@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/{middleware-CEctxBN6.mjs → middleware-DWjrfpcz.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-CvwTUgnP.mjs";
+import { n as FederationImpl } from "./middleware-D7_LO-Vs.mjs";
 export { FederationImpl };

package/dist/{mod-gOlPDuT8.d.cts → mod-BojP2Bw3.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Mt as WebFingerLinksDispatcher, ct as ActorAliasMapper, l as RequestContext, lt as ActorDispatcher, ut as ActorHandleMapper } from "./context-lxX6I7as.cjs";
+import { Jt as WebFingerLinksDispatcher, St as ActorHandleMapper, bt as ActorAliasMapper, p as RequestContext, xt as ActorDispatcher } from "./context-tsYPJ2Ew.cjs";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 

package/dist/mod-CavhAgLw.d.cts

@@ -0,0 +1,320 @@
+/// <reference lib="esnext.temporal" />
+import { B as VerifyPortableObjectProofOptions, a as KeyCache, v as VerificationObservationOptions, z as VerifyPortableObjectProofFailureReason } from "./key-DYxuyd-s.cjs";
+import { CryptographicKey, Multikey } from "@fedify/vocab";
+import { DocumentLoader, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
+import { MeterProvider, TracerProvider } from "@opentelemetry/api";
+
+//#region src/sig/ld.d.ts
+/**
+* A signature of a JSON-LD document.
+* @since 1.0.0
+*/
+interface Signature {
+  "@context"?: "https://w3id.org/identity/v1";
+  type: "RsaSignature2017";
+  id?: string;
+  creator: string;
+  created: string;
+  signatureValue: string;
+}
+/**
+* Attaches a LD signature to the given JSON-LD document.
+* @param jsonLd The JSON-LD document to attach the signature to.  It is not
+*               modified.
+* @param signature The signature to attach.
+* @returns The JSON-LD document with the attached signature.
+* @throws {TypeError} If the input document is not a valid JSON-LD document.
+* @since 1.0.0
+*/
+declare function attachSignature(jsonLd: unknown, signature: Signature): {
+  signature: Signature;
+};
+/**
+* Options for creating Linked Data Signatures.
+* @since 1.0.0
+*/
+interface CreateSignatureOptions {
+  /**
+  * The context loader for loading remote JSON-LD contexts.
+  */
+  contextLoader?: DocumentLoader;
+  /**
+  * The time when the signature was created.  If not specified, the current
+  * time will be used.
+  */
+  created?: Temporal.Instant;
+}
+/**
+* Creates a LD signature for the given JSON-LD document.
+* @param jsonLd The JSON-LD document to sign.
+* @param privateKey The private key to sign the document.
+* @param keyId The ID of the public key that corresponds to the private key.
+* @param options Additional options for creating the signature.
+*                See also {@link CreateSignatureOptions}.
+* @return The created signature.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 1.0.0
+*/
+declare function createSignature(jsonLd: unknown, privateKey: CryptoKey, keyId: URL, {
+  contextLoader,
+  created
+}?: CreateSignatureOptions): Promise<Signature>;
+/**
+* Options for signing JSON-LD documents.
+* @since 1.0.0
+*/
+interface SignJsonLdOptions extends CreateSignatureOptions {
+  /**
+  * The OpenTelemetry tracer provider for tracing the signing process.
+  * If omitted, the global tracer provider is used.
+  * @since 1.3.0
+  */
+  tracerProvider?: TracerProvider;
+}
+/**
+* Signs the given JSON-LD document with the private key and returns the signed
+* JSON-LD document.
+* @param jsonLd The JSON-LD document to sign.
+* @param privateKey The private key to sign the document.
+* @param keyId The key ID to use in the signature.  It will be used by the
+*              verifier to fetch the corresponding public key.
+* @param options Additional options for signing the document.
+*                See also {@link SignJsonLdOptions}.
+* @returns The signed JSON-LD document.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 1.0.0
+*/
+declare function signJsonLd(jsonLd: unknown, privateKey: CryptoKey, keyId: URL, options: SignJsonLdOptions): Promise<{
+  signature: Signature;
+}>;
+/**
+* Checks if the given JSON-LD document has a Linked Data Signature-like
+* object, without restricting it to a single suite-specific shape.
+* @param jsonLd The JSON-LD document to check.
+* @returns `true` if the document has a signature-like object; `false`
+*          otherwise.
+* @since 2.2.0
+*/
+declare function hasSignatureLike(jsonLd: unknown): boolean;
+/**
+* Detaches Linked Data Signatures from the given JSON-LD document.
+* @param jsonLd The JSON-LD document to modify.
+* @returns The modified JSON-LD document.  If the input document does not
+*          contain a signature, the original document is returned.
+* @since 1.0.0
+*/
+declare function detachSignature(jsonLd: unknown): unknown;
+/**
+* Options for verifying Linked Data Signatures.
+* @since 1.0.0
+*/
+interface VerifySignatureOptions extends VerificationObservationOptions {
+  /**
+  * The document loader to use for fetching the public key.
+  */
+  documentLoader?: DocumentLoader;
+  /**
+  * The context loader to use for JSON-LD context retrieval.
+  */
+  contextLoader?: DocumentLoader;
+  /**
+  * The key cache to use for caching public keys.
+  */
+  keyCache?: KeyCache;
+  /**
+  * The OpenTelemetry tracer provider for tracing the verification process.
+  * If omitted, the global tracer provider is used.
+  * @since 1.3.0
+  */
+  tracerProvider?: TracerProvider;
+  /**
+  * The OpenTelemetry meter provider.  If omitted, the global meter provider
+  * is used.
+  * @since 2.3.0
+  */
+  meterProvider?: MeterProvider;
+}
+/**
+* Verifies Linked Data Signatures of the given JSON-LD document.
+*
+* This is a low-level utility that only checks the cryptographic signature
+* and (optionally) the cached key.  It does not run the JSON-LD parsing,
+* attribution, and owner checks that a complete inbound LD verification
+* needs.  For incoming activities, prefer {@link verifyJsonLd}, which is
+* the public verification entry point and the one that emits the
+* `activitypub.signature.verification.duration` metric for the LD path.
+* `verifySignature` itself only emits
+* `activitypub.signature.key_fetch.duration`, since the rest of the work
+* that the verification-duration metric is meant to cover happens in
+* `verifyJsonLd`.
+* @param jsonLd The JSON-LD document to verify.
+* @param options Options for verifying the signature.
+* @returns The public key that signed the document or `null` if the signature
+*          is invalid or the key is not found.
+* @since 1.0.0
+*/
+declare function verifySignature(jsonLd: unknown, options?: VerifySignatureOptions): Promise<CryptographicKey | null>;
+/**
+* Options for verifying JSON-LD documents.
+*/
+interface VerifyJsonLdOptions extends VerifySignatureOptions {}
+/**
+* Verify the authenticity of the given JSON-LD document using Linked Data
+* Signatures.  If the document is signed, this function verifies the signature
+* and checks if the document is attributed to the owner of the public key.
+* If the document is not signed, this function returns `false`.
+* @param jsonLd The JSON-LD document to verify.
+* @param options Options for verifying the document.
+* @returns `true` if the document is authentic; `false` otherwise.
+*/
+declare function verifyJsonLd(jsonLd: unknown, options?: VerifyJsonLdOptions): Promise<boolean>;
+//#endregion
+//#region src/sig/portable-collection.d.ts
+/**
+* Options for {@link verifyPortableObject}.
+*
+* Besides the options for {@link verifyPortableObjectProof}, it takes where
+* the document came from, which property accessors pass automatically when
+* `verifyPortableObject()` is used as their `verifyPortableObject` option.
+* @since 2.4.0
+*/
+interface VerifyPortableObjectOptions extends VerifyPortableObjectProofOptions, Omit<PortableObjectVerifierOptions, "documentLoader" | "contextLoader" | "tracerProvider"> {}
+/**
+* The reason why {@link verifyPortableObject} did not accept a document.
+*
+* Besides the reasons of {@link verifyPortableObjectProof}, it describes why
+* an unsecured portable collection was not trusted.  The
+* `unsecuredCollection` reason itself never appears, since such collections
+* are judged by the gateway trust policy instead.
+* @since 2.4.0
+*/
+type VerifyPortableObjectFailureReason = Exclude<VerifyPortableObjectProofFailureReason, {
+  readonly type: "unsecuredCollection";
+}> | {
+  /**
+  * The unsecured collection was not retrieved from a gateway, i.e., the
+  * document's final URL is missing or is not a compatible identifier for
+  * the same portable collection.
+  */
+  readonly type: "unknownCollectionSource"; /** The final URL of the document, if known. */
+  readonly documentUrl: URL | null;
+} | {
+  /**
+  * The actor that owns the unsecured collection cannot be determined
+  * unambiguously.
+  */
+  readonly type: "unknownCollectionOwner";
+} | {
+  /** The collection, its pages, or its referrer disagree on its owner. */readonly type: "conflictingCollectionOwners"; /** The owner candidates that disagree. */
+  readonly candidates: readonly URL[];
+} | {
+  /**
+  * A collection page does not belong to the collection it was reached
+  * from: its `partOf` names another collection, or its cryptographic
+  * origin differs.
+  */
+  readonly type: "collectionPageMismatch"; /** The page. */
+  readonly pageId: URL; /** The collection that the page was reached from. */
+  readonly collectionId: URL; /** The mismatching `partOf`, or `null` if the origin differs. */
+  readonly partOf: URL | null;
+} | {
+  /**
+  * The owner's actor document could not be retrieved or verified, or it
+  * lists no gateways.
+  */
+  readonly type: "collectionOwnerUnavailable"; /** The owner candidate. */
+  readonly owner: URL;
+} | {
+  /**
+  * The owner's actor document does not list the collection as its
+  * `inbox`, `outbox`, `followers`, `following`, or `liked`.
+  */
+  readonly type: "collectionNotListedByOwner"; /** The owner. */
+  readonly owner: URL; /** The collection. */
+  readonly collectionId: URL;
+} | {
+  /**
+  * The unsecured collection was retrieved from a gateway that its owner
+  * does not list in its `gateways`.
+  */
+  readonly type: "untrustedGateway"; /** The owner. */
+  readonly owner: URL; /** The gateway that served the collection. */
+  readonly gateway: URL; /** The owner's gateways. */
+  readonly gateways: readonly URL[];
+};
+/**
+* The result of {@link verifyPortableObject}.
+* @since 2.4.0
+*/
+type VerifyPortableObjectResult = {
+  /** Whether the document is accepted. */readonly verified: true; /** The document carries valid Object Integrity Proofs. */
+  readonly method: "proof"; /** The public keys used by the verified proofs, in proof order. */
+  readonly keys: readonly Multikey[];
+  /**
+  * Opaque state for verifying the pages of a portable collection.  Do not
+  * inspect it; property accessors pass it back automatically.
+  */
+  readonly collectionContext?: unknown;
+} | {
+  /** Whether the document is accepted. */readonly verified: true;
+  /**
+  * The document is an unsecured portable collection served by a gateway
+  * that its owner lists.
+  */
+  readonly method: "gateway"; /** The document has no integrity proof. */
+  readonly unsecured: true; /** The actor that owns the collection. */
+  readonly owner: URL; /** The gateway that served the collection. */
+  readonly gateway: URL;
+  /**
+  * Opaque state for verifying the pages of a portable collection.  Do not
+  * inspect it; property accessors pass it back automatically.
+  */
+  readonly collectionContext: unknown;
+} | {
+  /** Whether the document is accepted. */readonly verified: false; /** Why the document was not accepted. */
+  readonly reason: VerifyPortableObjectFailureReason;
+};
+/**
+* Applies the [FEP-ef61] trust policy to a portable object fetched through
+* a gateway.
+*
+* Portable actors, activities, objects, and collections with proofs are
+* verified by {@link verifyPortableObjectProof}.  A portable collection or
+* collection page without a proof is accepted only if all of the following
+* hold:
+*
+*  -  It was retrieved from a gateway: its final URL (`documentUrl`) is
+*     a compatible identifier for the same portable collection.
+*  -  Its owner is determined unambiguously: the actor whose `inbox`,
+*     `outbox`, `followers`, `following`, or `liked` property referred to
+*     the collection, or the single actor in its `attributedTo`.  A page
+*     inherits the owner of the collection it was reached from through
+*     `first`, `last`, `current`, `next`, or `prev`, and must not name
+*     another collection in `partOf`.
+*  -  The owner's actor document is verified by its proof and lists the
+*     collection as its `inbox`, `outbox`, `followers`, `following`, or
+*     `liked`.
+*  -  The gateway that served the collection is in the owner's `gateways`.
+*
+* Where the document came from and which object referred to it are passed
+* by property accessors when this function is used as their
+* `verifyPortableObject` option.  Objects embedded in an unsecured
+* collection accepted this way are not trusted: accessors dereference and
+* verify them one by one.
+*
+* Note that acceptance through the gateway policy does not verify anything
+* cryptographically; it only means that the owner trusts the gateway.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param jsonLd The JSON-LD document to verify.
+* @param options Additional options.  See also
+*                {@link VerifyPortableObjectOptions}.
+* @returns The detailed result.
+* @throws {TypeError} If the input is not a single JSON-LD object or has a
+*                     malformed portable ID.
+* @since 2.4.0
+*/
+declare function verifyPortableObject(jsonLd: unknown, options?: VerifyPortableObjectOptions): Promise<VerifyPortableObjectResult>;
+//#endregion
+export { CreateSignatureOptions as a, VerifySignatureOptions as c, detachSignature as d, hasSignatureLike as f, verifySignature as h, verifyPortableObject as i, attachSignature as l, verifyJsonLd as m, VerifyPortableObjectOptions as n, SignJsonLdOptions as o, signJsonLd as p, VerifyPortableObjectResult as r, VerifyJsonLdOptions as s, VerifyPortableObjectFailureReason as t, createSignature as u };

package/dist/mod-CtpF2BU5.d.ts

@@ -0,0 +1,320 @@
+/// <reference lib="esnext.temporal" />
+import { B as VerifyPortableObjectProofOptions, a as KeyCache, v as VerificationObservationOptions, z as VerifyPortableObjectProofFailureReason } from "./key-C1nv7_jD.js";
+import { CryptographicKey, Multikey } from "@fedify/vocab";
+import { MeterProvider, TracerProvider } from "@opentelemetry/api";
+import { DocumentLoader, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
+
+//#region src/sig/ld.d.ts
+/**
+* A signature of a JSON-LD document.
+* @since 1.0.0
+*/
+interface Signature {
+  "@context"?: "https://w3id.org/identity/v1";
+  type: "RsaSignature2017";
+  id?: string;
+  creator: string;
+  created: string;
+  signatureValue: string;
+}
+/**
+* Attaches a LD signature to the given JSON-LD document.
+* @param jsonLd The JSON-LD document to attach the signature to.  It is not
+*               modified.
+* @param signature The signature to attach.
+* @returns The JSON-LD document with the attached signature.
+* @throws {TypeError} If the input document is not a valid JSON-LD document.
+* @since 1.0.0
+*/
+declare function attachSignature(jsonLd: unknown, signature: Signature): {
+  signature: Signature;
+};
+/**
+* Options for creating Linked Data Signatures.
+* @since 1.0.0
+*/
+interface CreateSignatureOptions {
+  /**
+  * The context loader for loading remote JSON-LD contexts.
+  */
+  contextLoader?: DocumentLoader;
+  /**
+  * The time when the signature was created.  If not specified, the current
+  * time will be used.
+  */
+  created?: Temporal.Instant;
+}
+/**
+* Creates a LD signature for the given JSON-LD document.
+* @param jsonLd The JSON-LD document to sign.
+* @param privateKey The private key to sign the document.
+* @param keyId The ID of the public key that corresponds to the private key.
+* @param options Additional options for creating the signature.
+*                See also {@link CreateSignatureOptions}.
+* @return The created signature.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 1.0.0
+*/
+declare function createSignature(jsonLd: unknown, privateKey: CryptoKey, keyId: URL, {
+  contextLoader,
+  created
+}?: CreateSignatureOptions): Promise<Signature>;
+/**
+* Options for signing JSON-LD documents.
+* @since 1.0.0
+*/
+interface SignJsonLdOptions extends CreateSignatureOptions {
+  /**
+  * The OpenTelemetry tracer provider for tracing the signing process.
+  * If omitted, the global tracer provider is used.
+  * @since 1.3.0
+  */
+  tracerProvider?: TracerProvider;
+}
+/**
+* Signs the given JSON-LD document with the private key and returns the signed
+* JSON-LD document.
+* @param jsonLd The JSON-LD document to sign.
+* @param privateKey The private key to sign the document.
+* @param keyId The key ID to use in the signature.  It will be used by the
+*              verifier to fetch the corresponding public key.
+* @param options Additional options for signing the document.
+*                See also {@link SignJsonLdOptions}.
+* @returns The signed JSON-LD document.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 1.0.0
+*/
+declare function signJsonLd(jsonLd: unknown, privateKey: CryptoKey, keyId: URL, options: SignJsonLdOptions): Promise<{
+  signature: Signature;
+}>;
+/**
+* Checks if the given JSON-LD document has a Linked Data Signature-like
+* object, without restricting it to a single suite-specific shape.
+* @param jsonLd The JSON-LD document to check.
+* @returns `true` if the document has a signature-like object; `false`
+*          otherwise.
+* @since 2.2.0
+*/
+declare function hasSignatureLike(jsonLd: unknown): boolean;
+/**
+* Detaches Linked Data Signatures from the given JSON-LD document.
+* @param jsonLd The JSON-LD document to modify.
+* @returns The modified JSON-LD document.  If the input document does not
+*          contain a signature, the original document is returned.
+* @since 1.0.0
+*/
+declare function detachSignature(jsonLd: unknown): unknown;
+/**
+* Options for verifying Linked Data Signatures.
+* @since 1.0.0
+*/
+interface VerifySignatureOptions extends VerificationObservationOptions {
+  /**
+  * The document loader to use for fetching the public key.
+  */
+  documentLoader?: DocumentLoader;
+  /**
+  * The context loader to use for JSON-LD context retrieval.
+  */
+  contextLoader?: DocumentLoader;
+  /**
+  * The key cache to use for caching public keys.
+  */
+  keyCache?: KeyCache;
+  /**
+  * The OpenTelemetry tracer provider for tracing the verification process.
+  * If omitted, the global tracer provider is used.
+  * @since 1.3.0
+  */
+  tracerProvider?: TracerProvider;
+  /**
+  * The OpenTelemetry meter provider.  If omitted, the global meter provider
+  * is used.
+  * @since 2.3.0
+  */
+  meterProvider?: MeterProvider;
+}
+/**
+* Verifies Linked Data Signatures of the given JSON-LD document.
+*
+* This is a low-level utility that only checks the cryptographic signature
+* and (optionally) the cached key.  It does not run the JSON-LD parsing,
+* attribution, and owner checks that a complete inbound LD verification
+* needs.  For incoming activities, prefer {@link verifyJsonLd}, which is
+* the public verification entry point and the one that emits the
+* `activitypub.signature.verification.duration` metric for the LD path.
+* `verifySignature` itself only emits
+* `activitypub.signature.key_fetch.duration`, since the rest of the work
+* that the verification-duration metric is meant to cover happens in
+* `verifyJsonLd`.
+* @param jsonLd The JSON-LD document to verify.
+* @param options Options for verifying the signature.
+* @returns The public key that signed the document or `null` if the signature
+*          is invalid or the key is not found.
+* @since 1.0.0
+*/
+declare function verifySignature(jsonLd: unknown, options?: VerifySignatureOptions): Promise<CryptographicKey | null>;
+/**
+* Options for verifying JSON-LD documents.
+*/
+interface VerifyJsonLdOptions extends VerifySignatureOptions {}
+/**
+* Verify the authenticity of the given JSON-LD document using Linked Data
+* Signatures.  If the document is signed, this function verifies the signature
+* and checks if the document is attributed to the owner of the public key.
+* If the document is not signed, this function returns `false`.
+* @param jsonLd The JSON-LD document to verify.
+* @param options Options for verifying the document.
+* @returns `true` if the document is authentic; `false` otherwise.
+*/
+declare function verifyJsonLd(jsonLd: unknown, options?: VerifyJsonLdOptions): Promise<boolean>;
+//#endregion
+//#region src/sig/portable-collection.d.ts
+/**
+* Options for {@link verifyPortableObject}.
+*
+* Besides the options for {@link verifyPortableObjectProof}, it takes where
+* the document came from, which property accessors pass automatically when
+* `verifyPortableObject()` is used as their `verifyPortableObject` option.
+* @since 2.4.0
+*/
+interface VerifyPortableObjectOptions extends VerifyPortableObjectProofOptions, Omit<PortableObjectVerifierOptions, "documentLoader" | "contextLoader" | "tracerProvider"> {}
+/**
+* The reason why {@link verifyPortableObject} did not accept a document.
+*
+* Besides the reasons of {@link verifyPortableObjectProof}, it describes why
+* an unsecured portable collection was not trusted.  The
+* `unsecuredCollection` reason itself never appears, since such collections
+* are judged by the gateway trust policy instead.
+* @since 2.4.0
+*/
+type VerifyPortableObjectFailureReason = Exclude<VerifyPortableObjectProofFailureReason, {
+  readonly type: "unsecuredCollection";
+}> | {
+  /**
+  * The unsecured collection was not retrieved from a gateway, i.e., the
+  * document's final URL is missing or is not a compatible identifier for
+  * the same portable collection.
+  */
+  readonly type: "unknownCollectionSource"; /** The final URL of the document, if known. */
+  readonly documentUrl: URL | null;
+} | {
+  /**
+  * The actor that owns the unsecured collection cannot be determined
+  * unambiguously.
+  */
+  readonly type: "unknownCollectionOwner";
+} | {
+  /** The collection, its pages, or its referrer disagree on its owner. */readonly type: "conflictingCollectionOwners"; /** The owner candidates that disagree. */
+  readonly candidates: readonly URL[];
+} | {
+  /**
+  * A collection page does not belong to the collection it was reached
+  * from: its `partOf` names another collection, or its cryptographic
+  * origin differs.
+  */
+  readonly type: "collectionPageMismatch"; /** The page. */
+  readonly pageId: URL; /** The collection that the page was reached from. */
+  readonly collectionId: URL; /** The mismatching `partOf`, or `null` if the origin differs. */
+  readonly partOf: URL | null;
+} | {
+  /**
+  * The owner's actor document could not be retrieved or verified, or it
+  * lists no gateways.
+  */
+  readonly type: "collectionOwnerUnavailable"; /** The owner candidate. */
+  readonly owner: URL;
+} | {
+  /**
+  * The owner's actor document does not list the collection as its
+  * `inbox`, `outbox`, `followers`, `following`, or `liked`.
+  */
+  readonly type: "collectionNotListedByOwner"; /** The owner. */
+  readonly owner: URL; /** The collection. */
+  readonly collectionId: URL;
+} | {
+  /**
+  * The unsecured collection was retrieved from a gateway that its owner
+  * does not list in its `gateways`.
+  */
+  readonly type: "untrustedGateway"; /** The owner. */
+  readonly owner: URL; /** The gateway that served the collection. */
+  readonly gateway: URL; /** The owner's gateways. */
+  readonly gateways: readonly URL[];
+};
+/**
+* The result of {@link verifyPortableObject}.
+* @since 2.4.0
+*/
+type VerifyPortableObjectResult = {
+  /** Whether the document is accepted. */readonly verified: true; /** The document carries valid Object Integrity Proofs. */
+  readonly method: "proof"; /** The public keys used by the verified proofs, in proof order. */
+  readonly keys: readonly Multikey[];
+  /**
+  * Opaque state for verifying the pages of a portable collection.  Do not
+  * inspect it; property accessors pass it back automatically.
+  */
+  readonly collectionContext?: unknown;
+} | {
+  /** Whether the document is accepted. */readonly verified: true;
+  /**
+  * The document is an unsecured portable collection served by a gateway
+  * that its owner lists.
+  */
+  readonly method: "gateway"; /** The document has no integrity proof. */
+  readonly unsecured: true; /** The actor that owns the collection. */
+  readonly owner: URL; /** The gateway that served the collection. */
+  readonly gateway: URL;
+  /**
+  * Opaque state for verifying the pages of a portable collection.  Do not
+  * inspect it; property accessors pass it back automatically.
+  */
+  readonly collectionContext: unknown;
+} | {
+  /** Whether the document is accepted. */readonly verified: false; /** Why the document was not accepted. */
+  readonly reason: VerifyPortableObjectFailureReason;
+};
+/**
+* Applies the [FEP-ef61] trust policy to a portable object fetched through
+* a gateway.
+*
+* Portable actors, activities, objects, and collections with proofs are
+* verified by {@link verifyPortableObjectProof}.  A portable collection or
+* collection page without a proof is accepted only if all of the following
+* hold:
+*
+*  -  It was retrieved from a gateway: its final URL (`documentUrl`) is
+*     a compatible identifier for the same portable collection.
+*  -  Its owner is determined unambiguously: the actor whose `inbox`,
+*     `outbox`, `followers`, `following`, or `liked` property referred to
+*     the collection, or the single actor in its `attributedTo`.  A page
+*     inherits the owner of the collection it was reached from through
+*     `first`, `last`, `current`, `next`, or `prev`, and must not name
+*     another collection in `partOf`.
+*  -  The owner's actor document is verified by its proof and lists the
+*     collection as its `inbox`, `outbox`, `followers`, `following`, or
+*     `liked`.
+*  -  The gateway that served the collection is in the owner's `gateways`.
+*
+* Where the document came from and which object referred to it are passed
+* by property accessors when this function is used as their
+* `verifyPortableObject` option.  Objects embedded in an unsecured
+* collection accepted this way are not trusted: accessors dereference and
+* verify them one by one.
+*
+* Note that acceptance through the gateway policy does not verify anything
+* cryptographically; it only means that the owner trusts the gateway.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param jsonLd The JSON-LD document to verify.
+* @param options Additional options.  See also
+*                {@link VerifyPortableObjectOptions}.
+* @returns The detailed result.
+* @throws {TypeError} If the input is not a single JSON-LD object or has a
+*                     malformed portable ID.
+* @since 2.4.0
+*/
+declare function verifyPortableObject(jsonLd: unknown, options?: VerifyPortableObjectOptions): Promise<VerifyPortableObjectResult>;
+//#endregion
+export { CreateSignatureOptions as a, VerifySignatureOptions as c, detachSignature as d, hasSignatureLike as f, verifySignature as h, verifyPortableObject as i, attachSignature as l, verifyJsonLd as m, VerifyPortableObjectOptions as n, SignJsonLdOptions as o, signJsonLd as p, VerifyPortableObjectResult as r, VerifyJsonLdOptions as s, VerifyPortableObjectFailureReason as t, createSignature as u };