@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/proof-Dxy6ByqI.mjs

@@ -0,0 +1,1299 @@
+import { Temporal } from "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { i as getPortableDid, l as isPortableId } from "./portable-key-id-Ca30-hOa.mjs";
+import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
+import { n as version, t as name } from "./deno-oR5aJKpU.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CYg9yxBL.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-BspPiXqn.mjs";
+import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
+import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CzaP-hJl.mjs";
+import { getLogger } from "@logtape/logtape";
+import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
+import { SpanStatusCode, trace } from "@opentelemetry/api";
+import { encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseGatewayUrl, parseIri } from "@fedify/vocab-runtime";
+import { encodeHex } from "byte-encodings/hex";
+import { getPortableActorGateways } from "@fedify/vocab-runtime/internal/jsonld-cache";
+import { isPlainJsonTree, retainSignedRepresentation } from "@fedify/vocab-runtime/internal/signed-representation";
+import jsonld from "@fedify/vocab-runtime/jsonld";
+import serialize from "json-canon";
+//#region src/sig/proof.ts
+/**
+* Known Object Integrity Proof `cryptosuite` values, used to keep
+* `object_integrity_proofs.cryptosuite` on a bounded set of spec-defined
+* string values.  Fedify currently signs and verifies only
+* `eddsa-jcs-2022`; other values come in only from external proofs and are
+* dropped from the metric attribute to avoid attacker-controlled
+* cardinality.
+*/
+const OIP_KNOWN_CRYPTOSUITES = /* @__PURE__ */ new Set(["eddsa-jcs-2022"]);
+const logger = getLogger([
+	"fedify",
+	"sig",
+	"proof"
+]);
+const SECURITY_NAMESPACE = "https://w3id.org/security#";
+const SECURITY_PROOF = `${SECURITY_NAMESPACE}proof`;
+const SECURITY_PROOF_VALUE = `${SECURITY_NAMESPACE}proofValue`;
+const DATA_INTEGRITY_PROOF = `${SECURITY_NAMESPACE}DataIntegrityProof`;
+const SECURITY_VERIFICATION_METHOD = `${SECURITY_NAMESPACE}verificationMethod`;
+const SECURITY_EXPIRATION = `${SECURITY_NAMESPACE}expiration`;
+const SECURITY_DOMAIN = `${SECURITY_NAMESPACE}domain`;
+const SECURITY_CHALLENGE = `${SECURITY_NAMESPACE}challenge`;
+const SECURITY_NONCE = `${SECURITY_NAMESPACE}nonce`;
+const SECURITY_PREVIOUS_PROOF = `${SECURITY_NAMESPACE}previousProof`;
+/**
+* Checks if the given JSON-LD document has a DataIntegrityProof-like object,
+* without fully deserializing it into vocabulary classes.
+* @param jsonLd The JSON-LD document to check.
+* @returns `true` if the document has a proof-like object; `false` otherwise.
+* @since 2.2.0
+*/
+function hasProofLike(jsonLd) {
+	if (typeof jsonLd !== "object" || jsonLd == null) return false;
+	const record = jsonLd;
+	const proof = record.proof ?? record["https://w3id.org/security#proof"];
+	const getField = (source, compact, expanded) => source[compact] ?? source[expanded];
+	const isReference = (value) => {
+		if (typeof value === "string") return true;
+		if (Array.isArray(value)) return value.some(isReference);
+		return typeof value === "object" && value != null && ("id" in value && typeof value.id === "string" || "@id" in value && typeof value["@id"] === "string" || "@value" in value && typeof value["@value"] === "string");
+	};
+	const hasType = (value) => {
+		if (typeof value === "string") return value === "DataIntegrityProof" || value === "https://w3id.org/security#DataIntegrityProof";
+		if (Array.isArray(value)) return value.some(hasType);
+		return false;
+	};
+	const isProofLike = (value) => {
+		if (typeof value !== "object" || value == null) return false;
+		const proofRecord = value;
+		return hasType(proofRecord.type ?? proofRecord["@type"]) && isReference(getField(proofRecord, "verificationMethod", "https://w3id.org/security#verificationMethod")) && isReference(getField(proofRecord, "proofPurpose", "https://w3id.org/security#proofPurpose")) && isReference(getField(proofRecord, "proofValue", "https://w3id.org/security#proofValue"));
+	};
+	return Array.isArray(proof) ? proof.some(isProofLike) : isProofLike(proof);
+}
+function isJsonMap(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
+/**
+* Assembles the secured JSON document from the bytes that were just signed.
+*
+* The document is not re-derived from the vocabulary object: it is
+* `compactMsg`, the value whose JCS form was hashed, with the serialized
+* proof added.  Every part of it is then checked against the digests and the
+* signature that {@link createProofInternal} produced, so a document that is
+* returned verifies under the map-local compound-proof profile by
+* construction.  Anything that does not check out yields `null`, and the
+* caller simply does not retain a representation.
+*/
+async function captureSecuredDocument(proof, compactMsg, msgCanon, proofCanon, proofValue, contextLoader) {
+	if (!isJsonMap(compactMsg)) return null;
+	const documentContext = compactMsg["@context"];
+	if (documentContext == null) return null;
+	if (globalThis.Object.hasOwn(compactMsg, "proof")) return null;
+	try {
+		const proofJson = await proof.toJsonLd({
+			format: "compact",
+			contextLoader,
+			context: documentContext
+		});
+		if (!isJsonMap(proofJson)) return null;
+		const { proofValue: serializedProofValue, ...proofConfiguration } = proofJson;
+		if (serializedProofValue !== proofValue) return null;
+		if (serialize(proofConfiguration) !== proofCanon) return null;
+		const securedDocument = {
+			...structuredClone(compactMsg),
+			proof: structuredClone(proofJson)
+		};
+		const { proof: _embeddedProof, ...unsecuredDocument } = securedDocument;
+		if (serialize(unsecuredDocument) !== msgCanon) return null;
+		if (!isPlainJsonTree(securedDocument)) return null;
+		return securedDocument;
+	} catch (error) {
+		logger.debug("Failed to capture the secured JSON document for a created proof; the signed object will not preserve its representation when it is embedded in another object.\n{error}", { error });
+		return null;
+	}
+}
+async function createProofInternal(object, privateKey, keyId, { contextLoader, context, created } = {}, capture = false) {
+	validateCryptoKey(privateKey, "private");
+	if (privateKey.algorithm.name !== "Ed25519") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
+	let compactMsg = await object.clone({ proofs: [] }).toJsonLd({
+		format: "compact",
+		contextLoader,
+		context
+	});
+	compactMsg = await normalizeOutgoingActivityJsonLd(compactMsg, contextLoader, { preserveNestedSecuredDocuments: true });
+	const msgCanon = serialize(compactMsg);
+	const encoder = new TextEncoder();
+	const msgBytes = encoder.encode(msgCanon);
+	const msgDigest = await crypto.subtle.digest("SHA-256", msgBytes);
+	created ??= Temporal.Now.instant();
+	const proofCanon = serialize({
+		"@context": compactMsg["@context"],
+		type: "DataIntegrityProof",
+		cryptosuite: "eddsa-jcs-2022",
+		verificationMethod: keyId.href,
+		proofPurpose: "assertionMethod",
+		created: created.toString()
+	});
+	const proofBytes = encoder.encode(proofCanon);
+	const proofDigest = await crypto.subtle.digest("SHA-256", proofBytes);
+	const digest = new Uint8Array(proofDigest.byteLength + msgDigest.byteLength);
+	digest.set(new Uint8Array(proofDigest), 0);
+	digest.set(new Uint8Array(msgDigest), proofDigest.byteLength);
+	const sig = new Uint8Array(await crypto.subtle.sign("Ed25519", privateKey, digest));
+	const proof = new DataIntegrityProof({
+		cryptosuite: "eddsa-jcs-2022",
+		verificationMethod: keyId,
+		proofPurpose: "assertionMethod",
+		created,
+		proofValue: sig
+	});
+	return {
+		proof,
+		securedDocument: capture ? await captureSecuredDocument(proof, compactMsg, msgCanon, proofCanon, new TextDecoder().decode(encodeMultibase("base58btc", sig)), contextLoader) : null
+	};
+}
+/**
+* Creates a proof for the given object.
+* @param object The object to create a proof for.
+* @param privateKey The private key to sign the proof with.
+* @param keyId The key ID to use in the proof. It will be used by the verifier.
+* @param options Additional options.  See also {@link CreateProofOptions}.
+* @returns The created proof.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 0.10.0
+*/
+async function createProof(object, privateKey, keyId, options = {}) {
+	const { proof } = await createProofInternal(object, privateKey, keyId, options);
+	return proof;
+}
+/**
+* Signs the given object with the private key and returns the signed object.
+* @param object The object to create a proof for.
+* @param privateKey The private key to sign the proof with.
+* @param keyId The key ID to use in the proof. It will be used by the verifier.
+* @param options Additional options.  See also {@link SignObjectOptions}.
+* @returns The signed object.
+* @throws {TypeError} If the private key is invalid or unsupported.
+* @since 0.10.0
+*/
+async function signObject(object, privateKey, keyId, options = {}) {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.sign", { attributes: { "activitypub.object.type": getTypeId(object).href } }, async (span) => {
+		try {
+			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
+			const existingProofs = [];
+			for await (const proof of object.getProofs(options)) existingProofs.push(proof);
+			const { proof, securedDocument } = await createProofInternal(object, privateKey, keyId, options, existingProofs.length < 1);
+			if (span.isRecording()) {
+				if (proof.cryptosuite != null) span.setAttribute("object_integrity_proofs.cryptosuite", proof.cryptosuite);
+				if (proof.verificationMethodId != null) span.setAttribute("object_integrity_proofs.key_id", proof.verificationMethodId.href);
+				if (proof.proofValue != null) span.setAttribute("object_integrity_proofs.signature", encodeHex(proof.proofValue));
+			}
+			const signed = object.clone({ proofs: [...existingProofs, proof] });
+			if (securedDocument != null) retainSignedRepresentation(signed, securedDocument);
+			else if (existingProofs.length > 0) logger.debug("The object {objectId} already had {proofCount} proof(s), so its signed representation is not retained for embedding; the map-local compound-proof profile accepts exactly one direct proof per map.", {
+				objectId: object.id?.href,
+				proofCount: existingProofs.length
+			});
+			return signed;
+		} catch (error) {
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
+/**
+* Verifies the given proof for the object.
+* @param jsonLd The JSON-LD object to verify the proof for.  Its proof
+*               properties are excluded from the message, but matching proof
+*               occurrences are used to authenticate the received proof
+*               configuration.
+* @param proof The proof to verify.
+* @param options Additional options.  See also {@link VerifyProofOptions}.
+* @returns The public key that was used to sign the proof, or `null` if the
+*          proof is invalid.
+* @since 0.10.0
+* @since 2.4.0 Matching proof configurations are authenticated.
+*/
+async function verifyProof(jsonLd, proof, options = {}) {
+	return await verifyProofWithMessageDigestCache(jsonLd, proof, options);
+}
+/**
+* Verifies the one direct literal proof on a map-local secured document.
+*
+* Unlike {@link verifyProof}, this removes only the literal `proof` member
+* from the message digest.  JSON-LD aliases remain part of the signed input,
+* and the document's received `@context` is not replaced by the proof
+* configuration context.
+*
+* @internal
+*/
+async function verifyMapLocalProof(jsonLd, options = {}) {
+	if (!isJsonLdNode(jsonLd) || !globalThis.Object.hasOwn(jsonLd, "proof") || !isJsonLdNode(jsonLd.proof)) return null;
+	const rawProof = jsonLd.proof;
+	const previousChecks = options[verificationObservation]?.attempt?.checks.length;
+	const malformed = () => observeCheck(options, {
+		mechanism: "objectIntegrity",
+		proofId: typeof rawProof.id === "string" ? rawProof.id : typeof rawProof["@id"] === "string" ? rawProof["@id"] : null,
+		proofIndex: previousChecks ?? null
+	}, getDeclaredProofKeyId(rawProof), () => Promise.resolve(null));
+	const proofContextLoader = getNormalizationContextLoader(preloadedOnlyDocumentLoader);
+	try {
+		const [candidate] = await parseRawProofCandidates(jsonLd, [jsonLd.proof], options, proofContextLoader);
+		if (candidate.proof == null) return await malformed();
+		return await verifyProofWithMessageDigestCache(jsonLd, candidate.proof, options, {
+			proofContextLoader,
+			proofPropertyMode: "literal"
+		}, candidate);
+	} catch {
+		if (previousChecks != null && options[verificationObservation]?.attempt?.checks.length === previousChecks) return await malformed();
+		return null;
+	}
+}
+function getDeclaredProofKeyId(value, propertyNames = ["verificationMethod", "https://w3id.org/security#verificationMethod"]) {
+	if (!isJsonLdNode(value)) return null;
+	const method = Array.from(propertyNames, (name) => value[name]).find((v) => v != null);
+	const candidate = Array.isArray(method) ? method[0] : method;
+	if (typeof candidate === "string") return candidate;
+	return isJsonLdNode(candidate) && typeof candidate["@id"] === "string" ? candidate["@id"] : null;
+}
+async function verifyProofWithMessageDigestCache(jsonLd, proof, options, messageDigestCache = {}, rawProofCandidate, keyIdBoundByCaller = false) {
+	if (options[verificationObservation] == null) return await verifyProofWithMessageDigestCache(jsonLd, proof, {
+		...options,
+		[verificationObservation]: {
+			attempts: [],
+			attempt: { checks: [] },
+			captureRawKeyIds: false
+		}
+	}, messageDigestCache, rawProofCandidate, keyIdBoundByCaller);
+	if (options[verificationObservation]?.attempt != null && options[verificationObservation]?.check == null) return await observeCheck(options, {
+		mechanism: "objectIntegrity",
+		proofId: proof.id?.href ?? null,
+		proofIndex: options[verificationObservation].attempt.checks.length
+	}, rawProofCandidate?.declaredKeyId ?? getDeclaredProofKeyId(rawProofCandidate?.value) ?? proof.verificationMethodId?.href ?? null, (observation) => verifyProofWithMessageDigestCache(jsonLd, proof, {
+		...options,
+		[verificationObservation]: observation
+	}, messageDigestCache, rawProofCandidate, keyIdBoundByCaller));
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.verify", async (span) => {
+		const start = performance.now();
+		let verified = false;
+		let threw = false;
+		const cryptosuite = proof.cryptosuite != null && OIP_KNOWN_CRYPTOSUITES.has(proof.cryptosuite) ? proof.cryptosuite : void 0;
+		if (span.isRecording()) {
+			if (proof.cryptosuite != null) span.setAttribute("object_integrity_proofs.cryptosuite", proof.cryptosuite);
+			if (proof.verificationMethodId != null) span.setAttribute("object_integrity_proofs.key_id", proof.verificationMethodId.href);
+			if (proof.proofValue != null) span.setAttribute("object_integrity_proofs.signature", encodeHex(proof.proofValue));
+		}
+		try {
+			const key = await verifyProofInternal(jsonLd, proof, options, messageDigestCache, rawProofCandidate, keyIdBoundByCaller);
+			if (key == null) {
+				span.setStatus({ code: SpanStatusCode.ERROR });
+				span.setAttribute("activitypub.verification.failure_reason", options[verificationObservation]?.check?.reason?.type ?? "invalidSignature");
+			} else verified = true;
+			return key;
+		} catch (error) {
+			threw = true;
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			const classified = threw ? "error" : verified ? "verified" : "rejected";
+			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "object_integrity", classified, {
+				cryptosuite,
+				verificationFailureReason: verified || threw ? void 0 : options[verificationObservation]?.check?.reason?.type ?? "invalidSignature"
+			});
+			span.end();
+		}
+	});
+}
+function expandContextPropertyIri(activeContext, key) {
+	const termId = jsonld.getContextValue(activeContext, key, "@id");
+	if (termId != null) return termId;
+	const colon = key.indexOf(":");
+	if (colon < 1) return key;
+	const prefix = key.substring(0, colon);
+	const suffix = key.substring(colon + 1);
+	if (prefix === "_" || suffix.startsWith("//")) return key;
+	const mapping = jsonld.getContextValue(activeContext, prefix);
+	if (typeof mapping === "object" && mapping != null && mapping._prefix === true && typeof mapping["@id"] === "string") return mapping["@id"] + suffix;
+	return key;
+}
+async function getJsonLdPropertyNames(jsonLd, propertyIri, defaults, documentLoader = preloadedOnlyDocumentLoader, inheritedContext, rejectOnContextError = false, contextState) {
+	const names = new Set(defaults);
+	const context = jsonLd["@context"] ?? inheritedContext;
+	if (context == null && contextState?.initial == null) return names;
+	try {
+		const options = { documentLoader };
+		let activeContext = contextState?.initial ?? await jsonld.processContext(null, null, options);
+		if (contextState?.scoped != null) activeContext = await jsonld.processContext(activeContext, contextState.scoped, options);
+		if (context != null) activeContext = await jsonld.processContext(activeContext, context, options);
+		const typeScopedContext = activeContext;
+		for (const key of globalThis.Object.keys(jsonLd).sort()) {
+			if (key !== "@type" && expandContextPropertyIri(activeContext, key) !== "@type") continue;
+			const value = jsonLd[key];
+			const types = Array.isArray(value) ? value.slice().sort() : [value];
+			for (const type of types) {
+				if (typeof type !== "string") continue;
+				const scopedContext = jsonld.getContextValue(typeScopedContext, type, "@context");
+				if (scopedContext != null) activeContext = await jsonld.processContext(activeContext, scopedContext, options);
+			}
+		}
+		if (contextState != null) contextState.active = activeContext;
+		for (const key of globalThis.Object.keys(jsonLd)) if (expandContextPropertyIri(activeContext, key) === propertyIri) names.add(key);
+	} catch {
+		if (rejectOnContextError) return null;
+	}
+	return names;
+}
+async function getProofPropertyNames(jsonLd, documentLoader = preloadedOnlyDocumentLoader) {
+	return await getJsonLdPropertyNames(jsonLd, SECURITY_PROOF, ["proof", SECURITY_PROOF], documentLoader) ?? /* @__PURE__ */ new Set(["proof", SECURITY_PROOF]);
+}
+async function createProofMessageDigests(jsonLd, proofContextLoader, context, proofPropertyMode = "jsonLd") {
+	const msg = { ...jsonLd };
+	if (proofPropertyMode === "literal") delete msg.proof;
+	else for (const property of await getProofPropertyNames(msg, proofContextLoader)) delete msg[property];
+	if (proofPropertyMode === "jsonLd" && context != null) msg["@context"] = structuredClone(context);
+	const encoder = new TextEncoder();
+	const digest = async (value) => {
+		const bytes = encoder.encode(serialize(value));
+		return await crypto.subtle.digest("SHA-256", bytes);
+	};
+	const onWire = await digest(msg);
+	let normalizedPromise;
+	return {
+		onWire,
+		normalized() {
+			normalizedPromise ??= (async () => {
+				const normalized = await normalizeOutgoingActivityJsonLd(msg, preloadedOnlyDocumentLoader);
+				return normalized === msg ? null : await digest(normalized);
+			})();
+			return normalizedPromise;
+		}
+	};
+}
+function contextValues(context) {
+	return Array.isArray(context) ? context : [context];
+}
+function equalJsonValues(left, right) {
+	try {
+		return serialize(left) === serialize(right);
+	} catch {
+		return false;
+	}
+}
+function contextStartsWith(documentContext, proofContext) {
+	if (documentContext == null) return false;
+	const documentValues = contextValues(documentContext);
+	const proofValues = contextValues(proofContext);
+	return proofValues.length <= documentValues.length && proofValues.every((value, index) => equalJsonValues(value, documentValues[index]));
+}
+function appendProofValues(values, value) {
+	if (Array.isArray(value)) for (const item of value) appendProofValues(values, item);
+	else if (isJsonLdNode(value) && Array.isArray(value["@graph"])) for (const item of value["@graph"]) appendProofValues(values, item);
+	else values.push(value);
+}
+async function getRawProofValues(jsonLd, documentLoader) {
+	const propertyNames = await getProofPropertyNames(jsonLd, documentLoader);
+	const values = [];
+	for (const [property, value] of globalThis.Object.entries(jsonLd)) if (propertyNames.has(property)) appendProofValues(values, value);
+	return values;
+}
+function sameBytes(left, right) {
+	if (left == null || right == null) return left === right;
+	return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function sameProof(left, right) {
+	return left.cryptosuite === right.cryptosuite && left.verificationMethodId?.href === right.verificationMethodId?.href && left.proofPurpose === right.proofPurpose && sameBytes(left.proofValue, right.proofValue) && left.created?.toString() === right.created?.toString();
+}
+function recordProofContexts(documentLoader) {
+	const documents = /* @__PURE__ */ new Map();
+	return {
+		loader: async (url, options) => {
+			const document = await documentLoader(url, options);
+			documents.set(url, document);
+			return document;
+		},
+		replay: (url, options) => {
+			const document = documents.get(url);
+			return document == null ? preloadedOnlyDocumentLoader(url, options) : Promise.resolve(document);
+		}
+	};
+}
+async function getAliasedDeclaredProofKeyId(value, inheritedContext, contextLoader) {
+	if (!isJsonLdNode(value)) return null;
+	const contextState = {};
+	const names = await getJsonLdPropertyNames(value, "https://w3id.org/security#verificationMethod", ["verificationMethod", "https://w3id.org/security#verificationMethod"], contextLoader, inheritedContext, false, contextState);
+	const methodName = Array.from(names ?? []).find((name) => value[name] != null);
+	const method = methodName == null ? void 0 : value[methodName];
+	const candidate = Array.isArray(method) ? method[0] : method;
+	if (typeof candidate === "string") return candidate;
+	if (!isJsonLdNode(candidate)) return null;
+	const idNames = await getJsonLdPropertyNames(candidate, "@id", ["@id"], contextLoader, void 0, false, {
+		initial: contextState.active,
+		scoped: contextState.active == null || methodName == null ? void 0 : jsonld.getContextValue(contextState.active, methodName, "@context")
+	});
+	for (const name of idNames ?? []) if (typeof candidate[name] === "string") return candidate[name];
+	return null;
+}
+function normalizeDocumentUrl(url) {
+	try {
+		return formatIri(parseIri(url));
+	} catch {
+		return URL.canParse(url) ? new URL(url).href : url;
+	}
+}
+function getRawProofReference(value) {
+	const node = Array.isArray(value) && value.length === 1 ? value[0] : value;
+	if (typeof node === "string") return normalizeDocumentUrl(node);
+	if (!isJsonLdNode(node)) return void 0;
+	const id = node["@id"] ?? node.id;
+	return typeof id === "string" ? normalizeDocumentUrl(id) : void 0;
+}
+async function parseRawProofCandidates(jsonLd, values, options, documentLoader) {
+	const candidates = [];
+	for (const value of values) {
+		let parsed = null;
+		const contexts = options[verificationObservation] != null && options[verificationObservation]?.captureRawKeyIds !== false ? recordProofContexts(documentLoader) : void 0;
+		if (isJsonLdNode(value)) {
+			const proofJsonLd = value["@context"] == null && jsonLd["@context"] != null ? {
+				"@context": jsonLd["@context"],
+				...value
+			} : value;
+			try {
+				parsed = await DataIntegrityProof.fromJsonLd(proofJsonLd, {
+					...options,
+					contextLoader: contexts?.loader ?? documentLoader
+				});
+			} catch {}
+		}
+		candidates.push({
+			value,
+			proof: parsed,
+			reference: getRawProofReference(value) ?? parsed?.id?.href,
+			declaredKeyId: contexts == null ? void 0 : await getAliasedDeclaredProofKeyId(value, jsonLd["@context"], contexts.replay)
+		});
+	}
+	return candidates;
+}
+async function findRawProofCandidate(jsonLd, proof, options, documentLoader) {
+	const candidates = await parseRawProofCandidates(jsonLd, await getRawProofValues(jsonLd, documentLoader), options, documentLoader);
+	const matches = [];
+	for (const candidate of candidates) if (candidate.proof != null && sameProof(candidate.proof, proof)) matches.push(candidate);
+	if (matches.length < 1) return void 0;
+	const first = matches[0];
+	const configurations = await Promise.all(matches.map((candidate) => normalizeProofConfiguration(candidate.value, jsonLd["@context"], documentLoader)));
+	const firstConfiguration = configurations[0];
+	return firstConfiguration != null && configurations.every((configuration) => configuration != null && equalJsonValues(configuration.value, firstConfiguration.value)) ? first : null;
+}
+function takeRawProofCandidate(pool, proof) {
+	for (let index = 0; index < pool.candidates.length; index++) {
+		if (pool.used.has(index)) continue;
+		const candidate = pool.candidates[index];
+		if (candidate.proof != null && sameProof(candidate.proof, proof)) {
+			pool.used.add(index);
+			return candidate;
+		}
+	}
+}
+const STANDARD_COMPACT_PROOF_PROPERTIES = /* @__PURE__ */ new Set([
+	"@context",
+	"type",
+	"cryptosuite",
+	"verificationMethod",
+	"proofPurpose",
+	"proofValue",
+	"created"
+]);
+const STANDARD_EXPANDED_PROOF_PROPERTIES = /* @__PURE__ */ new Set([
+	"@context",
+	"@type",
+	`${SECURITY_NAMESPACE}cryptosuite`,
+	SECURITY_VERIFICATION_METHOD,
+	`${SECURITY_NAMESPACE}proofPurpose`,
+	`${SECURITY_NAMESPACE}proofValue`,
+	"http://purl.org/dc/terms/created"
+]);
+function hasAdditionalProofOptions(value) {
+	const node = Array.isArray(value) && value.length === 1 ? value[0] : value;
+	return isJsonLdNode(node) && globalThis.Object.keys(node).some((property) => !STANDARD_COMPACT_PROOF_PROPERTIES.has(property) && !STANDARD_EXPANDED_PROOF_PROPERTIES.has(property));
+}
+function isExpandedJsonLdNode(value) {
+	const properties = globalThis.Object.keys(value).filter((key) => !key.startsWith("@"));
+	return properties.length > 0 && properties.every((property) => URL.canParse(property));
+}
+async function normalizeProofConfiguration(rawProof, documentContext, documentLoader) {
+	let node = Array.isArray(rawProof) && rawProof.length === 1 ? rawProof[0] : rawProof;
+	if (!isJsonLdNode(node)) return null;
+	if (isExpandedJsonLdNode(node)) {
+		if (documentContext == null) return null;
+		node = await jsonld.compact(node, documentContext, { documentLoader });
+		if (!isJsonLdNode(node)) return null;
+	} else node = structuredClone(node);
+	const receivedContext = node["@context"];
+	if (receivedContext != null && !contextStartsWith(documentContext, receivedContext)) return null;
+	const context = receivedContext ?? documentContext;
+	if (context != null) node["@context"] = structuredClone(context);
+	const proofValueProperties = await getJsonLdPropertyNames(node, SECURITY_PROOF_VALUE, ["proofValue", SECURITY_PROOF_VALUE], documentLoader, context) ?? /* @__PURE__ */ new Set(["proofValue", SECURITY_PROOF_VALUE]);
+	for (const property of proofValueProperties) delete node[property];
+	return {
+		value: node,
+		context
+	};
+}
+async function createProofConfiguration(jsonLd, proof, options, documentLoader, rawProofCandidate) {
+	let rawProof;
+	if (rawProofCandidate == null) {
+		const match = await findRawProofCandidate(jsonLd, proof, options, documentLoader);
+		if (match === null) return null;
+		rawProof = match?.value;
+	} else rawProof = rawProofCandidate.value;
+	if (rawProof == null) {
+		const serializedProof = await proof.toJsonLd();
+		if (hasAdditionalProofOptions(serializedProof)) rawProof = serializedProof;
+	}
+	if (rawProof != null) return await normalizeProofConfiguration(rawProof, jsonLd["@context"], documentLoader);
+	const context = jsonLd["@context"];
+	return {
+		value: {
+			...context == null ? {} : { "@context": context },
+			type: "DataIntegrityProof",
+			cryptosuite: proof.cryptosuite,
+			verificationMethod: proof.verificationMethodId.href,
+			proofPurpose: proof.proofPurpose,
+			created: proof.created.toString()
+		},
+		context
+	};
+}
+const KNOWN_PROOF_CONFIGURATION_PROPERTIES = /* @__PURE__ */ new Set([
+	"@context",
+	"@id",
+	"@type",
+	"id",
+	"type",
+	"cryptosuite",
+	`${SECURITY_NAMESPACE}cryptosuite`,
+	"verificationMethod",
+	SECURITY_VERIFICATION_METHOD,
+	"proofPurpose",
+	`${SECURITY_NAMESPACE}proofPurpose`,
+	"created",
+	"http://purl.org/dc/terms/created",
+	"expires",
+	SECURITY_EXPIRATION,
+	"domain",
+	SECURITY_DOMAIN,
+	"challenge",
+	SECURITY_CHALLENGE,
+	"nonce",
+	SECURITY_NONCE,
+	"previousProof",
+	SECURITY_PREVIOUS_PROOF
+]);
+async function getProofOption(proofConfig, propertyIri, defaults, documentLoader) {
+	let names = await getJsonLdPropertyNames(proofConfig, propertyIri, defaults, documentLoader, proofConfig["@context"], true);
+	if (names == null) {
+		if (globalThis.Object.keys(proofConfig).some((property) => !KNOWN_PROOF_CONFIGURATION_PROPERTIES.has(property))) return null;
+		names = new Set(defaults);
+	}
+	const present = globalThis.Object.keys(proofConfig).filter((property) => names.has(property));
+	if (present.length > 1) return null;
+	return present.length < 1 ? { present: false } : {
+		present: true,
+		value: proofConfig[present[0]]
+	};
+}
+function parseStringSet(value) {
+	if (typeof value === "string") return /* @__PURE__ */ new Set([value]);
+	if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) return null;
+	return new Set(value);
+}
+function equalStringSets(left, right) {
+	return left.size === right.size && [...left].every((value) => right.has(value));
+}
+async function hasValidProofOptions(proofConfig, options, documentLoader) {
+	const expires = await getProofOption(proofConfig, SECURITY_EXPIRATION, ["expires", SECURITY_EXPIRATION], documentLoader);
+	if (expires == null) return null;
+	let expiration;
+	if (expires.present) {
+		if (typeof expires.value !== "string") return null;
+		try {
+			expiration = Temporal.Instant.from(expires.value);
+		} catch {
+			return null;
+		}
+		if (Temporal.Instant.compare(Temporal.Now.instant(), expiration) >= 0) return null;
+	}
+	const domain = await getProofOption(proofConfig, SECURITY_DOMAIN, ["domain", SECURITY_DOMAIN], documentLoader);
+	if (domain == null) return null;
+	const proofDomains = domain.present ? parseStringSet(domain.value) : null;
+	if (domain.present && proofDomains == null) return null;
+	if (options.domain != null) {
+		const expectedDomains = parseStringSet(options.domain);
+		if (expectedDomains == null || proofDomains == null || !equalStringSets(proofDomains, expectedDomains)) return null;
+	}
+	const challenge = await getProofOption(proofConfig, SECURITY_CHALLENGE, ["challenge", SECURITY_CHALLENGE], documentLoader);
+	if (challenge == null || challenge.present && typeof challenge.value !== "string" || options.challenge != null && (!challenge.present || challenge.value !== options.challenge)) return null;
+	const nonce = await getProofOption(proofConfig, SECURITY_NONCE, ["nonce", SECURITY_NONCE], documentLoader);
+	if (nonce == null || nonce.present && typeof nonce.value !== "string") return null;
+	const previousProof = await getProofOption(proofConfig, SECURITY_PREVIOUS_PROOF, ["previousProof", SECURITY_PREVIOUS_PROOF], documentLoader);
+	if (previousProof == null || previousProof.present && typeof previousProof.value !== "string" && (!Array.isArray(previousProof.value) || previousProof.value.some((item) => typeof item !== "string"))) return null;
+	return { expires: expiration };
+}
+async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, rawProofCandidate, keyIdBoundByCaller = false) {
+	if (!isJsonLdNode(jsonLd) || proof.cryptosuite !== "eddsa-jcs-2022" || proof.verificationMethodId == null || proof.proofPurpose !== "assertionMethod" || proof.proofValue == null || proof.created == null) return null;
+	const proofContextLoader = messageDigestCache.proofContextLoader ?? preloadedOnlyDocumentLoader;
+	const proofConfiguration = await createProofConfiguration(jsonLd, proof, options, proofContextLoader, rawProofCandidate);
+	if (proofConfiguration == null) return null;
+	const validProofOptions = await hasValidProofOptions(proofConfiguration.value, options, proofContextLoader);
+	if (validProofOptions == null) return null;
+	const { expires } = validProofOptions;
+	if (expires != null && (messageDigestCache.expires == null || Temporal.Instant.compare(expires, messageDigestCache.expires) < 0)) messageDigestCache.expires = expires;
+	const publicKeyPromise = measureSignatureKeyFetch(options.meterProvider, "object_integrity", () => fetchKey(proof.verificationMethodId, Multikey, {
+		...options,
+		keyIdBoundByCaller
+	}));
+	const proofBytes = new TextEncoder().encode(serialize(proofConfiguration.value));
+	const proofDigest = await crypto.subtle.digest("SHA-256", proofBytes);
+	let fetchedKey;
+	try {
+		fetchedKey = await publicKeyPromise;
+	} catch (error) {
+		logger.debug("Failed to get the key (verificationMethod) for the proof:\n{proof}", {
+			proof,
+			keyId: proof.verificationMethodId.href,
+			error
+		});
+		return null;
+	}
+	const publicKey = fetchedKey.key;
+	if (publicKey == null) {
+		logger.debug("Failed to get the key (verificationMethod) for the proof:\n{proof}", {
+			proof,
+			keyId: proof.verificationMethodId.href
+		});
+		return null;
+	}
+	if (publicKey.publicKey.algorithm.name !== "Ed25519") {
+		if (fetchedKey.cached) {
+			logger.debug("The cached key (verificationMethod) for the proof is not a valid Ed25519 key:\n{keyId}; retrying with the freshly fetched key...", {
+				proof,
+				keyId: proof.verificationMethodId.href
+			});
+			return await verifyProofInternal(jsonLd, proof, {
+				...options,
+				keyCache: bypassKeyCacheReads(options.keyCache)
+			}, messageDigestCache, rawProofCandidate, keyIdBoundByCaller);
+		}
+		logger.debug("The fetched key (verificationMethod) for the proof is not a valid Ed25519 key:\n{keyId}", {
+			proof,
+			keyId: proof.verificationMethodId.href
+		});
+		return null;
+	}
+	const digest = new Uint8Array(proofDigest.byteLength + 32);
+	digest.set(new Uint8Array(proofDigest), 0);
+	const proofValue = proof.proofValue;
+	let keyTried = false;
+	const verifyCandidate = async (msgDigest) => {
+		digest.set(new Uint8Array(msgDigest), proofDigest.byteLength);
+		if (!keyTried) {
+			triedKey(options, publicKey);
+			keyTried = true;
+		}
+		return await crypto.subtle.verify("Ed25519", publicKey.publicKey, proofValue.slice(), digest);
+	};
+	const messageDigestKey = serialize(proofConfiguration.context ?? null);
+	const messageDigestValues = messageDigestCache.values ??= /* @__PURE__ */ new Map();
+	let messageDigestsPromise = messageDigestValues.get(messageDigestKey);
+	if (messageDigestsPromise == null) {
+		messageDigestsPromise = createProofMessageDigests(jsonLd, messageDigestCache.proofContextLoader, proofConfiguration.context, messageDigestCache.proofPropertyMode);
+		messageDigestValues.set(messageDigestKey, messageDigestsPromise);
+	}
+	const messageDigests = await messageDigestsPromise;
+	if (await verifyCandidate(messageDigests.onWire)) return publicKey;
+	if (messageDigestCache.proofPropertyMode !== "literal") {
+		const normalizedDigest = await messageDigests.normalized();
+		if (normalizedDigest != null && await verifyCandidate(normalizedDigest)) return publicKey;
+	}
+	if (fetchedKey.cached) {
+		logger.debug("Failed to verify the proof with the cached key {keyId}; retrying with the freshly fetched key...", {
+			keyId: proof.verificationMethodId.href,
+			proof
+		});
+		return await verifyProofInternal(jsonLd, proof, {
+			...options,
+			keyCache: bypassKeyCacheReads(options.keyCache)
+		}, messageDigestCache, rawProofCandidate, keyIdBoundByCaller);
+	}
+	logger.debug("Failed to verify the proof with the fetched key {keyId}:\n{proof}", {
+		keyId: proof.verificationMethodId.href,
+		proof
+	});
+	return null;
+}
+const AS_NAMESPACE = "https://www.w3.org/ns/activitystreams#";
+const FEP_2277_ACTOR_PROPERTIES = ["http://www.w3.org/ns/ldp#inbox", `${AS_NAMESPACE}outbox`];
+const FEP_2277_COLLECTION_PROPERTIES = [
+	"items",
+	"orderedItems",
+	"totalItems",
+	"partOf",
+	"first",
+	"last",
+	"next",
+	"prev",
+	"current"
+].map((property) => AS_NAMESPACE + property);
+const PORTABLE_OBJECT_ID_PATTERN = /^ap(?:\+ef61)?:\/\//i;
+const FUNCTIONAL_PROOF_PROPERTIES = [
+	`${SECURITY_NAMESPACE}cryptosuite`,
+	SECURITY_VERIFICATION_METHOD,
+	`${SECURITY_NAMESPACE}proofPurpose`,
+	`${SECURITY_NAMESPACE}proofValue`,
+	"http://purl.org/dc/terms/created"
+];
+function isJsonLdNode(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
+function hasValidPortableProofShape(proofValue) {
+	if (!isJsonLdNode(proofValue)) return false;
+	let proofNode = proofValue;
+	if ("@graph" in proofNode) {
+		const graph = proofNode["@graph"];
+		if (!Array.isArray(graph) || graph.length !== 1 || !isJsonLdNode(graph[0])) return false;
+		proofNode = graph[0];
+	}
+	const types = proofNode["@type"];
+	return Array.isArray(types) && types.length === 1 && types[0] === DATA_INTEGRITY_PROOF && FUNCTIONAL_PROOF_PROPERTIES.every((property) => {
+		const values = proofNode[property];
+		return Array.isArray(values) && values.length === 1 && !(isJsonLdNode(values[0]) && "@list" in values[0]);
+	});
+}
+/**
+* Checks whether an expanded portable actor node has the `gateways` that
+* FEP-ef61 requires: a non-empty list whose items are all HTTP(S) URIs with
+* an empty path, query, and fragment.  Like the generated vocabulary decoder,
+* this also tolerates a plain set of values instead of a `@list`, and gateway
+* strings given as `@value`s instead of `@id`s.  JCS-authenticated actors may
+* also supply an unmapped literal `gateways` list.
+*/
+function hasValidPortableActorGateways(node, allowUnmapped) {
+	const values = getPortableActorGateways(node, allowUnmapped);
+	if (!Array.isArray(values)) return false;
+	let items = values;
+	if (values.some((value) => isJsonLdNode(value) && "@list" in value)) {
+		if (values.length !== 1 || !isJsonLdNode(values[0])) return false;
+		items = values[0]["@list"];
+	}
+	if (!Array.isArray(items) || items.length < 1) return false;
+	return items.every((item) => {
+		if (!isJsonLdNode(item)) return false;
+		const gateway = typeof item["@id"] === "string" ? item["@id"] : item["@value"];
+		if (typeof gateway !== "string") return false;
+		try {
+			parseGatewayUrl(gateway);
+		} catch (error) {
+			if (error instanceof TypeError) return false;
+			throw error;
+		}
+		return true;
+	});
+}
+/**
+* Classifies an expanded JSON-LD node into an FEP-2277 core type by the
+* properties it has.
+* @internal
+*/
+function classifyFep2277CoreType(node) {
+	if (FEP_2277_ACTOR_PROPERTIES.every((property) => property in node)) return "actor";
+	if (`${SECURITY_NAMESPACE}publicKeyMultibase` in node) return "verificationMethod";
+	if (`${SECURITY_NAMESPACE}publicKeyPem` in node) return "publicKey";
+	if (`${AS_NAMESPACE}href` in node) return "link";
+	if (`${AS_NAMESPACE}actor` in node) return "activity";
+	if (FEP_2277_COLLECTION_PROPERTIES.some((property) => property in node)) return "collection";
+	return "object";
+}
+async function expandPortableObjectRoot(jsonLd, contextLoader) {
+	if (!isJsonLdNode(jsonLd)) throw new TypeError("Expected a single JSON-LD object.");
+	const loadedContexts = /* @__PURE__ */ new Map();
+	const loader = getNormalizationContextLoader(contextLoader);
+	const recordingLoader = async (url, options) => {
+		const remoteDocument = await loader(url, options);
+		const key = URL.canParse(url) ? new URL(url).href : url;
+		loadedContexts.set(key, structuredClone(remoteDocument));
+		return remoteDocument;
+	};
+	const expanded = await jsonld.expand(jsonLd, {
+		documentLoader: recordingLoader,
+		keepFreeFloatingNodes: true
+	});
+	if (expanded.length !== 1 || !isJsonLdNode(expanded[0])) throw new TypeError("Expected a single JSON-LD object.");
+	return {
+		root: expanded[0],
+		proofContextLoader: async (url, options) => {
+			const key = URL.canParse(url) ? new URL(url).href : url;
+			const remoteDocument = loadedContexts.get(key);
+			if (remoteDocument != null) return structuredClone(remoteDocument);
+			return await preloadedOnlyDocumentLoader(url, options);
+		}
+	};
+}
+/**
+* Gets the DID of a portable object ID, which is either an `ap:` or
+* `ap+ef61:` URI or an FEP-ef61 compatible identifier.
+* @throws {TypeError} If the ID is malformed.
+*/
+function getObjectDid(id) {
+	try {
+		parseIri(id);
+		if (PORTABLE_OBJECT_ID_PATTERN.test(id)) return getFe34Origin(id);
+		const portableId = fromCompatibleEf61Id(id);
+		if (portableId != null) return getFe34Origin(portableId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		throw new InvalidPortableObjectIdError(id, { cause: error });
+	}
+	throw new InvalidPortableObjectIdError(id);
+}
+/**
+* The error thrown when a document's ID looks portable, i.e., it is an `ap:`
+* or `ap+ef61:` URI or looks like an FEP-ef61 compatible identifier, but is
+* malformed.
+* @internal
+*/
+var InvalidPortableObjectIdError = class extends TypeError {
+	constructor(id, options) {
+		super(`Invalid portable object ID: ${id}`, options);
+		this.name = "InvalidPortableObjectIdError";
+	}
+};
+async function preparePortableObjectProof(jsonLd, options) {
+	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !isPortableId(jsonLd["@id"])) return {
+		prepared: false,
+		result: {
+			verified: false,
+			reason: { type: "notPortableObject" }
+		}
+	};
+	const { root, proofContextLoader } = await expandPortableObjectRoot(jsonLd, options.contextLoader);
+	const id = root["@id"];
+	if (typeof id !== "string" || !isPortableId(id)) return {
+		prepared: false,
+		result: {
+			verified: false,
+			reason: { type: "notPortableObject" }
+		}
+	};
+	const objectDid = getObjectDid(id);
+	const objectId = parseIri(id);
+	const objectType = classifyFep2277CoreType(root);
+	if (objectType === "verificationMethod" || objectType === "publicKey" || objectType === "link") return {
+		prepared: false,
+		result: {
+			verified: false,
+			reason: {
+				type: "unsupportedObjectType",
+				objectType
+			}
+		}
+	};
+	const proofValues = root[SECURITY_PROOF];
+	if (proofValues == null || Array.isArray(proofValues) && proofValues.length < 1) return {
+		prepared: false,
+		root,
+		objectType,
+		result: objectType === "collection" ? {
+			verified: false,
+			reason: { type: "unsecuredCollection" }
+		} : {
+			verified: false,
+			reason: { type: "missingProof" }
+		}
+	};
+	if (!Array.isArray(proofValues)) return {
+		prepared: false,
+		result: {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex: 0
+			}
+		}
+	};
+	const rawProofValues = isJsonLdNode(jsonLd) ? await getRawProofValues(jsonLd, proofContextLoader) : [];
+	const proofs = [];
+	for (let proofIndex = 0; proofIndex < proofValues.length; proofIndex++) {
+		const proofValue = proofValues[proofIndex];
+		if (!hasValidPortableProofShape(proofValue)) return {
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "invalidProof",
+					proofIndex
+				}
+			}
+		};
+		let proof;
+		try {
+			proof = await DataIntegrityProof.fromJsonLd(proofValue, options);
+		} catch {
+			return {
+				prepared: false,
+				result: {
+					verified: false,
+					reason: {
+						type: "invalidProof",
+						proofIndex
+					}
+				}
+			};
+		}
+		proofs.push(proof);
+	}
+	for (let proofIndex = 0; proofIndex < proofs.length; proofIndex++) {
+		const verificationMethod = proofs[proofIndex].verificationMethodId;
+		if (verificationMethod == null) return {
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "invalidProof",
+					proofIndex
+				}
+			}
+		};
+		if (verificationMethod.protocol !== "did:") return {
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "unsupportedVerificationMethod",
+					proofIndex,
+					verificationMethod
+				}
+			}
+		};
+		try {
+			getFe34Origin(verificationMethod);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			return {
+				prepared: false,
+				result: {
+					verified: false,
+					reason: {
+						type: "unsupportedVerificationMethod",
+						proofIndex,
+						verificationMethod
+					}
+				}
+			};
+		}
+		if (getFe34Origin(verificationMethod) !== objectDid) return {
+			prepared: false,
+			result: {
+				verified: false,
+				reason: {
+					type: "verificationMethodMismatch",
+					proofIndex,
+					objectId,
+					verificationMethod
+				}
+			}
+		};
+	}
+	if (objectType === "actor" && !hasValidPortableActorGateways(root, proofs.every((proof) => proof.cryptosuite === "eddsa-jcs-2022"))) return {
+		prepared: false,
+		root,
+		objectType,
+		result: {
+			verified: false,
+			reason: { type: "invalidGateways" }
+		}
+	};
+	return {
+		prepared: true,
+		root,
+		objectType,
+		objectId,
+		proofs,
+		rawProofValues,
+		proofContextLoader
+	};
+}
+/**
+* Applies portable-object proof policy to one map-local cryptographic result.
+*
+* @internal
+*/
+async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
+	const policyOptions = {
+		...options,
+		contextLoader: preloadedOnlyDocumentLoader
+	};
+	const prepared = await preparePortableObjectProof(jsonLd, policyOptions);
+	if (!prepared.prepared) return prepared.result;
+	const policyProof = prepared.proofs[0];
+	const literalProof = isJsonLdNode(jsonLd) && isJsonLdNode(jsonLd.proof) ? (await parseRawProofCandidates(jsonLd, [jsonLd.proof], policyOptions, prepared.proofContextLoader))[0]?.proof : null;
+	const verificationMethod = policyProof?.verificationMethodId;
+	if (prepared.proofs.length !== 1 || key == null || policyProof == null || literalProof == null || !sameProof(policyProof, literalProof) || verificationMethod == null || key.id?.href !== verificationMethod.href) return {
+		verified: false,
+		reason: {
+			type: "invalidProof",
+			proofIndex: prepared.proofs.length > 1 ? 1 : 0
+		}
+	};
+	return {
+		verified: true,
+		keys: [key],
+		objectId: formatIri(prepared.objectId)
+	};
+}
+/**
+* Verifies the FEP-ef61 Object Integrity Proof policy for a portable object.
+*
+* This applies the FEP-2277 core-type classification to the top-level JSON-LD
+* node.  Portable actors, activities, and objects require proofs.  A portable
+* collection without a proof is reported separately so a caller can apply a
+* gateway trust policy.  Embedded portable objects are not traversed.
+*
+* A portable object is a document whose ID is an `ap:` or `ap+ef61:` URI, or
+* an [FEP-ef61] compatible identifier such as
+* `https://gw.example/.well-known/apgateway/did:key:z6Mk…/actor`, which
+* stands for the portable ID `ap+ef61://did:key:z6Mk…/actor`.
+*
+* Every proof must use a DID URL whose DID matches the portable object's
+* authority, i.e., the DID of its canonical portable ID, and every proof must
+* pass {@link verifyProof}.  A portable actor must also have a non-empty
+* `gateways` list whose items are all HTTP(S) URIs with an empty path, query,
+* and fragment; otherwise, it is rejected with the `invalidGateways` reason
+* before its proofs are verified.  The proofs are verified over the document as
+* given; a compatible identifier is never rewritten into a portable ID.
+* An unmapped literal `gateways` property is also accepted when every proof
+* uses `eddsa-jcs-2022`, which authenticates the original JSON properties.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param jsonLd The JSON-LD document to verify.
+* @param options Additional options.  See also
+*                {@link VerifyPortableObjectProofOptions}.
+* @returns The detailed portable proof-policy result.
+* @throws {TypeError} If the input is not a single JSON-LD object or has a
+*                     malformed portable ID or compatible identifier.
+* @since 2.4.0
+*/
+async function verifyPortableObjectProof(jsonLd, options = {}) {
+	return (await verifyPortableObjectProofWithRoot(jsonLd, options)).result;
+}
+/**
+* Same as {@link verifyPortableObjectProof}, but also returns the expanded
+* root node and its FEP-2277 core type, so that a caller can apply further
+* policy, such as the gateway trust policy for unsecured collections, to the
+* same interpretation of the document.
+* @internal
+*/
+async function verifyPortableObjectProofWithRoot(jsonLd, options = {}) {
+	const prepared = await preparePortableObjectProof(jsonLd, options);
+	if (!prepared.prepared) return {
+		result: prepared.result,
+		...prepared.root == null ? {} : { root: prepared.root },
+		...prepared.objectType == null ? {} : { objectType: prepared.objectType }
+	};
+	const { root, objectType, proofContextLoader } = prepared;
+	const messageDigestCache = { proofContextLoader };
+	const result = await verifyPreparedPortableObjectProof(jsonLd, prepared, options, messageDigestCache);
+	const { expires } = messageDigestCache;
+	return {
+		result,
+		root,
+		objectType,
+		...result.verified && expires != null ? { expires } : {}
+	};
+}
+async function verifyPreparedPortableObjectProof(jsonLd, prepared, options, messageDigestCache) {
+	const { proofs, rawProofValues, proofContextLoader } = prepared;
+	const keys = [];
+	const rawProofCandidatePool = {
+		candidates: await parseRawProofCandidates(jsonLd, rawProofValues, options, proofContextLoader),
+		used: /* @__PURE__ */ new Set()
+	};
+	for (let proofIndex = 0; proofIndex < proofs.length; proofIndex++) {
+		const rawProofCandidate = takeRawProofCandidate(rawProofCandidatePool, proofs[proofIndex]);
+		if (rawProofCandidate == null) return {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex
+			}
+		};
+		const key = await verifyProofWithMessageDigestCache(jsonLd, proofs[proofIndex], options, messageDigestCache, rawProofCandidate, true);
+		if (key == null) return {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex
+			}
+		};
+		keys.push(key);
+	}
+	return {
+		verified: true,
+		keys
+	};
+}
+/**
+* Verifies the given object.  It will verify all the proofs in the object,
+* and succeed only if all the proofs are valid and all attributions and
+* actors are authenticated by the proofs.
+* @template T The type of the object to verify.
+* @param cls The class of the object to verify.  It must be a subclass of
+*            the {@link Object}.
+* @param jsonLd The JSON-LD object to verify.  It's assumed that the object
+*               is a compacted JSON-LD representation of a `T` with `@context`.
+* @param options Additional options.  See also {@link VerifyObjectOptions}.
+* @returns The object if it's verified, or `null` if it's not.
+* @throws {TypeError} If the object is invalid or unsupported.
+* @since 0.10.0
+*/
+async function verifyObject(cls, jsonLd, options = {}) {
+	if (options[verificationObservation]?.attempt == null) {
+		const observedOptions = {
+			...options,
+			[verificationObservation]: options[verificationObservation] ?? {
+				attempts: [],
+				captureRawKeyIds: false
+			}
+		};
+		return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.verify_object", async (span) => {
+			try {
+				return await observeAttempt(observedOptions, "objectIntegrity", async (observation) => {
+					const object = await verifyObject(cls, jsonLd, {
+						...options,
+						[verificationObservation]: observation
+					});
+					if (object == null) {
+						span.setStatus({ code: SpanStatusCode.ERROR });
+						span.setAttribute("activitypub.verification.failure_reason", observation.attempt?.reason?.type ?? "signatureVerificationFailed");
+					}
+					return object;
+				}, (value) => value != null);
+			} catch (error) {
+				span.setStatus({
+					code: SpanStatusCode.ERROR,
+					message: String(error)
+				});
+				throw error;
+			} finally {
+				span.end();
+			}
+		});
+	}
+	const observation = options[verificationObservation];
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"proof"
+	]);
+	const object = await cls.fromJsonLd(jsonLd, options);
+	observation?.parsedObject?.(object);
+	if (observation?.subject != null) observation.subject.id = object.id == null ? null : new URL(object.id.href);
+	const defaultDocumentLoader = getDocumentLoader();
+	const proofContextLoader = options.contextLoader ?? defaultDocumentLoader;
+	const attributions = new Set(object.attributionIds.map((uri) => uri.href));
+	if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
+	const rawProofValues = isJsonLdNode(jsonLd) ? await getRawProofValues(jsonLd, proofContextLoader) : [];
+	const rawProofCandidates = isJsonLdNode(jsonLd) ? await parseRawProofCandidates(jsonLd, rawProofValues, options, proofContextLoader) : [];
+	const rawProofCandidatePool = {
+		candidates: rawProofCandidates,
+		used: /* @__PURE__ */ new Set()
+	};
+	const baseDocumentLoader = options.documentLoader ?? defaultDocumentLoader;
+	const hydratedCandidates = /* @__PURE__ */ new Set();
+	let loadedPortableProofs = 0;
+	let acceptedPortableProofs = 0;
+	const acceptPortableProofDocument = async () => {
+		acceptedPortableProofs++;
+		return { verified: true };
+	};
+	const proofDocumentLoader = async (url, loaderOptions) => {
+		const remoteDocument = await baseDocumentLoader(url, loaderOptions);
+		if (isPortableId(url)) loadedPortableProofs++;
+		const reference = normalizeDocumentUrl(url);
+		const candidateIndex = rawProofCandidates.findIndex((candidate, index) => !hydratedCandidates.has(index) && !rawProofCandidatePool.used.has(index) && candidate.reference === reference);
+		if (candidateIndex >= 0) {
+			hydratedCandidates.add(candidateIndex);
+			let parsed = null;
+			const contexts = options[verificationObservation] != null && options[verificationObservation]?.captureRawKeyIds !== false ? recordProofContexts(proofContextLoader) : void 0;
+			try {
+				parsed = await DataIntegrityProof.fromJsonLd(remoteDocument.document, {
+					documentLoader: baseDocumentLoader,
+					contextLoader: contexts?.loader ?? proofContextLoader,
+					tracerProvider: options.tracerProvider,
+					baseUrl: parseIri(remoteDocument.documentUrl)
+				});
+			} catch {}
+			rawProofCandidates[candidateIndex] = {
+				value: structuredClone(remoteDocument.document),
+				proof: parsed,
+				reference,
+				declaredKeyId: contexts == null ? void 0 : await getAliasedDeclaredProofKeyId(remoteDocument.document, void 0, contexts.replay)
+			};
+		}
+		return remoteDocument;
+	};
+	for await (const proof of object.getProofs({
+		...options,
+		documentLoader: proofDocumentLoader,
+		gateways: [],
+		verifyPortableObject: acceptPortableProofDocument,
+		inheritPortableObjectVerifier: false
+	})) {
+		const rawProofCandidate = takeRawProofCandidate(rawProofCandidatePool, proof);
+		if (rawProofCandidate == null) return null;
+		const key = await verifyProofWithMessageDigestCache(jsonLd, proof, options, { proofContextLoader }, rawProofCandidate);
+		if (key === null) return null;
+		if (proof.verificationMethodId == null) return null;
+		if (key.controllerId == null) {
+			logger.debug("Key {keyId} does not have a controller.", { keyId: key.id?.href });
+			continue;
+		}
+		deleteAuthenticatedAttribution(attributions, key.controllerId, proof.verificationMethodId);
+	}
+	if (acceptedPortableProofs < loadedPortableProofs) {
+		logger.debug("Some portable proof references could not be dereferenced.");
+		return null;
+	}
+	if (attributions.size > 0) {
+		if (observation?.attempt != null) observation.attempt.reason = observation.attempt.checks.length === 0 ? { type: "noSignature" } : {
+			type: "uncoveredAttribution",
+			attributionIds: [...attributions].map((id) => new URL(id))
+		};
+		logger.debug("Some attributions are not authenticated by the proofs: {attributions}.", { attributions: [...attributions] });
+		return null;
+	}
+	return object;
+}
+function deleteAuthenticatedAttribution(attributions, controllerId, verificationMethodId) {
+	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) {
+		attributions.delete(controllerId.href);
+		return;
+	}
+	const did = getPortableDid(controllerId);
+	if (did == null || !hasCryptographicOrigin(verificationMethodId.href) || getPortableDid(verificationMethodId) !== did) return;
+	for (const attribution of [...attributions]) if ((hasCryptographicOrigin(attribution) || isPortableId(attribution)) && getPortableDid(attribution) === did) attributions.delete(attribution);
+}
+function hasCryptographicOrigin(iri) {
+	return /^did:/i.test(iri) || /^ap(?:\+ef61)?:\/\//i.test(iri);
+}
+//#endregion
+export { signObject as a, verifyPortableObjectProof as c, verifyProof as d, hasProofLike as i, verifyPortableObjectProofPolicy as l, classifyFep2277CoreType as n, verifyMapLocalProof as o, createProof as r, verifyObject as s, InvalidPortableObjectIdError as t, verifyPortableObjectProofWithRoot as u };