@fedify/fedify 2.4.0-dev.2084 → 2.4.0-dev.2099

package/dist/{http-4PCCvhsU.js → http-D-rbr_Sy.js}

@@ -3,17 +3,147 @@ import { URLPattern } from "urlpattern-polyfill";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, PUBLIC_COLLECTION, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, metrics, trace } from "@opentelemetry/api";
+import { FetchError, canonicalizePortableUri, encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDidKeyVerificationMethod, parseIri, preloadedContexts, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { encodeHex } from "byte-encodings/hex";
-import { FetchError, canonicalizePortableUri, encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, haveSameFe34Origin, isGatewayUrl, parseDidKeyVerificationMethod, parseIri, preloadedContexts, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import { Item, decodeDict, encodeDict, encodeItem } from "structured-field-values";
+import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { isPlainJsonTree, retainSignedRepresentation } from "@fedify/vocab-runtime/internal/signed-representation";
 import serialize from "json-canon";
-import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2084+4b8bd325";
+var version = "2.4.0-dev.2099+cd074fe2";
+//#endregion
+//#region src/sig/portable-key-id.ts
+const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+/**
+* Checks whether the URL is an `ap:` or `ap+ef61:` URI.
+* @internal
+*/
+function isPortableUri(url) {
+	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
+}
+/**
+* Checks whether an ID identifies an [FEP-ef61] portable object, i.e., it is
+* an `ap:` or `ap+ef61:` URI, or looks like a compatible identifier.
+* A malformed compatible identifier counts too, so that it is rejected as
+* a portable object that no proof can match, rather than trusted by its web
+* origin.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isPortableId(id) {
+	if (typeof id === "string") {
+		if (/^ap(?:\+ef61)?:\/\//i.test(id)) return true;
+	} else if (isPortableUri(id)) return true;
+	return isCompatibleEf61Iri(id);
+}
+/**
+* Gets the DID, i.e., the FEP-fe34 cryptographic origin, of an `ap:` or
+* `ap+ef61:` URI, a DID URL, or a compatible identifier.
+* @returns The DID, or `null` if the ID is none of them, or is malformed.
+* @internal
+*/
+function getPortableDid(id) {
+	try {
+		const raw = typeof id === "string" ? id : id.href;
+		if (/^(?:did:|ap(?:\+ef61)?:\/\/)/i.test(raw)) return getFe34Origin(id);
+		const portable = fromCompatibleEf61Id(id);
+		return portable == null ? null : getFe34Origin(portable);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Checks whether an activity is performed by an FEP-ef61 portable actor,
+* i.e., any of its actors has an `ap:` or `ap+ef61:` ID, or a compatible
+* identifier.
+* @internal
+*/
+function hasPortableActor(activity) {
+	return activity.actorIds.some((id) => isPortableId(id));
+}
+/**
+* Checks whether a key ID looks like an [FEP-ef61] compatible identifier,
+* i.e., an HTTP(S) URL under a gateway's `/.well-known/apgateway/did:` path.
+* Such a key ID names a key that a gateway holds for a portable actor, so it
+* is resolved only as a gateway key, and never cached in a key cache.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isCompatibleKeyId(keyId) {
+	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
+}
+/**
+* Gets the canonical portable ID of an actor ID that is either an `ap:` or
+* `ap+ef61:` URI or a compatible identifier.
+* @returns The canonical portable ID, or `null` if the ID is neither, or is
+*          malformed.
+* @internal
+*/
+function getCanonicalPortableId(id) {
+	try {
+		if (isPortableUri(id)) return canonicalizePortableUri(formatIri(id));
+		const portable = fromCompatibleEf61Id(id);
+		if (portable == null) return null;
+		return canonicalizePortableUri(formatIri(portable));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Builds the base of the key IDs of a gateway's keys for a portable actor:
+* the actor's compatible identifier on the gateway.
+* @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
+*                or a compatible identifier.  It must not have a fragment.
+* @param gateway The gateway's origin, e.g., `https://example.com`.
+* @returns The compatible identifier without query and fragment.
+* @throws {TypeError} If the actor ID is not a portable ID, or has
+*                     a fragment.
+* @internal
+*/
+function getGatewayKeyBase(actorId, gateway) {
+	let portable;
+	if (isPortableUri(actorId)) portable = actorId;
+	else try {
+		portable = fromCompatibleEf61Id(actorId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		portable = null;
+	}
+	if (portable == null) throw new TypeError(`The portable actor ID ${actorId.href} must be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier.`);
+	if (portable.hash !== "") throw new TypeError(`The portable actor ID ${actorId.href} must not have a fragment.`);
+	const base = toCompatibleEf61Id(portable, gateway);
+	base.search = "";
+	base.hash = "";
+	return base;
+}
+/**
+* Tells whether a parsed document is a portable actor, i.e., an actor whose
+* ID is an `ap:` or `ap+ef61:` URI or a compatible identifier.  Such an actor
+* is never authenticated by the web origin that served it; at a compatible
+* key ID, it makes the key a gateway key that only
+* {@link verifyPortableGatewayKeyDocument} can vouch for.
+* @internal
+*/
+function isPortableActorDocument(object) {
+	return isActor(object) && object.id != null && isPortableId(object.id);
+}
+/**
+* Compares two public keys by their key material.
+* @internal
+*/
+async function isSamePublicKey(a, b) {
+	if (a.algorithm.name !== b.algorithm.name) return false;
+	const [x, y] = await Promise.all([crypto.subtle.exportKey("jwk", a), crypto.subtle.exportKey("jwk", b)]);
+	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
+}
 //#endregion
 //#region src/sig/accept.ts
 /**
@@ -173,440 +303,44 @@ const preloadedOnlyDocumentLoader = (url) => {
 	return Promise.reject(/* @__PURE__ */ new Error("Refusing to fetch a non-preloaded JSON-LD context: " + url));
 };
 //#endregion
-//#region src/compat/secured-document.ts
-function isJsonMap$1(value) {
-	return typeof value === "object" && value != null && !Array.isArray(value);
-}
-function isNonEmptyString(value) {
-	return typeof value === "string" && value.length > 0;
-}
-function hasDataIntegrityProofType(value) {
-	return (Array.isArray(value) ? value : [value]).some((type) => type === "DataIntegrityProof" || type === "https://w3id.org/security#DataIntegrityProof");
-}
-/**
-* Checks whether a JSON value is a complete, self-contained secured document:
-* a map with its own `@context` and exactly one direct, map-valued `proof`
-* that carries every member `eddsa-jcs-2022` proof generation produces.
-*
-* This is deliberately stricter than {@link hasProofLike}, which exists to
-* decide whether a document is worth verifying.  Here a false positive would
-* silently suppress a wire-compatibility fix on an ordinary document, so a
-* partial or malformed proof does not qualify.
-*
-* @internal
-*/
-function isSelfContainedSecuredDocument(value) {
-	if (!isJsonMap$1(value)) return false;
-	if (!Object.hasOwn(value, "@context") || value["@context"] == null) return false;
-	if (!Object.hasOwn(value, "proof")) return false;
-	const proof = value.proof;
-	if (!isJsonMap$1(proof)) return false;
-	return hasDataIntegrityProofType(proof.type) && isNonEmptyString(proof.cryptosuite) && isNonEmptyString(proof.created) && isNonEmptyString(proof.verificationMethod) && isNonEmptyString(proof.proofPurpose) && isNonEmptyString(proof.proofValue);
-}
-//#endregion
-//#region src/compat/public-audience.ts
-const logger$4 = getLogger([
-	"fedify",
-	"compat",
-	"public-audience"
-]);
-const PUBLIC_ADDRESSING_FIELDS = /* @__PURE__ */ new Set([
-	"to",
-	"cc",
-	"bto",
-	"bcc",
-	"audience"
-]);
-const AS_CONTEXT_URL$1 = "https://www.w3.org/ns/activitystreams";
-const MAX_TRAVERSAL_DEPTH$1 = 64;
-const KNOWN_SAFE_CONTEXT_URLS$1 = new Set(Object.keys(preloadedContexts));
-function hasPublicCurieInAddressing(value, preserveSecured, parentKey, depth = 0) {
-	if (typeof value === "string") return parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public");
-	if (depth >= MAX_TRAVERSAL_DEPTH$1) return false;
-	if (Array.isArray(value)) return value.some((item) => hasPublicCurieInAddressing(item, preserveSecured, parentKey, depth + 1));
-	if (typeof value !== "object" || value == null) return false;
-	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(value)) return false;
-	const record = value;
-	for (const key of Object.keys(record)) {
-		if (record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public")) return true;
-		if (key === "@context") continue;
-		if (hasPublicCurieInAddressing(record[key], preserveSecured, key, depth + 1)) return true;
-	}
-	return false;
-}
-function rewritePublicAudience(value, preserveSecured, parentKey, depth = 0) {
-	if (typeof value === "string" && parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public")) return PUBLIC_COLLECTION.href;
-	if (depth >= MAX_TRAVERSAL_DEPTH$1) return value;
-	if (Array.isArray(value)) {
-		let changed = false;
-		const mapped = value.map((item) => {
-			const rewritten = rewritePublicAudience(item, preserveSecured, parentKey, depth + 1);
-			if (rewritten !== item) changed = true;
-			return rewritten;
-		});
-		return changed ? mapped : value;
-	}
-	if (typeof value !== "object" || value == null) return value;
-	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(value)) return value;
-	const record = value;
-	let changed = false;
-	const normalized = Object.create(null);
-	for (const key of Object.keys(record)) {
-		const rewritten = key === "@context" ? record[key] : record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public") ? PUBLIC_COLLECTION.href : rewritePublicAudience(record[key], preserveSecured, key, depth + 1);
-		if (rewritten !== record[key]) changed = true;
-		normalized[key] = rewritten;
-	}
-	return changed ? normalized : value;
-}
-/**
-* Reports whether `value` carries an `@context` property anywhere inside
-* its subtree (not counting the value itself).  A nested `@context` can
-* introduce a local term-definition scope that redefines `as:` or `Public`
-* even when the top-level `@context` is safe, so the fast path must defer
-* to the URDNA2015 equivalence check whenever one is present.
-*/
-function hasNestedContext$1(value, depth = 0) {
-	if (depth >= MAX_TRAVERSAL_DEPTH$1) return true;
-	if (Array.isArray(value)) return value.some((item) => hasNestedContext$1(item, depth + 1));
-	if (typeof value !== "object" || value == null) return false;
-	const record = value;
-	for (const key of Object.keys(record)) {
-		if (key === "@context") return true;
-		if (hasNestedContext$1(record[key], depth + 1)) return true;
-	}
-	return false;
-}
-/**
-* Checks whether the `@context` of a JSON-LD document is guaranteed not
-* to redefine the `as:` prefix or the bare `Public` term.  Only documents
-* whose `@context` is a string, or an array of strings, drawn from Fedify's
-* preloaded context set AND including the ActivityStreams URL qualify,
-* AND no nested subtree carries its own `@context` that might redefine
-* those terms within a local scope.  When all of that holds the rewrite
-* is provably semantics-preserving and the URDNA2015 equivalence check
-* can be skipped.  Any other shape (unknown external URLs, inline
-* objects at the top level, nested `@context` blocks) is treated as
-* potentially unsafe.
-*/
-function hasKnownSafeContext$1(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	const record = jsonLd;
-	if (!Object.hasOwn(record, "@context")) return false;
-	const ctx = record["@context"];
-	const entries = typeof ctx === "string" ? [ctx] : Array.isArray(ctx) ? ctx : null;
-	if (entries == null || entries.length === 0) return false;
-	let hasAs = false;
-	for (const entry of entries) {
-		if (typeof entry !== "string") return false;
-		if (!KNOWN_SAFE_CONTEXT_URLS$1.has(entry)) return false;
-		if (entry === AS_CONTEXT_URL$1) hasAs = true;
-	}
-	if (!hasAs) return false;
-	for (const key of Object.keys(record)) {
-		if (key === "@context") continue;
-		if (hasNestedContext$1(record[key])) return false;
-	}
-	return true;
-}
-/**
-* Rewrites the compact `as:Public` / `Public` CURIE appearing in activity
-* addressing fields (`to`, `cc`, `bto`, `bcc`, `audience`) to the fully
-* expanded `https://www.w3.org/ns/activitystreams#Public` URI.
-*
-* Several ActivityPub implementations, Lemmy among them, match these
-* fields as plain URLs without running JSON-LD expansion, and silently
-* drop activities whose public addressing appears in CURIE form.  This
-* helper works around that gap.
-*
-* For documents whose `@context` is drawn entirely from Fedify's
-* preloaded context set and includes the ActivityStreams URL, the
-* rewrite is applied directly: the content of every preloaded non-AS
-* context is known not to redefine the `as:` prefix or the bare `Public`
-* term, so the semantics are preserved by construction.  Any other
-* shape (an inline object, an unknown external URL, and so on) is
-* treated as potentially unsafe and gated on a JSON-LD equivalence
-* check; both forms are canonicalized with URDNA2015 and the resulting
-* N-Quads are compared.  When they differ, the original document is
-* returned unchanged.  Canonicalization failures also fall back to the
-* original document.
-*
-* When no `contextLoader` is supplied the helper falls back to an
-* internal loader that resolves only the URLs in Fedify's
-* preloaded-contexts set and rejects every other URL without issuing a
-* network request.  That behaviour is deliberately narrower than
-* `@fedify/vocab-runtime`'s `getDocumentLoader()`, which after its
-* `validatePublicUrl` check will happily fetch non-preloaded URLs: the
-* helper is reached from verification paths (`verifyProof()` /
-* `verifyObject()`) that operate on inbound, potentially adversarial
-* JSON-LD, and a default loader that fetches attacker-supplied
-* `@context` URLs on the caller's behalf would be an SSRF vector.
-* Canonicalization failures against the restricted loader fall back to
-* the original document, same as any other canonicalization error.
-* Callers that genuinely need the remote-fetch loader (for example
-* applications that sign local JSON-LD against a custom vocabulary)
-* should pass a `contextLoader` explicitly.
-*
-* Must be called before any signing step that canonicalizes the
-* compact form byte-for-byte (for example, Object Integrity Proofs
-* using the `eddsa-jcs-2022` cryptosuite), so the signed payload
-* matches what is sent on the wire.
-*/
-async function normalizePublicAudience(jsonLd, contextLoader, options = {}) {
-	const preserveSecured = options.preserveNestedSecuredDocuments ?? false;
-	if (!hasPublicCurieInAddressing(jsonLd, preserveSecured)) return jsonLd;
-	const normalized = rewritePublicAudience(jsonLd, preserveSecured);
-	if (hasKnownSafeContext$1(jsonLd)) return normalized;
-	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
-	try {
-		const [before, after] = await Promise.all([jsonld.canonize(jsonLd, {
-			format: "application/n-quads",
-			documentLoader: loader
-		}), jsonld.canonize(normalized, {
-			format: "application/n-quads",
-			documentLoader: loader
-		})]);
-		if (before === after) return normalized;
-		logger$4.warn("Expanding the public audience CURIE to its full URI would change the canonical form of the activity; sending the activity as is.  This usually means the active JSON-LD context redefines the `as:` prefix or the bare `Public` term.");
-	} catch (error) {
-		logger$4.debug("Failed to verify public audience normalization equivalence via JSON-LD canonicalization; sending the activity as is.\n{error}", { error });
-	}
-	return jsonLd;
-}
-//#endregion
-//#region src/compat/outgoing-jsonld.ts
-const logger$3 = getLogger([
-	"fedify",
-	"compat",
-	"outgoing-jsonld"
-]);
-const ATTACHMENT_FIELDS = /* @__PURE__ */ new Set(["attachment", "https://www.w3.org/ns/activitystreams#attachment"]);
-const AS_CONTEXT_URL = "https://www.w3.org/ns/activitystreams";
-const KNOWN_SAFE_CONTEXT_URLS = getKnownSafeContextUrls();
-const MAX_TRAVERSAL_DEPTH = 64;
-function isJsonLdListObject(value) {
-	return typeof value === "object" && value != null && Object.hasOwn(value, "@list");
-}
-function isJsonLdValueObject(value) {
-	return typeof value === "object" && value != null && Object.hasOwn(value, "@value");
-}
-function* getContextObjects(value, seen = /* @__PURE__ */ new WeakSet()) {
-	if (Array.isArray(value)) {
-		if (seen.has(value)) return;
-		seen.add(value);
-		for (const item of value) yield* getContextObjects(item, seen);
-		return;
-	}
-	if (typeof value === "object" && value != null) {
-		if (seen.has(value)) return;
-		seen.add(value);
-		const record = value;
-		yield record;
-		for (const definition of Object.values(record)) {
-			if (typeof definition !== "object" || definition == null) continue;
-			const nestedContext = definition["@context"];
-			if (nestedContext == null) continue;
-			yield* getContextObjects(nestedContext, seen);
-		}
-	}
-}
-function isActivityStreamsAttachmentTerm(value) {
-	return typeof value === "object" && value != null && value["@id"] === "as:attachment" && value["@type"] === "@id";
-}
-/** @internal */
-function isPreloadedContextAttachmentSafe(document) {
-	if (typeof document !== "object" || document == null) return true;
-	const context = document["@context"];
-	for (const contextObject of getContextObjects(context)) {
-		if (!Object.hasOwn(contextObject, "attachment")) continue;
-		if (isActivityStreamsAttachmentTerm(contextObject.attachment)) continue;
-		return false;
-	}
-	return true;
-}
-function getKnownSafeContextUrls() {
-	const urls = /* @__PURE__ */ new Set();
-	for (const [url, document] of Object.entries(preloadedContexts)) if (isPreloadedContextAttachmentSafe(document)) urls.add(url);
-	else logger$3.warn("Preloaded JSON-LD context {contextUrl} redefines the `attachment` term incompatibly; attachment array normalization will require canonicalization for documents using it.", { contextUrl: url });
-	return urls;
-}
-/**
-* Wraps scalar ActivityStreams attachment properties in arrays.
-*/
-function wrapScalarAttachments(jsonLd, preserveSecured, depth = 0) {
-	if (depth >= MAX_TRAVERSAL_DEPTH) return jsonLd;
-	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(jsonLd)) return jsonLd;
-	if (Array.isArray(jsonLd)) {
-		let normalized = null;
-		for (let i = 0; i < jsonLd.length; i++) {
-			const item = jsonLd[i];
-			const next = wrapScalarAttachments(item, preserveSecured, depth + 1);
-			if (normalized == null && next !== item) normalized = jsonLd.slice(0, i);
-			if (normalized != null) normalized[i] = next;
-		}
-		return normalized ?? jsonLd;
-	}
-	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
-	const record = jsonLd;
-	const keys = Object.keys(record);
-	let normalized = null;
-	for (let i = 0; i < keys.length; i++) {
-		const key = keys[i];
-		const value = record[key];
-		const next = key === "@context" || key === "@value" && isJsonLdValueObject(jsonLd) ? value : wrapScalarAttachments(value, preserveSecured, depth + 1);
-		const output = ATTACHMENT_FIELDS.has(key) && next != null && !Array.isArray(next) && !isJsonLdListObject(next) ? [next] : next;
-		if (normalized == null && output !== value) {
-			const cloned = Object.create(null);
-			for (let j = 0; j < i; j++) {
-				const previousKey = keys[j];
-				cloned[previousKey] = record[previousKey];
-			}
-			normalized = cloned;
-		}
-		if (normalized != null) normalized[key] = output;
-	}
-	return normalized ?? jsonLd;
-}
-function hasNestedContext(value, depth = 0) {
-	if (depth >= MAX_TRAVERSAL_DEPTH) return true;
-	if (Array.isArray(value)) return value.some((item) => hasNestedContext(item, depth + 1));
-	if (typeof value !== "object" || value == null) return false;
-	const record = value;
-	for (const key of Object.keys(record)) {
-		if (key === "@context") return true;
-		if (key === "@value" && isJsonLdValueObject(value)) continue;
-		if (hasNestedContext(record[key], depth + 1)) return true;
-	}
-	return false;
-}
-function exceedsTraversalDepth(value, depth = 0) {
-	if (depth >= MAX_TRAVERSAL_DEPTH) return true;
-	if (Array.isArray(value)) return value.some((item) => exceedsTraversalDepth(item, depth + 1));
-	if (typeof value !== "object" || value == null) return false;
-	const record = value;
-	for (const key of Object.keys(record)) {
-		if (key === "@context" || key === "@value" && isJsonLdValueObject(value)) continue;
-		if (exceedsTraversalDepth(record[key], depth + 1)) return true;
-	}
-	return false;
-}
-function hasKnownSafeContext(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	const record = jsonLd;
-	if (!Object.hasOwn(record, "@context")) return false;
-	const context = record["@context"];
-	const entries = typeof context === "string" ? [context] : Array.isArray(context) ? context : null;
-	if (entries == null || entries.length < 1) return false;
-	let hasActivityStreamsContext = false;
-	for (const entry of entries) {
-		if (typeof entry !== "string") return false;
-		if (!KNOWN_SAFE_CONTEXT_URLS.has(entry)) return false;
-		if (entry === AS_CONTEXT_URL) hasActivityStreamsContext = true;
-	}
-	if (!hasActivityStreamsContext) return false;
-	for (const key of Object.keys(record)) {
-		if (key === "@context") continue;
-		if (hasNestedContext(record[key])) return false;
-	}
-	return true;
-}
-function getLogSafeJsonLdMetadata(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return {};
-	const record = jsonLd;
-	const context = record["@context"];
-	return {
-		id: typeof record.id === "string" ? record.id : typeof record["@id"] === "string" ? record["@id"] : void 0,
-		type: typeof record.type === "string" ? record.type : typeof record["@type"] === "string" ? record["@type"] : void 0,
-		context: typeof context === "string" ? context : Array.isArray(context) ? context.filter((entry) => typeof entry === "string").slice(0, 4) : context == null ? void 0 : "[inline context]"
-	};
-}
-/**
-* Ensures ActivityStreams attachment properties are represented as arrays
-* when doing so preserves the JSON-LD semantics.
-*
-* JSON-LD compaction collapses single-item arrays into scalar values by
-* default.  Some ActivityPub implementations, Pixelfed among them, parse
-* `attachment` as a plain JSON array rather than a JSON-LD property and reject
-* otherwise valid objects whose single attachment is emitted as a scalar.
-*
-* When no `contextLoader` is supplied, the helper falls back to a restricted
-* loader that resolves only Fedify's preloaded JSON-LD contexts and rejects
-* every other URL without network access.  Documents with custom, inline, or
-* otherwise uncached contexts should pass a real `contextLoader` if they need
-* the semantic-preservation check to succeed; otherwise canonicalization
-* failures leave the original document unchanged.
-*/
-async function normalizeAttachmentArrays(jsonLd, contextLoader, options = {}) {
-	const normalized = wrapScalarAttachments(jsonLd, options.preserveNestedSecuredDocuments ?? false);
-	if (normalized === jsonLd) return jsonLd;
-	if (exceedsTraversalDepth(jsonLd)) {
-		logger$3.debug("Skipping attachment array normalization because the JSON-LD document exceeds the safe traversal depth; leaving it unchanged.");
-		return jsonLd;
-	}
-	if (hasKnownSafeContext(jsonLd)) return normalized;
-	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
-	try {
-		const [before, after] = await Promise.all([jsonld.canonize(jsonLd, {
-			format: "application/n-quads",
-			documentLoader: loader
-		}), jsonld.canonize(normalized, {
-			format: "application/n-quads",
-			documentLoader: loader
-		})]);
-		if (before === after) return normalized;
-		logger$3.warn("Wrapping scalar attachment values in arrays would change the canonical form of the JSON-LD document; leaving it unchanged.  This usually means the active JSON-LD context redefines the `attachment` term.  Document: {id}; type: {type}; context: {context}.", getLogSafeJsonLdMetadata(jsonLd));
-	} catch (error) {
-		logger$3.debug("Failed to verify attachment array normalization equivalence via JSON-LD canonicalization; leaving the JSON-LD document unchanged.\n{error}", { error });
-	}
-	return jsonLd;
-}
-/**
-* Applies Fedify's internal JSON-LD wire-format interoperability workarounds
-* to locally generated outgoing activities before they are signed, enqueued,
-* or sent.
-*/
-async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, options = {}) {
-	jsonLd = await normalizePublicAudience(jsonLd, contextLoader, options);
-	return await normalizeAttachmentArrays(jsonLd, contextLoader, options);
-}
-//#endregion
-//#region src/federation/metrics.ts
-var FederationMetrics = class {
-	deliverySent;
-	deliveryPermanentFailure;
-	signatureVerificationFailure;
-	signatureVerificationDuration;
-	signatureKeyFetchDuration;
-	deliveryDuration;
-	inboxProcessingDuration;
-	httpServerRequestCount;
-	httpServerRequestDuration;
-	queueTaskEnqueued;
-	queueTaskStarted;
-	queueTaskCompleted;
-	queueTaskFailed;
-	queueTaskDuration;
-	queueTaskInFlight;
-	queueDepth;
-	fanoutRecipients;
-	inboxActivity;
-	outboxActivity;
-	circuitBreakerStateChange;
-	keyLookup;
-	keyLookupDuration;
-	documentFetch;
-	documentFetchDuration;
-	documentCache;
-	webFingerHandle;
-	webFingerHandleDuration;
-	collectionRequest;
-	collectionDispatchDuration;
-	collectionPageItems;
-	collectionTotalItems;
-	constructor(meterProvider) {
-		const meter = meterProvider.getMeter(name, version);
-		this.deliverySent = meter.createCounter("activitypub.delivery.sent", {
-			description: "ActivityPub delivery attempts.",
-			unit: "{attempt}"
+//#region src/federation/metrics.ts
+var FederationMetrics = class {
+	deliverySent;
+	deliveryPermanentFailure;
+	signatureVerificationFailure;
+	signatureVerificationDuration;
+	signatureKeyFetchDuration;
+	deliveryDuration;
+	inboxProcessingDuration;
+	httpServerRequestCount;
+	httpServerRequestDuration;
+	queueTaskEnqueued;
+	queueTaskStarted;
+	queueTaskCompleted;
+	queueTaskFailed;
+	queueTaskDuration;
+	queueTaskInFlight;
+	queueDepth;
+	fanoutRecipients;
+	inboxActivity;
+	outboxActivity;
+	circuitBreakerStateChange;
+	keyLookup;
+	keyLookupDuration;
+	documentFetch;
+	documentFetchDuration;
+	documentCache;
+	webFingerHandle;
+	webFingerHandleDuration;
+	collectionRequest;
+	collectionDispatchDuration;
+	collectionPageItems;
+	collectionTotalItems;
+	constructor(meterProvider) {
+		const meter = meterProvider.getMeter(name, version);
+		this.deliverySent = meter.createCounter("activitypub.delivery.sent", {
+			description: "ActivityPub delivery attempts.",
+			unit: "{attempt}"
 		});
 		this.deliveryPermanentFailure = meter.createCounter("activitypub.delivery.permanent_failure", {
 			description: "ActivityPub deliveries abandoned as permanent failures.",
@@ -1379,99 +1113,6 @@ function getDurationMs(start) {
 	return Math.max(0, performance.now() - start);
 }
 //#endregion
-//#region src/sig/portable-key-id.ts
-const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
-/**
-* Checks whether the URL is an `ap:` or `ap+ef61:` URI.
-* @internal
-*/
-function isPortableUri(url) {
-	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
-}
-/**
-* Checks whether an activity is performed by an FEP-ef61 portable actor,
-* i.e., any of its actors has an `ap:` or `ap+ef61:` ID.
-* @internal
-*/
-function hasPortableActor(activity) {
-	return activity.actorIds.some(isPortableUri);
-}
-/**
-* Checks whether a key ID looks like an [FEP-ef61] compatible identifier,
-* i.e., an HTTP(S) URL under a gateway's `/.well-known/apgateway/did:` path.
-* Such a key ID names a key that a gateway holds for a portable actor, so it
-* is resolved only as a gateway key, and never cached in a key cache.
-*
-* [FEP-ef61]: https://w3id.org/fep/ef61
-* @internal
-*/
-function isCompatibleKeyId(keyId) {
-	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
-}
-/**
-* Gets the canonical portable ID of an actor ID that is either an `ap:` or
-* `ap+ef61:` URI or a compatible identifier.
-* @returns The canonical portable ID, or `null` if the ID is neither, or is
-*          malformed.
-* @internal
-*/
-function getCanonicalPortableId(id) {
-	try {
-		if (isPortableUri(id)) return canonicalizePortableUri(formatIri(id));
-		const portable = fromCompatibleEf61Id(id);
-		if (portable == null) return null;
-		return canonicalizePortableUri(formatIri(portable));
-	} catch (error) {
-		if (error instanceof TypeError) return null;
-		throw error;
-	}
-}
-/**
-* Builds the base of the key IDs of a gateway's keys for a portable actor:
-* the actor's compatible identifier on the gateway.
-* @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
-*                or a compatible identifier.  It must not have a fragment.
-* @param gateway The gateway's origin, e.g., `https://example.com`.
-* @returns The compatible identifier without query and fragment.
-* @throws {TypeError} If the actor ID is not a portable ID, or has
-*                     a fragment.
-* @internal
-*/
-function getGatewayKeyBase(actorId, gateway) {
-	let portable;
-	if (isPortableUri(actorId)) portable = actorId;
-	else try {
-		portable = fromCompatibleEf61Id(actorId);
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		portable = null;
-	}
-	if (portable == null) throw new TypeError(`The portable actor ID ${actorId.href} must be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier.`);
-	if (portable.hash !== "") throw new TypeError(`The portable actor ID ${actorId.href} must not have a fragment.`);
-	const base = toCompatibleEf61Id(portable, gateway);
-	base.search = "";
-	base.hash = "";
-	return base;
-}
-/**
-* Tells whether a parsed document at a compatible key ID is a portable actor,
-* which makes the key a gateway key that only
-* {@link verifyPortableGatewayKeyDocument} can vouch for.
-* @internal
-*/
-function isPortableActorDocument(object) {
-	return isActor(object) && object.id != null && isPortableUri(object.id);
-}
-/**
-* Compares two public keys by their key material.
-* @internal
-*/
-async function isSamePublicKey(a, b) {
-	if (a.algorithm.name !== b.algorithm.name) return false;
-	const [x, y] = await Promise.all([crypto.subtle.exportKey("jwk", a), crypto.subtle.exportKey("jwk", b)]);
-	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
-}
-//#endregion
 //#region src/sig/key.ts
 /**
 * Checks if the given key is valid and supported.  No-op if the key is valid,
@@ -1572,6 +1213,10 @@ async function fetchActorDocument(actorId, options = {}) {
 		"sig",
 		"key"
 	]);
+	if (isPortableId(actorId)) {
+		logger.debug("The actor {actorId} is a portable actor, which is not authenticated by the web origin that serves it.", { actorId: actorId.href });
+		return null;
+	}
 	const documentLoader = options.documentLoader ?? getDocumentLoader();
 	const contextLoader = options.contextLoader ?? getDocumentLoader();
 	const { tracerProvider } = options;
@@ -1605,6 +1250,13 @@ async function fetchActorDocument(actorId, options = {}) {
 		return null;
 	}
 	if (!isActor(object)) return null;
+	if (object.id != null && isPortableId(object.id)) {
+		logger.debug("The document served at {documentUrl} claims to be the portable actor {actorId}, which is not authenticated by the web origin that serves it.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
 	if (object.id == null || object.id.origin !== documentUrl.origin) {
 		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
 			documentUrl: documentUrl.href,
@@ -1748,992 +1400,1409 @@ async function fetchKeyDetailed(keyId, cls, options = {}) {
 				logger.debug("Entry {keyId} found in cache with preserved fetch failure details.", { keyId });
 				return {
 					key: null,
-					cached: true,
-					fetchError
+					cached: true,
+					fetchError
+				};
+			}
+			logger.debug("Entry {keyId} found in cache, but no fetch failure details are available.", { keyId });
+			return {
+				key: null,
+				cached: true
+			};
+		}, async (error, cacheKey, keyId, keyCache, logger) => {
+			logger.debug("Failed to fetch key {keyId}.", {
+				keyId,
+				error
+			});
+			await keyCache?.set(cacheKey, null);
+			if (error instanceof FetchError && error.response != null) {
+				const fetchError = {
+					status: error.response.status,
+					response: error.response.clone()
+				};
+				await keyCache?.setFetchError?.(cacheKey, fetchError);
+				return {
+					key: null,
+					cached: false,
+					fetchError
+				};
+			}
+			const fetchError = { error: error instanceof Error ? error : new Error(String(error)) };
+			await keyCache?.setFetchError?.(cacheKey, fetchError);
+			return {
+				key: null,
+				cached: false,
+				fetchError
+			};
+		});
+	});
+}
+async function getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger) {
+	if (keyCache == null) return null;
+	const cachedKey = await keyCache.get(cacheKey);
+	const hit = checkCachedKeyHit(cachedKey, keyId, cls, logger);
+	if (hit != null) return hit;
+	if (cachedKey === null) {
+		logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
+		return {
+			key: null,
+			cached: true
+		};
+	}
+	return null;
+}
+function checkCachedKeyHit(cachedKey, keyId, cls, logger) {
+	if (cachedKey instanceof cls && cachedKey.publicKey != null) {
+		logger.debug("Key {keyId} found in cache.", { keyId });
+		return {
+			key: cachedKey,
+			cached: true
+		};
+	}
+	return null;
+}
+async function clearFetchErrorMetadata(keyId, keyCache) {
+	await keyCache?.setFetchError?.(keyId, null);
+}
+/**
+* Returns the identifier a fragment-bearing DID URL is a fragment of, or
+* `null` if the URL is not a DID URL.  `did:web:example.com#key` is thereby
+* traced back to `did:web:example.com`, the DID that resolving the key went
+* through in the first place.
+*/
+function stripFragment(keyId) {
+	if (keyId.protocol !== "did:") return null;
+	const did = new URL(keyId.href);
+	did.hash = "";
+	return did;
+}
+function isDidKeyUrl(keyId) {
+	return keyId.protocol === "did:" && keyId.pathname.startsWith("key:");
+}
+async function doRawKeysMatch(left, right) {
+	const [leftRaw, rightRaw] = await Promise.all([crypto.subtle.exportKey("raw", left), crypto.subtle.exportKey("raw", right)]);
+	if (leftRaw.byteLength !== rightRaw.byteLength) return false;
+	const leftBytes = new Uint8Array(leftRaw);
+	const rightBytes = new Uint8Array(rightRaw);
+	return leftBytes.every((byte, index) => byte === rightBytes[index]);
+}
+async function isCachedDidKeyValid(key, verificationMethod) {
+	try {
+		return key.id?.href === verificationMethod.id.href && key.controllerId?.href === verificationMethod.controller.href && await doRawKeysMatch(key.publicKey, verificationMethod.publicKey);
+	} catch {
+		return false;
+	}
+}
+async function resolveDidKey(cacheKey, cls, keyCache, logger) {
+	if (!isDidKeyUrl(cacheKey)) return null;
+	const keyId = cacheKey.href;
+	if (!(cls === Multikey)) {
+		logger.debug("Failed to resolve did:key {keyId}; did:key verification methods are only supported as Multikey values.", { keyId });
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	let verificationMethod;
+	try {
+		verificationMethod = await parseDidKeyVerificationMethod(cacheKey);
+	} catch (error) {
+		logger.debug("Failed to resolve did:key verification method {keyId}: {error}", {
+			keyId,
+			error
+		});
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	const hit = checkCachedKeyHit(await keyCache?.get(cacheKey), keyId, cls, logger);
+	if (hit?.key instanceof Multikey && await isCachedDidKeyValid(hit.key, verificationMethod)) return hit;
+	const key = new Multikey({
+		id: verificationMethod.id,
+		controller: verificationMethod.controller,
+		publicKey: verificationMethod.publicKey
+	});
+	await keyCache?.set(cacheKey, key);
+	await clearFetchErrorMetadata(cacheKey, keyCache);
+	logger.debug("Resolved did:key verification method {keyId}.", { keyId });
+	return {
+		key,
+		cached: false
+	};
+}
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableGatewayKeyResolver }, logger) {
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		});
+	} catch (e) {
+		if (!(e instanceof TypeError)) throw e;
+		try {
+			object = await cls.fromJsonLd(document, {
+				documentLoader,
+				contextLoader,
+				tracerProvider
+			});
+		} catch (e) {
+			if (e instanceof TypeError) {
+				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+				await keyCache?.set(cacheKey, null);
+				await clearFetchErrorMetadata(cacheKey, keyCache);
+				return {
+					key: null,
+					cached: false
 				};
 			}
-			logger.debug("Entry {keyId} found in cache, but no fetch failure details are available.", { keyId });
+			throw e;
+		}
+	}
+	if (isCompatibleKeyId(cacheKey) && isPortableActorDocument(object)) {
+		if (portableGatewayKeyResolver == null || cls !== CryptographicKey) {
+			logger.debug("Failed to verify; key {keyId} is a gateway key of the portable actor {actorId}, which is only accepted for HTTP Signatures.", {
+				keyId,
+				actorId: object.id?.href
+			});
 			return {
 				key: null,
-				cached: true
+				cached: false
 			};
-		}, async (error, cacheKey, keyId, keyCache, logger) => {
-			logger.debug("Failed to fetch key {keyId}.", {
+		}
+		const resolution = await portableGatewayKeyResolver(document, object, cacheKey);
+		if (resolution.type !== "verified") {
+			logger.debug("Failed to verify; the portable actor {actorId} does not vouch for its gateway key {keyId}.", {
 				keyId,
-				error
+				actorId: object.id?.href
+			});
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		return {
+			key: resolution.key,
+			cached: false
+		};
+	}
+	let key = null;
+	let ownerDocument = null;
+	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
+	else if (isActor(object)) {
+		if (object.id == null || isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
+			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
+				keyId,
+				documentUrl: documentUrl.href,
+				actorId: object.id?.href
 			});
 			await keyCache?.set(cacheKey, null);
-			if (error instanceof FetchError && error.response != null) {
-				const fetchError = {
-					status: error.response.status,
-					response: error.response.clone()
-				};
-				await keyCache?.setFetchError?.(cacheKey, fetchError);
-				return {
-					key: null,
-					cached: false,
-					fetchError
-				};
-			}
-			const fetchError = { error: error instanceof Error ? error : new Error(String(error)) };
-			await keyCache?.setFetchError?.(cacheKey, fetchError);
 			return {
 				key: null,
-				cached: false,
-				fetchError
+				cached: false
 			};
+		}
+		ownerDocument = object;
+		const keys = cls === CryptographicKey ? object.getPublicKeys({
+			documentLoader,
+			contextLoader,
+			suppressError: true,
+			tracerProvider
+		}) : object.getAssertionMethods({
+			documentLoader,
+			contextLoader,
+			suppressError: true,
+			tracerProvider
 		});
-	});
-}
-async function getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger) {
-	if (keyCache == null) return null;
-	const cachedKey = await keyCache.get(cacheKey);
-	const hit = checkCachedKeyHit(cachedKey, keyId, cls, logger);
-	if (hit != null) return hit;
-	if (cachedKey === null) {
-		logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
+		let length = 0;
+		let lastKey = null;
+		try {
+			for await (const k of keys) {
+				length++;
+				lastKey = k;
+				if (k.id?.href === keyId) {
+					key = k;
+					break;
+				}
+			}
+		} catch (e) {
+			if (!(e instanceof TypeError)) throw e;
+			logger.debug("Failed to verify; a malformed key was encountered while iterating the keys of {keyId}; treating it as a missing key: {error}", {
+				keyId,
+				error: e
+			});
+		}
+		const keyIdUrl = new URL(keyId);
+		if (key == null && keyIdUrl.hash === "" && length === 1) key = lastKey;
+		if (key == null) {
+			logger.debug("Failed to verify; object {keyId} returned an {actorType}, but has no key matching {keyId}.", {
+				keyId,
+				actorType: object.constructor.name
+			});
+			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	} else {
+		logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		await clearFetchErrorMetadata(cacheKey, keyCache);
 		return {
 			key: null,
-			cached: true
+			cached: false
 		};
 	}
-	return null;
-}
-function checkCachedKeyHit(cachedKey, keyId, cls, logger) {
-	if (cachedKey instanceof cls && cachedKey.publicKey != null) {
-		logger.debug("Key {keyId} found in cache.", { keyId });
+	if (key.publicKey == null) {
+		logger.debug("Failed to verify; key {keyId} has no publicKeyPem field.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		await clearFetchErrorMetadata(cacheKey, keyCache);
 		return {
-			key: cachedKey,
-			cached: true
+			key: null,
+			cached: false
 		};
 	}
-	return null;
-}
-async function clearFetchErrorMetadata(keyId, keyCache) {
-	await keyCache?.setFetchError?.(keyId, null);
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (!(keyIdBoundByCaller && claimedOwnerId != null && claimedOwnerId.href === stripFragment(cacheKey)?.href)) {
+		if (claimedOwnerId != null && isPortableId(claimedOwnerId)) {
+			logger.debug("Failed to verify; key {keyId} claims the portable actor {claimedOwnerId} as its owner, but is not its gateway key.", {
+				keyId,
+				claimedOwnerId: claimedOwnerId.href
+			});
+			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
+		else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
+			if (await verifyKeyOwnership(key, {
+				documentLoader,
+				contextLoader,
+				tracerProvider
+			}) == null) {
+				logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
+					keyId,
+					claimedOwnerId: claimedOwnerId.href
+				});
+				await keyCache?.set(cacheKey, null);
+				return {
+					key: null,
+					cached: false
+				};
+			}
+		}
+	}
+	if (keyCache != null) {
+		await keyCache.set(cacheKey, key);
+		logger.debug("Key {keyId} cached.", { keyId });
+	}
+	await clearFetchErrorMetadata(cacheKey, keyCache);
+	return {
+		key,
+		cached: false
+	};
 }
 /**
-* Returns the identifier a fragment-bearing DID URL is a fragment of, or
-* `null` if the URL is not a DID URL.  `did:web:example.com#key` is thereby
-* traced back to `did:web:example.com`, the DID that resolving the key went
-* through in the first place.
+* Tells whether a key claims a portable actor as its owner.  Such a key can
+* only be a gateway key, which is never cached, so a cached one was cached
+* by an older version that trusted web origins, and is fetched again.
 */
-function stripFragment(keyId) {
-	if (keyId.protocol !== "did:") return null;
-	const did = new URL(keyId.href);
-	did.hash = "";
-	return did;
-}
-function isDidKeyUrl(keyId) {
-	return keyId.protocol === "did:" && keyId.pathname.startsWith("key:");
-}
-async function doRawKeysMatch(left, right) {
-	const [leftRaw, rightRaw] = await Promise.all([crypto.subtle.exportKey("raw", left), crypto.subtle.exportKey("raw", right)]);
-	if (leftRaw.byteLength !== rightRaw.byteLength) return false;
-	const leftBytes = new Uint8Array(leftRaw);
-	const rightBytes = new Uint8Array(rightRaw);
-	return leftBytes.every((byte, index) => byte === rightBytes[index]);
+function claimsPortableOwner(key) {
+	const ownerId = key instanceof CryptographicKey ? key.ownerId : key?.controllerId;
+	return ownerId != null && isPortableId(ownerId);
 }
-async function isCachedDidKeyValid(key, verificationMethod) {
+async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, onFetchError) {
+	const start = performance.now();
+	let outcome = { result: "error" };
 	try {
-		return key.id?.href === verificationMethod.id.href && key.controllerId?.href === verificationMethod.controller.href && await doRawKeysMatch(key.publicKey, verificationMethod.publicKey);
-	} catch {
-		return false;
-	}
-}
-async function resolveDidKey(cacheKey, cls, keyCache, logger) {
-	if (!isDidKeyUrl(cacheKey)) return null;
-	const keyId = cacheKey.href;
-	if (!(cls === Multikey)) {
-		logger.debug("Failed to resolve did:key {keyId}; did:key verification methods are only supported as Multikey values.", { keyId });
+		const logger = getLogger([
+			"fedify",
+			"sig",
+			"key"
+		]);
+		const keyId = cacheKey.href;
+		if (isCompatibleKeyId(cacheKey)) options = {
+			...options,
+			keyCache: void 0
+		};
+		const keyCache = options.keyCache;
+		const didKey = await resolveDidKey(cacheKey, cls, keyCache, logger);
+		if (didKey != null) {
+			outcome = { result: didKey.key == null ? "invalid" : didKey.cached ? "hit" : "fetched" };
+			return didKey;
+		}
+		const cached = await getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger);
+		if (cached?.key === null && cached.cached) {
+			const cachedUnavailable = await onCachedUnavailable(cacheKey, keyId, keyCache, logger);
+			outcome = { result: "hit" };
+			return cachedUnavailable;
+		}
+		if (cached != null && !claimsPortableOwner(cached.key)) {
+			outcome = { result: "hit" };
+			return cached;
+		}
+		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
+		let document;
+		let documentUrl = cacheKey;
+		try {
+			const remoteDocument = await (options.documentLoader ?? getDocumentLoader())(keyId);
+			document = remoteDocument.document;
+			documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
+		} catch (error) {
+			const classified = classifyFetchError(error);
+			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
+			outcome = classified;
+			return errored;
+		}
+		const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
+		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
+		return resolved;
+	} finally {
+		recordKeyLookup(options.meterProvider, {
+			durationMs: getDurationMs(start),
+			result: outcome.result,
+			remoteUrl: cacheKey,
+			cacheEnabled: options.keyCache != null,
+			statusCode: outcome.statusCode
+		});
+	}
+}
+async function fetchKeyInternal(keyId, cls, options = {}) {
+	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
 		return {
 			key: null,
-			cached: false
+			cached: true
 		};
-	}
-	let verificationMethod;
-	try {
-		verificationMethod = await parseDidKeyVerificationMethod(cacheKey);
-	} catch (error) {
-		logger.debug("Failed to resolve did:key verification method {keyId}: {error}", {
+	}, async (error, cacheKey, keyId, keyCache, logger) => {
+		logger.debug("Failed to fetch key {keyId}.", {
 			keyId,
 			error
 		});
+		await keyCache?.set(cacheKey, null);
+		if (error instanceof FetchError && error.response != null) await keyCache?.setFetchError?.(cacheKey, {
+			status: error.response.status,
+			response: error.response.clone()
+		});
+		else await keyCache?.setFetchError?.(cacheKey, { error: error instanceof Error ? error : new Error(String(error)) });
 		return {
 			key: null,
 			cached: false
 		};
+	});
+}
+//#endregion
+//#region src/sig/ld.ts
+const logger$4 = getLogger([
+	"fedify",
+	"sig",
+	"ld"
+]);
+const localContext = [
+	"https://w3id.org/identity/v1",
+	"https://www.w3.org/ns/activitystreams",
+	"https://w3id.org/security/v1",
+	"https://w3id.org/security/data-integrity/v1"
+];
+const localContextUrls = new Set(localContext);
+const builtInContextLoader = getDocumentLoader();
+const disallowedJsonLdKeywords = /* @__PURE__ */ new Set([
+	"@graph",
+	"@included",
+	"@reverse"
+]);
+/** @internal */
+var UnsafeJsonLdError = class extends TypeError {
+	keyword;
+	constructor(keyword) {
+		super(`Unsupported JSON-LD keyword: ${keyword}.`);
+		this.keyword = keyword;
+		this.name = "UnsafeJsonLdError";
 	}
-	const hit = checkCachedKeyHit(await keyCache?.get(cacheKey), keyId, cls, logger);
-	if (hit?.key instanceof Multikey && await isCachedDidKeyValid(hit.key, verificationMethod)) return hit;
-	const key = new Multikey({
-		id: verificationMethod.id,
-		controller: verificationMethod.controller,
-		publicKey: verificationMethod.publicKey
+};
+/** @internal */
+var InvalidContextReferenceError = class extends TypeError {
+	reference;
+	constructor(reference) {
+		super(`Invalid JSON-LD context reference: ${reference}.`);
+		this.reference = reference;
+		this.name = "InvalidContextReferenceError";
+	}
+};
+function createLoadingRemoteContextFailedError(reference, cause) {
+	const message = cause instanceof Error ? cause.message : String(cause);
+	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a valid JSON-LD context: ${reference}. ${message}`);
+	error.name = "jsonld.InvalidUrl";
+	error.details = {
+		code: "loading remote context failed",
+		url: reference
+	};
+	error.cause = cause;
+	return error;
+}
+/** @internal */
+function isClearlyMalformedContextReference(reference) {
+	for (const char of reference) {
+		const code = char.charCodeAt(0);
+		if (code <= 32 || code === 127) return true;
+	}
+	if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(reference) && !URL.canParse(reference)) return true;
+	for (let i = 0; i < reference.length; i++) {
+		if (reference[i] !== "%") continue;
+		if (i + 2 >= reference.length || !/[0-9A-Fa-f]/.test(reference[i + 1]) || !/[0-9A-Fa-f]/.test(reference[i + 2])) return true;
+		i += 2;
+	}
+	if (reference.startsWith("./") || reference.startsWith("../") || reference.startsWith("/") || reference.startsWith("//")) {
+		for (const char of reference) if ("[]<>\"\\^`{|}".includes(char)) return true;
+	}
+	return false;
+}
+function cloneRemoteDocument(remoteDocument) {
+	return structuredClone(remoteDocument);
+}
+function createMemoizedDocumentLoader(documentLoader) {
+	const cache = /* @__PURE__ */ new Map();
+	return async (url, options) => {
+		const cacheKey = URL.canParse(url) ? new URL(url).href : url;
+		let remoteDocument = cache.get(cacheKey);
+		if (remoteDocument == null) {
+			remoteDocument = Promise.resolve(documentLoader(url, options)).then(cloneRemoteDocument);
+			remoteDocument.catch(() => {
+				if (cache.get(cacheKey) === remoteDocument) cache.delete(cacheKey);
+			});
+			cache.set(cacheKey, remoteDocument);
+		}
+		return cloneRemoteDocument(await remoteDocument);
+	};
+}
+/** @internal */
+function wrapContextLoaderForJsonLd(contextLoader) {
+	const loader = contextLoader ?? builtInContextLoader;
+	return async (url, options) => {
+		try {
+			return await loader(url, options);
+		} catch (error) {
+			if (!isInvalidUrlTypeError(error)) throw error;
+			if (isClearlyMalformedContextReference(url)) throw new InvalidContextReferenceError(url);
+			throw createLoadingRemoteContextFailedError(url, error);
+		}
+	};
+}
+/** @internal */
+function getNormalizationContextLoader(contextLoader) {
+	const loader = wrapContextLoaderForJsonLd(contextLoader);
+	return createMemoizedDocumentLoader(async (url, options) => {
+		if (URL.canParse(url)) {
+			const normalizedUrl = new URL(url).href;
+			if (localContextUrls.has(normalizedUrl)) return await builtInContextLoader(normalizedUrl, options);
+		}
+		return await loader(url, options);
 	});
-	await keyCache?.set(cacheKey, key);
-	await clearFetchErrorMetadata(cacheKey, keyCache);
-	logger.debug("Resolved did:key verification method {keyId}.", { keyId });
+}
+/** @internal */
+async function compactJsonLd(jsonLd, contextLoader) {
+	const hasLds = typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
+	const signature = hasLds ? jsonLd.signature : void 0;
+	const normalizationContextLoader = getNormalizationContextLoader(contextLoader);
+	const document = hasLds ? detachSignature(jsonLd) : jsonLd;
+	await assertNoGraphBeforeCompaction(document, normalizationContextLoader);
+	const compacted = await jsonld.compact(document, localContext, { documentLoader: normalizationContextLoader });
+	if (hasLds && typeof compacted === "object" && compacted != null) compacted.signature = signature;
+	assertSafeJsonLd(compacted);
+	return compacted;
+}
+function createInvalidRemoteContextError(reference) {
+	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a JSON object. The response was valid JSON, but it was not a JSON object. URL: "${reference}".`);
+	error.name = "jsonld.InvalidUrl";
+	error.details = {
+		code: "invalid remote context",
+		url: reference
+	};
+	return error;
+}
+function getRemoteContext(remoteDocument, reference) {
+	const { contextUrl, documentUrl } = remoteDocument;
+	let { document } = remoteDocument;
+	if (typeof document === "string") document = JSON.parse(document);
+	if (typeof document !== "object" || document == null || Array.isArray(document)) throw createInvalidRemoteContextError(reference);
+	let context = "@context" in document ? document["@context"] : {};
+	if (contextUrl != null) context = Array.isArray(context) ? [...context, contextUrl] : [context, contextUrl];
 	return {
-		key,
-		cached: false
+		context,
+		baseUrl: documentUrl ?? reference
 	};
 }
-async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableGatewayKeyResolver }, logger) {
-	let object;
-	try {
-		object = await Object$1.fromJsonLd(document, {
-			documentLoader,
-			contextLoader,
-			tracerProvider
-		});
-	} catch (e) {
-		if (!(e instanceof TypeError)) throw e;
-		try {
-			object = await cls.fromJsonLd(document, {
-				documentLoader,
-				contextLoader,
-				tracerProvider
-			});
-		} catch (e) {
-			if (e instanceof TypeError) {
-				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
-				await keyCache?.set(cacheKey, null);
-				await clearFetchErrorMetadata(cacheKey, keyCache);
-				return {
-					key: null,
-					cached: false
-				};
+function createGraphAliasContextState() {
+	return {
+		graphTerms: /* @__PURE__ */ new Set(),
+		jsonTerms: /* @__PURE__ */ new Set(),
+		propertyContexts: /* @__PURE__ */ new Map(),
+		termTargets: /* @__PURE__ */ new Map()
+	};
+}
+function cloneGraphAliasContextState(state) {
+	return {
+		graphTerms: new Set(state.graphTerms),
+		jsonTerms: new Set(state.jsonTerms),
+		propertyContexts: new Map(state.propertyContexts),
+		termTargets: new Map(state.termTargets)
+	};
+}
+function resolveContextTarget(target, state) {
+	if (target === "@graph") return target;
+	const mapped = state.termTargets.get(target);
+	if (mapped == null) return target;
+	return mapped;
+}
+function getDirectContextTarget(definition) {
+	if (definition === null) return null;
+	if (typeof definition === "string") return definition;
+	if (typeof definition === "object" && definition != null && "@id" in definition) {
+		const id = definition["@id"];
+		if (id === null) return null;
+		if (typeof id === "string") return id;
+	}
+}
+function isJsonTypedDefinition(definition) {
+	return typeof definition === "object" && definition != null && "@type" in definition && definition["@type"] === "@json";
+}
+function resolveLocalContextTarget(target, state, localTargets, seen = /* @__PURE__ */ new Set()) {
+	if (target === "@graph") return target;
+	if (seen.has(target)) return target;
+	seen.add(target);
+	if (localTargets.has(target)) {
+		const localTarget = localTargets.get(target);
+		return localTarget == null ? target : resolveLocalContextTarget(localTarget, state, localTargets, seen);
+	}
+	return resolveContextTarget(target, state);
+}
+function refreshGraphAliases(state) {
+	state.graphTerms.clear();
+	for (const [term, target] of state.termTargets) if (target === "@graph") state.graphTerms.add(term);
+}
+function normalizeContextReference(reference, baseUrl) {
+	if (baseUrl != null) return new URL(reference, baseUrl).href;
+	return URL.canParse(reference) ? new URL(reference).href : reference;
+}
+/** @internal */
+function isInvalidUrlTypeError(error) {
+	const code = error.code;
+	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+}
+async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
+	if (context === null) return createGraphAliasContextState();
+	let nextState = cloneGraphAliasContextState(state);
+	if (Array.isArray(context)) {
+		for (const item of context) nextState = await applyGraphAliasContext(nextState, item, documentLoader, remoteContextCache, baseUrl, processingContexts);
+		return nextState;
+	}
+	if (typeof context === "string") {
+		const reference = normalizeContextReference(context, baseUrl);
+		const cacheKey = `${baseUrl ?? ""}\n${reference}`;
+		if (processingContexts.has(cacheKey)) return nextState;
+		processingContexts.add(cacheKey);
+		try {
+			let remoteContext = remoteContextCache.get(cacheKey);
+			if (remoteContext == null) {
+				remoteContext = (async () => {
+					try {
+						return getRemoteContext(await documentLoader(reference), reference);
+					} catch (error) {
+						if (reference === context && isInvalidUrlTypeError(error) && isClearlyMalformedContextReference(context)) throw new InvalidContextReferenceError(context);
+						throw error;
+					}
+				})();
+				remoteContextCache.set(cacheKey, remoteContext);
 			}
-			throw e;
+			const loadedRemoteContext = await remoteContext;
+			return await applyGraphAliasContext(nextState, loadedRemoteContext.context, documentLoader, remoteContextCache, loadedRemoteContext.baseUrl, processingContexts);
+		} finally {
+			processingContexts.delete(cacheKey);
 		}
 	}
-	if (isCompatibleKeyId(cacheKey) && isPortableActorDocument(object)) {
-		if (portableGatewayKeyResolver == null || cls !== CryptographicKey) {
-			logger.debug("Failed to verify; key {keyId} is a gateway key of the portable actor {actorId}, which is only accepted for HTTP Signatures.", {
-				keyId,
-				actorId: object.id?.href
-			});
-			return {
-				key: null,
-				cached: false
-			};
+	if (typeof context === "object" && context != null) {
+		if ("@import" in context && typeof context["@import"] === "string") nextState = await applyGraphAliasContext(nextState, context["@import"], documentLoader, remoteContextCache, baseUrl, processingContexts);
+		const localTargets = /* @__PURE__ */ new Map();
+		for (const [term, definition] of globalThis.Object.entries(context)) {
+			if (term.startsWith("@")) continue;
+			const target = getDirectContextTarget(definition);
+			if (target == null) localTargets.set(term, null);
+			else if (typeof target === "string") localTargets.set(term, target);
+			else localTargets.delete(term);
 		}
-		const resolution = await portableGatewayKeyResolver(document, object, cacheKey);
-		if (resolution.type !== "verified") {
-			logger.debug("Failed to verify; the portable actor {actorId} does not vouch for its gateway key {keyId}.", {
-				keyId,
-				actorId: object.id?.href
+		for (const [term, definition] of globalThis.Object.entries(context)) {
+			if (term.startsWith("@")) continue;
+			if (localTargets.has(term)) {
+				const directTarget = localTargets.get(term);
+				if (directTarget == null) nextState.termTargets.set(term, null);
+				else nextState.termTargets.set(term, resolveLocalContextTarget(directTarget, nextState, localTargets));
+			} else nextState.termTargets.delete(term);
+			if (typeof definition === "object" && definition != null && "@context" in definition) nextState.propertyContexts.set(term, {
+				context: definition["@context"],
+				baseUrl
 			});
-			return {
-				key: null,
-				cached: false
-			};
+			else nextState.propertyContexts.delete(term);
+			if (isJsonTypedDefinition(definition)) nextState.jsonTerms.add(term);
+			else nextState.jsonTerms.delete(term);
 		}
-		return {
-			key: resolution.key,
-			cached: false
-		};
+		refreshGraphAliases(nextState);
 	}
-	let key = null;
-	let ownerDocument = null;
-	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
-	else if (isActor(object)) {
-		if (object.id == null || object.id.origin !== documentUrl.origin) {
-			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
-				keyId,
-				documentUrl: documentUrl.href,
-				actorId: object.id?.href
-			});
-			await keyCache?.set(cacheKey, null);
-			return {
-				key: null,
-				cached: false
-			};
-		}
-		ownerDocument = object;
-		const keys = cls === CryptographicKey ? object.getPublicKeys({
-			documentLoader,
-			contextLoader,
-			suppressError: true,
-			tracerProvider
-		}) : object.getAssertionMethods({
-			documentLoader,
-			contextLoader,
-			suppressError: true,
-			tracerProvider
-		});
-		let length = 0;
-		let lastKey = null;
-		try {
-			for await (const k of keys) {
-				length++;
-				lastKey = k;
-				if (k.id?.href === keyId) {
-					key = k;
-					break;
-				}
-			}
-		} catch (e) {
-			if (!(e instanceof TypeError)) throw e;
-			logger.debug("Failed to verify; a malformed key was encountered while iterating the keys of {keyId}; treating it as a missing key: {error}", {
-				keyId,
-				error: e
-			});
-		}
-		const keyIdUrl = new URL(keyId);
-		if (key == null && keyIdUrl.hash === "" && length === 1) key = lastKey;
-		if (key == null) {
-			logger.debug("Failed to verify; object {keyId} returned an {actorType}, but has no key matching {keyId}.", {
-				keyId,
-				actorType: object.constructor.name
-			});
-			await keyCache?.set(cacheKey, null);
-			await clearFetchErrorMetadata(cacheKey, keyCache);
-			return {
-				key: null,
-				cached: false
-			};
-		}
-	} else {
-		logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
-		await keyCache?.set(cacheKey, null);
-		await clearFetchErrorMetadata(cacheKey, keyCache);
-		return {
-			key: null,
-			cached: false
-		};
+	return nextState;
+}
+async function assertNoGraphBeforeCompaction(jsonLd, documentLoader, inheritedState = createGraphAliasContextState(), propertyContext, remoteContextCache = /* @__PURE__ */ new Map()) {
+	if (Array.isArray(jsonLd)) {
+		for (const item of jsonLd) await assertNoGraphBeforeCompaction(item, documentLoader, inheritedState, propertyContext, remoteContextCache);
+		return;
 	}
-	if (key.publicKey == null) {
-		logger.debug("Failed to verify; key {keyId} has no publicKeyPem field.", { keyId });
-		await keyCache?.set(cacheKey, null);
-		await clearFetchErrorMetadata(cacheKey, keyCache);
-		return {
-			key: null,
-			cached: false
-		};
+	if (typeof jsonLd !== "object" || jsonLd == null) return;
+	const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
+	let state = inheritedState;
+	if (propertyContext !== void 0) state = await applyGraphAliasContext(state, propertyContext.context, documentLoader, remoteContextCache, propertyContext.baseUrl);
+	if ("@context" in jsonLd) state = await applyGraphAliasContext(state, jsonLd["@context"], documentLoader, remoteContextCache);
+	for (const [key, value] of globalThis.Object.entries(jsonLd)) {
+		if (key === "@context") continue;
+		if (jsonLiteralWrapper && key === "@value") continue;
+		if (key === "@graph" || state.graphTerms.has(key)) throw new UnsafeJsonLdError("@graph");
+		if (state.jsonTerms.has(key)) continue;
+		await assertNoGraphBeforeCompaction(value, documentLoader, state, state.propertyContexts.get(key), remoteContextCache);
 	}
-	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
-	if (!(keyIdBoundByCaller && claimedOwnerId != null && claimedOwnerId.href === stripFragment(cacheKey)?.href)) {
-		if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
-		else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
-			if (await verifyKeyOwnership(key, {
-				documentLoader,
-				contextLoader,
-				tracerProvider
-			}) == null) {
-				logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
-					keyId,
-					claimedOwnerId: claimedOwnerId.href
-				});
-				await keyCache?.set(cacheKey, null);
-				return {
-					key: null,
-					cached: false
-				};
+}
+function isJsonLiteralWrapper(value) {
+	return "@value" in value && (value["@type"] === "@json" || value.type === "@json");
+}
+/** @internal */
+function assertSafeJsonLd(jsonLd) {
+	if (Array.isArray(jsonLd)) for (const item of jsonLd) assertSafeJsonLd(item);
+	else if (typeof jsonLd === "object" && jsonLd != null) {
+		const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
+		for (const [key, value] of globalThis.Object.entries(jsonLd)) {
+			if (disallowedJsonLdKeywords.has(key)) throw new UnsafeJsonLdError(key);
+			if (jsonLiteralWrapper && key === "@value") continue;
+			assertSafeJsonLd(value);
+		}
+	}
+}
+/**
+* Attaches a LD signature to the given JSON-LD document.
+* @param jsonLd The JSON-LD document to attach the signature to.  It is not
+*               modified.
+* @param signature The signature to attach.
+* @returns The JSON-LD document with the attached signature.
+* @throws {TypeError} If the input document is not a valid JSON-LD document.
+* @since 1.0.0
+*/
+function attachSignature(jsonLd, signature) {
+	if (typeof jsonLd !== "object" || jsonLd == null) throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
+	return {
+		...jsonLd,
+		signature
+	};
+}
+/**
+* Creates a LD signature for the given JSON-LD document.
+* @param jsonLd The JSON-LD document to sign.
+* @param privateKey The private key to sign the document.
+* @param keyId The ID of the public key that corresponds to the private key.
+* @param options Additional options for creating the signature.
+*                See also {@link CreateSignatureOptions}.
+* @return The created signature.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 1.0.0
+*/
+async function createSignature(jsonLd, privateKey, keyId, { contextLoader, created } = {}) {
+	validateCryptoKey(privateKey, "private");
+	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
+	const options = {
+		"@context": "https://w3id.org/identity/v1",
+		creator: keyId.href,
+		created: created?.toString() ?? (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const message = await hashJsonLd(options, contextLoader) + await hashJsonLd(jsonLd, contextLoader);
+	const messageBytes = new TextEncoder().encode(message);
+	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, messageBytes);
+	return {
+		...options,
+		type: "RsaSignature2017",
+		signatureValue: encodeBase64(signature)
+	};
+}
+/**
+* Signs the given JSON-LD document with the private key and returns the signed
+* JSON-LD document.
+* @param jsonLd The JSON-LD document to sign.
+* @param privateKey The private key to sign the document.
+* @param keyId The key ID to use in the signature.  It will be used by the
+*              verifier to fetch the corresponding public key.
+* @param options Additional options for signing the document.
+*                See also {@link SignJsonLdOptions}.
+* @returns The signed JSON-LD document.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 1.0.0
+*/
+async function signJsonLd(jsonLd, privateKey, keyId, options) {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.sign", { attributes: { "ld_signatures.key_id": keyId.href } }, async (span) => {
+		try {
+			const signature = await createSignature(jsonLd, privateKey, keyId, options);
+			if (span.isRecording()) {
+				span.setAttribute("ld_signatures.type", signature.type);
+				span.setAttribute("ld_signatures.signature", encodeHex(decodeBase64(signature.signatureValue)));
 			}
+			return attachSignature(jsonLd, signature);
+		} catch (error) {
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
 		}
-	}
-	if (keyCache != null) {
-		await keyCache.set(cacheKey, key);
-		logger.debug("Key {keyId} cached.", { keyId });
-	}
-	await clearFetchErrorMetadata(cacheKey, keyCache);
-	return {
-		key,
-		cached: false
+	});
+}
+/**
+* Checks if the given JSON-LD document has a Linked Data Signature-like
+* object, without restricting it to a single suite-specific shape.
+* @param jsonLd The JSON-LD document to check.
+* @returns `true` if the document has a signature-like object; `false`
+*          otherwise.
+* @since 2.2.0
+*/
+function hasSignatureLike(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	const signature = jsonLd.signature;
+	const hasReference = (value) => {
+		if (typeof value === "string") return true;
+		if (Array.isArray(value)) return value.some(hasReference);
+		return typeof value === "object" && value != null && ("id" in value && typeof value.id === "string" || "@id" in value && typeof value["@id"] === "string");
+	};
+	const hasSignatureObject = (value) => {
+		if (typeof value !== "object" || value == null) return false;
+		const signatureRecord = value;
+		return (typeof signatureRecord.type === "string" || Array.isArray(signatureRecord.type) && signatureRecord.type.some((item) => typeof item === "string")) && (hasReference(signatureRecord.creator) || hasReference(signatureRecord.verificationMethod)) && (typeof signatureRecord.signatureValue === "string" || typeof signatureRecord.jws === "string");
 	};
+	return Array.isArray(signature) ? signature.some(hasSignatureObject) : hasSignatureObject(signature);
 }
-async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, onFetchError) {
-	const start = performance.now();
-	let outcome = { result: "error" };
-	try {
-		const logger = getLogger([
-			"fedify",
-			"sig",
-			"key"
-		]);
-		const keyId = cacheKey.href;
-		if (isCompatibleKeyId(cacheKey)) options = {
-			...options,
-			keyCache: void 0
-		};
-		const keyCache = options.keyCache;
-		const didKey = await resolveDidKey(cacheKey, cls, keyCache, logger);
-		if (didKey != null) {
-			outcome = { result: didKey.key == null ? "invalid" : didKey.cached ? "hit" : "fetched" };
-			return didKey;
-		}
-		const cached = await getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger);
-		if (cached?.key === null && cached.cached) {
-			const cachedUnavailable = await onCachedUnavailable(cacheKey, keyId, keyCache, logger);
-			outcome = { result: "hit" };
-			return cachedUnavailable;
-		}
-		if (cached != null) {
-			outcome = { result: "hit" };
-			return cached;
-		}
-		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
-		let document;
-		let documentUrl = cacheKey;
-		try {
-			const remoteDocument = await (options.documentLoader ?? getDocumentLoader())(keyId);
-			document = remoteDocument.document;
-			documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
-		} catch (error) {
-			const classified = classifyFetchError(error);
-			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
-			outcome = classified;
-			return errored;
-		}
-		const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
-		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
-		return resolved;
-	} finally {
-		recordKeyLookup(options.meterProvider, {
-			durationMs: getDurationMs(start),
-			result: outcome.result,
-			remoteUrl: cacheKey,
-			cacheEnabled: options.keyCache != null,
-			statusCode: outcome.statusCode
-		});
+/**
+* Checks if the given JSON-LD document has a Linked Data Signature.
+* @param jsonLd The JSON-LD document to check.
+* @returns `true` if the document has a signature; `false` otherwise.
+* @since 1.0.0
+*/
+function hasSignature(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	if ("signature" in jsonLd) {
+		const signature = jsonLd.signature;
+		if (typeof signature !== "object" || signature == null) return false;
+		return "type" in signature && signature.type === "RsaSignature2017" && "creator" in signature && typeof signature.creator === "string" && "created" in signature && typeof signature.created === "string" && "signatureValue" in signature && typeof signature.signatureValue === "string";
 	}
+	return false;
 }
-async function fetchKeyInternal(keyId, cls, options = {}) {
-	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
-		return {
-			key: null,
-			cached: true
-		};
-	}, async (error, cacheKey, keyId, keyCache, logger) => {
-		logger.debug("Failed to fetch key {keyId}.", {
-			keyId,
+/**
+* Detaches Linked Data Signatures from the given JSON-LD document.
+* @param jsonLd The JSON-LD document to modify.
+* @returns The modified JSON-LD document.  If the input document does not
+*          contain a signature, the original document is returned.
+* @since 1.0.0
+*/
+function detachSignature(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
+	const doc = { ...jsonLd };
+	delete doc.signature;
+	return doc;
+}
+/**
+* Verifies Linked Data Signatures of the given JSON-LD document.
+*
+* This is a low-level utility that only checks the cryptographic signature
+* and (optionally) the cached key.  It does not run the JSON-LD parsing,
+* attribution, and owner checks that a complete inbound LD verification
+* needs.  For incoming activities, prefer {@link verifyJsonLd}, which is
+* the public verification entry point and the one that emits the
+* `activitypub.signature.verification.duration` metric for the LD path.
+* `verifySignature` itself only emits
+* `activitypub.signature.key_fetch.duration`, since the rest of the work
+* that the verification-duration metric is meant to cover happens in
+* `verifyJsonLd`.
+* @param jsonLd The JSON-LD document to verify.
+* @param options Options for verifying the signature.
+* @returns The public key that signed the document or `null` if the signature
+*          is invalid or the key is not found.
+* @since 1.0.0
+*/
+async function verifySignature(jsonLd, options = {}) {
+	if (!hasSignature(jsonLd)) return null;
+	const sig = jsonLd.signature;
+	let signature;
+	try {
+		signature = decodeBase64(sig.signatureValue);
+	} catch (error) {
+		logger$4.debug("Failed to verify; invalid base64 signatureValue: {signatureValue}", {
+			...sig,
 			error
 		});
-		await keyCache?.set(cacheKey, null);
-		if (error instanceof FetchError && error.response != null) await keyCache?.setFetchError?.(cacheKey, {
-			status: error.response.status,
-			response: error.response.clone()
-		});
-		else await keyCache?.setFetchError?.(cacheKey, { error: error instanceof Error ? error : new Error(String(error)) });
-		return {
-			key: null,
-			cached: false
-		};
-	});
-}
-//#endregion
-//#region src/sig/ld.ts
-const logger$2 = getLogger([
-	"fedify",
-	"sig",
-	"ld"
-]);
-const localContext = [
-	"https://w3id.org/identity/v1",
-	"https://www.w3.org/ns/activitystreams",
-	"https://w3id.org/security/v1",
-	"https://w3id.org/security/data-integrity/v1"
-];
-const localContextUrls = new Set(localContext);
-const builtInContextLoader = getDocumentLoader();
-const disallowedJsonLdKeywords = /* @__PURE__ */ new Set([
-	"@graph",
-	"@included",
-	"@reverse"
-]);
-/** @internal */
-var UnsafeJsonLdError = class extends TypeError {
-	keyword;
-	constructor(keyword) {
-		super(`Unsupported JSON-LD keyword: ${keyword}.`);
-		this.keyword = keyword;
-		this.name = "UnsafeJsonLdError";
-	}
-};
-/** @internal */
-var InvalidContextReferenceError = class extends TypeError {
-	reference;
-	constructor(reference) {
-		super(`Invalid JSON-LD context reference: ${reference}.`);
-		this.reference = reference;
-		this.name = "InvalidContextReferenceError";
+		return null;
 	}
-};
-function createLoadingRemoteContextFailedError(reference, cause) {
-	const message = cause instanceof Error ? cause.message : String(cause);
-	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a valid JSON-LD context: ${reference}. ${message}`);
-	error.name = "jsonld.InvalidUrl";
-	error.details = {
-		code: "loading remote context failed",
-		url: reference
+	const { key, cached } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), CryptographicKey, options));
+	if (key == null) return null;
+	const sigOpts = {
+		...sig,
+		"@context": "https://w3id.org/identity/v1"
 	};
-	error.cause = cause;
-	return error;
-}
-/** @internal */
-function isClearlyMalformedContextReference(reference) {
-	for (const char of reference) {
-		const code = char.charCodeAt(0);
-		if (code <= 32 || code === 127) return true;
+	delete sigOpts.type;
+	delete sigOpts.id;
+	delete sigOpts.signatureValue;
+	let sigOptsHash;
+	try {
+		sigOptsHash = await hashJsonLd(sigOpts, options.contextLoader);
+	} catch (error) {
+		logger$4.warn("Failed to verify; failed to hash the signature options: {signatureOptions}\n{error}", {
+			signatureOptions: sigOpts,
+			error
+		});
+		return null;
 	}
-	if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(reference) && !URL.canParse(reference)) return true;
-	for (let i = 0; i < reference.length; i++) {
-		if (reference[i] !== "%") continue;
-		if (i + 2 >= reference.length || !/[0-9A-Fa-f]/.test(reference[i + 1]) || !/[0-9A-Fa-f]/.test(reference[i + 2])) return true;
-		i += 2;
+	const document = { ...jsonLd };
+	delete document.signature;
+	let docHash;
+	try {
+		docHash = await hashJsonLd(document, options.contextLoader);
+	} catch (error) {
+		logger$4.warn("Failed to verify; failed to hash the document: {document}\n{error}", {
+			document,
+			error
+		});
+		return null;
 	}
-	if (reference.startsWith("./") || reference.startsWith("../") || reference.startsWith("/") || reference.startsWith("//")) {
-		for (const char of reference) if ("[]<>\"\\^`{|}".includes(char)) return true;
+	const encoder = new TextEncoder();
+	const message = sigOptsHash + docHash;
+	const messageBytes = encoder.encode(message);
+	if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes)) return key;
+	if (cached) {
+		logger$4.debug("Failed to verify with the cached key {keyId}; signature {signatureValue} is invalid.  Retrying with the freshly fetched key...", {
+			keyId: sig.creator,
+			...sig
+		});
+		const { key } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), CryptographicKey, {
+			...options,
+			keyCache: {
+				get: () => Promise.resolve(void 0),
+				set: async (keyId, key) => await options.keyCache?.set(keyId, key)
+			}
+		}));
+		if (key == null) return null;
+		return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes) ? key : null;
 	}
-	return false;
+	logger$4.debug("Failed to verify with the fetched key {keyId}; signature {signatureValue} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
+		keyId: sig.creator,
+		...sig,
+		message
+	});
+	return null;
 }
-function cloneRemoteDocument(remoteDocument) {
-	return structuredClone(remoteDocument);
+/**
+* Known Linked Data Signature `type` values, used to keep
+* `ld_signatures.type` on a bounded set of spec-defined string values.
+* Fedify only signs and verifies `RsaSignature2017`; other values come in
+* only from external documents and are dropped from the metric attribute to
+* avoid attacker-controlled cardinality.
+*/
+const LD_KNOWN_SIGNATURE_TYPES = /* @__PURE__ */ new Set(["RsaSignature2017"]);
+/**
+* Reports only whether a `signature` key is present on the document, with
+* no shape check on its value.  This is intentionally looser than
+* {@link hasSignature} (which validates a full `RsaSignature2017` shape)
+* and {@link hasSignatureLike} (which structurally accepts several known
+* suites): `verifyJsonLd` needs to tell a document with a malformed or
+* unsupported signature payload (classified as `rejected`) apart from a
+* truly unsigned document (classified as `missing`), and only this
+* presence-only check captures both cases.
+*/
+function hasLdSignatureProperty(jsonLd) {
+	return typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
 }
-function createMemoizedDocumentLoader(documentLoader) {
-	const cache = /* @__PURE__ */ new Map();
-	return async (url, options) => {
-		const cacheKey = URL.canParse(url) ? new URL(url).href : url;
-		let remoteDocument = cache.get(cacheKey);
-		if (remoteDocument == null) {
-			remoteDocument = Promise.resolve(documentLoader(url, options)).then(cloneRemoteDocument);
-			remoteDocument.catch(() => {
-				if (cache.get(cacheKey) === remoteDocument) cache.delete(cacheKey);
-			});
-			cache.set(cacheKey, remoteDocument);
-		}
-		return cloneRemoteDocument(await remoteDocument);
-	};
+function getLdSignatureObject(jsonLd) {
+	if (!hasLdSignatureProperty(jsonLd)) return void 0;
+	const { signature } = jsonLd;
+	if (typeof signature !== "object" || signature == null || Array.isArray(signature)) return;
+	return signature;
+}
+/**
+* Verify the authenticity of the given JSON-LD document using Linked Data
+* Signatures.  If the document is signed, this function verifies the signature
+* and checks if the document is attributed to the owner of the public key.
+* If the document is not signed, this function returns `false`.
+* @param jsonLd The JSON-LD document to verify.
+* @param options Options for verifying the document.
+* @returns `true` if the document is authentic; `false` otherwise.
+*/
+async function verifyJsonLd(jsonLd, options = {}) {
+	return await verifyJsonLdInternal(jsonLd, options, true);
 }
 /** @internal */
-function wrapContextLoaderForJsonLd(contextLoader) {
-	const loader = contextLoader ?? builtInContextLoader;
-	return async (url, options) => {
+async function verifyCompactJsonLd(jsonLd, options = {}) {
+	return await verifyJsonLdInternal(jsonLd, options, false);
+}
+async function verifyJsonLdInternal(jsonLd, options, compact) {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
+		const start = performance.now();
+		let verified = false;
+		let threw = false;
+		let signatureType;
 		try {
-			return await loader(url, options);
+			const verificationOptions = hasSignature(jsonLd) ? {
+				...options,
+				contextLoader: getNormalizationContextLoader(options.contextLoader)
+			} : options;
+			const compacted = compact ? hasSignature(jsonLd) ? await compactJsonLd(jsonLd, options.contextLoader) : jsonLd : jsonLd;
+			const object = await Object$1.fromJsonLd(compacted, verificationOptions);
+			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
+			span.setAttribute("activitypub.object.type", getTypeId(object).href);
+			const sig = getLdSignatureObject(jsonLd);
+			if (sig != null) {
+				if (typeof sig.creator === "string") span.setAttribute("ld_signatures.key_id", sig.creator);
+				if (typeof sig.signatureValue === "string") span.setAttribute("ld_signatures.signature", sig.signatureValue);
+				if (typeof sig.type === "string") {
+					span.setAttribute("ld_signatures.type", sig.type);
+					if (LD_KNOWN_SIGNATURE_TYPES.has(sig.type)) signatureType = sig.type;
+				}
+			}
+			const attributions = new Set(object.attributionIds.map((uri) => uri.href));
+			if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
+			const key = await verifySignature(compacted, verificationOptions);
+			if (key == null) return false;
+			if (key.ownerId == null) {
+				logger$4.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
+				return false;
+			}
+			attributions.delete(key.ownerId.href);
+			if (attributions.size > 0) {
+				logger$4.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
+				return false;
+			}
+			verified = true;
+			return true;
 		} catch (error) {
-			if (!isInvalidUrlTypeError(error)) throw error;
-			if (isClearlyMalformedContextReference(url)) throw new InvalidContextReferenceError(url);
-			throw createLoadingRemoteContextFailedError(url, error);
-		}
-	};
-}
-/** @internal */
-function getNormalizationContextLoader(contextLoader) {
-	const loader = wrapContextLoaderForJsonLd(contextLoader);
-	return createMemoizedDocumentLoader(async (url, options) => {
-		if (URL.canParse(url)) {
-			const normalizedUrl = new URL(url).href;
-			if (localContextUrls.has(normalizedUrl)) return await builtInContextLoader(normalizedUrl, options);
+			threw = true;
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			const classified = threw ? "error" : verified ? "verified" : hasLdSignatureProperty(jsonLd) ? "rejected" : "missing";
+			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "linked_data", classified, { ldType: signatureType });
+			span.end();
 		}
-		return await loader(url, options);
 	});
 }
-/** @internal */
-async function compactJsonLd(jsonLd, contextLoader) {
-	const hasLds = typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
-	const signature = hasLds ? jsonLd.signature : void 0;
-	const normalizationContextLoader = getNormalizationContextLoader(contextLoader);
-	const document = hasLds ? detachSignature(jsonLd) : jsonLd;
-	await assertNoGraphBeforeCompaction(document, normalizationContextLoader);
-	const compacted = await jsonld.compact(document, localContext, { documentLoader: normalizationContextLoader });
-	if (hasLds && typeof compacted === "object" && compacted != null) compacted.signature = signature;
-	assertSafeJsonLd(compacted);
-	return compacted;
-}
-function createInvalidRemoteContextError(reference) {
-	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a JSON object. The response was valid JSON, but it was not a JSON object. URL: "${reference}".`);
-	error.name = "jsonld.InvalidUrl";
-	error.details = {
-		code: "invalid remote context",
-		url: reference
-	};
-	return error;
+async function hashJsonLd(jsonLd, contextLoader) {
+	const canon = await jsonld.canonize(jsonLd, {
+		format: "application/n-quads",
+		documentLoader: contextLoader ?? getDocumentLoader()
+	});
+	const encoder = new TextEncoder();
+	return encodeHex(await crypto.subtle.digest("SHA-256", encoder.encode(canon)));
 }
-function getRemoteContext(remoteDocument, reference) {
-	const { contextUrl, documentUrl } = remoteDocument;
-	let { document } = remoteDocument;
-	if (typeof document === "string") document = JSON.parse(document);
-	if (typeof document !== "object" || document == null || Array.isArray(document)) throw createInvalidRemoteContextError(reference);
-	let context = "@context" in document ? document["@context"] : {};
-	if (contextUrl != null) context = Array.isArray(context) ? [...context, contextUrl] : [context, contextUrl];
-	return {
-		context,
-		baseUrl: documentUrl ?? reference
-	};
+//#endregion
+//#region src/compat/secured-document.ts
+function isJsonMap$1(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
 }
-function createGraphAliasContextState() {
-	return {
-		graphTerms: /* @__PURE__ */ new Set(),
-		jsonTerms: /* @__PURE__ */ new Set(),
-		propertyContexts: /* @__PURE__ */ new Map(),
-		termTargets: /* @__PURE__ */ new Map()
-	};
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.length > 0;
 }
-function cloneGraphAliasContextState(state) {
-	return {
-		graphTerms: new Set(state.graphTerms),
-		jsonTerms: new Set(state.jsonTerms),
-		propertyContexts: new Map(state.propertyContexts),
-		termTargets: new Map(state.termTargets)
-	};
+function hasDataIntegrityProofType(value) {
+	return (Array.isArray(value) ? value : [value]).some((type) => type === "DataIntegrityProof" || type === "https://w3id.org/security#DataIntegrityProof");
 }
-function resolveContextTarget(target, state) {
-	if (target === "@graph") return target;
-	const mapped = state.termTargets.get(target);
-	if (mapped == null) return target;
-	return mapped;
+/**
+* Checks whether a JSON value is a complete, self-contained secured document:
+* a map with its own `@context` and exactly one direct, map-valued `proof`
+* that carries every member `eddsa-jcs-2022` proof generation produces.
+*
+* This is deliberately stricter than {@link hasProofLike}, which exists to
+* decide whether a document is worth verifying.  Here a false positive would
+* silently suppress a wire-compatibility fix on an ordinary document, so a
+* partial or malformed proof does not qualify.
+*
+* @internal
+*/
+function isSelfContainedSecuredDocument(value) {
+	if (!isJsonMap$1(value)) return false;
+	if (!Object.hasOwn(value, "@context") || value["@context"] == null) return false;
+	if (!Object.hasOwn(value, "proof")) return false;
+	const proof = value.proof;
+	if (!isJsonMap$1(proof)) return false;
+	return hasDataIntegrityProofType(proof.type) && isNonEmptyString(proof.cryptosuite) && isNonEmptyString(proof.created) && isNonEmptyString(proof.verificationMethod) && isNonEmptyString(proof.proofPurpose) && isNonEmptyString(proof.proofValue);
 }
-function getDirectContextTarget(definition) {
-	if (definition === null) return null;
-	if (typeof definition === "string") return definition;
-	if (typeof definition === "object" && definition != null && "@id" in definition) {
-		const id = definition["@id"];
-		if (id === null) return null;
-		if (typeof id === "string") return id;
+//#endregion
+//#region src/compat/public-audience.ts
+const logger$3 = getLogger([
+	"fedify",
+	"compat",
+	"public-audience"
+]);
+const PUBLIC_ADDRESSING_FIELDS = /* @__PURE__ */ new Set([
+	"to",
+	"cc",
+	"bto",
+	"bcc",
+	"audience"
+]);
+const AS_CONTEXT_URL$1 = "https://www.w3.org/ns/activitystreams";
+const MAX_TRAVERSAL_DEPTH$1 = 64;
+const KNOWN_SAFE_CONTEXT_URLS$1 = new Set(Object.keys(preloadedContexts));
+function hasPublicCurieInAddressing(value, preserveSecured, parentKey, depth = 0) {
+	if (typeof value === "string") return parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public");
+	if (depth >= MAX_TRAVERSAL_DEPTH$1) return false;
+	if (Array.isArray(value)) return value.some((item) => hasPublicCurieInAddressing(item, preserveSecured, parentKey, depth + 1));
+	if (typeof value !== "object" || value == null) return false;
+	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(value)) return false;
+	const record = value;
+	for (const key of Object.keys(record)) {
+		if (record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public")) return true;
+		if (key === "@context") continue;
+		if (hasPublicCurieInAddressing(record[key], preserveSecured, key, depth + 1)) return true;
 	}
+	return false;
 }
-function isJsonTypedDefinition(definition) {
-	return typeof definition === "object" && definition != null && "@type" in definition && definition["@type"] === "@json";
-}
-function resolveLocalContextTarget(target, state, localTargets, seen = /* @__PURE__ */ new Set()) {
-	if (target === "@graph") return target;
-	if (seen.has(target)) return target;
-	seen.add(target);
-	if (localTargets.has(target)) {
-		const localTarget = localTargets.get(target);
-		return localTarget == null ? target : resolveLocalContextTarget(localTarget, state, localTargets, seen);
+function rewritePublicAudience(value, preserveSecured, parentKey, depth = 0) {
+	if (typeof value === "string" && parentKey != null && PUBLIC_ADDRESSING_FIELDS.has(parentKey) && (value === "as:Public" || value === "Public")) return PUBLIC_COLLECTION.href;
+	if (depth >= MAX_TRAVERSAL_DEPTH$1) return value;
+	if (Array.isArray(value)) {
+		let changed = false;
+		const mapped = value.map((item) => {
+			const rewritten = rewritePublicAudience(item, preserveSecured, parentKey, depth + 1);
+			if (rewritten !== item) changed = true;
+			return rewritten;
+		});
+		return changed ? mapped : value;
 	}
-	return resolveContextTarget(target, state);
-}
-function refreshGraphAliases(state) {
-	state.graphTerms.clear();
-	for (const [term, target] of state.termTargets) if (target === "@graph") state.graphTerms.add(term);
-}
-function normalizeContextReference(reference, baseUrl) {
-	if (baseUrl != null) return new URL(reference, baseUrl).href;
-	return URL.canParse(reference) ? new URL(reference).href : reference;
+	if (typeof value !== "object" || value == null) return value;
+	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(value)) return value;
+	const record = value;
+	let changed = false;
+	const normalized = Object.create(null);
+	for (const key of Object.keys(record)) {
+		const rewritten = key === "@context" ? record[key] : record.type === "Follow" && key === "object" && (record[key] === "as:Public" || record[key] === "Public") ? PUBLIC_COLLECTION.href : rewritePublicAudience(record[key], preserveSecured, key, depth + 1);
+		if (rewritten !== record[key]) changed = true;
+		normalized[key] = rewritten;
+	}
+	return changed ? normalized : value;
 }
-/** @internal */
-function isInvalidUrlTypeError(error) {
-	const code = error.code;
-	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+/**
+* Reports whether `value` carries an `@context` property anywhere inside
+* its subtree (not counting the value itself).  A nested `@context` can
+* introduce a local term-definition scope that redefines `as:` or `Public`
+* even when the top-level `@context` is safe, so the fast path must defer
+* to the URDNA2015 equivalence check whenever one is present.
+*/
+function hasNestedContext$1(value, depth = 0) {
+	if (depth >= MAX_TRAVERSAL_DEPTH$1) return true;
+	if (Array.isArray(value)) return value.some((item) => hasNestedContext$1(item, depth + 1));
+	if (typeof value !== "object" || value == null) return false;
+	const record = value;
+	for (const key of Object.keys(record)) {
+		if (key === "@context") return true;
+		if (hasNestedContext$1(record[key], depth + 1)) return true;
+	}
+	return false;
 }
-async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
-	if (context === null) return createGraphAliasContextState();
-	let nextState = cloneGraphAliasContextState(state);
-	if (Array.isArray(context)) {
-		for (const item of context) nextState = await applyGraphAliasContext(nextState, item, documentLoader, remoteContextCache, baseUrl, processingContexts);
-		return nextState;
+/**
+* Checks whether the `@context` of a JSON-LD document is guaranteed not
+* to redefine the `as:` prefix or the bare `Public` term.  Only documents
+* whose `@context` is a string, or an array of strings, drawn from Fedify's
+* preloaded context set AND including the ActivityStreams URL qualify,
+* AND no nested subtree carries its own `@context` that might redefine
+* those terms within a local scope.  When all of that holds the rewrite
+* is provably semantics-preserving and the URDNA2015 equivalence check
+* can be skipped.  Any other shape (unknown external URLs, inline
+* objects at the top level, nested `@context` blocks) is treated as
+* potentially unsafe.
+*/
+function hasKnownSafeContext$1(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	const record = jsonLd;
+	if (!Object.hasOwn(record, "@context")) return false;
+	const ctx = record["@context"];
+	const entries = typeof ctx === "string" ? [ctx] : Array.isArray(ctx) ? ctx : null;
+	if (entries == null || entries.length === 0) return false;
+	let hasAs = false;
+	for (const entry of entries) {
+		if (typeof entry !== "string") return false;
+		if (!KNOWN_SAFE_CONTEXT_URLS$1.has(entry)) return false;
+		if (entry === AS_CONTEXT_URL$1) hasAs = true;
 	}
-	if (typeof context === "string") {
-		const reference = normalizeContextReference(context, baseUrl);
-		const cacheKey = `${baseUrl ?? ""}\n${reference}`;
-		if (processingContexts.has(cacheKey)) return nextState;
-		processingContexts.add(cacheKey);
-		try {
-			let remoteContext = remoteContextCache.get(cacheKey);
-			if (remoteContext == null) {
-				remoteContext = (async () => {
-					try {
-						return getRemoteContext(await documentLoader(reference), reference);
-					} catch (error) {
-						if (reference === context && isInvalidUrlTypeError(error) && isClearlyMalformedContextReference(context)) throw new InvalidContextReferenceError(context);
-						throw error;
-					}
-				})();
-				remoteContextCache.set(cacheKey, remoteContext);
-			}
-			const loadedRemoteContext = await remoteContext;
-			return await applyGraphAliasContext(nextState, loadedRemoteContext.context, documentLoader, remoteContextCache, loadedRemoteContext.baseUrl, processingContexts);
-		} finally {
-			processingContexts.delete(cacheKey);
-		}
+	if (!hasAs) return false;
+	for (const key of Object.keys(record)) {
+		if (key === "@context") continue;
+		if (hasNestedContext$1(record[key])) return false;
 	}
-	if (typeof context === "object" && context != null) {
-		if ("@import" in context && typeof context["@import"] === "string") nextState = await applyGraphAliasContext(nextState, context["@import"], documentLoader, remoteContextCache, baseUrl, processingContexts);
-		const localTargets = /* @__PURE__ */ new Map();
-		for (const [term, definition] of globalThis.Object.entries(context)) {
-			if (term.startsWith("@")) continue;
-			const target = getDirectContextTarget(definition);
-			if (target == null) localTargets.set(term, null);
-			else if (typeof target === "string") localTargets.set(term, target);
-			else localTargets.delete(term);
-		}
-		for (const [term, definition] of globalThis.Object.entries(context)) {
-			if (term.startsWith("@")) continue;
-			if (localTargets.has(term)) {
-				const directTarget = localTargets.get(term);
-				if (directTarget == null) nextState.termTargets.set(term, null);
-				else nextState.termTargets.set(term, resolveLocalContextTarget(directTarget, nextState, localTargets));
-			} else nextState.termTargets.delete(term);
-			if (typeof definition === "object" && definition != null && "@context" in definition) nextState.propertyContexts.set(term, {
-				context: definition["@context"],
-				baseUrl
-			});
-			else nextState.propertyContexts.delete(term);
-			if (isJsonTypedDefinition(definition)) nextState.jsonTerms.add(term);
-			else nextState.jsonTerms.delete(term);
-		}
-		refreshGraphAliases(nextState);
+	return true;
+}
+/**
+* Rewrites the compact `as:Public` / `Public` CURIE appearing in activity
+* addressing fields (`to`, `cc`, `bto`, `bcc`, `audience`) to the fully
+* expanded `https://www.w3.org/ns/activitystreams#Public` URI.
+*
+* Several ActivityPub implementations, Lemmy among them, match these
+* fields as plain URLs without running JSON-LD expansion, and silently
+* drop activities whose public addressing appears in CURIE form.  This
+* helper works around that gap.
+*
+* For documents whose `@context` is drawn entirely from Fedify's
+* preloaded context set and includes the ActivityStreams URL, the
+* rewrite is applied directly: the content of every preloaded non-AS
+* context is known not to redefine the `as:` prefix or the bare `Public`
+* term, so the semantics are preserved by construction.  Any other
+* shape (an inline object, an unknown external URL, and so on) is
+* treated as potentially unsafe and gated on a JSON-LD equivalence
+* check; both forms are canonicalized with URDNA2015 and the resulting
+* N-Quads are compared.  When they differ, the original document is
+* returned unchanged.  Canonicalization failures also fall back to the
+* original document.
+*
+* When no `contextLoader` is supplied the helper falls back to an
+* internal loader that resolves only the URLs in Fedify's
+* preloaded-contexts set and rejects every other URL without issuing a
+* network request.  That behaviour is deliberately narrower than
+* `@fedify/vocab-runtime`'s `getDocumentLoader()`, which after its
+* `validatePublicUrl` check will happily fetch non-preloaded URLs: the
+* helper is reached from verification paths (`verifyProof()` /
+* `verifyObject()`) that operate on inbound, potentially adversarial
+* JSON-LD, and a default loader that fetches attacker-supplied
+* `@context` URLs on the caller's behalf would be an SSRF vector.
+* Canonicalization failures against the restricted loader fall back to
+* the original document, same as any other canonicalization error.
+* Callers that genuinely need the remote-fetch loader (for example
+* applications that sign local JSON-LD against a custom vocabulary)
+* should pass a `contextLoader` explicitly.
+*
+* Must be called before any signing step that canonicalizes the
+* compact form byte-for-byte (for example, Object Integrity Proofs
+* using the `eddsa-jcs-2022` cryptosuite), so the signed payload
+* matches what is sent on the wire.
+*/
+async function normalizePublicAudience(jsonLd, contextLoader, options = {}) {
+	const preserveSecured = options.preserveNestedSecuredDocuments ?? false;
+	if (!hasPublicCurieInAddressing(jsonLd, preserveSecured)) return jsonLd;
+	const normalized = rewritePublicAudience(jsonLd, preserveSecured);
+	if (hasKnownSafeContext$1(jsonLd)) return normalized;
+	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
+	try {
+		const [before, after] = await Promise.all([jsonld.canonize(jsonLd, {
+			format: "application/n-quads",
+			documentLoader: loader
+		}), jsonld.canonize(normalized, {
+			format: "application/n-quads",
+			documentLoader: loader
+		})]);
+		if (before === after) return normalized;
+		logger$3.warn("Expanding the public audience CURIE to its full URI would change the canonical form of the activity; sending the activity as is.  This usually means the active JSON-LD context redefines the `as:` prefix or the bare `Public` term.");
+	} catch (error) {
+		logger$3.debug("Failed to verify public audience normalization equivalence via JSON-LD canonicalization; sending the activity as is.\n{error}", { error });
 	}
-	return nextState;
+	return jsonLd;
 }
-async function assertNoGraphBeforeCompaction(jsonLd, documentLoader, inheritedState = createGraphAliasContextState(), propertyContext, remoteContextCache = /* @__PURE__ */ new Map()) {
-	if (Array.isArray(jsonLd)) {
-		for (const item of jsonLd) await assertNoGraphBeforeCompaction(item, documentLoader, inheritedState, propertyContext, remoteContextCache);
+//#endregion
+//#region src/compat/outgoing-jsonld.ts
+const logger$2 = getLogger([
+	"fedify",
+	"compat",
+	"outgoing-jsonld"
+]);
+const ATTACHMENT_FIELDS = /* @__PURE__ */ new Set(["attachment", "https://www.w3.org/ns/activitystreams#attachment"]);
+const AS_CONTEXT_URL = "https://www.w3.org/ns/activitystreams";
+const KNOWN_SAFE_CONTEXT_URLS = getKnownSafeContextUrls();
+const MAX_TRAVERSAL_DEPTH = 64;
+function isJsonLdListObject(value) {
+	return typeof value === "object" && value != null && Object.hasOwn(value, "@list");
+}
+function isJsonLdValueObject(value) {
+	return typeof value === "object" && value != null && Object.hasOwn(value, "@value");
+}
+function* getContextObjects(value, seen = /* @__PURE__ */ new WeakSet()) {
+	if (Array.isArray(value)) {
+		if (seen.has(value)) return;
+		seen.add(value);
+		for (const item of value) yield* getContextObjects(item, seen);
 		return;
 	}
-	if (typeof jsonLd !== "object" || jsonLd == null) return;
-	const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
-	let state = inheritedState;
-	if (propertyContext !== void 0) state = await applyGraphAliasContext(state, propertyContext.context, documentLoader, remoteContextCache, propertyContext.baseUrl);
-	if ("@context" in jsonLd) state = await applyGraphAliasContext(state, jsonLd["@context"], documentLoader, remoteContextCache);
-	for (const [key, value] of globalThis.Object.entries(jsonLd)) {
-		if (key === "@context") continue;
-		if (jsonLiteralWrapper && key === "@value") continue;
-		if (key === "@graph" || state.graphTerms.has(key)) throw new UnsafeJsonLdError("@graph");
-		if (state.jsonTerms.has(key)) continue;
-		await assertNoGraphBeforeCompaction(value, documentLoader, state, state.propertyContexts.get(key), remoteContextCache);
+	if (typeof value === "object" && value != null) {
+		if (seen.has(value)) return;
+		seen.add(value);
+		const record = value;
+		yield record;
+		for (const definition of Object.values(record)) {
+			if (typeof definition !== "object" || definition == null) continue;
+			const nestedContext = definition["@context"];
+			if (nestedContext == null) continue;
+			yield* getContextObjects(nestedContext, seen);
+		}
 	}
 }
-function isJsonLiteralWrapper(value) {
-	return "@value" in value && (value["@type"] === "@json" || value.type === "@json");
+function isActivityStreamsAttachmentTerm(value) {
+	return typeof value === "object" && value != null && value["@id"] === "as:attachment" && value["@type"] === "@id";
 }
 /** @internal */
-function assertSafeJsonLd(jsonLd) {
-	if (Array.isArray(jsonLd)) for (const item of jsonLd) assertSafeJsonLd(item);
-	else if (typeof jsonLd === "object" && jsonLd != null) {
-		const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
-		for (const [key, value] of globalThis.Object.entries(jsonLd)) {
-			if (disallowedJsonLdKeywords.has(key)) throw new UnsafeJsonLdError(key);
-			if (jsonLiteralWrapper && key === "@value") continue;
-			assertSafeJsonLd(value);
-		}
+function isPreloadedContextAttachmentSafe(document) {
+	if (typeof document !== "object" || document == null) return true;
+	const context = document["@context"];
+	for (const contextObject of getContextObjects(context)) {
+		if (!Object.hasOwn(contextObject, "attachment")) continue;
+		if (isActivityStreamsAttachmentTerm(contextObject.attachment)) continue;
+		return false;
 	}
+	return true;
 }
-/**
-* Attaches a LD signature to the given JSON-LD document.
-* @param jsonLd The JSON-LD document to attach the signature to.  It is not
-*               modified.
-* @param signature The signature to attach.
-* @returns The JSON-LD document with the attached signature.
-* @throws {TypeError} If the input document is not a valid JSON-LD document.
-* @since 1.0.0
-*/
-function attachSignature(jsonLd, signature) {
-	if (typeof jsonLd !== "object" || jsonLd == null) throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
-	return {
-		...jsonLd,
-		signature
-	};
-}
-/**
-* Creates a LD signature for the given JSON-LD document.
-* @param jsonLd The JSON-LD document to sign.
-* @param privateKey The private key to sign the document.
-* @param keyId The ID of the public key that corresponds to the private key.
-* @param options Additional options for creating the signature.
-*                See also {@link CreateSignatureOptions}.
-* @return The created signature.
-* @throws {TypeError} If the private key is invalid or unsupported.
-* @since 1.0.0
-*/
-async function createSignature(jsonLd, privateKey, keyId, { contextLoader, created } = {}) {
-	validateCryptoKey(privateKey, "private");
-	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
-	const options = {
-		"@context": "https://w3id.org/identity/v1",
-		creator: keyId.href,
-		created: created?.toString() ?? (/* @__PURE__ */ new Date()).toISOString()
-	};
-	const message = await hashJsonLd(options, contextLoader) + await hashJsonLd(jsonLd, contextLoader);
-	const messageBytes = new TextEncoder().encode(message);
-	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, messageBytes);
-	return {
-		...options,
-		type: "RsaSignature2017",
-		signatureValue: encodeBase64(signature)
-	};
+function getKnownSafeContextUrls() {
+	const urls = /* @__PURE__ */ new Set();
+	for (const [url, document] of Object.entries(preloadedContexts)) if (isPreloadedContextAttachmentSafe(document)) urls.add(url);
+	else logger$2.warn("Preloaded JSON-LD context {contextUrl} redefines the `attachment` term incompatibly; attachment array normalization will require canonicalization for documents using it.", { contextUrl: url });
+	return urls;
 }
 /**
-* Signs the given JSON-LD document with the private key and returns the signed
-* JSON-LD document.
-* @param jsonLd The JSON-LD document to sign.
-* @param privateKey The private key to sign the document.
-* @param keyId The key ID to use in the signature.  It will be used by the
-*              verifier to fetch the corresponding public key.
-* @param options Additional options for signing the document.
-*                See also {@link SignJsonLdOptions}.
-* @returns The signed JSON-LD document.
-* @throws {TypeError} If the private key is invalid or unsupported.
-* @since 1.0.0
+* Wraps scalar ActivityStreams attachment properties in arrays.
 */
-async function signJsonLd(jsonLd, privateKey, keyId, options) {
-	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.sign", { attributes: { "ld_signatures.key_id": keyId.href } }, async (span) => {
-		try {
-			const signature = await createSignature(jsonLd, privateKey, keyId, options);
-			if (span.isRecording()) {
-				span.setAttribute("ld_signatures.type", signature.type);
-				span.setAttribute("ld_signatures.signature", encodeHex(decodeBase64(signature.signatureValue)));
+function wrapScalarAttachments(jsonLd, preserveSecured, depth = 0) {
+	if (depth >= MAX_TRAVERSAL_DEPTH) return jsonLd;
+	if (preserveSecured && depth > 0 && isSelfContainedSecuredDocument(jsonLd)) return jsonLd;
+	if (Array.isArray(jsonLd)) {
+		let normalized = null;
+		for (let i = 0; i < jsonLd.length; i++) {
+			const item = jsonLd[i];
+			const next = wrapScalarAttachments(item, preserveSecured, depth + 1);
+			if (normalized == null && next !== item) normalized = jsonLd.slice(0, i);
+			if (normalized != null) normalized[i] = next;
+		}
+		return normalized ?? jsonLd;
+	}
+	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
+	const record = jsonLd;
+	const keys = Object.keys(record);
+	let normalized = null;
+	for (let i = 0; i < keys.length; i++) {
+		const key = keys[i];
+		const value = record[key];
+		const next = key === "@context" || key === "@value" && isJsonLdValueObject(jsonLd) ? value : wrapScalarAttachments(value, preserveSecured, depth + 1);
+		const output = ATTACHMENT_FIELDS.has(key) && next != null && !Array.isArray(next) && !isJsonLdListObject(next) ? [next] : next;
+		if (normalized == null && output !== value) {
+			const cloned = Object.create(null);
+			for (let j = 0; j < i; j++) {
+				const previousKey = keys[j];
+				cloned[previousKey] = record[previousKey];
 			}
-			return attachSignature(jsonLd, signature);
-		} catch (error) {
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
+			normalized = cloned;
 		}
-	});
-}
-/**
-* Checks if the given JSON-LD document has a Linked Data Signature-like
-* object, without restricting it to a single suite-specific shape.
-* @param jsonLd The JSON-LD document to check.
-* @returns `true` if the document has a signature-like object; `false`
-*          otherwise.
-* @since 2.2.0
-*/
-function hasSignatureLike(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	const signature = jsonLd.signature;
-	const hasReference = (value) => {
-		if (typeof value === "string") return true;
-		if (Array.isArray(value)) return value.some(hasReference);
-		return typeof value === "object" && value != null && ("id" in value && typeof value.id === "string" || "@id" in value && typeof value["@id"] === "string");
-	};
-	const hasSignatureObject = (value) => {
-		if (typeof value !== "object" || value == null) return false;
-		const signatureRecord = value;
-		return (typeof signatureRecord.type === "string" || Array.isArray(signatureRecord.type) && signatureRecord.type.some((item) => typeof item === "string")) && (hasReference(signatureRecord.creator) || hasReference(signatureRecord.verificationMethod)) && (typeof signatureRecord.signatureValue === "string" || typeof signatureRecord.jws === "string");
-	};
-	return Array.isArray(signature) ? signature.some(hasSignatureObject) : hasSignatureObject(signature);
+		if (normalized != null) normalized[key] = output;
+	}
+	return normalized ?? jsonLd;
 }
-/**
-* Checks if the given JSON-LD document has a Linked Data Signature.
-* @param jsonLd The JSON-LD document to check.
-* @returns `true` if the document has a signature; `false` otherwise.
-* @since 1.0.0
-*/
-function hasSignature(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return false;
-	if ("signature" in jsonLd) {
-		const signature = jsonLd.signature;
-		if (typeof signature !== "object" || signature == null) return false;
-		return "type" in signature && signature.type === "RsaSignature2017" && "creator" in signature && typeof signature.creator === "string" && "created" in signature && typeof signature.created === "string" && "signatureValue" in signature && typeof signature.signatureValue === "string";
+function hasNestedContext(value, depth = 0) {
+	if (depth >= MAX_TRAVERSAL_DEPTH) return true;
+	if (Array.isArray(value)) return value.some((item) => hasNestedContext(item, depth + 1));
+	if (typeof value !== "object" || value == null) return false;
+	const record = value;
+	for (const key of Object.keys(record)) {
+		if (key === "@context") return true;
+		if (key === "@value" && isJsonLdValueObject(value)) continue;
+		if (hasNestedContext(record[key], depth + 1)) return true;
 	}
 	return false;
 }
-/**
-* Detaches Linked Data Signatures from the given JSON-LD document.
-* @param jsonLd The JSON-LD document to modify.
-* @returns The modified JSON-LD document.  If the input document does not
-*          contain a signature, the original document is returned.
-* @since 1.0.0
-*/
-function detachSignature(jsonLd) {
-	if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
-	const doc = { ...jsonLd };
-	delete doc.signature;
-	return doc;
-}
-/**
-* Verifies Linked Data Signatures of the given JSON-LD document.
-*
-* This is a low-level utility that only checks the cryptographic signature
-* and (optionally) the cached key.  It does not run the JSON-LD parsing,
-* attribution, and owner checks that a complete inbound LD verification
-* needs.  For incoming activities, prefer {@link verifyJsonLd}, which is
-* the public verification entry point and the one that emits the
-* `activitypub.signature.verification.duration` metric for the LD path.
-* `verifySignature` itself only emits
-* `activitypub.signature.key_fetch.duration`, since the rest of the work
-* that the verification-duration metric is meant to cover happens in
-* `verifyJsonLd`.
-* @param jsonLd The JSON-LD document to verify.
-* @param options Options for verifying the signature.
-* @returns The public key that signed the document or `null` if the signature
-*          is invalid or the key is not found.
-* @since 1.0.0
-*/
-async function verifySignature(jsonLd, options = {}) {
-	if (!hasSignature(jsonLd)) return null;
-	const sig = jsonLd.signature;
-	let signature;
-	try {
-		signature = decodeBase64(sig.signatureValue);
-	} catch (error) {
-		logger$2.debug("Failed to verify; invalid base64 signatureValue: {signatureValue}", {
-			...sig,
-			error
-		});
-		return null;
-	}
-	const { key, cached } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), CryptographicKey, options));
-	if (key == null) return null;
-	const sigOpts = {
-		...sig,
-		"@context": "https://w3id.org/identity/v1"
-	};
-	delete sigOpts.type;
-	delete sigOpts.id;
-	delete sigOpts.signatureValue;
-	let sigOptsHash;
-	try {
-		sigOptsHash = await hashJsonLd(sigOpts, options.contextLoader);
-	} catch (error) {
-		logger$2.warn("Failed to verify; failed to hash the signature options: {signatureOptions}\n{error}", {
-			signatureOptions: sigOpts,
-			error
-		});
-		return null;
-	}
-	const document = { ...jsonLd };
-	delete document.signature;
-	let docHash;
-	try {
-		docHash = await hashJsonLd(document, options.contextLoader);
-	} catch (error) {
-		logger$2.warn("Failed to verify; failed to hash the document: {document}\n{error}", {
-			document,
-			error
-		});
-		return null;
+function exceedsTraversalDepth(value, depth = 0) {
+	if (depth >= MAX_TRAVERSAL_DEPTH) return true;
+	if (Array.isArray(value)) return value.some((item) => exceedsTraversalDepth(item, depth + 1));
+	if (typeof value !== "object" || value == null) return false;
+	const record = value;
+	for (const key of Object.keys(record)) {
+		if (key === "@context" || key === "@value" && isJsonLdValueObject(value)) continue;
+		if (exceedsTraversalDepth(record[key], depth + 1)) return true;
 	}
-	const encoder = new TextEncoder();
-	const message = sigOptsHash + docHash;
-	const messageBytes = encoder.encode(message);
-	if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes)) return key;
-	if (cached) {
-		logger$2.debug("Failed to verify with the cached key {keyId}; signature {signatureValue} is invalid.  Retrying with the freshly fetched key...", {
-			keyId: sig.creator,
-			...sig
-		});
-		const { key } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), CryptographicKey, {
-			...options,
-			keyCache: {
-				get: () => Promise.resolve(void 0),
-				set: async (keyId, key) => await options.keyCache?.set(keyId, key)
-			}
-		}));
-		if (key == null) return null;
-		return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes) ? key : null;
+	return false;
+}
+function hasKnownSafeContext(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	const record = jsonLd;
+	if (!Object.hasOwn(record, "@context")) return false;
+	const context = record["@context"];
+	const entries = typeof context === "string" ? [context] : Array.isArray(context) ? context : null;
+	if (entries == null || entries.length < 1) return false;
+	let hasActivityStreamsContext = false;
+	for (const entry of entries) {
+		if (typeof entry !== "string") return false;
+		if (!KNOWN_SAFE_CONTEXT_URLS.has(entry)) return false;
+		if (entry === AS_CONTEXT_URL) hasActivityStreamsContext = true;
 	}
-	logger$2.debug("Failed to verify with the fetched key {keyId}; signature {signatureValue} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
-		keyId: sig.creator,
-		...sig,
-		message
-	});
-	return null;
+	if (!hasActivityStreamsContext) return false;
+	for (const key of Object.keys(record)) {
+		if (key === "@context") continue;
+		if (hasNestedContext(record[key])) return false;
+	}
+	return true;
+}
+function getLogSafeJsonLdMetadata(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return {};
+	const record = jsonLd;
+	const context = record["@context"];
+	return {
+		id: typeof record.id === "string" ? record.id : typeof record["@id"] === "string" ? record["@id"] : void 0,
+		type: typeof record.type === "string" ? record.type : typeof record["@type"] === "string" ? record["@type"] : void 0,
+		context: typeof context === "string" ? context : Array.isArray(context) ? context.filter((entry) => typeof entry === "string").slice(0, 4) : context == null ? void 0 : "[inline context]"
+	};
 }
 /**
-* Known Linked Data Signature `type` values, used to keep
-* `ld_signatures.type` on a bounded set of spec-defined string values.
-* Fedify only signs and verifies `RsaSignature2017`; other values come in
-* only from external documents and are dropped from the metric attribute to
-* avoid attacker-controlled cardinality.
-*/
-const LD_KNOWN_SIGNATURE_TYPES = /* @__PURE__ */ new Set(["RsaSignature2017"]);
-/**
-* Reports only whether a `signature` key is present on the document, with
-* no shape check on its value.  This is intentionally looser than
-* {@link hasSignature} (which validates a full `RsaSignature2017` shape)
-* and {@link hasSignatureLike} (which structurally accepts several known
-* suites): `verifyJsonLd` needs to tell a document with a malformed or
-* unsupported signature payload (classified as `rejected`) apart from a
-* truly unsigned document (classified as `missing`), and only this
-* presence-only check captures both cases.
+* Ensures ActivityStreams attachment properties are represented as arrays
+* when doing so preserves the JSON-LD semantics.
+*
+* JSON-LD compaction collapses single-item arrays into scalar values by
+* default.  Some ActivityPub implementations, Pixelfed among them, parse
+* `attachment` as a plain JSON array rather than a JSON-LD property and reject
+* otherwise valid objects whose single attachment is emitted as a scalar.
+*
+* When no `contextLoader` is supplied, the helper falls back to a restricted
+* loader that resolves only Fedify's preloaded JSON-LD contexts and rejects
+* every other URL without network access.  Documents with custom, inline, or
+* otherwise uncached contexts should pass a real `contextLoader` if they need
+* the semantic-preservation check to succeed; otherwise canonicalization
+* failures leave the original document unchanged.
 */
-function hasLdSignatureProperty(jsonLd) {
-	return typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
-}
-function getLdSignatureObject(jsonLd) {
-	if (!hasLdSignatureProperty(jsonLd)) return void 0;
-	const { signature } = jsonLd;
-	if (typeof signature !== "object" || signature == null || Array.isArray(signature)) return;
-	return signature;
+async function normalizeAttachmentArrays(jsonLd, contextLoader, options = {}) {
+	const normalized = wrapScalarAttachments(jsonLd, options.preserveNestedSecuredDocuments ?? false);
+	if (normalized === jsonLd) return jsonLd;
+	if (exceedsTraversalDepth(jsonLd)) {
+		logger$2.debug("Skipping attachment array normalization because the JSON-LD document exceeds the safe traversal depth; leaving it unchanged.");
+		return jsonLd;
+	}
+	if (hasKnownSafeContext(jsonLd)) return normalized;
+	const loader = contextLoader ?? preloadedOnlyDocumentLoader;
+	try {
+		const [before, after] = await Promise.all([jsonld.canonize(jsonLd, {
+			format: "application/n-quads",
+			documentLoader: loader
+		}), jsonld.canonize(normalized, {
+			format: "application/n-quads",
+			documentLoader: loader
+		})]);
+		if (before === after) return normalized;
+		logger$2.warn("Wrapping scalar attachment values in arrays would change the canonical form of the JSON-LD document; leaving it unchanged.  This usually means the active JSON-LD context redefines the `attachment` term.  Document: {id}; type: {type}; context: {context}.", getLogSafeJsonLdMetadata(jsonLd));
+	} catch (error) {
+		logger$2.debug("Failed to verify attachment array normalization equivalence via JSON-LD canonicalization; leaving the JSON-LD document unchanged.\n{error}", { error });
+	}
+	return jsonLd;
 }
 /**
-* Verify the authenticity of the given JSON-LD document using Linked Data
-* Signatures.  If the document is signed, this function verifies the signature
-* and checks if the document is attributed to the owner of the public key.
-* If the document is not signed, this function returns `false`.
-* @param jsonLd The JSON-LD document to verify.
-* @param options Options for verifying the document.
-* @returns `true` if the document is authentic; `false` otherwise.
+* Applies Fedify's internal JSON-LD wire-format interoperability workarounds
+* to locally generated outgoing activities before they are signed, enqueued,
+* or sent.
 */
-async function verifyJsonLd(jsonLd, options = {}) {
-	return await verifyJsonLdInternal(jsonLd, options, true);
-}
-/** @internal */
-async function verifyCompactJsonLd(jsonLd, options = {}) {
-	return await verifyJsonLdInternal(jsonLd, options, false);
-}
-async function verifyJsonLdInternal(jsonLd, options, compact) {
-	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
-		const start = performance.now();
-		let verified = false;
-		let threw = false;
-		let signatureType;
-		try {
-			const verificationOptions = hasSignature(jsonLd) ? {
-				...options,
-				contextLoader: getNormalizationContextLoader(options.contextLoader)
-			} : options;
-			const compacted = compact ? hasSignature(jsonLd) ? await compactJsonLd(jsonLd, options.contextLoader) : jsonLd : jsonLd;
-			const object = await Object$1.fromJsonLd(compacted, verificationOptions);
-			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
-			span.setAttribute("activitypub.object.type", getTypeId(object).href);
-			const sig = getLdSignatureObject(jsonLd);
-			if (sig != null) {
-				if (typeof sig.creator === "string") span.setAttribute("ld_signatures.key_id", sig.creator);
-				if (typeof sig.signatureValue === "string") span.setAttribute("ld_signatures.signature", sig.signatureValue);
-				if (typeof sig.type === "string") {
-					span.setAttribute("ld_signatures.type", sig.type);
-					if (LD_KNOWN_SIGNATURE_TYPES.has(sig.type)) signatureType = sig.type;
-				}
-			}
-			const attributions = new Set(object.attributionIds.map((uri) => uri.href));
-			if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
-			const key = await verifySignature(compacted, verificationOptions);
-			if (key == null) return false;
-			if (key.ownerId == null) {
-				logger$2.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
-				return false;
-			}
-			attributions.delete(key.ownerId.href);
-			if (attributions.size > 0) {
-				logger$2.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
-				return false;
-			}
-			verified = true;
-			return true;
-		} catch (error) {
-			threw = true;
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			const classified = threw ? "error" : verified ? "verified" : hasLdSignatureProperty(jsonLd) ? "rejected" : "missing";
-			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "linked_data", classified, { ldType: signatureType });
-			span.end();
-		}
-	});
-}
-async function hashJsonLd(jsonLd, contextLoader) {
-	const canon = await jsonld.canonize(jsonLd, {
-		format: "application/n-quads",
-		documentLoader: contextLoader ?? getDocumentLoader()
-	});
-	const encoder = new TextEncoder();
-	return encodeHex(await crypto.subtle.digest("SHA-256", encoder.encode(canon)));
+async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, options = {}) {
+	jsonLd = await normalizePublicAudience(jsonLd, contextLoader, options);
+	return await normalizeAttachmentArrays(jsonLd, contextLoader, options);
 }
 //#endregion
 //#region src/sig/proof.ts
@@ -3457,8 +3526,37 @@ async function expandPortableObjectRoot(jsonLd, contextLoader) {
 		}
 	};
 }
+/**
+* Gets the DID of a portable object ID, which is either an `ap:` or
+* `ap+ef61:` URI or an FEP-ef61 compatible identifier.
+* @throws {TypeError} If the ID is malformed.
+*/
+function getObjectDid(id) {
+	try {
+		parseIri(id);
+		if (PORTABLE_OBJECT_ID_PATTERN.test(id)) return getFe34Origin(id);
+		const portableId = fromCompatibleEf61Id(id);
+		if (portableId != null) return getFe34Origin(portableId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		throw new InvalidPortableObjectIdError(id, { cause: error });
+	}
+	throw new InvalidPortableObjectIdError(id);
+}
+/**
+* The error thrown when a document's ID looks portable, i.e., it is an `ap:`
+* or `ap+ef61:` URI or looks like an FEP-ef61 compatible identifier, but is
+* malformed.
+* @internal
+*/
+var InvalidPortableObjectIdError = class extends TypeError {
+	constructor(id, options) {
+		super(`Invalid portable object ID: ${id}`, options);
+		this.name = "InvalidPortableObjectIdError";
+	}
+};
 async function preparePortableObjectProof(jsonLd, options) {
-	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !PORTABLE_OBJECT_ID_PATTERN.test(jsonLd["@id"])) return {
+	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !isPortableId(jsonLd["@id"])) return {
 		prepared: false,
 		result: {
 			verified: false,
@@ -3467,15 +3565,15 @@ async function preparePortableObjectProof(jsonLd, options) {
 	};
 	const { root, proofContextLoader } = await expandPortableObjectRoot(jsonLd, options.contextLoader);
 	const id = root["@id"];
-	if (typeof id !== "string" || !PORTABLE_OBJECT_ID_PATTERN.test(id)) return {
+	if (typeof id !== "string" || !isPortableId(id)) return {
 		prepared: false,
 		result: {
 			verified: false,
 			reason: { type: "notPortableObject" }
 		}
 	};
+	const objectDid = getObjectDid(id);
 	const objectId = parseIri(id);
-	getFe34Origin(objectId);
 	const objectType = classifyFep2277CoreType(root);
 	if (objectType === "verificationMethod" || objectType === "publicKey" || objectType === "link") return {
 		prepared: false,
@@ -3580,7 +3678,7 @@ async function preparePortableObjectProof(jsonLd, options) {
 				}
 			};
 		}
-		if (!haveSameFe34Origin(objectId, verificationMethod)) return {
+		if (getFe34Origin(verificationMethod) !== objectDid) return {
 			prepared: false,
 			result: {
 				verified: false,
@@ -3639,15 +3737,24 @@ async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
 * collection without a proof is reported separately so a caller can apply a
 * gateway trust policy.  Embedded portable objects are not traversed.
 *
+* A portable object is a document whose ID is an `ap:` or `ap+ef61:` URI, or
+* an [FEP-ef61] compatible identifier such as
+* `https://gw.example/.well-known/apgateway/did:key:z6Mk…/actor`, which
+* stands for the portable ID `ap+ef61://did:key:z6Mk…/actor`.
+*
 * Every proof must use a DID URL whose DID matches the portable object's
-* authority, and every proof must pass {@link verifyProof}.
+* authority, i.e., the DID of its canonical portable ID, and every proof must
+* pass {@link verifyProof}.  The proofs are verified over the document as
+* given; a compatible identifier is never rewritten into a portable ID.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 *
 * @param jsonLd The JSON-LD document to verify.
 * @param options Additional options.  See also
 *                {@link VerifyPortableObjectProofOptions}.
 * @returns The detailed portable proof-policy result.
 * @throws {TypeError} If the input is not a single JSON-LD object or has a
-*                     malformed portable ID.
+*                     malformed portable ID or compatible identifier.
 * @since 2.4.0
 */
 async function verifyPortableObjectProof(jsonLd, options = {}) {
@@ -3747,7 +3854,7 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	};
 	const proofDocumentLoader = async (url, loaderOptions) => {
 		const remoteDocument = await baseDocumentLoader(url, loaderOptions);
-		if (PORTABLE_OBJECT_ID_PATTERN.test(url)) loadedPortableProofs++;
+		if (isPortableId(url)) loadedPortableProofs++;
 		const reference = normalizeDocumentUrl(url);
 		const candidateIndex = rawProofCandidates.findIndex((candidate, index) => !hydratedCandidates.has(index) && !rawProofCandidatePool.used.has(index) && candidate.reference === reference);
 		if (candidateIndex >= 0) {
@@ -3797,11 +3904,13 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	return object;
 }
 function deleteAuthenticatedAttribution(attributions, controllerId, verificationMethodId) {
-	const controllerHasCryptographicOrigin = hasCryptographicOrigin(controllerId.href);
-	const verificationMethodMatchesController = controllerHasCryptographicOrigin && hasCryptographicOrigin(verificationMethodId.href) && haveSameFe34Origin(controllerId, verificationMethodId);
-	if (!controllerHasCryptographicOrigin || verificationMethodMatchesController) attributions.delete(controllerId.href);
-	if (!verificationMethodMatchesController) return;
-	for (const attribution of [...attributions]) if (hasCryptographicOrigin(attribution) && haveSameFe34Origin(controllerId, attribution)) attributions.delete(attribution);
+	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) {
+		attributions.delete(controllerId.href);
+		return;
+	}
+	const did = getPortableDid(controllerId);
+	if (did == null || !hasCryptographicOrigin(verificationMethodId.href) || getPortableDid(verificationMethodId) !== did) return;
+	for (const attribution of [...attributions]) if ((hasCryptographicOrigin(attribution) || isPortableId(attribution)) && getPortableDid(attribution) === did) attributions.delete(attribution);
 }
 function hasCryptographicOrigin(iri) {
 	return /^did:/i.test(iri) || /^ap(?:\+ef61)?:\/\//i.test(iri);
@@ -3820,13 +3929,19 @@ const SEC = "https://w3id.org/security#";
 *
 * A gateway key is accepted only if:
 *
-*  -  the document is an actor whose portable ID is the one the key ID is
-*     the compatible identifier of;
+*  -  the document is an actor whose portable ID, i.e., its `ap:` ID or
+*     the canonical portable ID of its compatible identifier, is the one
+*     the key ID is the compatible identifier of;
 *  -  the document has a valid [FEP-8b32] Object Integrity Proof made by
 *     the DID of its ID, i.e., it satisfies the [FEP-ef61] proof policy;
 *  -  the document embeds a `Multikey` with that ID in its `assertionMethod`,
-*     whose `controller` is the actor, as [FEP-521a] requires; a key
-*     embedded in its `publicKey` with the same ID must agree with it; and
+*     whose `controller` is the actor, as [FEP-521a] requires, and a key
+*     embedded in its `publicKey` with the same ID agrees with it; or, if
+*     no `assertionMethod` entry has that ID, the document embeds
+*     a `CryptographicKey` with that ID in its `publicKey`, whose `owner` is
+*     the actor, as some publishers, e.g., tootik, list their RSA keys only
+*     there;
+*  -  no more than one entry of either property has that ID; and
 *  -  the key ID's origin is one of the actor's `gateways`.
 *
 * [FEP-8b32]: https://w3id.org/fep/8b32
@@ -3875,6 +3990,21 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 	if (!result.verified) return reject("The actor document does not satisfy the FEP-ef61 proof policy: " + result.reason.type);
 	if (root == null) return reject("The actor document could not be expanded.");
 	const refuse = (url) => Promise.reject(/* @__PURE__ */ new Error(`Refusing to fetch ${url}.`));
+	const parseEmbeddedPublicKey = async (node) => {
+		if (isReference(node)) return null;
+		let key;
+		try {
+			key = await CryptographicKey.fromJsonLd(node, {
+				documentLoader: refuse,
+				contextLoader: options.contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			return null;
+		}
+		return key.publicKey == null ? null : key;
+	};
 	let verifiedActor;
 	try {
 		verifiedActor = await Object$1.fromJsonLd(root, {
@@ -3888,41 +4018,42 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 	}
 	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
 	actor = verifiedActor;
-	const multikeyNode = findEmbeddedNode(root[`${SEC}assertionMethod`], keyId);
-	if (multikeyNode == null) return reject("The actor document does not embed the key in its assertionMethod.");
-	let multikey;
-	try {
-		multikey = await Multikey.fromJsonLd(multikeyNode, {
-			documentLoader: refuse,
-			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider
-		});
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		return reject("The key in the assertionMethod is malformed.");
-	}
-	if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
-	if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
-	const publicKeyNode = findEmbeddedNode(root[`${SEC}publicKey`], keyId);
-	if (publicKeyNode != null) {
-		let publicKey;
+	const assertionNodes = findNodes(root[`${SEC}assertionMethod`], keyId);
+	const publicKeyNodes = findNodes(root[`${SEC}publicKey`], keyId);
+	if (assertionNodes.length > 1 || publicKeyNodes.length > 1) return reject("The actor document has more than one key with the ID.");
+	let publicKey;
+	if (assertionNodes.length > 0) {
+		if (isReference(assertionNodes[0])) return reject("The actor document does not embed the key in its assertionMethod.");
+		let multikey;
 		try {
-			publicKey = await CryptographicKey.fromJsonLd(publicKeyNode, {
+			multikey = await Multikey.fromJsonLd(assertionNodes[0], {
 				documentLoader: refuse,
 				contextLoader: options.contextLoader,
 				tracerProvider: options.tracerProvider
 			});
 		} catch (error) {
 			if (!(error instanceof TypeError)) throw error;
-			return reject("The key in the publicKey is malformed.");
+			return reject("The key in the assertionMethod is malformed.");
 		}
-		if (publicKey.publicKey == null || !await isSamePublicKey(publicKey.publicKey, multikey.publicKey) || publicKey.ownerId != null && getCanonicalPortableId(publicKey.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
+		if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
+		if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
+		publicKey = multikey.publicKey;
+		if (publicKeyNodes.length > 0 && !isReference(publicKeyNodes[0])) {
+			const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
+			if (embedded == null || !await isSamePublicKey(embedded.publicKey, publicKey) || embedded.ownerId != null && getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
+		}
+	} else {
+		if (publicKeyNodes.length < 1) return reject("The actor document embeds the key in neither its assertionMethod nor its publicKey.");
+		const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
+		if (embedded == null) return reject("The key in the publicKey is not embedded or malformed.");
+		if (embedded.ownerId == null || getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The owner of the key is not the actor.");
+		publicKey = embedded.publicKey;
 	}
 	if (!actor.gateways.some((gateway) => isGatewayUrl(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
 	const key = new CryptographicKey({
 		id: keyId,
 		owner: actor.id,
-		publicKey: multikey.publicKey
+		publicKey
 	});
 	return {
 		type: "verified",
@@ -3972,24 +4103,21 @@ async function fetchPortableGatewayKey(keyId, options = {}) {
 		contextLoader
 	});
 }
-function findEmbeddedNode(values, id) {
-	if (!Array.isArray(values)) return null;
+function findNodes(values, id) {
+	if (!Array.isArray(values)) return [];
+	const nodes = [];
 	for (const value of values) {
 		if (value == null || typeof value !== "object" || Array.isArray(value)) continue;
 		const node = value;
 		const nodeId = node["@id"];
-		if (typeof nodeId !== "string") continue;
-		let parsed;
-		try {
-			parsed = new URL(nodeId);
-		} catch {
-			continue;
-		}
-		if (parsed.href !== id.href) continue;
-		if (Object.keys(node).every((key) => key === "@id")) continue;
-		return node;
+		if (typeof nodeId !== "string" || !URL.canParse(nodeId)) continue;
+		if (new URL(nodeId).href === id.href) nodes.push(node);
 	}
-	return null;
+	return nodes;
+}
+/** A node with nothing but an `@id` is a reference, not an embedded key. */
+function isReference(node) {
+	return Object.keys(node).every((key) => key === "@id");
 }
 //#endregion
 //#region src/sig/http.ts
@@ -4180,6 +4308,81 @@ function parseRfc9421Signature(signature) {
 	for (const [key, value] of Object.entries(dict)) if (value.value instanceof Uint8Array) result[key] = value.value;
 	return result;
 }
+/**
+* Parses the `Signature` header of draft-cavage HTTP Signatures into its
+* fields, e.g., `keyId` and `headers`.
+*/
+function parseDraftSignature(signature) {
+	return Object.fromEntries(signature.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)=(?:"([^"]*)"|(\d+))\s*$/)).filter((m) => m != null).map((m) => [m[1], m[2] ?? m[3]]));
+}
+/**
+* Lists the HTTP Signatures that a request claims to carry, without verifying
+* any of them.  Signatures whose key IDs are not URLs are left out.
+* @param request The request.
+* @returns The signatures; RFC 9421 ones if the request has
+*          a `Signature-Input` header, or a draft-cavage one otherwise.
+* @internal
+*/
+function listRequestSignatures(request) {
+	const signatureInput = request.headers.get("Signature-Input");
+	if (signatureInput != null) {
+		const signatures = [];
+		const inputs = parseRfc9421SignatureInput(signatureInput);
+		for (const [label, input] of Object.entries(inputs)) {
+			const keyId = parseKeyId(input.keyId);
+			if (keyId == null) continue;
+			signatures.push({
+				keyId,
+				label,
+				components: input.components
+			});
+		}
+		return signatures;
+	}
+	const signature = request.headers.get("Signature");
+	if (signature == null) return [];
+	const values = parseDraftSignature(signature);
+	const keyId = parseKeyId(values.keyId);
+	if (keyId == null) return [];
+	return [{
+		keyId,
+		label: null,
+		components: (values.headers ?? "").split(/\s+/g).filter((name) => name !== "").map((name) => ({
+			value: name,
+			params: {}
+		}))
+	}];
+}
+/**
+* Makes a copy of a request that carries only one of its RFC 9421 signatures,
+* so that verifying the copy verifies that signature and no other.
+* A draft-cavage signature is the only one in its request, so the request is
+* just copied.
+* @param request The request, whose body must not be consumed.
+* @param signature One of the signatures that {@link listRequestSignatures}
+*                  lists for the request.
+* @returns The copy of the request.
+* @internal
+*/
+function selectRequestSignature(request, signature) {
+	const copy = request.clone();
+	if (signature.label == null) return copy;
+	const { label } = signature;
+	const pick = (header) => {
+		if (header == null) return "";
+		let dict;
+		try {
+			dict = decodeDict(header);
+		} catch {
+			return "";
+		}
+		return Object.hasOwn(dict, label) ? encodeDict({ [label]: dict[label] }) : "";
+	};
+	const headers = new Headers(copy.headers);
+	headers.set("Signature-Input", pick(headers.get("Signature-Input")));
+	headers.set("Signature", pick(headers.get("Signature")));
+	return new Request(copy, { headers });
+}
 async function signRequestRfc9421(request, privateKey, keyId, span, currentTime, bodyBuffer, rfc9421Options) {
 	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
 	const url = new URL(request.url);
@@ -4411,7 +4614,7 @@ async function verifyRequestDraft(request, span, metricsContext, { documentLoade
 		logger.debug("Failed to verify; no Signature header found.", { headers: Object.fromEntries(request.headers.entries()) });
 		return noSignatureResult();
 	}
-	const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)=(?:"([^"]*)"|(\d+))\s*$/)).filter((m) => m != null).map((m) => [m[1], m[2] ?? m[3]]));
+	const sigValues = parseDraftSignature(sigHeader);
 	const parsedKeyId = parseKeyId(sigValues.keyId);
 	const dateHeader = request.headers.get("Date");
 	if (dateHeader == null) {
@@ -5084,4 +5287,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { recordCollectionPageItems as $, verifySignature as A, getCanonicalPortableId as B, hasSignature as C, signJsonLd as D, isInvalidUrlTypeError as E, fetchKeyDetailed as F, isSamePublicKey as G, hasPortableActor as H, generateCryptoKeyPair as I, getRemoteHost as J, getDurationMs as K, importJwk as L, exportJwk as M, fetchActorDocument as N, verifyCompactJsonLd as O, fetchKey as P, recordCollectionDispatchDuration as Q, validateCryptoKey as R, getNormalizationContextLoader as S, isClearlyMalformedContextReference as T, isCompatibleKeyId as U, getGatewayKeyBase as V, isPortableUri as W, isAbortError$1 as X, instrumentDocumentLoader as Y, recordCircuitBreakerStateChange as Z, assertSafeJsonLd as _, verifyRequestDetailed as a, recordOutboxActivity as at, createSignature as b, hasProofLike as c, registerQueueDepthGauge as ct, verifyObject as d, fulfillAcceptSignature as dt, recordCollectionRequest as et, verifyPortableObjectProof as f, parseAcceptSignature as ft, InvalidContextReferenceError as g, verifyProof as h, version as ht, verifyRequest as i, recordInboxActivity as it, wrapContextLoaderForJsonLd as j, verifyJsonLd as k, signObject as l, normalizeOutgoingActivityJsonLd as lt, verifyPortableObjectProofWithRoot as m, name as mt, parseRfc9421SignatureInput as n, recordDocumentCache as nt, fetchPortableGatewayKey as o, recordOutboxEnqueue as ot, verifyPortableObjectProofPolicy as p, validateAcceptSignature as pt, getFederationMetrics as q, signRequest as r, recordFanoutRecipients as rt, createProof as s, recordWebFingerHandle as st, doubleKnock as t, recordCollectionTotalItems as tt, verifyMapLocalProof as u, formatAcceptSignature as ut, attachSignature as v, hasSignatureLike as w, detachSignature as x, compactJsonLd as y, verifyKeyOwnership as z };
+export { recordCollectionTotalItems as $, isInvalidUrlTypeError as A, generateCryptoKeyPair as B, compactJsonLd as C, hasSignature as D, getNormalizationContextLoader as E, wrapContextLoaderForJsonLd as F, getFederationMetrics as G, validateCryptoKey as H, exportJwk as I, isAbortError$1 as J, getRemoteHost as K, fetchActorDocument as L, verifyCompactJsonLd as M, verifyJsonLd as N, hasSignatureLike as O, verifySignature as P, recordCollectionRequest as Q, fetchKey as R, attachSignature as S, detachSignature as T, verifyKeyOwnership as U, importJwk as V, getDurationMs as W, recordCollectionDispatchDuration as X, recordCircuitBreakerStateChange as Y, recordCollectionPageItems as Z, verifyPortableObjectProofWithRoot as _, isPortableId as _t, signRequest as a, recordWebFingerHandle as at, InvalidContextReferenceError as b, name as bt, fetchPortableGatewayKey as c, formatAcceptSignature as ct, hasProofLike as d, validateAcceptSignature as dt, recordDocumentCache as et, signObject as f, getCanonicalPortableId as ft, verifyPortableObjectProofPolicy as g, isCompatibleKeyId as gt, verifyPortableObjectProof as h, hasPortableActor as ht, selectRequestSignature as i, recordOutboxEnqueue as it, signJsonLd as j, isClearlyMalformedContextReference as k, InvalidPortableObjectIdError as l, fulfillAcceptSignature as lt, verifyObject as m, getPortableDid as mt, listRequestSignatures as n, recordInboxActivity as nt, verifyRequest as o, registerQueueDepthGauge as ot, verifyMapLocalProof as p, getGatewayKeyBase as pt, instrumentDocumentLoader as q, parseRfc9421SignatureInput as r, recordOutboxActivity as rt, verifyRequestDetailed as s, preloadedOnlyDocumentLoader as st, doubleKnock as t, recordFanoutRecipients as tt, createProof as u, parseAcceptSignature as ut, verifyProof as v, isPortableUri as vt, createSignature as w, assertSafeJsonLd as x, version as xt, normalizeOutgoingActivityJsonLd as y, isSamePublicKey as yt, fetchKeyDetailed as z };