@originator-profile/verify 0.4.0 → 0.5.0-beta.2

package/dist/index.d.cts

@@ -1,10 +1,7 @@
+import { ContentAttestation, Image, Target, ContentAttestationSet, OpVc, Jwk, CoreProfile, Certificate as Certificate$1, WebMediaProfile, WebsiteProfile, ArticleCA, JapaneseExistenceCertificate, OriginatorProfileSet, Jwks, SiteProfile, AllowedOrigin } from '@originator-profile/model';
 import { JwtVcDecodingResult, JwtVcVerificationResult, UnverifiedJwtVc, VerifiedJwtVc, VcValidator } from '@originator-profile/securing-mechanism';
-import { ContentAttestation, Target, ContentAttestationSet, JwtOpPayload, JwtDpPayload, Op, Dp, OpVc, Jwk, CoreProfile, Certificate as Certificate$1, WebMediaProfile, WebsiteProfile, ArticleCA, JapaneseExistenceCertificate, OriginatorProfileSet, Jwks, SiteProfile, CertificationSystem, AllowedOrigin } from '@originator-profile/model';
 import { Keys } from '@originator-profile/cryptography';
-import { DigestSriContent, ContentFetcher, ElementSelector } from '@originator-profile/sign';
-import { ErrorObject } from 'ajv';
-import { JWTVerifyResult, ResolvedKey, JWTPayload } from 'jose';
-import { JOSEError } from 'jose/errors';
+import { DigestSriResult, ContentFetcher, ElementSelector } from '@originator-profile/sign';
 
 /** Content Attestation 復号失敗 */
 type CaDecodingFailure = JwtVcDecodingResult<ContentAttestation>;
@@ -47,7 +44,7 @@ declare class CaVerifyFailed extends Error {
  * @see {@link https://www.w3.org/TR/SRI/#the-integrity-attribute}
  * @example
  * ```ts
- * const content: DigestSriContent = {
+ * const content = {
  *   id: "<URL>",
  *   digestSRI: "sha256-...",
  * };
@@ -55,12 +52,36 @@ declare class CaVerifyFailed extends Error {
  * await verifyDigestSri(content); // true or false
  * ```
  */
-declare function verifyDigestSri(content: DigestSriContent, fetcher?: typeof fetch): Promise<boolean>;
+declare function verifyDigestSri(content: DigestSriResult, fetcher?: typeof fetch): Promise<boolean>;
+/**
+ * Image の digestSRI を検証する。
+ * 後方互換性の観点で、2027年までは検証失敗時に console.warn のみで処理を中断しない。
+ */
+declare function verifyImageDigestSri(value: Image | undefined, fetcher?: typeof fetch): Promise<void>;
+
+declare class IntegrityFetchFailed extends Error {
+    static get code(): "ERR_INTEGRITY_FETCH_FAILED";
+    readonly code: "ERR_INTEGRITY_FETCH_FAILED";
+    readonly ok = false;
+    /** 取得結果 */
+    result?: Error;
+    constructor(message: string, result: IntegrityFetchFailed["result"]);
+}
+declare class IntegrityVerificationFailed extends Error {
+    static get code(): "ERR_INTEGRITY_VERIFICATION_FAILED";
+    readonly code: "ERR_INTEGRITY_VERIFICATION_FAILED";
+    readonly ok = false;
+    /** 取得結果 */
+    result?: unknown;
+    constructor(message: string, result: IntegrityVerificationFailed["result"]);
+}
 
 type IntegrityVerifyResult = {
     valid: boolean;
     failedIntegrities: ReadonlyArray<string>;
 };
+type FetchIntegrityResult = IntegrityVerifyResult | IntegrityFetchFailed | IntegrityVerificationFailed;
+
 /** Target Integrity のコンテンツ取得・要素位置特定アルゴリズム */
 declare const TargetIntegrityAlgorithm: {
     HtmlTargetIntegrity: {
@@ -94,7 +115,7 @@ declare const TargetIntegrityAlgorithm: {
  * await verifyIntegrity(content); // true or false
  * ```
  */
-declare function verifyIntegrity(content: Target, doc?: Document, fetcher?: typeof fetch): Promise<IntegrityVerifyResult>;
+declare function verifyIntegrity(content: Target, doc?: Document, fetcher?: typeof fetch): Promise<FetchIntegrityResult>;
 type VerifyIntegrity = typeof verifyIntegrity;
 
 /**
@@ -171,116 +192,6 @@ declare function normalizeCasItem<Ca>(ca: Ca | CasItem<Ca>): CasItem<Ca>;
  */
 declare function verifyCas<T extends ContentAttestation = ContentAttestation>(cas: ContentAttestationSet, verifiedOps: VerifiedOps, url: string, verifyIntegrity: VerifyIntegrity, validator?: typeof VcValidator): Promise<CasVerificationResult<T>>;
 
-interface ProfilePair {
-    op: {
-        iss: string;
-        sub: string;
-        profile: string;
-    };
-    dp: {
-        sub: string;
-        profile: string;
-    };
-}
-interface WebsiteProfilePair {
-    "@context": string;
-    website: ProfilePair;
-}
-interface AdProfilePair {
-    "@context": string;
-    ad: ProfilePair;
-}
-/** Profile の Token の復号結果 */
-type DecodeResult = {
-    op: true;
-    payload: JwtOpPayload;
-    jwt: string;
-} | {
-    dp: true;
-    payload: JwtDpPayload;
-    jwt: string;
-} | ProfileClaimsValidationFailed;
-/** Profile の Token の検証結果 */
-type VerifyTokenResult = (JWTVerifyResult & ResolvedKey & ({
-    op: Op;
-    jwt: string;
-} | {
-    dp: Dp;
-    jwt: string;
-})) | ProfileClaimsValidationFailed | ProfileTokenVerifyFailed;
-/** Profile Set */
-type Profiles = {
-    profile: string[];
-    ad?: ProfilePair[];
-};
-/** Profile の検証結果 */
-type VerifyResult = VerifyTokenResult | ProfilesResolveFailed | ProfilesVerifyFailed;
-/** Profile Set の検証結果 */
-type VerifyResults = VerifyResult[];
-
-declare class ProfileGenericError extends Error {
-    static get code(): string;
-    readonly code: string;
-}
-declare class ProfileClaimsValidationFailed extends ProfileGenericError {
-    static get code(): "ERR_PROFILE_CLAIMS_VALIDATION_FAILED";
-    readonly code: "ERR_PROFILE_CLAIMS_VALIDATION_FAILED";
-    /** 復号結果 */
-    result: {
-        error?: JOSEError;
-        errors?: ErrorObject[];
-        payload?: JWTPayload;
-        jwt: string;
-    };
-    constructor(message: string, result: ProfileClaimsValidationFailed["result"]);
-}
-declare class ProfileTokenVerifyFailed extends ProfileGenericError {
-    static get code(): "ERR_PROFILE_TOKEN_VERIFY_FAILED";
-    readonly code: "ERR_PROFILE_TOKEN_VERIFY_FAILED";
-    /** 検証結果 */
-    result: Exclude<DecodeResult, ProfileGenericError> & {
-        error?: JOSEError;
-    };
-    constructor(message: string, result: ProfileTokenVerifyFailed["result"]);
-}
-declare class ProfileBodyExtractFailed extends ProfileGenericError {
-    static get code(): "ERR_PROFILE_BODY_EXTRACT_FAILED";
-    readonly code: "ERR_PROFILE_BODY_EXTRACT_FAILED";
-}
-declare class ProfileBodyVerifyFailed extends ProfileGenericError {
-    static get code(): "ERR_PROFILE_BODY_VERIFY_FAILED";
-    readonly code: "ERR_PROFILE_BODY_VERIFY_FAILED";
-    /** 検証結果 */
-    result: {
-        error?: JOSEError;
-        body: string;
-    };
-    constructor(message: string, result: ProfileBodyVerifyFailed["result"]);
-}
-declare class ProfilesResolveFailed extends ProfileGenericError {
-    static get code(): "ERR_PROFILES_RESOLVE_FAILED";
-    readonly code: "ERR_PROFILES_RESOLVE_FAILED";
-    /** 検証結果 */
-    result: Exclude<DecodeResult, ProfileGenericError>;
-    constructor(message: string, result: ProfilesResolveFailed["result"]);
-}
-declare class ProfilesVerifyFailed extends ProfileGenericError {
-    static get code(): "ERR_PROFILES_VERIFY_FAILED";
-    readonly code: "ERR_PROFILES_VERIFY_FAILED";
-    /** 検証結果 */
-    result: Exclude<DecodeResult | VerifyTokenResult, ProfileGenericError>;
-    constructor(message: string, result: ProfilesVerifyFailed["result"]);
-}
-declare class CertificationSystemValidationFailed extends ProfileGenericError {
-    static get code(): "ERR_CERTIFICATION_SYSTEM_VALIDATION_FAILED";
-    readonly code: "ERR_CERTIFICATION_SYSTEM_VALIDATION_FAILED";
-    /** 検証結果 */
-    result: {
-        payload?: unknown;
-    };
-    constructor(message: string, result: CertificationSystemValidationFailed["result"]);
-}
-
 // Definitions by: Eddie Atkinson <https://github.com/eddie-atkinson>
 
 type Operation = "add" | "replace" | "remove" | "move";
@@ -415,19 +326,36 @@ declare class OpVerifyFailed extends Error {
     readonly code: string;
     constructor(message: string, result: OpVerificationFailure);
 }
+/**
+ * 証明書の有効期限エラー
+ *
+ * 証明書の有効期限チェックに失敗しました。次の原因で使用されます。
+ *
+ * - 証明書の有効期限が開始していない (validFrom より前)
+ * - 証明書の有効期限が切れている (validUntil より後)
+ *
+ * なお、validFrom と validUntil はオプショナルフィールドのため、
+ * 片方のみが指定されている場合もあります。
+ **/
+declare class CertificateExpired<T extends OpVc> extends Error {
+    result: VerifiedJwtVc<T>;
+    static get code(): string;
+    readonly code: string;
+    constructor(message: string, result: VerifiedJwtVc<T>);
+}
 
 type Certificate = Certificate$1 | JapaneseExistenceCertificate;
 /** Originator Profile 復号失敗 */
 type OpDecodingFailure = {
     core: JwtVcDecodingResult<CoreProfile>;
     annotations?: JwtVcDecodingResult<Certificate>[];
-    media?: JwtVcDecodingResult<WebMediaProfile>;
+    media?: JwtVcDecodingResult<WebMediaProfile>[];
 };
 /** 復号済み Originator Profile */
 type DecodedOp = {
     core: UnverifiedJwtVc<CoreProfile>;
     annotations?: UnverifiedJwtVc<Certificate>[];
-    media: UnverifiedJwtVc<WebMediaProfile>;
+    media?: UnverifiedJwtVc<WebMediaProfile>[];
 };
 /** Originator Profile 復号結果 */
 type OpDecodingResult = DecodedOp | OpInvalid;
@@ -441,13 +369,13 @@ type OpsDecodingResult = DecodedOps | OpsInvalid;
 type OpVerificationFailure = {
     core: JwtVcVerificationResult<CoreProfile> | CoreProfileNotFound<CoreProfile>;
     annotations?: (JwtVcVerificationResult<Certificate> | CoreProfileNotFound<Certificate>)[];
-    media?: JwtVcVerificationResult<WebMediaProfile> | CoreProfileNotFound<WebMediaProfile>;
+    media?: (JwtVcVerificationResult<WebMediaProfile> | CoreProfileNotFound<WebMediaProfile>)[];
 };
 /** 検証済み Originator Profile */
 type VerifiedOp = {
     core: VerifiedJwtVc<CoreProfile>;
     annotations?: VerifiedJwtVc<Certificate>[];
-    media?: VerifiedJwtVc<WebMediaProfile>;
+    media?: VerifiedJwtVc<WebMediaProfile>[];
 };
 /** Originator Profile 検証結果 */
 type OpVerificationResult = VerifiedOp | OpVerifyFailed;
@@ -511,11 +439,11 @@ declare class SiteProfileVerifyFailed extends Error {
 /** Site Profile 検証失敗 */
 type SpVerificationFailure = {
     originators: OpsVerificationResult;
-    credential?: JwtVcVerificationResult<WebsiteProfile> | JwtVcDecodingResult<WebsiteProfile> | CoreProfileNotFound<WebsiteProfile>;
+    sites: (JwtVcVerificationResult<WebsiteProfile> | JwtVcDecodingResult<WebsiteProfile> | CoreProfileNotFound<WebsiteProfile>)[];
 };
 type VerifiedSp = {
     originators: VerifiedOps;
-    credential: VerifiedJwtVc<WebsiteProfile>;
+    sites: VerifiedJwtVc<WebsiteProfile>[];
 };
 type SpVerificationResult = VerifiedSp | SiteProfileInvalid | SiteProfileVerifyFailed;
 
@@ -531,16 +459,6 @@ type SpVerificationResult = VerifiedSp | SiteProfileInvalid | SiteProfileVerifyF
  */
 declare function SpVerifier(sp: SiteProfile, keys: Keys, issuer: string | string[], origin: URL["origin"], verifyOrigin?: boolean, validator?: typeof VcValidator): () => Promise<SpVerificationResult>;
 
-/** 認証制度ペイロードの確認のためのバリデーター */
-declare function CertificationSystemValidator(): (payload: unknown) => true | CertificationSystemValidationFailed;
-type CertificationSystemValidator = ReturnType<typeof CertificationSystemValidator>;
-/**
- * 認証制度の検証
- * @param payload ペイロード
- * @return 検証結果
- */
-declare function validateCertificationSystem(payload: unknown): CertificationSystem | CertificationSystemValidationFailed;
-
 /**
  * URLオリジンが対象のオリジンの中に含まれているのか検証する
  * @param origin 対象とするオリジン
@@ -549,4 +467,4 @@ declare function validateCertificationSystem(payload: unknown): CertificationSys
  */
 declare function verifyAllowedOrigin(origin: URL["origin"], allowedOrigins: AllowedOrigin): boolean;
 
-export { type AdProfilePair, type CaDecodingFailure, type CaDecodingResult, CaInvalid, type CaVerificationFailure, type CaVerificationResult, CaVerifier, CaVerifyFailed, type CasItem, type CasVerificationFailure, type CasVerificationResult, CasVerifyFailed, type Certificate, CertificationSystemValidationFailed, CertificationSystemValidator, CoreProfileNotFound, type DecodeResult, type DecodedCa, type DecodedOp, type DecodedOps, type IntegrityVerifyResult, type MappedKeys, type OpDecodingFailure, type OpDecodingResult, OpInvalid, type OpVerificationFailure, type OpVerificationResult, OpVerifyFailed, type OpsDecodingFailure, type OpsDecodingResult, OpsInvalid, type OpsVerificationFailure, type OpsVerificationResult, OpsVerifier, OpsVerifyFailed, ProfileBodyExtractFailed, ProfileBodyVerifyFailed, ProfileClaimsValidationFailed, ProfileGenericError, type ProfilePair, ProfileTokenVerifyFailed, type Profiles, ProfilesResolveFailed, ProfilesVerifyFailed, SiteProfileInvalid, SiteProfileVerifyFailed, type SpVerificationFailure, type SpVerificationResult, SpVerifier, TargetIntegrityAlgorithm, type TupledKeys, type VerifiedCa, type VerifiedCas, type VerifiedOp, type VerifiedOps, type VerifiedSp, type VerifyIntegrity, type VerifyResult, VerifyResultFactory, type VerifyResults, type VerifyTokenResult, type WebsiteProfilePair, article, caId, caUrl, certificate, cp, decodeOps, getMappedKeys, getTupledKeys, normalizeCasItem, opId, patch, validateCertificationSystem, verifyAllowedOrigin, verifyCas, verifyDigestSri, verifyIntegrity, wmp, wsp };
+export { type CaDecodingFailure, type CaDecodingResult, CaInvalid, type CaVerificationFailure, type CaVerificationResult, CaVerifier, CaVerifyFailed, type CasItem, type CasVerificationFailure, type CasVerificationResult, CasVerifyFailed, type Certificate, CertificateExpired, CoreProfileNotFound, type DecodedCa, type DecodedOp, type DecodedOps, type FetchIntegrityResult, IntegrityFetchFailed, IntegrityVerificationFailed, type IntegrityVerifyResult, type MappedKeys, type OpDecodingFailure, type OpDecodingResult, OpInvalid, type OpVerificationFailure, type OpVerificationResult, OpVerifyFailed, type OpsDecodingFailure, type OpsDecodingResult, OpsInvalid, type OpsVerificationFailure, type OpsVerificationResult, OpsVerifier, OpsVerifyFailed, SiteProfileInvalid, SiteProfileVerifyFailed, type SpVerificationFailure, type SpVerificationResult, SpVerifier, TargetIntegrityAlgorithm, type TupledKeys, type VerifiedCa, type VerifiedCas, type VerifiedOp, type VerifiedOps, type VerifiedSp, type VerifyIntegrity, VerifyResultFactory, article, caId, caUrl, certificate, cp, decodeOps, getMappedKeys, getTupledKeys, normalizeCasItem, opId, patch, verifyAllowedOrigin, verifyCas, verifyDigestSri, verifyImageDigestSri, verifyIntegrity, wmp, wsp };

package/dist/index.d.mts

@@ -1,10 +1,7 @@
+import { ContentAttestation, Image, Target, ContentAttestationSet, OpVc, Jwk, CoreProfile, Certificate as Certificate$1, WebMediaProfile, WebsiteProfile, ArticleCA, JapaneseExistenceCertificate, OriginatorProfileSet, Jwks, SiteProfile, AllowedOrigin } from '@originator-profile/model';
 import { JwtVcDecodingResult, JwtVcVerificationResult, UnverifiedJwtVc, VerifiedJwtVc, VcValidator } from '@originator-profile/securing-mechanism';
-import { ContentAttestation, Target, ContentAttestationSet, JwtOpPayload, JwtDpPayload, Op, Dp, OpVc, Jwk, CoreProfile, Certificate as Certificate$1, WebMediaProfile, WebsiteProfile, ArticleCA, JapaneseExistenceCertificate, OriginatorProfileSet, Jwks, SiteProfile, CertificationSystem, AllowedOrigin } from '@originator-profile/model';
 import { Keys } from '@originator-profile/cryptography';
-import { DigestSriContent, ContentFetcher, ElementSelector } from '@originator-profile/sign';
-import { ErrorObject } from 'ajv';
-import { JWTVerifyResult, ResolvedKey, JWTPayload } from 'jose';
-import { JOSEError } from 'jose/errors';
+import { DigestSriResult, ContentFetcher, ElementSelector } from '@originator-profile/sign';
 
 /** Content Attestation 復号失敗 */
 type CaDecodingFailure = JwtVcDecodingResult<ContentAttestation>;
@@ -47,7 +44,7 @@ declare class CaVerifyFailed extends Error {
  * @see {@link https://www.w3.org/TR/SRI/#the-integrity-attribute}
  * @example
  * ```ts
- * const content: DigestSriContent = {
+ * const content = {
  *   id: "<URL>",
  *   digestSRI: "sha256-...",
  * };
@@ -55,12 +52,36 @@ declare class CaVerifyFailed extends Error {
  * await verifyDigestSri(content); // true or false
  * ```
  */
-declare function verifyDigestSri(content: DigestSriContent, fetcher?: typeof fetch): Promise<boolean>;
+declare function verifyDigestSri(content: DigestSriResult, fetcher?: typeof fetch): Promise<boolean>;
+/**
+ * Image の digestSRI を検証する。
+ * 後方互換性の観点で、2027年までは検証失敗時に console.warn のみで処理を中断しない。
+ */
+declare function verifyImageDigestSri(value: Image | undefined, fetcher?: typeof fetch): Promise<void>;
+
+declare class IntegrityFetchFailed extends Error {
+    static get code(): "ERR_INTEGRITY_FETCH_FAILED";
+    readonly code: "ERR_INTEGRITY_FETCH_FAILED";
+    readonly ok = false;
+    /** 取得結果 */
+    result?: Error;
+    constructor(message: string, result: IntegrityFetchFailed["result"]);
+}
+declare class IntegrityVerificationFailed extends Error {
+    static get code(): "ERR_INTEGRITY_VERIFICATION_FAILED";
+    readonly code: "ERR_INTEGRITY_VERIFICATION_FAILED";
+    readonly ok = false;
+    /** 取得結果 */
+    result?: unknown;
+    constructor(message: string, result: IntegrityVerificationFailed["result"]);
+}
 
 type IntegrityVerifyResult = {
     valid: boolean;
     failedIntegrities: ReadonlyArray<string>;
 };
+type FetchIntegrityResult = IntegrityVerifyResult | IntegrityFetchFailed | IntegrityVerificationFailed;
+
 /** Target Integrity のコンテンツ取得・要素位置特定アルゴリズム */
 declare const TargetIntegrityAlgorithm: {
     HtmlTargetIntegrity: {
@@ -94,7 +115,7 @@ declare const TargetIntegrityAlgorithm: {
  * await verifyIntegrity(content); // true or false
  * ```
  */
-declare function verifyIntegrity(content: Target, doc?: Document, fetcher?: typeof fetch): Promise<IntegrityVerifyResult>;
+declare function verifyIntegrity(content: Target, doc?: Document, fetcher?: typeof fetch): Promise<FetchIntegrityResult>;
 type VerifyIntegrity = typeof verifyIntegrity;
 
 /**
@@ -171,116 +192,6 @@ declare function normalizeCasItem<Ca>(ca: Ca | CasItem<Ca>): CasItem<Ca>;
  */
 declare function verifyCas<T extends ContentAttestation = ContentAttestation>(cas: ContentAttestationSet, verifiedOps: VerifiedOps, url: string, verifyIntegrity: VerifyIntegrity, validator?: typeof VcValidator): Promise<CasVerificationResult<T>>;
 
-interface ProfilePair {
-    op: {
-        iss: string;
-        sub: string;
-        profile: string;
-    };
-    dp: {
-        sub: string;
-        profile: string;
-    };
-}
-interface WebsiteProfilePair {
-    "@context": string;
-    website: ProfilePair;
-}
-interface AdProfilePair {
-    "@context": string;
-    ad: ProfilePair;
-}
-/** Profile の Token の復号結果 */
-type DecodeResult = {
-    op: true;
-    payload: JwtOpPayload;
-    jwt: string;
-} | {
-    dp: true;
-    payload: JwtDpPayload;
-    jwt: string;
-} | ProfileClaimsValidationFailed;
-/** Profile の Token の検証結果 */
-type VerifyTokenResult = (JWTVerifyResult & ResolvedKey & ({
-    op: Op;
-    jwt: string;
-} | {
-    dp: Dp;
-    jwt: string;
-})) | ProfileClaimsValidationFailed | ProfileTokenVerifyFailed;
-/** Profile Set */
-type Profiles = {
-    profile: string[];
-    ad?: ProfilePair[];
-};
-/** Profile の検証結果 */
-type VerifyResult = VerifyTokenResult | ProfilesResolveFailed | ProfilesVerifyFailed;
-/** Profile Set の検証結果 */
-type VerifyResults = VerifyResult[];
-
-declare class ProfileGenericError extends Error {
-    static get code(): string;
-    readonly code: string;
-}
-declare class ProfileClaimsValidationFailed extends ProfileGenericError {
-    static get code(): "ERR_PROFILE_CLAIMS_VALIDATION_FAILED";
-    readonly code: "ERR_PROFILE_CLAIMS_VALIDATION_FAILED";
-    /** 復号結果 */
-    result: {
-        error?: JOSEError;
-        errors?: ErrorObject[];
-        payload?: JWTPayload;
-        jwt: string;
-    };
-    constructor(message: string, result: ProfileClaimsValidationFailed["result"]);
-}
-declare class ProfileTokenVerifyFailed extends ProfileGenericError {
-    static get code(): "ERR_PROFILE_TOKEN_VERIFY_FAILED";
-    readonly code: "ERR_PROFILE_TOKEN_VERIFY_FAILED";
-    /** 検証結果 */
-    result: Exclude<DecodeResult, ProfileGenericError> & {
-        error?: JOSEError;
-    };
-    constructor(message: string, result: ProfileTokenVerifyFailed["result"]);
-}
-declare class ProfileBodyExtractFailed extends ProfileGenericError {
-    static get code(): "ERR_PROFILE_BODY_EXTRACT_FAILED";
-    readonly code: "ERR_PROFILE_BODY_EXTRACT_FAILED";
-}
-declare class ProfileBodyVerifyFailed extends ProfileGenericError {
-    static get code(): "ERR_PROFILE_BODY_VERIFY_FAILED";
-    readonly code: "ERR_PROFILE_BODY_VERIFY_FAILED";
-    /** 検証結果 */
-    result: {
-        error?: JOSEError;
-        body: string;
-    };
-    constructor(message: string, result: ProfileBodyVerifyFailed["result"]);
-}
-declare class ProfilesResolveFailed extends ProfileGenericError {
-    static get code(): "ERR_PROFILES_RESOLVE_FAILED";
-    readonly code: "ERR_PROFILES_RESOLVE_FAILED";
-    /** 検証結果 */
-    result: Exclude<DecodeResult, ProfileGenericError>;
-    constructor(message: string, result: ProfilesResolveFailed["result"]);
-}
-declare class ProfilesVerifyFailed extends ProfileGenericError {
-    static get code(): "ERR_PROFILES_VERIFY_FAILED";
-    readonly code: "ERR_PROFILES_VERIFY_FAILED";
-    /** 検証結果 */
-    result: Exclude<DecodeResult | VerifyTokenResult, ProfileGenericError>;
-    constructor(message: string, result: ProfilesVerifyFailed["result"]);
-}
-declare class CertificationSystemValidationFailed extends ProfileGenericError {
-    static get code(): "ERR_CERTIFICATION_SYSTEM_VALIDATION_FAILED";
-    readonly code: "ERR_CERTIFICATION_SYSTEM_VALIDATION_FAILED";
-    /** 検証結果 */
-    result: {
-        payload?: unknown;
-    };
-    constructor(message: string, result: CertificationSystemValidationFailed["result"]);
-}
-
 // Definitions by: Eddie Atkinson <https://github.com/eddie-atkinson>
 
 type Operation = "add" | "replace" | "remove" | "move";
@@ -415,19 +326,36 @@ declare class OpVerifyFailed extends Error {
     readonly code: string;
     constructor(message: string, result: OpVerificationFailure);
 }
+/**
+ * 証明書の有効期限エラー
+ *
+ * 証明書の有効期限チェックに失敗しました。次の原因で使用されます。
+ *
+ * - 証明書の有効期限が開始していない (validFrom より前)
+ * - 証明書の有効期限が切れている (validUntil より後)
+ *
+ * なお、validFrom と validUntil はオプショナルフィールドのため、
+ * 片方のみが指定されている場合もあります。
+ **/
+declare class CertificateExpired<T extends OpVc> extends Error {
+    result: VerifiedJwtVc<T>;
+    static get code(): string;
+    readonly code: string;
+    constructor(message: string, result: VerifiedJwtVc<T>);
+}
 
 type Certificate = Certificate$1 | JapaneseExistenceCertificate;
 /** Originator Profile 復号失敗 */
 type OpDecodingFailure = {
     core: JwtVcDecodingResult<CoreProfile>;
     annotations?: JwtVcDecodingResult<Certificate>[];
-    media?: JwtVcDecodingResult<WebMediaProfile>;
+    media?: JwtVcDecodingResult<WebMediaProfile>[];
 };
 /** 復号済み Originator Profile */
 type DecodedOp = {
     core: UnverifiedJwtVc<CoreProfile>;
     annotations?: UnverifiedJwtVc<Certificate>[];
-    media: UnverifiedJwtVc<WebMediaProfile>;
+    media?: UnverifiedJwtVc<WebMediaProfile>[];
 };
 /** Originator Profile 復号結果 */
 type OpDecodingResult = DecodedOp | OpInvalid;
@@ -441,13 +369,13 @@ type OpsDecodingResult = DecodedOps | OpsInvalid;
 type OpVerificationFailure = {
     core: JwtVcVerificationResult<CoreProfile> | CoreProfileNotFound<CoreProfile>;
     annotations?: (JwtVcVerificationResult<Certificate> | CoreProfileNotFound<Certificate>)[];
-    media?: JwtVcVerificationResult<WebMediaProfile> | CoreProfileNotFound<WebMediaProfile>;
+    media?: (JwtVcVerificationResult<WebMediaProfile> | CoreProfileNotFound<WebMediaProfile>)[];
 };
 /** 検証済み Originator Profile */
 type VerifiedOp = {
     core: VerifiedJwtVc<CoreProfile>;
     annotations?: VerifiedJwtVc<Certificate>[];
-    media?: VerifiedJwtVc<WebMediaProfile>;
+    media?: VerifiedJwtVc<WebMediaProfile>[];
 };
 /** Originator Profile 検証結果 */
 type OpVerificationResult = VerifiedOp | OpVerifyFailed;
@@ -511,11 +439,11 @@ declare class SiteProfileVerifyFailed extends Error {
 /** Site Profile 検証失敗 */
 type SpVerificationFailure = {
     originators: OpsVerificationResult;
-    credential?: JwtVcVerificationResult<WebsiteProfile> | JwtVcDecodingResult<WebsiteProfile> | CoreProfileNotFound<WebsiteProfile>;
+    sites: (JwtVcVerificationResult<WebsiteProfile> | JwtVcDecodingResult<WebsiteProfile> | CoreProfileNotFound<WebsiteProfile>)[];
 };
 type VerifiedSp = {
     originators: VerifiedOps;
-    credential: VerifiedJwtVc<WebsiteProfile>;
+    sites: VerifiedJwtVc<WebsiteProfile>[];
 };
 type SpVerificationResult = VerifiedSp | SiteProfileInvalid | SiteProfileVerifyFailed;
 
@@ -531,16 +459,6 @@ type SpVerificationResult = VerifiedSp | SiteProfileInvalid | SiteProfileVerifyF
  */
 declare function SpVerifier(sp: SiteProfile, keys: Keys, issuer: string | string[], origin: URL["origin"], verifyOrigin?: boolean, validator?: typeof VcValidator): () => Promise<SpVerificationResult>;
 
-/** 認証制度ペイロードの確認のためのバリデーター */
-declare function CertificationSystemValidator(): (payload: unknown) => true | CertificationSystemValidationFailed;
-type CertificationSystemValidator = ReturnType<typeof CertificationSystemValidator>;
-/**
- * 認証制度の検証
- * @param payload ペイロード
- * @return 検証結果
- */
-declare function validateCertificationSystem(payload: unknown): CertificationSystem | CertificationSystemValidationFailed;
-
 /**
  * URLオリジンが対象のオリジンの中に含まれているのか検証する
  * @param origin 対象とするオリジン
@@ -549,4 +467,4 @@ declare function validateCertificationSystem(payload: unknown): CertificationSys
  */
 declare function verifyAllowedOrigin(origin: URL["origin"], allowedOrigins: AllowedOrigin): boolean;
 
-export { type AdProfilePair, type CaDecodingFailure, type CaDecodingResult, CaInvalid, type CaVerificationFailure, type CaVerificationResult, CaVerifier, CaVerifyFailed, type CasItem, type CasVerificationFailure, type CasVerificationResult, CasVerifyFailed, type Certificate, CertificationSystemValidationFailed, CertificationSystemValidator, CoreProfileNotFound, type DecodeResult, type DecodedCa, type DecodedOp, type DecodedOps, type IntegrityVerifyResult, type MappedKeys, type OpDecodingFailure, type OpDecodingResult, OpInvalid, type OpVerificationFailure, type OpVerificationResult, OpVerifyFailed, type OpsDecodingFailure, type OpsDecodingResult, OpsInvalid, type OpsVerificationFailure, type OpsVerificationResult, OpsVerifier, OpsVerifyFailed, ProfileBodyExtractFailed, ProfileBodyVerifyFailed, ProfileClaimsValidationFailed, ProfileGenericError, type ProfilePair, ProfileTokenVerifyFailed, type Profiles, ProfilesResolveFailed, ProfilesVerifyFailed, SiteProfileInvalid, SiteProfileVerifyFailed, type SpVerificationFailure, type SpVerificationResult, SpVerifier, TargetIntegrityAlgorithm, type TupledKeys, type VerifiedCa, type VerifiedCas, type VerifiedOp, type VerifiedOps, type VerifiedSp, type VerifyIntegrity, type VerifyResult, VerifyResultFactory, type VerifyResults, type VerifyTokenResult, type WebsiteProfilePair, article, caId, caUrl, certificate, cp, decodeOps, getMappedKeys, getTupledKeys, normalizeCasItem, opId, patch, validateCertificationSystem, verifyAllowedOrigin, verifyCas, verifyDigestSri, verifyIntegrity, wmp, wsp };
+export { type CaDecodingFailure, type CaDecodingResult, CaInvalid, type CaVerificationFailure, type CaVerificationResult, CaVerifier, CaVerifyFailed, type CasItem, type CasVerificationFailure, type CasVerificationResult, CasVerifyFailed, type Certificate, CertificateExpired, CoreProfileNotFound, type DecodedCa, type DecodedOp, type DecodedOps, type FetchIntegrityResult, IntegrityFetchFailed, IntegrityVerificationFailed, type IntegrityVerifyResult, type MappedKeys, type OpDecodingFailure, type OpDecodingResult, OpInvalid, type OpVerificationFailure, type OpVerificationResult, OpVerifyFailed, type OpsDecodingFailure, type OpsDecodingResult, OpsInvalid, type OpsVerificationFailure, type OpsVerificationResult, OpsVerifier, OpsVerifyFailed, SiteProfileInvalid, SiteProfileVerifyFailed, type SpVerificationFailure, type SpVerificationResult, SpVerifier, TargetIntegrityAlgorithm, type TupledKeys, type VerifiedCa, type VerifiedCas, type VerifiedOp, type VerifiedOps, type VerifiedSp, type VerifyIntegrity, VerifyResultFactory, article, caId, caUrl, certificate, cp, decodeOps, getMappedKeys, getTupledKeys, normalizeCasItem, opId, patch, verifyAllowedOrigin, verifyCas, verifyDigestSri, verifyImageDigestSri, verifyIntegrity, wmp, wsp };