return cloneRemoteDocument(await remoteDocument);
-	};
+function getLdSignatureObject(jsonLd) {
+	if (!hasLdSignatureProperty(jsonLd)) return void 0;
+	const { signature } = jsonLd;
+	if (typeof signature !== "object" || signature == null || Array.isArray(signature)) return;
+	return signature;
+}
+/**
+* Verify the authenticity of the given JSON-LD document using Linked Data
+* Signatures.  If the document is signed, this function verifies the signature
+* and checks if the document is attributed to the owner of the public key.
+* If the document is not signed, this function returns `false`.
+* @param jsonLd The JSON-LD document to verify.
+* @param options Options for verifying the document.
+* @returns `true` if the document is authentic; `false` otherwise.
+*/
+async function verifyJsonLd(jsonLd, options = {}) {
+	return await verifyJsonLdInternal(jsonLd, options, true);
 }
 /** @internal */
-function wrapContextLoaderForJsonLd(contextLoader) {
-	const loader = contextLoader ?? builtInContextLoader;
-	return async (url, options) => {
+async function verifyCompactJsonLd(jsonLd, options = {}) {
+	return await verifyJsonLdInternal(jsonLd, options, false);
+}
+async function verifyJsonLdInternal(jsonLd, options, compact) {
+	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
+		const start = performance.now();
+		let verified = false;
+		let threw = false;
+		let signatureType;
 		try {
-			return await loader(url, options);
+			const verificationOptions = hasSignature(jsonLd) ? {
+				...options,
+				contextLoader: getNormalizationContextLoader(options.contextLoader)
+			} : options;
+			const compacted = compact ? hasSignature(jsonLd) ? await compactJsonLd(jsonLd, options.contextLoader) : jsonLd : jsonLd;
+			const object = await _fedify_vocab.Object.fromJsonLd(compacted, verificationOptions);
+			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
+			span.setAttribute("activitypub.object.type", (0, _fedify_vocab.getTypeId)(object).href);
+			const sig = getLdSignatureObject(jsonLd);
+			if (sig != null) {
+				if (typeof sig.creator === "string") span.setAttribute("ld_signatures.key_id", sig.creator);
+				if (typeof sig.signatureValue === "string") span.setAttribute("ld_signatures.signature", sig.signatureValue);
+				if (typeof sig.type === "string") {
+					span.setAttribute("ld_signatures.type", sig.type);
+					if (LD_KNOWN_SIGNATURE_TYPES.has(sig.type)) signatureType = sig.type;
+				}
+			}
+			const attributions = new Set(object.attributionIds.map((uri) => uri.href));
+			if (object instanceof _fedify_vocab.Activity) for (const uri of object.actorIds) attributions.add(uri.href);
+			const key = await verifySignature(compacted, verificationOptions);
+			if (key == null) return false;
+			if (key.ownerId == null) {
+				logger$4.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
+				return false;
+			}
+			attributions.delete(key.ownerId.href);
+			if (attributions.size > 0) {
+				logger$4.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
+				return false;
+			}
+			verified = true;
+			return true;
 		} catch (error) {
-			if (!isInvalidUrlTypeError(error)) throw error;
-			if (isClearlyMalformedContextReference(url)) throw new InvalidContextReferenceError(url);
-			throw createLoadingRemoteContextFailedError(url, error);
-		}
-	};
-}
-/** @internal */
-function getNormalizationContextLoader(contextLoader) {
-	const loader = wrapContextLoaderForJsonLd(contextLoader);
-	return createMemoizedDocumentLoader(async (url, options) => {
-		if (URL.canParse(url)) {
-			const normalizedUrl = new URL(url).href;
-			if (localContextUrls.has(normalizedUrl)) return await builtInContextLoader(normalizedUrl, options);
+			threw = true;
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			const classified = threw ? "error" : verified ? "verified" : hasLdSignatureProperty(jsonLd) ? "rejected" : "missing";
+			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "linked_data", classified, { ldType: signatureType });
+			span.end();
 		}
-		return await loader(url, options);
 	});
 }
-/** @internal */
-async function compactJsonLd(jsonLd, contextLoader) {
-	const hasLds = typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
-	const signature = hasLds ? jsonLd.signature : void 0;
-	const normalizationContextLoader = getNormalizationContextLoader(contextLoader);
-	const document = hasLds ? detachSignature(jsonLd) : jsonLd;
-	await assertNoGraphBeforeCompaction(document, normalizationContextLoader);
-	const compacted = await _fedify_vocab_runtime_jsonld.default.compact(document, localContext, { documentLoader: normalizationContextLoader });
-	if (hasLds && typeof compacted === "object" && compacted != null) compacted.signature = signature;
-	assertSafeJsonLd(compacted);
-	return compacted;
-}
-function createInvalidRemoteContextError(reference) {
-	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a JSON object. The response was valid JSON, but it was not a JSON object. URL: "${reference}".`);
-	error.name = "jsonld.InvalidUrl";
-	error.details = {
-		code: "invalid remote context",
-		url: reference
-	};
-	return error;
+async function hashJsonLd(jsonLd, contextLoader) {
+	const canon = await _fedify_vocab_runtime_jsonld.default.canonize(jsonLd, {
+		format: "application/n-quads",
+		documentLoader: contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)()
+	});
+	const encoder = new TextEncoder();
+	return (0, byte_encodings_hex.encodeHex)(await crypto.subtle.digest("SHA-256", encoder.encode(canon)));
 }
-function getRemoteContext(remoteDocument, reference) {
-	const { contextUrl, documentUrl } = remoteDocument;
-	let { document } = remoteDocument;
-	if (typeof document === "string") document = JSON.parse(document);
-	if (typeof document !== "object" || document == null || Array.isArray(document)) throw createInvalidRemoteContextError(reference);
-	let context = "@context" in document ? document["@context"] : {};
-	if (contextUrl != null) context = Array.isArray(context) ? [...context, contextUrl] : [context, contextUrl];
-	return {
-		context,
-		baseUrl: documentUrl ?? reference
-	};
+//#endregion
+//#region src/compat/secured-document.ts
+function isJsonMap$1(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
 }
-function createGraphAliasContextState() {
-	return {
-		graphTerms: /* @__PURE__ */ new Set(),
-		jsonTerms: /* @__PURE__ */ new Set(),
-		propertyContexts: /* @__PURE__ */ new Map(),
-		termTargets: /* @__PURE__ */ new Map()
-	};
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.length > 0;
 }
-function cloneGraphAliasContextState(state) {
-	return {
-		graphTerms: new Set(state.graphTerms),
-		jsonTerms: new Set(state.jsonTerms),
-		propertyContexts: new Map(state.propertyContexts),
-		termTargets: new Map(state.termTargets)
-	};
+function hasDataIntegrityProofType(value) {
+	return (Array.isArray(value) ? value : [value]).some((type) => type === "DataIntegrityProof" || type === "https://w3id.org/security#DataIntegrityProof");
 }
-function resolveContextTarget(target, state) {
-	if (target === "@graph") return target;
-	const mapped = state.termTargets.get(target);
-	if (mapped == null) return target;
-	return mapped;
+/**
+* Checks whether a JSON value is a complete, self-contained secured document:
+* a map with its own `@context` and exactly one direct, map-valued `proof`
+* that carries every member `eddsa-jcs-2022` proof generation produces.
+*
+* This is deliberately stricter than {@link hasProofLike}, which exists to
+* decide whether a document is worth verifying.  Here a false positive would
+* silently suppress a wire-compatibility fix on an ordinary document, so a
+* partial or malformed proof does not qualify.
+*
+* @internal
+*/
+function isSelfContainedSecuredDocument(value) {
+	if (!isJsonMap$1(value)) return false;
+	if (!Object.hasOwn(value, "@context") || value["@context"] == null) return false;
+	if (!Object.hasOwn(value, "proof")) return false;
+	const proof = value.proof;
+	if (!isJsonMap$1(proof)) return false;
+	return hasDataIntegrityProofType(proof.type) && isNonEmptyString(proof.cryptosuite) && isNonEmptyString(proof.created) && isNonEmptyString(proof.verificationMethod) && isNonEmptyString(proof.proofPurpose) && isNonEmptyString(proof.proofValue);
 }
-function getDirectContextTarget(definition) {
-	if (definition === null) return null;
-	if (typeof definition === "string") return definition;
-	if (typeof definition === "object" && definition != null && "@id" in definition) {
-		const id = definition["@id"];
-		if (id === null) return null;
-		if (typeof id === "string") return id;
+//#endregion
+//#region src/compat/public-audience.ts
+const logger$3 = (0, _logtape_logtape.getLogger)([
+	"fedify",
+	"compat",
+	"public-audience"
+]);
+const PUBLIC_ADDRESSING_FIELDS = /* @__PURE__ */ new Set([
+	"to",
+	"cc",
+	"bto",
+	"bcc",
+	"audience"
+]);
+const AS_CONTEXT_URL$1 = "https://www.w3.org/ns/activitystreams";
+const MAX_TRAVERSAL_DEPTH$1 = 64;
+const KNOWN_SAFE_CONTEXT_URLS$1 = new Set(Object.keys(_fedify_vocab_runtime.preloadedContexts));
+function hasPublicCurieInAddressing(value, preserveSecured, parentKey, depth = 0) {
+	if (typeof value === "string") return parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public");
+	if (depth >= MAX_TRAVERSAL_DEPTH$1) return false;
+	if (Array.isArray(value)) return value.some((item) => hasPublicCurieInAddressing(item, preserveSecured, parentKey, depth + 1));
+	if (typeof value !== "object" || value == null) return false;
+	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(value)) return false;
+	const record = value;
+	for (const key of Object.keys(record)) {
+		if (record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public")) return true;
+		if (key === "@context") continue;
+		if (hasPublicCurieInAddressing(record[key], preserveSecured, key, depth + 1)) return true;
 	}
+	return false;
 }
-function isJsonTypedDefinition(definition) {
-	return typeof definition === "object" && definition != null && "@type" in definition && definition["@type"] === "@json";
-}
-function resolveLocalContextTarget(target, state, localTargets, seen = /* @__PURE__ */ new Set()) {
-	if (target === "@graph") return target;
-	if (seen.has(target)) return target;
-	seen.add(target);
-	if (localTargets.has(target)) {
-		const localTarget = localTargets.get(target);
-		return localTarget == null ? target : resolveLocalContextTarget(localTarget, state, localTargets, seen);
+function rewritePublicAudience(value, preserveSecured, parentKey, depth = 0) {
+	if (typeof value === "string" && parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public")) return _fedify_vocab.PUBLIC_COLLECTION.href;
+	if (depth >= MAX_TRAVERSAL_DEPTH$1) return value;
+	if (Array.isArray(value)) {
+		let changed = false;
+		const mapped = value.map((item) => {
+			const rewritten = rewritePublicAudience(item, preserveSecured, parentKey, depth + 1);
+			if (rewritten !== item) changed = true;
+			return rewritten;
+		});
+		return changed ? mapped : value;
 	}
-	return resolveContextTarget(target, state);
-}
-function refreshGraphAliases(state) {
-	state.graphTerms.clear();
-	for (const [term, target] of state.termTargets) if (target === "@graph") state.graphTerms.add(term);
-}
-function normalizeContextReference(reference, baseUrl) {
-	if (baseUrl != null) return new URL(reference, baseUrl).href;
-	return URL.canParse(reference) ? new URL(reference).href : reference;
-}
-/** @internal */
-function isInvalidUrlTypeError(error) {
-	const code = error.code;
-	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+	if (typeof value !== "object" || value == null) return value;
+	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(value)) return value;
+	const record = value;
+	let changed = false;
+	const normalized = Object.create(null);
+	for (const key of Object.keys(record)) {
+		const rewritten = key === "@context" ? record[key] : record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public") ? _fedify_vocab.PUBLIC_COLLECTION.href : rewritePublicAudience(record[key], preserveSecured, key, depth + 1);
+		if (rewritten !== record[key]) changed = true;
+		normalized[key] = rewritten;
+	}
+	return changed ? normalized : value;
 }
-async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
-	if (context === null) return createGraphAliasContextState();
-	let nextState = cloneGraphAliasContextState(state);
-	if (Array.isArray(context)) {
-		for (const item of context) nextState = await applyGraphAliasContext(nextState, item, documentLoader, remoteContextCache, baseUrl, processingContexts);
-		return nextState;
+/**
+* Reports whether `value` carries an `@context` property anywhere inside
+* its subtree (not counting the value itself).  A nested `@context` can
+* introduce a local term-definition scope that redefines `as:` or `Public`
+* even when the top-level `@context` is safe, so the fast path must defer
+* to the URDNA2015 equivalence check whenever one is present.
+*/
+function hasNestedContext$1(value, depth = 0) {
+	if (depth >= MAX_TRAVERSAL_DEPTH$1) return true;
+	if (Array.isArray(value)) return value.some((item) => hasNestedContext$1(item, depth + 1));
+	if (typeof value !== "object" || value == null) return false;
+	const record = value;
+	for (const key of Object.keys(record)) {
+		if (key === "@context") return true;
+		if (hasNestedContext$1(record[key], depth + 1)) return true;
 	}
-	if (typeof context === "string") {
-		const reference = normalizeContextReference(context, baseUrl);
-		const cacheKey = `${baseUrl ?? ""}\n${reference}`;
-		if (processingContexts.has(cacheKey)) return nextState;
-		processingContexts.add(cacheKey);
-		try {
-			let remoteContext = remoteContextCache.get(cacheKey);
-			if (remoteContext == null) {
-				remoteContext = (async () => {
-					try {
-						return getRemoteContext(await documentLoader(reference), reference);
-					} catch (error) {
-						if (reference === context && isInvalidUrlTypeError(error) && isClearlyMalformedContextReference(context)) throw new InvalidContextReferenceError(context);
-						throw error;
-					}
-				})();
-				remoteContextCache.set(cacheKey, remoteContext);
-			}
-			const loadedRemoteContext = await remoteContext;
-			return await applyGraphAliasContext(nextState, loadedRemoteContext.context, documentLoader, remoteContextCache, loadedRemoteContext.baseUrl, processingContexts);
-		} finally {
-			processingContexts.delete(cacheKey);
-		}
+	return false;
+}
+/**
+* Checks whether the `@context` of a JSON-LD document is guaranteed not
+* to redefine the `as:` prefix or the bare `Public` term.  Only documents
+* whose `@context` is a string, or an array of strings, drawn from Fedify's
+* preloaded context set AND including the ActivityStreams URL qualify,
+* AND no nested subtree carries its own `@context` that might redefine
+* those terms within a local scope.  When all of that holds the rewrite
+* is provably semantics-preserving and the URDNA2015 equivalence check
+* can be skipped.  Any other shape (unknown external URLs, inline
+* objects at the top level, nested `@context` blocks) is treated as
+* potentially unsafe.
+*/
+function hasKnownSafeContext$1(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	const record = jsonLd;
+	if (!Object.hasOwn(record, "@context")) return false;
+	const ctx = record["@context"];
+	const entries = typeof ctx === "string" ? [ctx] : Array.isArray(ctx) ? ctx : null;
+	if (entries == null || entries.length === 0) return false;
+	let hasAs = false;
+	for (const entry of entries) {
+		if (typeof entry !== "string") return false;
+		if (!KNOWN_SAFE_CONTEXT_URLS$1.has(entry)) return false;
+		if (entry === AS_CONTEXT_URL$1) hasAs = true;
 	}
-	if (typeof context === "object" && context != null) {
-		if ("@import" in context && typeof context["@import"] === "string") nextState = await applyGraphAliasContext(nextState, context["@import"], documentLoader, remoteContextCache, baseUrl, processingContexts);
-		const localTargets = /* @__PURE__ */ new Map();
-		for (const [term, definition] of globalThis.Object.entries(context)) {
-			if (term.startsWith("@")) continue;
-			const target = getDirectContextTarget(definition);
-			if (target == null) localTargets.set(term, null);
-			else if (typeof target === "string") localTargets.set(term, target);
-			else localTargets.delete(term);
-		}
-		for (const [term, definition] of globalThis.Object.entries(context)) {
-			if (term.startsWith("@")) continue;
-			if (localTargets.has(term)) {
-				const directTarget = localTargets.get(term);
-				if (directTarget == null) nextState.termTargets.set(term, null);
-				else nextState.termTargets.set(term, resolveLocalContextTarget(directTarget, nextState, localTargets));
-			} else nextState.termTargets.delete(term);
-			if (typeof definition === "object" && definition != null && "@context" in definition) nextState.propertyContexts.set(term, {
-				context: definition["@context"],
-				baseUrl
-			});
-			else nextState.propertyContexts.delete(term);
-			if (isJsonTypedDefinition(definition)) nextState.jsonTerms.add(term);
-			else nextState.jsonTerms.delete(term);
-		}
-		refreshGraphAliases(nextState);
+	if (!hasAs) return false;
+	for (const key of Object.keys(record)) {
+		if (key === "@context") continue;
+		if (hasNestedContext$1(record[key])) return false;
 	}
-	return nextState;
+	return true;
 }
-async function assertNoGraphBeforeCompaction(jsonLd, documentLoader, inheritedState = createGraphAliasContextState(), propertyContext, remoteContextCache = /* @__PURE__ */ new Map()) {
-	if (Array.isArray(jsonLd)) {
-		for (const item of jsonLd) await assertNoGraphBeforeCompaction(item, documentLoader, inheritedState, propertyContext, remoteContextCache);
-		return;
+/**
+* Rewrites the compact `as:Public` / `Public` CURIE appearing in activity
+* addressing fields (`to`, `cc`, `bto`, `bcc`, `audience`) to the fully
+* expanded `https://www.w3.org/ns/activitystreams#Public` URI.
+*
+* Several ActivityPub implementations, Lemmy among them, match these
+* fields as plain URLs without running JSON-LD expansion, and silently
+* drop activities whose public addressing appears in CURIE form.  This
+* helper works around that gap.
+*
+* For documents whose `@context` is drawn entirely from Fedify's
+* preloaded context set and includes the ActivityStreams URL, the
+* rewrite is applied directly: the content of every preloaded non-AS
+* context is known not to redefine the `as:` prefix or the bare `Public`
+* term, so the semantics are preserved by construction.  Any other
+* shape (an inline object, an unknown external URL, and so on) is
+* treated as potentially unsafe and gated on a JSON-LD equivalence
+* check; both forms are canonicalized with URDNA2015 and the resulting
+* N-Quads are compared.  When they differ, the original document is
+* returned unchanged.  Canonicalization failures also fall back to the
+* original document.
+*
+* When no `contextLoader` is supplied the helper falls back to an
+* internal loader that resolves only the URLs in Fedify's
+* preloaded-contexts set and rejects every other URL without issuing a
+* network request.  That behaviour is deliberately narrower than
+* `@fedify/vocab-runtime`'s `getDocumentLoader()`, which after its
+* `validatePublicUrl` check will happily fetch non-preloaded URLs: the
+* helper is reached from verification paths (`verifyProof()` /
+* `verifyObject()`) that operate on inbound, potentially adversarial
+* JSON-LD, and a default loader that fetches attacker-supplied
+* `@context` URLs on the caller's behalf would be an SSRF vector.
+* Canonicalization failures against the restricted loader fall back to
+* the original document, same as any other canonicalization error.
+* Callers that genuinely need the remote-fetch loader (for example
+* applications that sign local JSON-LD against a custom vocabulary)
+* should pass a `contextLoader` explicitly.
+*
+* Must be called before any signing step that canonicalizes the
+* compact form byte-for-byte (for example, Object Integrity Proofs
+* using the `eddsa-jcs-2022` cryptosuite), so the signed payload
+* matches what is sent on the wire.
+*/
+async function normalizePublicAudience(jsonLd, contextLoader, options = {}) {
+	const preserveSecured = options.preserveNestedSecuredDocuments ?? false;
+	if (!hasPublicCurieInAddressing(jsonLd, preserveSecured)) return jsonLd;
+	const normalized = rewritePublicAudience(jsonLd, preserveSecured);
+	if (hasKnownSafeContext$1(jsonLd)) return normalized;
+	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
+	try {
+		const [before, after] = await Promise.all([_fedify_vocab_runtime_jsonld.default.canonize(jsonLd, {
+			format: "application/n-quads",
+			documentLoader: loader
+		}), _fedify_vocab_runtime_jsonld.default.canonize(normalized, {
+			format: "application/n-quads",
+			documentLoader: loader
+		})]);
+		if (before === after) return normalized;
+		logger$3.warn("Expanding the public audience CURIE to its full URI would change the canonical form of the activity; sending the activity as is.  This usually means the active JSON-LD context redefines the `as:` prefix or the bare `Public` term.");
+	} catch (error) {
+		logger$3.debug("Failed to verify public audience normalization equivalence via JSON-LD canonicalization; sending the activity as is.\n{error}", { error });
 	}
-	if (typeof jsonLd !== "object" || jsonLd == null) return;
-	const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
-	let state = inheritedState;
-	if (propertyContext !== void 0) state = await applyGraphAliasContext(state, propertyContext.context, documentLoader, remoteContextCache, propertyContext.baseUrl);
-	if ("@context" in jsonLd) state = await applyGraphAliasContext(state, jsonLd["@context"], documentLoader, remoteContextCache);
-	for (const [key, value] of globalThis.Object.entries(jsonLd)) {
-		if (key === "@context") continue;
-		if (jsonLiteralWrapper && key === "@value") continue;
-		if (key === "@graph" || state.graphTerms.has(key)) throw new UnsafeJsonLdError("@graph");
-		if (state.jsonTerms.has(key)) continue;
-		await assertNoGraphBeforeCompaction(value, documentLoader, state, state.propertyContexts.get(key), remoteContextCache);
+	return jsonLd;
+}
+//#endregion
+//#region src/compat/outgoing-jsonld.ts
+const logger$2 = (0, _logtape_logtape.getLogger)([
+	"fedify",
+	"compat",
+	"outgoing-jsonld"
+]);
+const ATTACHMENT_FIELDS = /* @__PURE__ */ new Set(["attachment", "https://www.w3.org/ns/activitystreams#attachment"]);
+const AS_CONTEXT_URL = "https://www.w3.org/ns/activitystreams";
+const KNOWN_SAFE_CONTEXT_URLS = getKnownSafeContextUrls();
+const MAX_TRAVERSAL_DEPTH = 64;
+function isJsonLdListObject(value) {
+	return typeof value === "object" && value != null && Object.hasOwn(value, "@list");
+}
+function isJsonLdValueObject(value) {
+	return typeof value === "object" && value != null && Object.hasOwn(value, "@value");
+}
+function* getContextObjects(value, seen = /* @__PURE__ */ new WeakSet()) {
+	if (Array.isArray(value)) {
+		if (seen.has(value)) return;
+		seen.add(value);
+		for (const item of value) yield* getContextObjects(item, seen);
+		return;
+	}
+	if (typeof value === "object" && value != null) {
+		if (seen.has(value)) return;
+		seen.add(value);
+		const record = value;
+		yield record;
+		for (const definition of Object.values(record)) {
+			if (typeof definition !== "object" || definition == null) continue;
+			const nestedContext = definition["@context"];
+			if (nestedContext == null) continue;
+			yield* getContextObjects(nestedContext, seen);
+		}
 	}
 }
-function isJsonLiteralWrapper(value) {
-	return "@value" in value && (value["@type"] === "@json" || value.type === "@json");
+function isActivityStreamsAttachmentTerm(value) {
+	return typeof value === "object" && value != null && value["@id"] === "as:attachment" && value["@type"] === "@id";
 }
 /** @internal */
-function assertSafeJsonLd(jsonLd) {
-	if (Array.isArray(jsonLd)) for (const item of jsonLd) assertSafeJsonLd(item);
-	else if (typeof jsonLd === "object" && jsonLd != null) {
-		const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
-		for (const [key, value] of globalThis.Object.entries(jsonLd)) {
-			if (disallowedJsonLdKeywords.has(key)) throw new UnsafeJsonLdError(key);
-			if (jsonLiteralWrapper && key === "@value") continue;
-			assertSafeJsonLd(value);
-		}
+function isPreloadedContextAttachmentSafe(document) {
+	if (typeof document !== "object" || document == null) return true;
+	const context = document["@context"];
+	for (const contextObject of getContextObjects(context)) {
+		if (!Object.hasOwn(contextObject, "attachment")) continue;
+		if (isActivityStreamsAttachmentTerm(contextObject.attachment)) continue;
+		return false;
 	}
+	return true;
 }
-/**
-* Attaches a LD signature to the given JSON-LD document.
-* @param jsonLd The JSON-LD document to attach the signature to.  It is not
-*               modified.
-* @param signature The signature to attach.
-* @returns The JSON-LD document with the attached signature.
-* @throws {TypeError} If the input document is not a valid JSON-LD document.
-* @since 1.0.0
-*/
-function attachSignature(jsonLd, signature) {
-	if (typeof jsonLd !== "object" || jsonLd == null) throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
-	return {
-		...jsonLd,
-		signature
-	};
-}
-/**
-* Creates a LD signature for the given JSON-LD document.
-* @param jsonLd The JSON-LD document to sign.
-* @param privateKey The private key to sign the document.
-* @param keyId The ID of the public key that corresponds to the private key.
-* @param options Additional options for creating the signature.
-*                See also {@link CreateSignatureOptions}.
-* @return The created signature.
-* @throws {TypeError} If the private key is invalid or unsupported.
-* @since 1.0.0
-*/
-async function createSignature(jsonLd, privateKey, keyId, { contextLoader, created } = {}) {
-	validateCryptoKey(privateKey, "private");
-	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
-	const options = {
-		"@context": "https://w3id.org/identity/v1",
-		creator: keyId.href,
-		created: created?.toString() ?? (/* @__PURE__ */ new Date()).toISOString()
-	};
-	const message = await hashJsonLd(options, contextLoader) + await hashJsonLd(jsonLd, contextLoader);
-	const messageBytes = new TextEncoder().encode(message);
-	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, messageBytes);
-	return {
-		...options,
-		type: "RsaSignature2017",
-		signatureValue: (0, byte_encodings_base64.encodeBase64)(signature)
-	};
+function getKnownSafeContextUrls() {
+	const urls = /* @__PURE__ */ new Set();
+	for (const [url, document] of Object.entries(_fedify_vocab_runtime.preloadedContexts)) if (isPreloadedContextAttachmentSafe(document)) urls.add(url);
+	else logger$2.warn("Preloaded JSON-LD context {contextUrl} redefines the `attachment` term incompatibly; attachment array normalization will require canonicalization for documents using it.", { contextUrl: url });
+	return urls;
 }
 /**
-* Signs the given JSON-LD document with the private key and returns the signed
-* JSON-LD document.
-* @param jsonLd The JSON-LD document to sign.
-* @param privateKey The private key to sign the document.
-* @param keyId The key ID to use in the signature.  It will be used by the
-*              verifier to fetch the corresponding public key.
-* @param options Additional options for signing the document.
-*                See also {@link SignJsonLdOptions}.
-* @returns The signed JSON-LD document.
-* @throws {TypeError} If the private key is invalid or unsupported.
-* @since 1.0.0
+* Wraps scalar ActivityStreams attachment properties in arrays.
 */
-async function signJsonLd(jsonLd, privateKey, keyId, options) {
-	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.sign", { attributes: { "ld_signatures.key_id": keyId.href } }, async (span) => {
-		try {
-			const signature = await createSignature(jsonLd, privateKey, keyId, options);
-			if (span.isRecording()) {
-				span.setAttribute("ld_signatures.type", signature.type);
-				span.setAttribute("ld_signatures.signature", (0, byte_encodings_hex.encodeHex)((0, byte_encodings_base64.decodeBase64)(signature.signatureValue)));
+function wrapScalarAttachments(jsonLd, preserveSecured, depth = 0) {
+	if (depth >= MAX_TRAVERSAL_DEPTH) return jsonLd;
+	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(jsonLd)) return jsonLd;
+	if (Array.isArray(jsonLd)) {
+		let normalized = null;
+		for (let i = 0; i < jsonLd.length; i++) {
+			const item = jsonLd[i];
+			const next = wrapScalarAttachments(item, preserveSecured, depth + 1);
+			if (normalized == null && next !== item) normalized = jsonLd.slice(0, i);
+			if (normalized != null) normalized[i] = next;
+		}
+		return normalized ?? jsonLd;
+	}
+	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
+	const record = jsonLd;
+	const keys = Object.keys(record);
+	let normalized = null;
+	for (let i = 0; i < keys.length; i++) {
+		const key = keys[i];
+		const value = record[key];
+		const next = key === "@context" || key === "@value" && isJsonLdValueObject(jsonLd) ? value : wrapScalarAttachments(value, preserveSecured, depth + 1);
+		const output = ATTACHMENT_FIELDS.has(key) && next != null && !Array.isArray(next) && !isJsonLdListObject(next) ? [next] : next;
+		if (normalized == null && output !== value) {
+			const cloned = Object.create(null);
+			for (let j = 0; j < i; j++) {
+				const previousKey = keys[j];
+				cloned[previousKey] = record[previousKey];
 			}
-			return attachSignature(jsonLd, signature);
-		} catch (error) {
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
+			normalized = cloned;
 		}
-	});
-}
-/**
-* Checks if the given JSON-LD document has a Linked Data Signature-like
-* object, without restricting it to a single suite-specific shape.
-* @param jsonLd The JSON-LD document to check.
-* @returns `true` if the document has a signature-like object; `false`
-*          otherwise.
-* @since 2.2.0
-*/
-function hasSignatureLike(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	const signature = jsonLd.signature;
-	const hasReference = (value) => {
-		if (typeof value === "string") return true;
-		if (Array.isArray(value)) return value.some(hasReference);
-		return typeof value === "object" && value != null && ("id" in value && typeof value.id === "string" || "@id" in value && typeof value["@id"] === "string");
-	};
-	const hasSignatureObject = (value) => {
-		if (typeof value !== "object" || value == null) return false;
-		const signatureRecord = value;
-		return (typeof signatureRecord.type === "string" || Array.isArray(signatureRecord.type) && signatureRecord.type.some((item) => typeof item === "string")) && (hasReference(signatureRecord.creator) || hasReference(signatureRecord.verificationMethod)) && (typeof signatureRecord.signatureValue === "string" || typeof signatureRecord.jws === "string");
-	};
-	return Array.isArray(signature) ? signature.some(hasSignatureObject) : hasSignatureObject(signature);
+		if (normalized != null) normalized[key] = output;
+	}
+	return normalized ?? jsonLd;
 }
-/**
-* Checks if the given JSON-LD document has a Linked Data Signature.
-* @param jsonLd The JSON-LD document to check.
-* @returns `true` if the document has a signature; `false` otherwise.
-* @since 1.0.0
-*/
-function hasSignature(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	if ("signature" in jsonLd) {
-		const signature = jsonLd.signature;
-		if (typeof signature !== "object" || signature == null) return false;
-		return "type" in signature && signature.type === "RsaSignature2017" && "creator" in signature && typeof signature.creator === "string" && "created" in signature && typeof signature.created === "string" && "signatureValue" in signature && typeof signature.signatureValue === "string";
+function hasNestedContext(value, depth = 0) {
+	if (depth >= MAX_TRAVERSAL_DEPTH) return true;
+	if (Array.isArray(value)) return value.some((item) => hasNestedContext(item, depth + 1));
+	if (typeof value !== "object" || value == null) return false;
+	const record = value;
+	for (const key of Object.keys(record)) {
+		if (key === "@context") return true;
+		if (key === "@value" && isJsonLdValueObject(value)) continue;
+		if (hasNestedContext(record[key], depth + 1)) return true;
 	}
 	return false;
 }
-/**
-* Detaches Linked Data Signatures from the given JSON-LD document.
-* @param jsonLd The JSON-LD document to modify.
-* @returns The modified JSON-LD document.  If the input document does not
-*          contain a signature, the original document is returned.
-* @since 1.0.0
-*/
-function detachSignature(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
-	const doc = { ...jsonLd };
-	delete doc.signature;
-	return doc;
-}
-/**
-* Verifies Linked Data Signatures of the given JSON-LD document.
-*
-* This is a low-level utility that only checks the cryptographic signature
-* and (optionally) the cached key.  It does not run the JSON-LD parsing,
-* attribution, and owner checks that a complete inbound LD verification
-* needs.  For incoming activities, prefer {@link verifyJsonLd}, which is
-* the public verification entry point and the one that emits the
-* `activitypub.signature.verification.duration` metric for the LD path.
-* `verifySignature` itself only emits
-* `activitypub.signature.key_fetch.duration`, since the rest of the work
-* that the verification-duration metric is meant to cover happens in
-* `verifyJsonLd`.
-* @param jsonLd The JSON-LD document to verify.
-* @param options Options for verifying the signature.
-* @returns The public key that signed the document or `null` if the signature
-*          is invalid or the key is not found.
-* @since 1.0.0
-*/
-async function verifySignature(jsonLd, options = {}) {
-	if (!hasSignature(jsonLd)) return null;
-	const sig = jsonLd.signature;
-	let signature;
-	try {
-		signature = (0, byte_encodings_base64.decodeBase64)(sig.signatureValue);
-	} catch (error) {
-		logger$2.debug("Failed to verify; invalid base64 signatureValue: {signatureValue}", {
-			...sig,
-			error
-		});
-		return null;
-	}
-	const { key, cached } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), _fedify_vocab.CryptographicKey, options));
-	if (key == null) return null;
-	const sigOpts = {
-		...sig,
-		"@context": "https://w3id.org/identity/v1"
-	};
-	delete sigOpts.type;
-	delete sigOpts.id;
-	delete sigOpts.signatureValue;
-	let sigOptsHash;
-	try {
-		sigOptsHash = await hashJsonLd(sigOpts, options.contextLoader);
-	} catch (error) {
-		logger$2.warn("Failed to verify; failed to hash the signature options: {signatureOptions}\n{error}", {
-			signatureOptions: sigOpts,
-			error
-		});
-		return null;
+function exceedsTraversalDepth(value, depth = 0) {
+	if (depth >= MAX_TRAVERSAL_DEPTH) return true;
+	if (Array.isArray(value)) return value.some((item) => exceedsTraversalDepth(item, depth + 1));
+	if (typeof value !== "object" || value == null) return false;
+	const record = value;
+	for (const key of Object.keys(record)) {
+		if (key === "@context" || key === "@value" && isJsonLdValueObject(value)) continue;
+		if (exceedsTraversalDepth(record[key], depth + 1)) return true;
 	}
-	const document = { ...jsonLd };
-	delete document.signature;
-	let docHash;
-	try {
-		docHash = await hashJsonLd(document, options.contextLoader);
-	} catch (error) {
-		logger$2.warn("Failed to verify; failed to hash the document: {document}\n{error}", {
-			document,
-			error
-		});
-		return null;
+	return false;
+}
+function hasKnownSafeContext(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	const record = jsonLd;
+	if (!Object.hasOwn(record, "@context")) return false;
+	const context = record["@context"];
+	const entries = typeof context === "string" ? [context] : Array.isArray(context) ? context : null;
+	if (entries == null || entries.length < 1) return false;
+	let hasActivityStreamsContext = false;
+	for (const entry of entries) {
+		if (typeof entry !== "string") return false;
+		if (!KNOWN_SAFE_CONTEXT_URLS.has(entry)) return false;
+		if (entry === AS_CONTEXT_URL) hasActivityStreamsContext = true;
 	}
-	const encoder = new TextEncoder();
-	const message = sigOptsHash + docHash;
-	const messageBytes = encoder.encode(message);
-	if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes)) return key;
-	if (cached) {
-		logger$2.debug("Failed to verify with the cached key {keyId}; signature {signatureValue} is invalid.  Retrying with the freshly fetched key...", {
-			keyId: sig.creator,
-			...sig
-		});
-		const { key } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), _fedify_vocab.CryptographicKey, {
-			...options,
-			keyCache: {
-				get: () => Promise.resolve(void 0),
-				set: async (keyId, key) => await options.keyCache?.set(keyId, key)
-			}
-		}));
-		if (key == null) return null;
-		return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes) ? key : null;
+	if (!hasActivityStreamsContext) return false;
+	for (const key of Object.keys(record)) {
+		if (key === "@context") continue;
+		if (hasNestedContext(record[key])) return false;
 	}
-	logger$2.debug("Failed to verify with the fetched key {keyId}; signature {signatureValue} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
-		keyId: sig.creator,
-		...sig,
-		message
-	});
-	return null;
+	return true;
+}
+function getLogSafeJsonLdMetadata(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return {};
+	const record = jsonLd;
+	const context = record["@context"];
+	return {
+		id: typeof record.id === "string" ? record.id : typeof record["@id"] === "string" ? record["@id"] : void 0,
+		type: typeof record.type === "string" ? record.type : typeof record["@type"] === "string" ? record["@type"] : void 0,
+		context: typeof context === "string" ? context : Array.isArray(context) ? context.filter((entry) => typeof entry === "string").slice(0, 4) : context == null ? void 0 : "[inline context]"
+	};
 }
 /**
-* Known Linked Data Signature `type` values, used to keep
-* `ld_signatures.type` on a bounded set of spec-defined string values.
-* Fedify only signs and verifies `RsaSignature2017`; other values come in
-* only from external documents and are dropped from the metric attribute to
-* avoid attacker-controlled cardinality.
-*/
-const LD_KNOWN_SIGNATURE_TYPES = /* @__PURE__ */ new Set(["RsaSignature2017"]);
-/**
-* Reports only whether a `signature` key is present on the document, with
-* no shape check on its value.  This is intentionally looser than
-* {@link hasSignature} (which validates a full `RsaSignature2017` shape)
-* and {@link hasSignatureLike} (which structurally accepts several known
-* suites): `verifyJsonLd` needs to tell a document with a malformed or
-* unsupported signature payload (classified as `rejected`) apart from a
-* truly unsigned document (classified as `missing`), and only this
-* presence-only check captures both cases.
+* Ensures ActivityStreams attachment properties are represented as arrays
+* when doing so preserves the JSON-LD semantics.
+*
+* JSON-LD compaction collapses single-item arrays into scalar values by
+* default.  Some ActivityPub implementations, Pixelfed among them, parse
+* `attachment` as a plain JSON array rather than a JSON-LD property and reject
+* otherwise valid objects whose single attachment is emitted as a scalar.
+*
+* When no `contextLoader` is supplied, the helper falls back to a restricted
+* loader that resolves only Fedify's preloaded JSON-LD contexts and rejects
+* every other URL without network access.  Documents with custom, inline, or
+* otherwise uncached contexts should pass a real `contextLoader` if they need
+* the semantic-preservation check to succeed; otherwise canonicalization
+* failures leave the original document unchanged.
 */
-function hasLdSignatureProperty(jsonLd) {
-	return typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
-}
-function getLdSignatureObject(jsonLd) {
-	if (!hasLdSignatureProperty(jsonLd)) return void 0;
-	const { signature } = jsonLd;
-	if (typeof signature !== "object" || signature == null || Array.isArray(signature)) return;
-	return signature;
+async function normalizeAttachmentArrays(jsonLd, contextLoader, options = {}) {
+	const normalized = wrapScalarAttachments(jsonLd, options.preserveNestedSecuredDocuments ?? false);
+	if (normalized === jsonLd) return jsonLd;
+	if (exceedsTraversalDepth(jsonLd)) {
+		logger$2.debug("Skipping attachment array normalization because the JSON-LD document exceeds the safe traversal depth; leaving it unchanged.");
+		return jsonLd;
+	}
+	if (hasKnownSafeContext(jsonLd)) return normalized;
+	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
+	try {
+		const [before, after] = await Promise.all([_fedify_vocab_runtime_jsonld.default.canonize(jsonLd, {
+			format: "application/n-quads",
+			documentLoader: loader
+		}), _fedify_vocab_runtime_jsonld.default.canonize(normalized, {
+			format: "application/n-quads",
+			documentLoader: loader
+		})]);
+		if (before === after) return normalized;
+		logger$2.warn("Wrapping scalar attachment values in arrays would change the canonical form of the JSON-LD document; leaving it unchanged.  This usually means the active JSON-LD context redefines the `attachment` term.  Document: {id}; type: {type}; context: {context}.", getLogSafeJsonLdMetadata(jsonLd));
+	} catch (error) {
+		logger$2.debug("Failed to verify attachment array normalization equivalence via JSON-LD canonicalization; leaving the JSON-LD document unchanged.\n{error}", { error });
+	}
+	return jsonLd;
 }
 /**
-* Verify the authenticity of the given JSON-LD document using Linked Data
-* Signatures.  If the document is signed, this function verifies the signature
-* and checks if the document is attributed to the owner of the public key.
-* If the document is not signed, this function returns `false`.
-* @param jsonLd The JSON-LD document to verify.
-* @param options Options for verifying the document.
-* @returns `true` if the document is authentic; `false` otherwise.
+* Applies Fedify's internal JSON-LD wire-format interoperability workarounds
+* to locally generated outgoing activities before they are signed, enqueued,
+* or sent.
 */
-async function verifyJsonLd(jsonLd, options = {}) {
-	return await verifyJsonLdInternal(jsonLd, options, true);
-}
-/** @internal */
-async function verifyCompactJsonLd(jsonLd, options = {}) {
-	return await verifyJsonLdInternal(jsonLd, options, false);
-}
-async function verifyJsonLdInternal(jsonLd, options, compact) {
-	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
-		const start = performance.now();
-		let verified = false;
-		let threw = false;
-		let signatureType;
-		try {
-			const verificationOptions = hasSignature(jsonLd) ? {
-				...options,
-				contextLoader: getNormalizationContextLoader(options.contextLoader)
-			} : options;
-			const compacted = compact ? hasSignature(jsonLd) ? await compactJsonLd(jsonLd, options.contextLoader) : jsonLd : jsonLd;
-			const object = await _fedify_vocab.Object.fromJsonLd(compacted, verificationOptions);
-			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
-			span.setAttribute("activitypub.object.type", (0, _fedify_vocab.getTypeId)(object).href);
-			const sig = getLdSignatureObject(jsonLd);
-			if (sig != null) {
-				if (typeof sig.creator === "string") span.setAttribute("ld_signatures.key_id", sig.creator);
-				if (typeof sig.signatureValue === "string") span.setAttribute("ld_signatures.signature", sig.signatureValue);
-				if (typeof sig.type === "string") {
-					span.setAttribute("ld_signatures.type", sig.type);
-					if (LD_KNOWN_SIGNATURE_TYPES.has(sig.type)) signatureType = sig.type;
-				}
-			}
-			const attributions = new Set(object.attributionIds.map((uri) => uri.href));
-			if (object instanceof _fedify_vocab.Activity) for (const uri of object.actorIds) attributions.add(uri.href);
-			const key = await verifySignature(compacted, verificationOptions);
-			if (key == null) return false;
-			if (key.ownerId == null) {
-				logger$2.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
-				return false;
-			}
-			attributions.delete(key.ownerId.href);
-			if (attributions.size > 0) {
-				logger$2.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
-				return false;
-			}
-			verified = true;
-			return true;
-		} catch (error) {
-			threw = true;
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			const classified = threw ? "error" : verified ? "verified" : hasLdSignatureProperty(jsonLd) ? "rejected" : "missing";
-			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "linked_data", classified, { ldType: signatureType });
-			span.end();
-		}
-	});
-}
-async function hashJsonLd(jsonLd, contextLoader) {
-	const canon = await _fedify_vocab_runtime_jsonld.default.canonize(jsonLd, {
-		format: "application/n-quads",
-		documentLoader: contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)()
-	});
-	const encoder = new TextEncoder();
-	return (0, byte_encodings_hex.encodeHex)(await crypto.subtle.digest("SHA-256", encoder.encode(canon)));
+async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, options = {}) {
+	jsonLd = await normalizePublicAudience(jsonLd, contextLoader, options);
+	return await normalizeAttachmentArrays(jsonLd, contextLoader, options);
 }
 //#endregion
 //#region src/sig/proof.ts
@@ -7024,8 +7093,37 @@ async function expandPortableObjectRoot(jsonLd, contextLoader) {
 		}
 	};
 }
+/**
+* Gets the DID of a portable object ID, which is either an `ap:` or
+* `ap+ef61:` URI or an FEP-ef61 compatible identifier.
+* @throws {TypeError} If the ID is malformed.
+*/
+function getObjectDid(id) {
+	try {
+		(0, _fedify_vocab_runtime.parseIri)(id);
+		if (PORTABLE_OBJECT_ID_PATTERN.test(id)) return (0, _fedify_vocab_runtime.getFe34Origin)(id);
+		const portableId = (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(id);
+		if (portableId != null) return (0, _fedify_vocab_runtime.getFe34Origin)(portableId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		throw new InvalidPortableObjectIdError(id, { cause: error });
+	}
+	throw new InvalidPortableObjectIdError(id);
+}
+/**
+* The error thrown when a document's ID looks portable, i.e., it is an `ap:`
+* or `ap+ef61:` URI or looks like an FEP-ef61 compatible identifier, but is
+* malformed.
+* @internal
+*/
+var InvalidPortableObjectIdError = class extends TypeError {
+	constructor(id, options) {
+		super(`Invalid portable object ID: ${id}`, options);
+		this.name = "InvalidPortableObjectIdError";
+	}
+};
 async function preparePortableObjectProof(jsonLd, options) {
-	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !PORTABLE_OBJECT_ID_PATTERN.test(jsonLd["@id"])) return {
+	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !isPortableId(jsonLd["@id"])) return {
 		prepared: false,
 		result: {
 			verified: false,
@@ -7034,15 +7132,15 @@ async function preparePortableObjectProof(jsonLd, options) {
 	};
 	const { root, proofContextLoader } = await expandPortableObjectRoot(jsonLd, options.contextLoader);
 	const id = root["@id"];
-	if (typeof id !== "string" || !PORTABLE_OBJECT_ID_PATTERN.test(id)) return {
+	if (typeof id !== "string" || !isPortableId(id)) return {
 		prepared: false,
 		result: {
 			verified: false,
 			reason: { type: "notPortableObject" }
 		}
 	};
+	const objectDid = getObjectDid(id);
 	const objectId = (0, _fedify_vocab_runtime.parseIri)(id);
-	(0, _fedify_vocab_runtime.getFe34Origin)(objectId);
 	const objectType = classifyFep2277CoreType(root);
 	if (objectType === "verificationMethod" || objectType === "publicKey" || objectType === "link") return {
 		prepared: false,
@@ -7147,7 +7245,7 @@ async function preparePortableObjectProof(jsonLd, options) {
 				}
 			};
 		}
-		if (!(0, _fedify_vocab_runtime.haveSameFe34Origin)(objectId, verificationMethod)) return {
+		if ((0, _fedify_vocab_runtime.getFe34Origin)(verificationMethod) !== objectDid) return {
 			prepared: false,
 			result: {
 				verified: false,
@@ -7206,15 +7304,24 @@ async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
 * collection without a proof is reported separately so a caller can apply a
 * gateway trust policy.  Embedded portable objects are not traversed.
 *
+* A portable object is a document whose ID is an `ap:` or `ap+ef61:` URI, or
+* an [FEP-ef61] compatible identifier such as
+* `https://gw.example/.well-known/apgateway/did:key:z6Mk…/actor`, which
+* stands for the portable ID `ap+ef61://did:key:z6Mk…/actor`.
+*
 * Every proof must use a DID URL whose DID matches the portable object's
-* authority, and every proof must pass {@link verifyProof}.
+* authority, i.e., the DID of its canonical portable ID, and every proof must
+* pass {@link verifyProof}.  The proofs are verified over the document as
+* given; a compatible identifier is never rewritten into a portable ID.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 *
 * @param jsonLd The JSON-LD document to verify.
 * @param options Additional options.  See also
 *                {@link VerifyPortableObjectProofOptions}.
 * @returns The detailed portable proof-policy result.
 * @throws {TypeError} If the input is not a single JSON-LD object or has a
-*                     malformed portable ID.
+*                     malformed portable ID or compatible identifier.
 * @since 2.4.0
 */
 async function verifyPortableObjectProof(jsonLd, options = {}) {
@@ -7314,7 +7421,7 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	};
 	const proofDocumentLoader = async (url, loaderOptions) => {
 		const remoteDocument = await baseDocumentLoader(url, loaderOptions);
-		if (PORTABLE_OBJECT_ID_PATTERN.test(url)) loadedPortableProofs++;
+		if (isPortableId(url)) loadedPortableProofs++;
 		const reference = normalizeDocumentUrl(url);
 		const candidateIndex = rawProofCandidates.findIndex((candidate, index) => !hydratedCandidates.has(index) && !rawProofCandidatePool.used.has(index) && candidate.reference === reference);
 		if (candidateIndex >= 0) {
@@ -7364,11 +7471,13 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	return object;
 }
 function deleteAuthenticatedAttribution(attributions, controllerId, verificationMethodId) {
-	const controllerHasCryptographicOrigin = hasCryptographicOrigin(controllerId.href);
-	const verificationMethodMatchesController = controllerHasCryptographicOrigin && hasCryptographicOrigin(verificationMethodId.href) && (0, _fedify_vocab_runtime.haveSameFe34Origin)(controllerId, verificationMethodId);
-	if (!controllerHasCryptographicOrigin || verificationMethodMatchesController) attributions.delete(controllerId.href);
-	if (!verificationMethodMatchesController) return;
-	for (const attribution of [...attributions]) if (hasCryptographicOrigin(attribution) && (0, _fedify_vocab_runtime.haveSameFe34Origin)(controllerId, attribution)) attributions.delete(attribution);
+	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) {
+		attributions.delete(controllerId.href);
+		return;
+	}
+	const did = getPortableDid(controllerId);
+	if (did == null || !hasCryptographicOrigin(verificationMethodId.href) || getPortableDid(verificationMethodId) !== did) return;
+	for (const attribution of [...attributions]) if ((hasCryptographicOrigin(attribution) || isPortableId(attribution)) && getPortableDid(attribution) === did) attributions.delete(attribution);
 }
 function hasCryptographicOrigin(iri) {
 	return /^did:/i.test(iri) || /^ap(?:\+ef61)?:\/\//i.test(iri);
@@ -7387,13 +7496,19 @@ const SEC = "https://w3id.org/security#";
 *
 * A gateway key is accepted only if:
 *
-*  -  the document is an actor whose portable ID is the one the key ID is
-*     the compatible identifier of;
+*  -  the document is an actor whose portable ID, i.e., its `ap:` ID or
+*     the canonical portable ID of its compatible identifier, is the one
+*     the key ID is the compatible identifier of;
 *  -  the document has a valid [FEP-8b32] Object Integrity Proof made by
 *     the DID of its ID, i.e., it satisfies the [FEP-ef61] proof policy;
 *  -  the document embeds a `Multikey` with that ID in its `assertionMethod`,
-*     whose `controller` is the actor, as [FEP-521a] requires; a key
-*     embedded in its `publicKey` with the same ID must agree with it; and
+*     whose `controller` is the actor, as [FEP-521a] requires, and a key
+*     embedded in its `publicKey` with the same ID agrees with it; or, if
+*     no `assertionMethod` entry has that ID, the document embeds
+*     a `CryptographicKey` with that ID in its `publicKey`, whose `owner` is
+*     the actor, as some publishers, e.g., tootik, list their RSA keys only
+*     there;
+*  -  no more than one entry of either property has that ID; and
 *  -  the key ID's origin is one of the actor's `gateways`.
 *
 * [FEP-8b32]: https://w3id.org/fep/8b32
@@ -7442,6 +7557,21 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 	if (!result.verified) return reject("The actor document does not satisfy the FEP-ef61 proof policy: " + result.reason.type);
 	if (root == null) return reject("The actor document could not be expanded.");
 	const refuse = (url) => Promise.reject(/* @__PURE__ */ new Error(`Refusing to fetch ${url}.`));
+	const parseEmbeddedPublicKey = async (node) => {
+		if (isReference(node)) return null;
+		let key;
+		try {
+			key = await _fedify_vocab.CryptographicKey.fromJsonLd(node, {
+				documentLoader: refuse,
+				contextLoader: options.contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			return null;
+		}
+		return key.publicKey == null ? null : key;
+	};
 	let verifiedActor;
 	try {
 		verifiedActor = await _fedify_vocab.Object.fromJsonLd(root, {
@@ -7455,41 +7585,42 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 	}
 	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
 	actor = verifiedActor;
-	const multikeyNode = findEmbeddedNode(root[`${SEC}assertionMethod`], keyId);
-	if (multikeyNode == null) return reject("The actor document does not embed the key in its assertionMethod.");
-	let multikey;
-	try {
-		multikey = await _fedify_vocab.Multikey.fromJsonLd(multikeyNode, {
-			documentLoader: refuse,
-			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider
-		});
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		return reject("The key in the assertionMethod is malformed.");
-	}
-	if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
-	if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
-	const publicKeyNode = findEmbeddedNode(root[`${SEC}publicKey`], keyId);
-	if (publicKeyNode != null) {
-		let publicKey;
+	const assertionNodes = findNodes(root[`${SEC}assertionMethod`], keyId);
+	const publicKeyNodes = findNodes(root[`${SEC}publicKey`], keyId);
+	if (assertionNodes.length > 1 || publicKeyNodes.length > 1) return reject("The actor document has more than one key with the ID.");
+	let publicKey;
+	if (assertionNodes.length > 0) {
+		if (isReference(assertionNodes[0])) return reject("The actor document does not embed the key in its assertionMethod.");
+		let multikey;
 		try {
-			publicKey = await _fedify_vocab.CryptographicKey.fromJsonLd(publicKeyNode, {
+			multikey = await _fedify_vocab.Multikey.fromJsonLd(assertionNodes[0], {
 				documentLoader: refuse,
 				contextLoader: options.contextLoader,
 				tracerProvider: options.tracerProvider
 			});
 		} catch (error) {
 			if (!(error instanceof TypeError)) throw error;
-			return reject("The key in the publicKey is malformed.");
+			return reject("The key in the assertionMethod is malformed.");
 		}
-		if (publicKey.publicKey == null || !await isSamePublicKey(publicKey.publicKey, multikey.publicKey) || publicKey.ownerId != null && getCanonicalPortableId(publicKey.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
+		if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
+		if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
+		publicKey = multikey.publicKey;
+		if (publicKeyNodes.length > 0 && !isReference(publicKeyNodes[0])) {
+			const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
+			if (embedded == null || !await isSamePublicKey(embedded.publicKey, publicKey) || embedded.ownerId != null && getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
+		}
+	} else {
+		if (publicKeyNodes.length < 1) return reject("The actor document embeds the key in neither its assertionMethod nor its publicKey.");
+		const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
+		if (embedded == null) return reject("The key in the publicKey is not embedded or malformed.");
+		if (embedded.ownerId == null || getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The owner of the key is not the actor.");
+		publicKey = embedded.publicKey;
 	}
 	if (!actor.gateways.some((gateway) => (0, _fedify_vocab_runtime.isGatewayUrl)(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
 	const key = new _fedify_vocab.CryptographicKey({
 		id: keyId,
 		owner: actor.id,
-		publicKey: multikey.publicKey
+		publicKey
 	});
 	return {
 		type: "verified",
@@ -7539,24 +7670,21 @@ async function fetchPortableGatewayKey(keyId, options = {}) {
 		contextLoader
 	});
 }
-function findEmbeddedNode(values, id) {
-	if (!Array.isArray(values)) return null;
+function findNodes(values, id) {
+	if (!Array.isArray(values)) return [];
+	const nodes = [];
 	for (const value of values) {
 		if (value == null || typeof value !== "object" || Array.isArray(value)) continue;
 		const node = value;
 		const nodeId = node["@id"];
-		if (typeof nodeId !== "string") continue;
-		let parsed;
-		try {
-			parsed = new URL(nodeId);
-		} catch {
-			continue;
-		}
-		if (parsed.href !== id.href) continue;
-		if (Object.keys(node).every((key) => key === "@id")) continue;
-		return node;
+		if (typeof nodeId !== "string" || !URL.canParse(nodeId)) continue;
+		if (new URL(nodeId).href === id.href) nodes.push(node);
 	}
-	return null;
+	return nodes;
+}
+/** A node with nothing but an `@id` is a reference, not an embedded key. */
+function isReference(node) {
+	return Object.keys(node).every((key) => key === "@id");
 }
 //#endregion
 //#region src/sig/http.ts
@@ -8658,6 +8786,12 @@ Object.defineProperty(exports, "InvalidContextReferenceError", {
 		return InvalidContextReferenceError;
 	}
 });
+Object.defineProperty(exports, "InvalidPortableObjectIdError", {
+	enumerable: true,
+	get: function() {
+		return InvalidPortableObjectIdError;
+	}
+});
 Object.defineProperty(exports, "Temporal", {
 	enumerable: true,
 	get: function() {
@@ -8784,6 +8918,12 @@ Object.defineProperty(exports, "getNormalizationContextLoader", {
 		return getNormalizationContextLoader;
 	}
 });
+Object.defineProperty(exports, "getPortableDid", {
+	enumerable: true,
+	get: function() {
+		return getPortableDid;
+	}
+});
 Object.defineProperty(exports, "getRemoteHost", {
 	enumerable: true,
 	get: function() {
@@ -8850,6 +8990,12 @@ Object.defineProperty(exports, "isInvalidUrlTypeError", {
 		return isInvalidUrlTypeError;
 	}
 });
+Object.defineProperty(exports, "isPortableId", {
+	enumerable: true,
+	get: function() {
+		return isPortableId;
+	}
+});
 Object.defineProperty(exports, "isPortableUri", {
 	enumerable: true,
 	get: function() {
@@ -8886,6 +9032,12 @@ Object.defineProperty(exports, "parseRfc9421SignatureInput", {
 		return parseRfc9421SignatureInput;
 	}
 });
+Object.defineProperty(exports, "preloadedOnlyDocumentLoader", {
+	enumerable: true,
+	get: function() {
+		return preloadedOnlyDocumentLoader;
+	}
+});
 Object.defineProperty(exports, "recordCircuitBreakerStateChange", {
 	enumerable: true,
 	get: function() {