@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/{ld-Cj9F_5AP.mjs → ld-CzaP-hJl.mjs}

@@ -1,9 +1,10 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BHzKn9Ig.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DMk-nTxI.mjs";
-import { n as fetchKey, o as validateCryptoKey } from "./key-DfPsX8hv.mjs";
+import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
+import { n as version, t as name } from "./deno-oR5aJKpU.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CYg9yxBL.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-BspPiXqn.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -25,7 +26,7 @@ const localContext = [
 ];
 const localContextUrls = new Set(localContext);
 const builtInContextLoader = getDocumentLoader();
-const disallowedJsonLdKeywords = new Set([
+const disallowedJsonLdKeywords = /* @__PURE__ */ new Set([
 	"@graph",
 	"@included",
 	"@reverse"
@@ -206,7 +207,7 @@ function normalizeContextReference(reference, baseUrl) {
 /** @internal */
 function isInvalidUrlTypeError(error) {
 	const code = error.code;
-	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+	return error instanceof TypeError && (code === "ERR_INVALID_URL" || error.message === "Invalid URL string." || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
 }
 async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
 	if (context === null) return createGraphAliasContextState();
@@ -450,6 +451,13 @@ function detachSignature(jsonLd) {
 */
 async function verifySignature(jsonLd, options = {}) {
 	if (!hasSignature(jsonLd)) return null;
+	if (options[verificationObservation]?.attempt != null && options[verificationObservation]?.check == null) {
+		const declared = getLdSignatureObject(jsonLd)?.creator;
+		return await observeCheck(options, { mechanism: "linkedData" }, typeof declared === "string" ? declared : null, (observation) => verifySignature(jsonLd, {
+			...options,
+			[verificationObservation]: observation
+		}));
+	}
 	const sig = jsonLd.signature;
 	let signature;
 	try {
@@ -495,6 +503,7 @@ async function verifySignature(jsonLd, options = {}) {
 	const encoder = new TextEncoder();
 	const message = sigOptsHash + docHash;
 	const messageBytes = encoder.encode(message);
+	triedKey(options, key);
 	if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes)) return key;
 	if (cached) {
 		logger.debug("Failed to verify with the cached key {keyId}; signature {signatureValue} is invalid.  Retrying with the freshly fetched key...", {
@@ -503,12 +512,10 @@ async function verifySignature(jsonLd, options = {}) {
 		});
 		const { key } = await measureSignatureKeyFetch(options.meterProvider, "linked_data", () => fetchKey(new URL(sig.creator), CryptographicKey, {
 			...options,
-			keyCache: {
-				get: () => Promise.resolve(void 0),
-				set: async (keyId, key) => await options.keyCache?.set(keyId, key)
-			}
+			keyCache: bypassKeyCacheReads(options.keyCache)
 		}));
 		if (key == null) return null;
+		triedKey(options, key);
 		return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes) ? key : null;
 	}
 	logger.debug("Failed to verify with the fetched key {keyId}; signature {signatureValue} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
@@ -525,7 +532,7 @@ async function verifySignature(jsonLd, options = {}) {
 * only from external documents and are dropped from the metric attribute to
 * avoid attacker-controlled cardinality.
 */
-const LD_KNOWN_SIGNATURE_TYPES = new Set(["RsaSignature2017"]);
+const LD_KNOWN_SIGNATURE_TYPES = /* @__PURE__ */ new Set(["RsaSignature2017"]);
 /**
 * Reports only whether a `signature` key is present on the document, with
 * no shape check on its value.  This is intentionally looser than
@@ -562,6 +569,14 @@ async function verifyCompactJsonLd(jsonLd, options = {}) {
 	return await verifyJsonLdInternal(jsonLd, options, false);
 }
 async function verifyJsonLdInternal(jsonLd, options, compact) {
+	if (options[verificationObservation]?.attempt == null) return await observeAttempt({
+		...options,
+		[verificationObservation]: options[verificationObservation] ?? { attempts: [] }
+	}, "linkedData", (observation) => verifyJsonLdInternal(jsonLd, {
+		...options,
+		[verificationObservation]: observation
+	}, compact), (value) => value);
+	const observation = options[verificationObservation];
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
 		const start = performance.now();
 		let verified = false;
@@ -574,6 +589,8 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 			} : options;
 			const compacted = compact ? hasSignature(jsonLd) ? await compactJsonLd(jsonLd, options.contextLoader) : jsonLd : jsonLd;
 			const object = await Object$1.fromJsonLd(compacted, verificationOptions);
+			observation?.parsedObject?.(object);
+			if (observation?.subject != null) observation.subject.id = object.id == null ? null : new URL(object.id.href);
 			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
 			span.setAttribute("activitypub.object.type", getTypeId(object).href);
 			const sig = getLdSignatureObject(jsonLd);
@@ -588,13 +605,21 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 			const attributions = new Set(object.attributionIds.map((uri) => uri.href));
 			if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
 			const key = await verifySignature(compacted, verificationOptions);
-			if (key == null) return false;
+			if (key == null) {
+				if (observation?.attempt != null && !hasLdSignatureProperty(jsonLd)) observation.attempt.reason = { type: "noSignature" };
+				return false;
+			}
 			if (key.ownerId == null) {
+				if (observation?.attempt != null) observation.attempt.reason = { type: "missingOwner" };
 				logger.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
 				return false;
 			}
 			attributions.delete(key.ownerId.href);
 			if (attributions.size > 0) {
+				if (observation?.attempt != null) observation.attempt.reason = {
+					type: "uncoveredAttribution",
+					attributionIds: [...attributions].map((id) => new URL(id))
+				};
 				logger.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
 				return false;
 			}
@@ -608,8 +633,15 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 			});
 			throw error;
 		} finally {
+			if (observation?.attempt?.reason != null) {
+				span.setAttribute("activitypub.verification.failure_reason", observation.attempt.reason.type);
+				span.setStatus({ code: SpanStatusCode.ERROR });
+			}
 			const classified = threw ? "error" : verified ? "verified" : hasLdSignatureProperty(jsonLd) ? "rejected" : "missing";
-			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "linked_data", classified, { ldType: signatureType });
+			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "linked_data", classified, {
+				ldType: signatureType,
+				verificationFailureReason: verified || threw ? void 0 : observation?.attempt?.reason?.type ?? (hasLdSignatureProperty(jsonLd) ? "signatureVerificationFailed" : "noSignature")
+			});
 			span.end();
 		}
 	});

package/dist/map-local-context-conflict-DOYEEJ3u.mjs

@@ -0,0 +1,204 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+//#region test-vectors/fep-8b32/map-local-context-conflict.json
+var map_local_context_conflict_default = {
+	id: "fedify-fep-8b32-map-local-context-conflict-v1",
+	profile: "Fedify map-local compound proof profile",
+	cryptosuite: "eddsa-jcs-2022",
+	notes: [
+		"The parent sets a default language that the child's local context does not reset.",
+		"The inner proof authenticates the extracted standalone child JSON map.",
+		"The outer proof authenticates the complete compound JSON snapshot.",
+		"Both proofs can be valid even though standalone and in-parent JSON-LD expansions differ."
+	],
+	keys: {
+		"outer": {
+			"controller": "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+			"verificationMethod": "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2#z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+			"publicKeyMultibase": "z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+			"publicKeyJwk": {
+				"kty": "OKP",
+				"crv": "Ed25519",
+				"x": "sA2Nk45_dz1RVlqtNqYj9TRPf10ZYPnPPo4SYg6igQ8",
+				"key_ops": ["verify"],
+				"ext": true
+			},
+			"testPrivateKeyJwk": {
+				"kty": "OKP",
+				"crv": "Ed25519",
+				"d": "yW756hDF5BTEcXI6_53nLDX6W3D66X6IMuysfS4rjtY",
+				"x": "sA2Nk45_dz1RVlqtNqYj9TRPf10ZYPnPPo4SYg6igQ8",
+				"key_ops": ["sign"],
+				"ext": true
+			}
+		},
+		"inner": {
+			"controller": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"publicKeyMultibase": "z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"publicKeyJwk": {
+				"kty": "OKP",
+				"crv": "Ed25519",
+				"x": "LR8epAGDe-cVq5p2Tx49CCfphpk1rNhkNoY9i-XEUfg",
+				"key_ops": ["verify"],
+				"ext": true
+			},
+			"testPrivateKeyJwk": {
+				"kty": "OKP",
+				"crv": "Ed25519",
+				"d": "LledL195fP9TQGQrkE2l2Y2k48UvqCzYI9M1zXyh7zQ",
+				"x": "LR8epAGDe-cVq5p2Tx49CCfphpk1rNhkNoY9i-XEUfg",
+				"key_ops": ["sign"],
+				"ext": true
+			}
+		}
+	},
+	documents: {
+		"finalSecuredCompound": {
+			"@context": [
+				"https://www.w3.org/ns/activitystreams",
+				"https://w3id.org/security/data-integrity/v1",
+				{ "@language": "en" }
+			],
+			"id": "ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/activities/context-conflict",
+			"type": "Create",
+			"actor": "ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/actor",
+			"object": {
+				"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+				"id": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/context-conflict",
+				"type": "Note",
+				"attributedTo": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor",
+				"content": "A portable note with inherited language",
+				"proof": {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+					"type": "DataIntegrityProof",
+					"cryptosuite": "eddsa-jcs-2022",
+					"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+					"proofPurpose": "assertionMethod",
+					"created": "2023-02-24T23:36:38Z",
+					"proofValue": "z3arp9jZdt6kcLacoXxx5kb6QVM8GZFXD13nEisfna52uwMprZz2yJCXsbyMBvvBKZopCCNRq3o22UqYgudLum5eM"
+				}
+			},
+			"proof": {
+				"@context": [
+					"https://www.w3.org/ns/activitystreams",
+					"https://w3id.org/security/data-integrity/v1",
+					{ "@language": "en" }
+				],
+				"type": "DataIntegrityProof",
+				"cryptosuite": "eddsa-jcs-2022",
+				"verificationMethod": "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2#z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+				"proofPurpose": "assertionMethod",
+				"created": "2023-02-24T23:36:38Z",
+				"proofValue": "z33BeAxXEtbCKnt9mKodwoJFSDKqK2Q2zMrWN36TtpFhDn9K9FFX7rvyfY2jkFh8gcUo3iQvUutzqBKXZdsyKZAEz"
+			}
+		},
+		"securedInner": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"id": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/context-conflict",
+			"type": "Note",
+			"attributedTo": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor",
+			"content": "A portable note with inherited language",
+			"proof": {
+				"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+				"type": "DataIntegrityProof",
+				"cryptosuite": "eddsa-jcs-2022",
+				"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+				"proofPurpose": "assertionMethod",
+				"created": "2023-02-24T23:36:38Z",
+				"proofValue": "z3arp9jZdt6kcLacoXxx5kb6QVM8GZFXD13nEisfna52uwMprZz2yJCXsbyMBvvBKZopCCNRq3o22UqYgudLum5eM"
+			}
+		},
+		"outerUnsecuredDocument": {
+			"@context": [
+				"https://www.w3.org/ns/activitystreams",
+				"https://w3id.org/security/data-integrity/v1",
+				{ "@language": "en" }
+			],
+			"id": "ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/activities/context-conflict",
+			"type": "Create",
+			"actor": "ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/actor",
+			"object": {
+				"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+				"id": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/context-conflict",
+				"type": "Note",
+				"attributedTo": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor",
+				"content": "A portable note with inherited language",
+				"proof": {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+					"type": "DataIntegrityProof",
+					"cryptosuite": "eddsa-jcs-2022",
+					"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+					"proofPurpose": "assertionMethod",
+					"created": "2023-02-24T23:36:38Z",
+					"proofValue": "z3arp9jZdt6kcLacoXxx5kb6QVM8GZFXD13nEisfna52uwMprZz2yJCXsbyMBvvBKZopCCNRq3o22UqYgudLum5eM"
+				}
+			}
+		},
+		"innerUnsecuredDocument": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"id": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/context-conflict",
+			"type": "Note",
+			"attributedTo": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor",
+			"content": "A portable note with inherited language"
+		},
+		"outerProofConfiguration": {
+			"@context": [
+				"https://www.w3.org/ns/activitystreams",
+				"https://w3id.org/security/data-integrity/v1",
+				{ "@language": "en" }
+			],
+			"type": "DataIntegrityProof",
+			"cryptosuite": "eddsa-jcs-2022",
+			"verificationMethod": "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2#z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+			"proofPurpose": "assertionMethod",
+			"created": "2023-02-24T23:36:38Z"
+		},
+		"innerProofConfiguration": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"type": "DataIntegrityProof",
+			"cryptosuite": "eddsa-jcs-2022",
+			"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"proofPurpose": "assertionMethod",
+			"created": "2023-02-24T23:36:38Z"
+		}
+	},
+	canonicalization: {
+		"outer": {
+			"documentJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\",{\"@language\":\"en\"}],\"actor\":\"ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/actor\",\"id\":\"ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/activities/context-conflict\",\"object\":{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"attributedTo\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor\",\"content\":\"A portable note with inherited language\",\"id\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/context-conflict\",\"proof\":{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"created\":\"2023-02-24T23:36:38Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"proofValue\":\"z3arp9jZdt6kcLacoXxx5kb6QVM8GZFXD13nEisfna52uwMprZz2yJCXsbyMBvvBKZopCCNRq3o22UqYgudLum5eM\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3\"},\"type\":\"Note\"},\"type\":\"Create\"}",
+			"proofConfigurationJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\",{\"@language\":\"en\"}],\"created\":\"2023-02-24T23:36:38Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2#z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2\"}"
+		},
+		"inner": {
+			"documentJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"attributedTo\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor\",\"content\":\"A portable note with inherited language\",\"id\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/context-conflict\",\"type\":\"Note\"}",
+			"proofConfigurationJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"created\":\"2023-02-24T23:36:38Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3\"}"
+		}
+	},
+	hashes: {
+		"outer": {
+			"documentSha256": "7b0a0d3668e43492c8c54cb98d0227a1bf0aefd11da7adb48af6e31f6d5322df",
+			"proofConfigurationSha256": "94b98e0a2519065217496bad2936e6e892bfe12ccb176282ec274ce8eb98a6a3",
+			"combinedSigningInput": "94b98e0a2519065217496bad2936e6e892bfe12ccb176282ec274ce8eb98a6a37b0a0d3668e43492c8c54cb98d0227a1bf0aefd11da7adb48af6e31f6d5322df"
+		},
+		"inner": {
+			"documentSha256": "3772e3a906c7b49d195345b05d73c3156bb3d61a5d1c641d64f4f03d661f7eeb",
+			"proofConfigurationSha256": "1ebdc71cb480bd324b030f85c02dc6f8db879716faf0f7ee0f05df4c395d71b4",
+			"combinedSigningInput": "1ebdc71cb480bd324b030f85c02dc6f8db879716faf0f7ee0f05df4c395d71b43772e3a906c7b49d195345b05d73c3156bb3d61a5d1c641d64f4f03d661f7eeb"
+		}
+	},
+	proofValues: {
+		"outer": "z33BeAxXEtbCKnt9mKodwoJFSDKqK2Q2zMrWN36TtpFhDn9K9FFX7rvyfY2jkFh8gcUo3iQvUutzqBKXZdsyKZAEz",
+		"inner": "z3arp9jZdt6kcLacoXxx5kb6QVM8GZFXD13nEisfna52uwMprZz2yJCXsbyMBvvBKZopCCNRq3o22UqYgudLum5eM"
+	},
+	expectedVerification: { "original": {
+		"inner": true,
+		"outer": true
+	} },
+	expectedInterpretation: {
+		"standaloneAndInParentExpansionsEqual": false,
+		"standaloneContentLanguage": null,
+		"inParentContentLanguage": "en"
+	}
+};
+//#endregion
+export { map_local_context_conflict_default as t };

package/dist/map-local-create-note-B0SeXJms.mjs

@@ -0,0 +1,214 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+//#region test-vectors/fep-8b32/map-local-create-note.json
+var map_local_create_note_default = {
+	id: "fedify-fep-8b32-map-local-create-note-v1",
+	profile: "Fedify map-local compound proof profile",
+	cryptosuite: "eddsa-jcs-2022",
+	notes: [
+		"Each map has one direct literal proof property.",
+		"Each map has an explicit local context.",
+		"The outer unsecured document retains the complete secured inner map.",
+		"Combined inputs concatenate proof-configuration SHA-256 first and document SHA-256 second."
+	],
+	keys: {
+		"outer": {
+			"controller": "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+			"verificationMethod": "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2#z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+			"publicKeyMultibase": "z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+			"publicKeyJwk": {
+				"kty": "OKP",
+				"crv": "Ed25519",
+				"x": "sA2Nk45_dz1RVlqtNqYj9TRPf10ZYPnPPo4SYg6igQ8",
+				"key_ops": ["verify"],
+				"ext": true
+			},
+			"testPrivateKeyJwk": {
+				"kty": "OKP",
+				"crv": "Ed25519",
+				"d": "yW756hDF5BTEcXI6_53nLDX6W3D66X6IMuysfS4rjtY",
+				"x": "sA2Nk45_dz1RVlqtNqYj9TRPf10ZYPnPPo4SYg6igQ8",
+				"key_ops": ["sign"],
+				"ext": true
+			}
+		},
+		"inner": {
+			"controller": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"publicKeyMultibase": "z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"publicKeyJwk": {
+				"kty": "OKP",
+				"crv": "Ed25519",
+				"x": "LR8epAGDe-cVq5p2Tx49CCfphpk1rNhkNoY9i-XEUfg",
+				"key_ops": ["verify"],
+				"ext": true
+			},
+			"testPrivateKeyJwk": {
+				"kty": "OKP",
+				"crv": "Ed25519",
+				"d": "LledL195fP9TQGQrkE2l2Y2k48UvqCzYI9M1zXyh7zQ",
+				"x": "LR8epAGDe-cVq5p2Tx49CCfphpk1rNhkNoY9i-XEUfg",
+				"key_ops": ["sign"],
+				"ext": true
+			}
+		}
+	},
+	documents: {
+		"finalSecuredCompound": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"id": "ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/activities/1",
+			"type": "Create",
+			"actor": "ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/actor",
+			"object": {
+				"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+				"id": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/1",
+				"type": "Note",
+				"attributedTo": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor",
+				"content": "A portable note",
+				"proof": {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+					"type": "DataIntegrityProof",
+					"cryptosuite": "eddsa-jcs-2022",
+					"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+					"proofPurpose": "assertionMethod",
+					"created": "2023-02-24T23:36:38Z",
+					"proofValue": "z2GCde7JjRjsTipz43CEeCjiDF7NCGbAcvqAkwuywq2u1mQTXs7U9WeT3jXmi6ib6uqpdiT53CxFrkSPLsHiQxhk7"
+				}
+			},
+			"proof": {
+				"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+				"type": "DataIntegrityProof",
+				"cryptosuite": "eddsa-jcs-2022",
+				"verificationMethod": "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2#z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+				"proofPurpose": "assertionMethod",
+				"created": "2023-02-24T23:36:38Z",
+				"proofValue": "z5KEH1yoB2DsDs39emBhGJM2GqgM9waar91Mj34gqaa238KgyyEvyTrVvBTWKxHxR5Xin6X8tPYr4Ucb6WDzBkMMz"
+			}
+		},
+		"securedInner": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"id": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/1",
+			"type": "Note",
+			"attributedTo": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor",
+			"content": "A portable note",
+			"proof": {
+				"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+				"type": "DataIntegrityProof",
+				"cryptosuite": "eddsa-jcs-2022",
+				"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+				"proofPurpose": "assertionMethod",
+				"created": "2023-02-24T23:36:38Z",
+				"proofValue": "z2GCde7JjRjsTipz43CEeCjiDF7NCGbAcvqAkwuywq2u1mQTXs7U9WeT3jXmi6ib6uqpdiT53CxFrkSPLsHiQxhk7"
+			}
+		},
+		"outerUnsecuredDocument": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"id": "ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/activities/1",
+			"type": "Create",
+			"actor": "ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/actor",
+			"object": {
+				"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+				"id": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/1",
+				"type": "Note",
+				"attributedTo": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor",
+				"content": "A portable note",
+				"proof": {
+					"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+					"type": "DataIntegrityProof",
+					"cryptosuite": "eddsa-jcs-2022",
+					"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+					"proofPurpose": "assertionMethod",
+					"created": "2023-02-24T23:36:38Z",
+					"proofValue": "z2GCde7JjRjsTipz43CEeCjiDF7NCGbAcvqAkwuywq2u1mQTXs7U9WeT3jXmi6ib6uqpdiT53CxFrkSPLsHiQxhk7"
+				}
+			}
+		},
+		"innerUnsecuredDocument": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"id": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/1",
+			"type": "Note",
+			"attributedTo": "ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor",
+			"content": "A portable note"
+		},
+		"outerProofConfiguration": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"type": "DataIntegrityProof",
+			"cryptosuite": "eddsa-jcs-2022",
+			"verificationMethod": "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2#z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2",
+			"proofPurpose": "assertionMethod",
+			"created": "2023-02-24T23:36:38Z"
+		},
+		"innerProofConfiguration": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"type": "DataIntegrityProof",
+			"cryptosuite": "eddsa-jcs-2022",
+			"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"proofPurpose": "assertionMethod",
+			"created": "2023-02-24T23:36:38Z"
+		},
+		"replacementInnerProof": {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			"type": "DataIntegrityProof",
+			"cryptosuite": "eddsa-jcs-2022",
+			"verificationMethod": "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3",
+			"proofPurpose": "assertionMethod",
+			"created": "2023-02-25T23:36:38Z",
+			"proofValue": "z2fmC2UAoxpesDmSJ6LWoRReCRhPGCKTHgBCsq1491B2Hx2SN8MszWgfcgJkF1poPnyhFAEGrpeqGWchiw261np9z"
+		}
+	},
+	canonicalization: {
+		"outer": {
+			"documentJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"actor\":\"ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/actor\",\"id\":\"ap+ef61://did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/activities/1\",\"object\":{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"attributedTo\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor\",\"content\":\"A portable note\",\"id\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/1\",\"proof\":{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"created\":\"2023-02-24T23:36:38Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"proofValue\":\"z2GCde7JjRjsTipz43CEeCjiDF7NCGbAcvqAkwuywq2u1mQTXs7U9WeT3jXmi6ib6uqpdiT53CxFrkSPLsHiQxhk7\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3\"},\"type\":\"Note\"},\"type\":\"Create\"}",
+			"proofConfigurationJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"created\":\"2023-02-24T23:36:38Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2#z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2\"}"
+		},
+		"inner": {
+			"documentJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"attributedTo\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor\",\"content\":\"A portable note\",\"id\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/1\",\"type\":\"Note\"}",
+			"proofConfigurationJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"created\":\"2023-02-24T23:36:38Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3\"}"
+		},
+		"replacementInner": {
+			"documentJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"attributedTo\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/actor\",\"content\":\"A portable note\",\"id\":\"ap+ef61://did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3/objects/1\",\"type\":\"Note\"}",
+			"proofConfigurationJcs": "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\"],\"created\":\"2023-02-25T23:36:38Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3#z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3\"}"
+		}
+	},
+	hashes: {
+		"outer": {
+			"documentSha256": "f49f8c592c02d0ee85b7f7182fd593ddf6e7f432d8388843e4d086238f45bafc",
+			"proofConfigurationSha256": "c9842a6bca0a0594e99f1525344ce4f0c8c6096f5a832525a05205aacd8791e0",
+			"combinedSigningInput": "c9842a6bca0a0594e99f1525344ce4f0c8c6096f5a832525a05205aacd8791e0f49f8c592c02d0ee85b7f7182fd593ddf6e7f432d8388843e4d086238f45bafc"
+		},
+		"inner": {
+			"documentSha256": "9c9ffa1efcc871d219b8622e98253168ac65867ee76d6e4183ee0ca0226c2fd3",
+			"proofConfigurationSha256": "1ebdc71cb480bd324b030f85c02dc6f8db879716faf0f7ee0f05df4c395d71b4",
+			"combinedSigningInput": "1ebdc71cb480bd324b030f85c02dc6f8db879716faf0f7ee0f05df4c395d71b49c9ffa1efcc871d219b8622e98253168ac65867ee76d6e4183ee0ca0226c2fd3"
+		},
+		"replacementInner": {
+			"documentSha256": "9c9ffa1efcc871d219b8622e98253168ac65867ee76d6e4183ee0ca0226c2fd3",
+			"proofConfigurationSha256": "00da7da35af5e922313de14cf0f8f63c9a27152205b1eb5ef049a7f6023589ad",
+			"combinedSigningInput": "00da7da35af5e922313de14cf0f8f63c9a27152205b1eb5ef049a7f6023589ad9c9ffa1efcc871d219b8622e98253168ac65867ee76d6e4183ee0ca0226c2fd3"
+		}
+	},
+	proofValues: {
+		"outer": "z5KEH1yoB2DsDs39emBhGJM2GqgM9waar91Mj34gqaa238KgyyEvyTrVvBTWKxHxR5Xin6X8tPYr4Ucb6WDzBkMMz",
+		"inner": "z2GCde7JjRjsTipz43CEeCjiDF7NCGbAcvqAkwuywq2u1mQTXs7U9WeT3jXmi6ib6uqpdiT53CxFrkSPLsHiQxhk7",
+		"replacementInner": "z2fmC2UAoxpesDmSJ6LWoRReCRhPGCKTHgBCsq1491B2Hx2SN8MszWgfcgJkF1poPnyhFAEGrpeqGWchiw261np9z"
+	},
+	expectedVerification: {
+		"original": {
+			"inner": true,
+			"outer": true
+		},
+		"tamperedInnerContent": {
+			"inner": false,
+			"outer": false
+		},
+		"replacedInnerProof": {
+			"inner": true,
+			"outer": false
+		},
+		"standaloneInner": true,
+		"standaloneOuter": true
+	}
+};
+//#endregion
+export { map_local_create_note_default as t };

package/dist/{metrics-DMk-nTxI.mjs → metrics-CYg9yxBL.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BHzKn9Ig.mjs";
+import { n as version, t as name } from "./deno-oR5aJKpU.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts
@@ -302,6 +302,7 @@ var FederationMetrics = class {
 		};
 		if (extra.algorithm != null) attributes["http_signatures.algorithm"] = extra.algorithm;
 		if (extra.failureReason != null) attributes["http_signatures.failure_reason"] = extra.failureReason;
+		if (extra.verificationFailureReason != null) attributes["activitypub.verification.failure_reason"] = extra.verificationFailureReason;
 		if (extra.ldType != null) attributes["ld_signatures.type"] = extra.ldType;
 		if (extra.cryptosuite != null) attributes["object_integrity_proofs.cryptosuite"] = extra.cryptosuite;
 		this.signatureVerificationDuration.record(durationMs, attributes);
@@ -770,7 +771,7 @@ function isAbortError(error) {
 	const name = error.name;
 	return typeof name === "string" && name === "AbortError";
 }
-const KNOWN_HTTP_METHODS = new Set([
+const KNOWN_HTTP_METHODS = /* @__PURE__ */ new Set([
 	"CONNECT",
 	"DELETE",
 	"GET",

package/dist/metrics-DVKYY6K1.d.cts

@@ -0,0 +1,36 @@
+/// <reference lib="esnext.temporal" />
+import { DocumentLoader } from "@fedify/vocab-runtime";
+import { MeterProvider } from "@opentelemetry/api";
+
+//#region src/federation/metrics.d.ts
+/**
+* The kind of remote ActivityPub lookup, recorded as
+* `activitypub.lookup.kind` on the public-key lookup and remote document
+* fetch metric families.
+*
+*  -  `public_key`: a public key lookup performed by `fetchKey` /
+*     `fetchKeyDetailed` (always recorded on `activitypub.key.lookup*`).
+*  -  `actor`: a document fetch whose resolved value is an Actor.  The
+*     bucket exists in the taxonomy for future actor-aware call sites;
+*     today, actor documents fetched through Fedify's generic document
+*     loader are still classified as `object` because the kind is decided
+*     at the loader boundary, before the response is parsed.
+*  -  `object`: a generic ActivityPub object fetch through Fedify's
+*     document loader.  This is the default classification for
+*     `documentLoader` invocations that do not match a more specific
+*     bucket.
+*  -  `context`: a JSON-LD `@context` document fetch through Fedify's
+*     context loader.
+*  -  `other`: a fetch that does not fit any of the above classifications.
+* @since 2.3.0
+*/
+type LookupKind = "public_key" | "actor" | "object" | "context" | "other";
+/**
+* The {@link LookupKind} values that can appear on remote document fetch
+* metrics.  `public_key` lookups are reported on the
+* `activitypub.key.lookup` metric family instead, so it is excluded here.
+* @since 2.3.0
+*/
+type DocumentFetchKind = Exclude<LookupKind, "public_key">;
+//#endregion
+export { DocumentFetchKind as t };