@originator-profile/verify 0.5.3 → 0.6.0-beta.1

package/dist/index.cjs

@@ -1,1245 +0,0 @@
-'use strict';
-
-var securingMechanism = require('@originator-profile/securing-mechanism');
-var sign = require('@originator-profile/sign');
-var cryptography = require('@originator-profile/cryptography');
-var model = require('@originator-profile/model');
-var zod = require('zod');
-
-class CaInvalid extends Error {
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-  static get code() {
-    return "ERR_CONTENT_ATTESTATION_INVALID";
-  }
-  code = CaInvalid.code;
-}
-class CaVerifyFailed extends Error {
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-  static get code() {
-    return "ERR_CONTENT_ATTESTATION_VERIFY_FAILED";
-  }
-  code = CaVerifyFailed.code;
-}
-
-const supportedHashAlgorithms = {
-  /** SHA-256 hash algorithm */
-  sha256: "SHA-256",
-  /** SHA-384 hash algorithm */
-  sha384: "SHA-384",
-  /** SHA-512 hash algorithm */
-  sha512: "SHA-512"
-};
-function getPrioritizedHashAlgorithm(a, b) {
-  if (a === b) return "";
-  if (!(a in supportedHashAlgorithms)) {
-    return b in supportedHashAlgorithms ? b : "";
-  }
-  if (!(b in supportedHashAlgorithms)) {
-    return a in supportedHashAlgorithms ? a : "";
-  }
-  return a < b ? b : a;
-}
-const IntegrityMetadataRegex = /^(?<alg>sha256|sha384|sha512)-(?<val>(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)(?:[?](?<opt>[\x21-\x7e]*))?$/;
-const SeparatorRegex = /[^\x21-\x7e]+/;
-class IntegrityMetadata {
-  /** Hash algorithm */
-  alg;
-  /** The base64-encoded hash value of the resource */
-  val;
-  /** Optional additional attributes */
-  opt;
-  /**
-   * Creates an instance of `IntegrityMetadata` from a given object or string.
-   * @param integrity The integrity metadata input, which can be a string or object.
-   * @example
-   * ```js
-   * new IntegrityMetadata("sha256-MV9b23bQeMQ7isAGTkoBZGErH853yGk0W/yUx1iU7dM=")
-   * ```
-   *
-   * or
-   *
-   * ```js
-   * new IntegrityMetadata({
-   *   alg: "sha256",
-   *   val: "MV9b23bQeMQ7isAGTkoBZGErH853yGk0W/yUx1iU7dM=",
-   * })
-   * ```
-   */
-  constructor(integrity) {
-    const integrityString = typeof integrity === "object" && integrity !== null ? IntegrityMetadata.stringify(integrity) : String(integrity ?? "").trim();
-    const {
-      alg = "",
-      val = "",
-      opt
-    } = IntegrityMetadataRegex.exec(integrityString)?.groups ?? {};
-    Object.assign(this, {
-      alg,
-      val,
-      opt: opt?.split("?") ?? []
-    });
-  }
-  /**
-   * Compares the current integrity metadata with another object or string.
-   * @param integrity The integrity metadata to compare with.
-   * @returns `true` if the integrity metadata matches, `false` otherwise.
-   * @example
-   * ```js
-   * integrityMetadata.match("sha256-MV9b23bQeMQ7isAGTkoBZGErH853yGk0W/yUx1iU7dM=")
-   * ```
-   *
-   * or
-   *
-   * ```js
-   * integrityMetadata.match({
-   *   alg: "sha256",
-   *   val: "MV9b23bQeMQ7isAGTkoBZGErH853yGk0W/yUx1iU7dM=",
-   * })
-   * ```
-   */
-  match(integrity) {
-    const { alg, val } = new IntegrityMetadata(integrity);
-    if (!alg) return false;
-    if (!val) return false;
-    if (!(alg in supportedHashAlgorithms)) return false;
-    return alg === this.alg && val === this.val;
-  }
-  /**
-   * Converts the integrity metadata into a string representation.
-   * @returns The string representation of the integrity metadata.
-   */
-  toString() {
-    return IntegrityMetadata.stringify(this);
-  }
-  /**
-   * Converts the integrity metadata into a JSON string.
-   * @returns The JSON string representation of the integrity metadata.
-   */
-  toJSON() {
-    return this.toString();
-  }
-  /**
-   * Static method to stringify an integrity metadata object.
-   * @param integrity The integrity metadata object to stringify.
-   * @returns The stringified integrity metadata.
-   * @example
-   * ```js
-   * IntegrityMetadata.stringify({
-   *   alg: "sha256",
-   *   val: "MV9b23bQeMQ7isAGTkoBZGErH853yGk0W/yUx1iU7dM=",
-   * }) // "sha256-MV9b23bQeMQ7isAGTkoBZGErH853yGk0W/yUx1iU7dM="
-   * ```
-   */
-  static stringify({ alg, val, opt = [] }) {
-    if (!alg) return "";
-    if (!val) return "";
-    if (!(alg in supportedHashAlgorithms)) return "";
-    return `${alg}-${[val, ...opt].join("?")}`;
-  }
-}
-async function createIntegrityMetadata(hashAlgorithm, data, opt = []) {
-  const alg = hashAlgorithm.toLowerCase();
-  if (!(alg in supportedHashAlgorithms)) {
-    return new IntegrityMetadata("");
-  }
-  const hashAlgorithmIdentifier = supportedHashAlgorithms[alg];
-  const arrayBuffer = await crypto.subtle.digest(hashAlgorithmIdentifier, data);
-  const val = btoa(String.fromCharCode(...new Uint8Array(arrayBuffer)));
-  const integrity = IntegrityMetadata.stringify({ alg, val, opt });
-  return new IntegrityMetadata(integrity);
-}
-class IntegrityMetadataSet {
-  #set;
-  #getPrioritizedHashAlgorithm = getPrioritizedHashAlgorithm;
-  /**
-   * Create an instance of `IntegrityMetadataSet` from integrity metadata or an array of integrity
-   * metadata.
-   * @param integrity The integrity metadata or an array of integrity metadata.
-   * @param options Optional configuration options for hash algorithm prioritization.
-   * @example
-   * ```js
-   * new IntegrityMetadataSet([
-   *   "sha256-MV9b23bQeMQ7isAGTkoBZGErH853yGk0W/yUx1iU7dM=",
-   *   "sha384-VbxVaw0v4Pzlgrpf4Huq//A1ZTY4x6wNVJTCpkwL6hzFczHHwSpFzbyn9MNKCJ7r",
-   *   "sha512-wVJ82JPBJHc9gRkRlwyP5uhX1t9dySJr2KFgYUwM2WOk3eorlLt9NgIe+dhl1c6ilKgt1JoLsmn1H256V/eUIQ==",
-   * ])
-   * ```
-   *
-   * or
-   *
-   * ```js
-   * new IntegrityMetadataSet(`
-   *   sha256-MV9b23bQeMQ7isAGTkoBZGErH853yGk0W/yUx1iU7dM=
-   *   sha384-VbxVaw0v4Pzlgrpf4Huq//A1ZTY4x6wNVJTCpkwL6hzFczHHwSpFzbyn9MNKCJ7r
-   *   sha512-wVJ82JPBJHc9gRkRlwyP5uhX1t9dySJr2KFgYUwM2WOk3eorlLt9NgIe+dhl1c6ilKgt1JoLsmn1H256V/eUIQ==
-   * `)
-   * ```
-   */
-  constructor(integrity, {
-    getPrioritizedHashAlgorithm: _getPrioritizedHashAlgorithm = getPrioritizedHashAlgorithm
-  } = {}) {
-    this.#set = [integrity].flat().flatMap(
-      (integrity2) => {
-        if (typeof integrity2 === "string") {
-          return integrity2.split(SeparatorRegex);
-        }
-        return [integrity2];
-      }
-    ).map((integrity2) => new IntegrityMetadata(integrity2)).filter((integrityMetadata) => integrityMetadata.toString() !== "");
-    this.#getPrioritizedHashAlgorithm = _getPrioritizedHashAlgorithm;
-  }
-  /**
-   * Enables iteration over the set of integrity metadata.
-   * @returns A generator that yields each IntegrityMetadata object.
-   * @example
-   * ```js
-   * [...integrityMetadataSet]
-   * ```
-   */
-  *[Symbol.iterator]() {
-    for (const integrityMetadata of this.#set) {
-      yield new IntegrityMetadata(integrityMetadata);
-    }
-  }
-  /**
-   * The number of integrity metadata entries in the set.
-   */
-  get size() {
-    return this.#set.length;
-  }
-  /**
-   * The strongest (most secure) integrity metadata from the set.
-   * @see {@link https://www.w3.org/TR/SRI/#get-the-strongest-metadata-from-set}
-   */
-  get strongest() {
-    let strongest = new IntegrityMetadataSet([]);
-    for (const integrityMetadata of this.#set) {
-      const [{ alg } = new IntegrityMetadata("")] = strongest;
-      const prioritizedHashAlgorithm = this.#getPrioritizedHashAlgorithm(
-        alg,
-        integrityMetadata.alg
-      );
-      switch (prioritizedHashAlgorithm) {
-        case "":
-          strongest = new IntegrityMetadataSet([
-            ...strongest,
-            integrityMetadata
-          ]);
-          break;
-        case integrityMetadata.alg:
-          strongest = new IntegrityMetadataSet(integrityMetadata);
-          break;
-      }
-    }
-    return strongest;
-  }
-  /**
-   * Returns an array of the strongest supported hash algorithms in the set.
-   */
-  get strongestHashAlgorithms() {
-    const strongestHashAlgorithms = [...this.strongest].map(({ alg }) => alg).filter(Boolean);
-    return [...new Set(strongestHashAlgorithms)];
-  }
-  /**
-   * Checks if a given integrity metadata object or string matches any in the set.
-   * @param integrity The integrity metadata to match.
-   * @returns `true` if the integrity metadata matches, `false` otherwise.
-   * @example
-   * ```js
-   * integrityMetadataSet.match("sha256-MV9b23bQeMQ7isAGTkoBZGErH853yGk0W/yUx1iU7dM=")
-   * ```
-   *
-   * or
-   *
-   * ```js
-   * integrityMetadataSet.match({
-   *   alg: "sha256",
-   *   val: "MV9b23bQeMQ7isAGTkoBZGErH853yGk0W/yUx1iU7dM=",
-   * })
-   * ```
-   */
-  match(integrity) {
-    return this.#set.some(
-      (integrityMetadata) => integrityMetadata.match(integrity)
-    );
-  }
-  /**
-   * Joins the integrity metadata in the set into a single string, separated by the specified
-   * separator.
-   * @param separator The separator to use (default is a space).
-   * @returns The joined string representation of the set.
-   */
-  join(separator = " ") {
-    return this.#set.map(String).join(separator);
-  }
-  /**
-   * Converts the set of integrity metadata to a string representation.
-   * @returns The string representation of the set.
-   */
-  toString() {
-    return this.join();
-  }
-  /**
-   * Converts the set of integrity metadata to a JSON string.
-   * @returns The JSON string representation of the set.
-   */
-  toJSON() {
-    return this.toString();
-  }
-}
-async function createIntegrityMetadataSet(hashAlgorithms, data, options = {
-  getPrioritizedHashAlgorithm
-}) {
-  const set = await Promise.all(
-    [hashAlgorithms].flat().map((alg) => createIntegrityMetadata(alg, data))
-  );
-  return new IntegrityMetadataSet(set, options);
-}
-
-const WARN_SUFFIX = `This will become an error after 2027. See: https://docs.originator-profile.org/en/opb/context/#the-image-datatype`;
-async function verifyDigestSri(content, fetcher = fetch) {
-  const integrity = new IntegrityMetadataSet(content.digestSRI);
-  const alg = integrity.strongestHashAlgorithms.filter(Boolean);
-  if (alg.length === 0) return false;
-  try {
-    const result = await sign.createDigestSri(alg[0], content, fetcher);
-    return "digestSRI" in result && integrity.match(result.digestSRI);
-  } catch (error) {
-    console.error(
-      "Failed to access content for digestSRI verification:",
-      error
-    );
-    return false;
-  }
-}
-async function verifyImageDigestSri(value, fetcher = fetch) {
-  if (!value) return;
-  if (!value.digestSRI) {
-    console.warn(`digestSRI is missing. ${WARN_SUFFIX}`);
-    return;
-  }
-  const valid = await verifyDigestSri(
-    { id: value.id, digestSRI: value.digestSRI },
-    fetcher
-  );
-  if (!valid) {
-    console.warn(`digestSRI verification failed. ${WARN_SUFFIX}`);
-  }
-}
-
-class IntegrityFetchFailed extends Error {
-  static get code() {
-    return "ERR_INTEGRITY_FETCH_FAILED";
-  }
-  code = IntegrityFetchFailed.code;
-  ok = false;
-  /** 取得結果 */
-  result;
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-}
-class IntegrityVerificationFailed extends Error {
-  static get code() {
-    return "ERR_INTEGRITY_VERIFICATION_FAILED";
-  }
-  code = IntegrityVerificationFailed.code;
-  ok = false;
-  /** 取得結果 */
-  result;
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-}
-
-class IntegrityVerifier {
-  constructor(contentFetcher, elementSelector) {
-    this.contentFetcher = contentFetcher;
-    this.elementSelector = elementSelector;
-  }
-  async verify(content, document2) {
-    const integrity = new IntegrityMetadataSet(content.integrity);
-    const alg = integrity.strongestHashAlgorithms.filter(Boolean);
-    if (alg.length === 0) return { valid: false, failedIntegrities: [] };
-    const elements = this.elementSelector({ ...content, document: document2 });
-    if (elements.length === 0) return { valid: false, failedIntegrities: [] };
-    const responses = await this.contentFetcher(elements);
-    const meta = await Promise.all(
-      responses.map(async (res) => {
-        const data = await res.arrayBuffer();
-        return await createIntegrityMetadataSet(alg, data);
-      })
-    );
-    const failedIntegrities = meta.filter((m) => [...m].every((m2) => !integrity.match(m2))).map((m) => m.toString());
-    return { valid: failedIntegrities.length === 0, failedIntegrities };
-  }
-}
-const TargetIntegrityAlgorithm = {
-  HtmlTargetIntegrity: {
-    contentFetcher: sign.fetchHtmlContent,
-    elementSelector: sign.selectByCss
-  },
-  TextTargetIntegrity: {
-    contentFetcher: sign.fetchTextContent,
-    elementSelector: sign.selectByCss
-  },
-  VisibleTextTargetIntegrity: {
-    contentFetcher: sign.fetchVisibleTextContent,
-    elementSelector: sign.selectByCss
-  },
-  ExternalResourceTargetIntegrity: {
-    contentFetcher: sign.fetchExternalResource,
-    elementSelector: sign.selectByIntegrity
-  }
-};
-async function verifyIntegrity(content, doc = document, fetcher = fetch) {
-  const { contentFetcher, elementSelector } = TargetIntegrityAlgorithm[content.type];
-  const integrityVerifier = new IntegrityVerifier(
-    (content2) => contentFetcher(content2, fetcher),
-    elementSelector
-  );
-  try {
-    return await integrityVerifier.verify(content, doc);
-  } catch (e) {
-    if (e instanceof sign.FetchFailed) {
-      return new IntegrityFetchFailed("Verify integrity failed", e.error);
-    }
-    return new IntegrityVerificationFailed("Verify integrity failed", e);
-  }
-}
-
-function verifyAllowedOrigin(origin, allowedOrigins) {
-  if (origin === "null") {
-    return false;
-  }
-  return [allowedOrigins].flat().includes(origin);
-}
-
-async function importURLPatternPolyfill() {
-  if (typeof URLPattern === "undefined") {
-    await Promise.resolve().then(function () { return require('./index-D-j8gXz_.cjs'); });
-  }
-}
-function ReplaceEncode(url) {
-  return url.replace(/(%[0-9a-f]{2}?)+/g, function(match) {
-    return match.toUpperCase();
-  });
-}
-async function verifyAllowedUrl(url, allowedUrl) {
-  await importURLPatternPolyfill();
-  return [allowedUrl].flat().some((value) => {
-    if (!value) {
-      return false;
-    }
-    try {
-      const pattern = new URLPattern(ReplaceEncode(value));
-      return pattern.test(ReplaceEncode(url));
-    } catch (e) {
-      console.error(`Invalid URLPattern: ${value} (url: ${url})`);
-    }
-    return false;
-  });
-}
-
-async function checkUrlAndOrigin(result, url) {
-  if (result.doc.allowedUrl && result.doc.allowedOrigin) {
-    return new CaInvalid("allowedUrl and allowedOrigin are exclusive", result);
-  }
-  if (result.doc.allowedOrigin) {
-    console.warn(
-      "[OP Warning] allowedOrigin is deprecated in Content Attestation and will be removed after September 2026. Please use allowedUrl instead. See: https://docs.originator-profile.org/"
-    );
-  }
-  if (result.doc.allowedUrl && !await verifyAllowedUrl(url.toString(), result.doc.allowedUrl)) {
-    return new CaVerifyFailed(
-      `URL not allowed. Expected:${Array.isArray(result.doc.allowedUrl) ? result.doc.allowedUrl.join(", ") : result.doc.allowedUrl} Actual:${url}`,
-      result
-    );
-  }
-  if (result.doc.allowedOrigin && !verifyAllowedOrigin(url.origin, result.doc.allowedOrigin)) {
-    return new CaVerifyFailed(
-      `Origin not allowed. Expected:${Array.isArray(result.doc.allowedOrigin) ? result.doc.allowedOrigin.join(", ") : result.doc.allowedOrigin} Actual:${url.origin}`,
-      result
-    );
-  }
-  return result;
-}
-function checkIntegrityResults(integrityResults, urlResult) {
-  const fetchFailedResults = integrityResults.filter(
-    (r) => r.verifyResult instanceof Error && r.verifyResult.code === IntegrityFetchFailed.code
-  );
-  if (fetchFailedResults.length > 0) {
-    const failedIntegritiesMessage = fetchFailedResults.map((result) => {
-      return `target[${result.index}] Expected: ${result.expectedIntegrity}`;
-    }).join(", ");
-    return new CaVerifyFailed(
-      `Content Attestation Target integrity fetch failed for element(s): ${failedIntegritiesMessage}`,
-      urlResult
-    );
-  }
-  const verificationFailedResults = integrityResults.filter(
-    (r) => r.verifyResult instanceof Error && r.verifyResult.code === IntegrityVerificationFailed.code
-  );
-  if (verificationFailedResults.length > 0) {
-    const failedIntegritiesMessage = verificationFailedResults.map((result) => {
-      return `target[${result.index}] Expected: ${result.expectedIntegrity}`;
-    }).join(", ");
-    return new CaVerifyFailed(
-      `Content Attestation Target integrity verification failed for element(s): ${failedIntegritiesMessage}`,
-      urlResult
-    );
-  }
-}
-function CaVerifier(ca, keys, issuer, url, verifyIntegrity$1 = verifyIntegrity, validator) {
-  const verifyCa = securingMechanism.JwtVcVerifier(keys, issuer, validator);
-  return async () => {
-    const result = await verifyCa(ca);
-    if (result instanceof securingMechanism.VcValidateFailed) {
-      return new CaInvalid("Content Attestation validate failed", result);
-    }
-    if (result instanceof securingMechanism.VcVerifyFailed) {
-      return new CaVerifyFailed("Content Attestation verify failed", result);
-    }
-    const urlResult = await checkUrlAndOrigin(result, url);
-    if (urlResult instanceof Error) {
-      return urlResult;
-    }
-    await verifyImageDigestSri(
-      urlResult.doc.credentialSubject.image
-    );
-    if (urlResult.doc.target) {
-      if (urlResult.doc.target.length === 0) {
-        return new CaInvalid("Target is empty", urlResult);
-      }
-      const integrityResults = await Promise.all(
-        urlResult.doc.target.map(async (t, index) => ({
-          index,
-          verifyResult: await verifyIntegrity$1(t),
-          expectedIntegrity: t.integrity
-        }))
-      );
-      const error = checkIntegrityResults(integrityResults, urlResult);
-      if (error) {
-        return error;
-      }
-      const failedIndices = integrityResults.filter(
-        (result2) => !(result2.verifyResult instanceof Error) && !result2.verifyResult.valid
-      ).map((result2) => result2.index);
-      if (failedIndices.length > 0) {
-        const failedIntegritiesMessage = failedIndices.map((integrityResultIndex) => {
-          const integrityResult = integrityResults[integrityResultIndex];
-          if (integrityResult) {
-            const verifyResult = integrityResult.verifyResult;
-            const calculatedIntegrities = verifyResult.failedIntegrities.join();
-            return `target[${integrityResultIndex}] Expected: ${integrityResult.expectedIntegrity}, Calculated: ${calculatedIntegrities}`;
-          }
-          return void 0;
-        }).join(", ");
-        return new CaVerifyFailed(
-          `Content Attestation Target integrity verification failed for element(s): ${failedIntegritiesMessage}`,
-          urlResult
-        );
-      }
-    }
-    return urlResult;
-  };
-}
-
-class CasVerifyFailed extends Error {
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-  static get code() {
-    return "ERR_CONTENT_ATTESTATION_SET_VERIFY_FAILED";
-  }
-  code = CasVerifyFailed.code;
-}
-
-function normalizeCasItem(ca) {
-  if (typeof ca === "object" && ca !== null && "attestation" in ca) {
-    return ca;
-  }
-  return { main: false, attestation: ca };
-}
-
-async function verifyCas(cas, verifiedOps, url, verifyIntegrity, validator) {
-  const decodeCa = securingMechanism.JwtVcDecoder();
-  const resultCas = await Promise.all(
-    cas.map(async (ca) => {
-      const { main, attestation: source } = normalizeCasItem(ca);
-      const decodedCa = decodeCa(source);
-      if (decodedCa instanceof Error) {
-        return { main, attestation: new CaInvalid("Invalid CA", decodedCa) };
-      }
-      const cp = verifiedOps.find(
-        (ops) => ops.core.doc.credentialSubject.id === decodedCa.doc.issuer
-      );
-      if (!cp) {
-        return {
-          main,
-          attestation: new CoreProfileNotFound(
-            "Appropriate Core Profile not found",
-            decodedCa
-          )
-        };
-      }
-      const verify = CaVerifier(
-        source,
-        cryptography.LocalKeys(cp.core.doc.credentialSubject.jwks),
-        decodedCa.doc.issuer,
-        new URL(url),
-        verifyIntegrity,
-        validator?.(model.ContentAttestation)
-      );
-      return { main, attestation: await verify() };
-    })
-  );
-  if (resultCas.some((ca) => {
-    return ca.attestation instanceof CaInvalid || ca.attestation instanceof CoreProfileNotFound || ca.attestation instanceof CaVerifyFailed;
-  })) {
-    return new CasVerifyFailed(
-      "Content Attestation Set verify failed",
-      resultCas
-    );
-  }
-  return resultCas;
-}
-
-var REMOVE = "remove";
-var REPLACE = "replace";
-var ADD = "add";
-var MOVE = "move";
-function diffApply(obj, diff, pathConverter) {
-  if (!obj || typeof obj != "object") {
-    throw new Error("base object must be an object or an array");
-  }
-  if (!Array.isArray(diff)) {
-    throw new Error("diff must be an array");
-  }
-  var diffLength = diff.length;
-  for (var i = 0; i < diffLength; i++) {
-    var thisDiff = diff[i];
-    var subObject = obj;
-    var thisOp = thisDiff.op;
-    var thisPath = transformPath(pathConverter, thisDiff.path);
-    var thisFromPath = thisDiff.from && transformPath(pathConverter, thisDiff.from);
-    var toPath, toPathCopy, lastToProp, subToObject, valueToMove;
-    if (thisFromPath) {
-      toPath = thisPath;
-      thisPath = thisFromPath;
-      toPathCopy = toPath.slice();
-      lastToProp = toPathCopy.pop();
-      prototypeCheck(lastToProp);
-      if (lastToProp == null) {
-        return false;
-      }
-      var thisToProp;
-      while ((thisToProp = toPathCopy.shift()) != null) {
-        prototypeCheck(thisToProp);
-        if (!(thisToProp in subToObject)) {
-          subToObject[thisToProp] = {};
-        }
-        subToObject = subToObject[thisToProp];
-      }
-    }
-    var pathCopy = thisPath.slice();
-    var lastProp = pathCopy.pop();
-    prototypeCheck(lastProp);
-    if (lastProp == null) {
-      return false;
-    }
-    var thisProp;
-    while ((thisProp = pathCopy.shift()) != null) {
-      prototypeCheck(thisProp);
-      if (!(thisProp in subObject)) {
-        subObject[thisProp] = {};
-      }
-      subObject = subObject[thisProp];
-    }
-    if (thisOp === REMOVE || thisOp === REPLACE || thisOp === MOVE) {
-      var path = thisOp === MOVE ? thisDiff.from : thisDiff.path;
-      if (!subObject.hasOwnProperty(lastProp)) {
-        throw new Error(["expected to find property", path, "in object", obj].join(" "));
-      }
-    }
-    if (thisOp === REMOVE || thisOp === MOVE) {
-      if (thisOp === MOVE) {
-        valueToMove = subObject[lastProp];
-      }
-      Array.isArray(subObject) ? subObject.splice(lastProp, 1) : delete subObject[lastProp];
-    }
-    if (thisOp === REPLACE || thisOp === ADD) {
-      subObject[lastProp] = thisDiff.value;
-    }
-    if (thisOp === MOVE) {
-      subObject[lastToProp] = valueToMove;
-    }
-  }
-  return subObject;
-}
-function transformPath(pathConverter, thisPath) {
-  {
-    if (!Array.isArray(thisPath)) {
-      throw new Error([
-        "diff path",
-        thisPath,
-        "must be an array, consider supplying a path converter"
-      ].join(" "));
-    }
-  }
-  return thisPath;
-}
-function prototypeCheck(prop) {
-  if (prop == "__proto__" || prop == "constructor" || prop == "prototype") {
-    throw new Error("setting of prototype values not supported");
-  }
-}
-
-const patch = (...args) => {
-  const [source, diff] = args;
-  const patched = structuredClone(source);
-  diffApply(patched, diff);
-  return patched;
-};
-const VerifyResultFactory = (issuedAt, expiredAt) => ({
-  create: (vc, jwt, verificationKey, validated = false) => {
-    const unverified = {
-      doc: vc,
-      issuedAt,
-      expiredAt,
-      algorithm: "ES256",
-      mediaType: "application/vc+jwt",
-      source: jwt
-    };
-    if (!verificationKey) return unverified;
-    return { ...unverified, verificationKey, validated };
-  }
-});
-const opId = {
-  /** CP 発行者 */
-  authority: "dns:cp-issuer.example.org",
-  /** PA 発行者 */
-  certifier: "dns:pa-issuer.example.org",
-  /** CA 発行者 */
-  originator: "dns:originator.example.org",
-  /** 無効な第三者 */
-  invalid: "dns:invalid.example.org"
-};
-const cp = {
-  "@context": [
-    "https://www.w3.org/ns/credentials/v2",
-    "https://originator-profile.org/ns/credentials/v1"
-  ],
-  type: ["VerifiableCredential", "CoreProfile"],
-  issuer: opId.authority,
-  credentialSubject: {
-    id: opId.originator,
-    type: "Core",
-    jwks: {
-      keys: []
-    }
-  }
-};
-const certificate = {
-  "@context": [
-    "https://www.w3.org/ns/credentials/v2",
-    "https://originator-profile.org/ns/credentials/v1",
-    "https://originator-profile.org/ns/cip/v1",
-    {
-      "@language": "ja"
-    }
-  ],
-  type: ["VerifiableCredential", "Certificate"],
-  issuer: opId.certifier,
-  credentialSubject: {
-    id: opId.originator,
-    type: "CertificateProperties",
-    description: "Example Certificate",
-    certificationSystem: {
-      id: "urn:uuid:de5d6e80-10a5-404f-b4d3-e9f0e6926a21",
-      type: "CertificationSystem",
-      name: "Example Certification System",
-      description: "Example Certification System Description"
-    }
-  }
-};
-const wmp = {
-  "@context": [
-    "https://www.w3.org/ns/credentials/v2",
-    "https://originator-profile.org/ns/credentials/v1",
-    "https://originator-profile.org/ns/cip/v1",
-    {
-      "@language": "ja"
-    }
-  ],
-  type: ["VerifiableCredential", "WebMediaProfile"],
-  issuer: opId.authority,
-  credentialSubject: {
-    id: opId.originator,
-    type: "OnlineBusiness",
-    name: "Example OP Holder",
-    url: "https://op-originator.example.org/"
-  }
-};
-const wsp = {
-  "@context": [
-    "https://www.w3.org/ns/credentials/v2",
-    "https://originator-profile.org/ns/credentials/v1",
-    "https://originator-profile.org/ns/cip/v1",
-    {
-      "@language": "ja"
-    }
-  ],
-  type: ["VerifiableCredential", "WebsiteProfile"],
-  issuer: opId.originator,
-  credentialSubject: {
-    id: "https://originator.example.org",
-    type: "WebSite",
-    name: "Example Website",
-    description: "Example Website Description",
-    allowedOrigin: ["https://originator.example.org"]
-  }
-};
-const caId = "urn:uuid:78550fa7-f846-4e0f-ad5c-8d34461cb95b";
-const caUrl = new URL("https://www.example.org/articles/example");
-const article = {
-  "@context": [
-    "https://www.w3.org/ns/credentials/v2",
-    "https://originator-profile.org/ns/credentials/v1",
-    "https://originator-profile.org/ns/cip/v1",
-    { "@language": "ja" }
-  ],
-  type: ["VerifiableCredential", "ContentAttestation"],
-  issuer: opId.originator,
-  target: [],
-  allowedUrl: ["https://www.example.org/articles*"],
-  credentialSubject: {
-    id: caId,
-    type: "Article",
-    headline: "\u30C6\u30B9\u30C8\u8A18\u4E8B",
-    description: "\u8A18\u4E8B\u306E\u8AAC\u660E"
-  }
-};
-
-function getMappedKeys(ops) {
-  const groupedOps = Object.groupBy(
-    ops,
-    (op) => op.core.doc.credentialSubject.id
-  );
-  const keyMap = {};
-  for (const [opId, ops2] of Object.entries(groupedOps)) {
-    if (!ops2) continue;
-    const kidSet = /* @__PURE__ */ new Set();
-    const keys = ops2.flatMap((op) => op.core.doc.credentialSubject.jwks.keys).filter(({ kid }) => !kidSet.has(kid) && kidSet.add(kid));
-    keyMap[opId] = { keys };
-  }
-  return keyMap;
-}
-function getTupledKeys(ops) {
-  const keyMap = getMappedKeys(ops);
-  const kidSet = /* @__PURE__ */ new Set();
-  const opId = Object.keys(keyMap);
-  const keys = Object.values(keyMap).flatMap((jwks) => jwks.keys).filter(({ kid }) => !kidSet.has(kid) && kidSet.add(kid));
-  return [opId.length === 1 ? opId[0] : opId, cryptography.LocalKeys({ keys })];
-}
-
-class OpsInvalid extends Error {
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-  static get code() {
-    return "ERR_ORIGINATOR_PROFILE_SET_INVALID";
-  }
-  code = OpsInvalid.code;
-}
-class OpInvalid extends Error {
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-  static get code() {
-    return "ERR_ORIGINATOR_PROFILE_INVALID";
-  }
-  code = OpInvalid.code;
-}
-class CoreProfileNotFound extends Error {
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-  static get code() {
-    return "ERR_CORE_PROFILE_NOT_FOUND";
-  }
-  code = CoreProfileNotFound.code;
-}
-class OpsVerifyFailed extends Error {
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-  static get code() {
-    return "ERR_ORIGINATOR_PROFILE_SET_VERIFY_FAILED";
-  }
-  code = OpsVerifyFailed.code;
-}
-class OpVerifyFailed extends Error {
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-  static get code() {
-    return "ERR_ORIGINATOR_PROFILE_VERIFY_FAILED";
-  }
-  code = OpVerifyFailed.code;
-}
-class CertificateExpired extends Error {
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-  static get code() {
-    return "ERR_CERTIFICATE_EXPIRED";
-  }
-  code = CertificateExpired.code;
-}
-
-const isEveryDecodedPa = (annotations) => annotations.every((annotation) => "doc" in annotation);
-const isEveryDecodedWmp = (media) => media.every((m) => "doc" in m);
-const validateDecodedOp = (core, annotations, media, resultOp) => {
-  if (annotations && !isEveryDecodedPa(annotations)) {
-    return new OpInvalid("Profile Annotation decode failed", resultOp);
-  }
-  if (media && !isEveryDecodedWmp(media)) {
-    return new OpInvalid("Web Media Profile decode failed", resultOp);
-  }
-  if (media && media.some(
-    (m) => core.doc.credentialSubject.id !== m.doc.credentialSubject.id
-  )) {
-    return new OpInvalid(
-      "Subject mismatch between Core Profile and Web Media Profile",
-      resultOp
-    );
-  }
-  if (annotations && annotations.some(
-    (annotation) => core.doc.credentialSubject.id !== annotation.doc.credentialSubject.id
-  )) {
-    return new OpInvalid(
-      "Subject mismatch between Core Profile and Profile Annotation",
-      resultOp
-    );
-  }
-  return { type: "valid", annotations, media };
-};
-const isDecodedOps = (ops) => ops.every((op) => !(op instanceof OpInvalid));
-function decodeOps(ops) {
-  const decodeCp = securingMechanism.JwtVcDecoder();
-  const decodePa = securingMechanism.JwtVcDecoder();
-  const decodeWmp = securingMechanism.JwtVcDecoder();
-  const resultOps = ops.map((op) => {
-    const core = decodeCp(op.core);
-    const annotations = op.annotations ? op.annotations.map(decodePa) : void 0;
-    const mediaInput = op.media;
-    const mediaArray = mediaInput ? Array.isArray(mediaInput) ? mediaInput : [mediaInput] : void 0;
-    const media = mediaArray ? mediaArray.map(decodeWmp) : void 0;
-    const resultOp = { core, annotations, media };
-    if (core instanceof Error) {
-      return new OpInvalid("Core Profile decode failed", resultOp);
-    }
-    const validated = validateDecodedOp(core, annotations, media, resultOp);
-    if (validated instanceof OpInvalid) {
-      return validated;
-    }
-    return {
-      core,
-      annotations: validated.annotations,
-      media: validated.media
-    };
-  });
-  if (!isDecodedOps(resultOps)) {
-    return new OpsInvalid("Invalid Originator Profile Set", resultOps);
-  }
-  return resultOps;
-}
-
-function OpVerifier(paOrWmpIssuerKeys, vc, validator) {
-  const issuer = vc.doc.issuer;
-  const jwks = paOrWmpIssuerKeys[issuer];
-  if (!jwks) {
-    return async () => new CoreProfileNotFound(`Missing Core Profile (${issuer})`, vc);
-  }
-  const cpKeys = cryptography.LocalKeys(jwks);
-  return securingMechanism.JwtVcVerifier(cpKeys, issuer, validator);
-}
-function validateCertificateExpiry(verifiedVc) {
-  const now = /* @__PURE__ */ new Date();
-  const validFrom = verifiedVc.doc.validFrom ? new Date(verifiedVc.doc.validFrom) : null;
-  const validUntil = verifiedVc.doc.validUntil ? new Date(verifiedVc.doc.validUntil) : null;
-  if (validFrom && now < validFrom) {
-    return new CertificateExpired("Certificate not yet valid", verifiedVc);
-  }
-  if (validUntil && now > validUntil) {
-    return new CertificateExpired("Certificate expired", verifiedVc);
-  }
-  return verifiedVc;
-}
-async function verifyAnnotations(paIssuerKeys, annotations, validator) {
-  if (!annotations) return;
-  return await Promise.all(
-    annotations.map(async (annotation) => {
-      const verify = OpVerifier(
-        paIssuerKeys,
-        annotation,
-        validator?.(zod.z.union([model.Certificate, model.JapaneseExistenceCertificate]))
-      );
-      const result = await verify(annotation.source);
-      if (result instanceof Error) {
-        return result;
-      }
-      const valid = validateCertificateExpiry(result);
-      if (valid instanceof CertificateExpired) {
-        return valid;
-      }
-      await verifyImageDigestSri(
-        valid.doc.credentialSubject.image
-      );
-      return valid;
-    })
-  );
-}
-async function verifyMedia(wmpIssuerKeys, media, validator) {
-  if (!media) return;
-  return await Promise.all(
-    media.map(async (m) => {
-      const verify = OpVerifier(
-        wmpIssuerKeys,
-        m,
-        validator?.(model.WebMediaProfile)
-      );
-      const result = await verify(m.source);
-      if (result instanceof Error) {
-        return result;
-      }
-      await verifyImageDigestSri(result.doc.credentialSubject.logo);
-      return result;
-    })
-  );
-}
-const isVerifiedOps = (ops) => ops.every((op) => !(op instanceof OpVerifyFailed));
-function OpsVerifier(ops, keys, issuer, validator) {
-  const decoded = decodeOps(ops);
-  const verifyCp = securingMechanism.JwtVcVerifier(
-    keys,
-    issuer,
-    validator?.(model.CoreProfile)
-  );
-  async function verify() {
-    if (decoded instanceof OpsInvalid) {
-      return decoded;
-    }
-    const paOrWmpIssuerKeys = getMappedKeys(decoded);
-    const resultOps = await Promise.all(
-      decoded.map(async (op) => {
-        const core = await verifyCp(op.core.source);
-        const annotations = await verifyAnnotations(
-          paOrWmpIssuerKeys,
-          op.annotations,
-          validator
-        );
-        const media = await verifyMedia(paOrWmpIssuerKeys, op.media, validator);
-        const resultOp = { core, annotations, media };
-        if (core instanceof Error) {
-          return new OpVerifyFailed("Core Profile verify failed", resultOp);
-        }
-        if (annotations && annotations.some((annotation) => annotation instanceof Error)) {
-          return new OpVerifyFailed(
-            "Profile Annotation verify failed",
-            resultOp
-          );
-        }
-        if (media && media.some((m) => m instanceof Error)) {
-          return new OpVerifyFailed(
-            "Web Media Profile verify failed",
-            resultOp
-          );
-        }
-        return resultOp;
-      })
-    );
-    if (!isVerifiedOps(resultOps)) {
-      return new OpsVerifyFailed(
-        "Originator Profile Set verify failed",
-        resultOps
-      );
-    }
-    return resultOps;
-  }
-  return verify;
-}
-
-class SiteProfileInvalid extends Error {
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-  static get code() {
-    return "ERR_SITE_PROFILE_INVALID";
-  }
-  code = SiteProfileInvalid.code;
-}
-class SiteProfileVerifyFailed extends Error {
-  constructor(message, result) {
-    super(message);
-    this.result = result;
-  }
-  static get code() {
-    return "ERR_SITE_PROFILE_VERIFY_FAILED";
-  }
-  code = SiteProfileVerifyFailed.code;
-}
-
-const decodeWebsiteProfiles = (sp, opsVerified) => {
-  const wspSources = sp.sites || (sp.credential ? [sp.credential] : []);
-  if (wspSources.length === 0) {
-    return new SiteProfileInvalid("No Website Profile found", {
-      originators: opsVerified,
-      sites: []
-    });
-  }
-  const decodeWsp = securingMechanism.JwtVcDecoder();
-  const decodedWsps = wspSources.map(decodeWsp);
-  const decodeErrors = decodedWsps.filter((wsp) => wsp instanceof Error);
-  if (decodeErrors.length > 0) {
-    return new SiteProfileInvalid("Website Profile invalid", {
-      originators: opsVerified,
-      sites: decodeErrors
-    });
-  }
-  return {
-    decodedWsps,
-    wspSources
-  };
-};
-function SpVerifier(sp, keys, issuer, origin, verifyOrigin = true, validator) {
-  async function verify() {
-    const verifyOps = OpsVerifier(sp.originators, keys, issuer, validator);
-    const opsVerified = await verifyOps();
-    if (opsVerified instanceof OpsInvalid) {
-      return new SiteProfileInvalid("Originator Profile Set invalid", {
-        originators: opsVerified,
-        sites: []
-      });
-    }
-    if (opsVerified instanceof OpsVerifyFailed) {
-      return new SiteProfileVerifyFailed(
-        "Originator Profile Set verify failed",
-        { originators: opsVerified, sites: [] }
-      );
-    }
-    const decoded = decodeWebsiteProfiles(sp, opsVerified);
-    if (decoded instanceof SiteProfileInvalid) {
-      return decoded;
-    }
-    const { decodedWsps, wspSources } = decoded;
-    const verifiedWsps = await Promise.all(
-      decodedWsps.map(async (decodedWsp, index) => {
-        if (decodedWsp instanceof Error) {
-          return decodedWsp;
-        }
-        const wspIssuer = decodedWsp.doc.issuer;
-        const cp = opsVerified.find(
-          (op) => op.core.doc.credentialSubject.id === wspIssuer
-        );
-        if (!cp) {
-          return new CoreProfileNotFound(
-            `Missing Core Profile (${wspIssuer})`,
-            decodedWsp
-          );
-        }
-        const verifyWsp = securingMechanism.JwtVcVerifier(
-          cryptography.LocalKeys(cp.core.doc.credentialSubject.jwks),
-          cp.core.doc.credentialSubject.id,
-          validator?.(model.WebsiteProfile)
-        );
-        const verified = await verifyWsp(wspSources[index]);
-        if (verified instanceof Error) {
-          return verified;
-        }
-        if (verifyOrigin) {
-          const allowedOrigin = "allowedOrigin" in verified.doc.credentialSubject ? verified.doc.credentialSubject.allowedOrigin : verified.doc.credentialSubject.url;
-          if (!verifyAllowedOrigin(origin, allowedOrigin)) {
-            return new Error("Origin not allowed");
-          }
-        }
-        await verifyImageDigestSri(verified.doc.credentialSubject.image);
-        return verified;
-      })
-    );
-    const hasCoreProfileNotFound = verifiedWsps.some(
-      (wsp) => wsp instanceof CoreProfileNotFound
-    );
-    if (hasCoreProfileNotFound) {
-      return new SiteProfileInvalid("Appropriate Core Profile not found", {
-        originators: opsVerified,
-        sites: verifiedWsps
-      });
-    }
-    const hasError = verifiedWsps.some((wsp) => wsp instanceof Error);
-    if (hasError) {
-      return new SiteProfileVerifyFailed("Website Profile verify failed", {
-        originators: opsVerified,
-        sites: verifiedWsps
-      });
-    }
-    return {
-      originators: opsVerified,
-      sites: verifiedWsps
-    };
-  }
-  return verify;
-}
-
-exports.CaInvalid = CaInvalid;
-exports.CaVerifier = CaVerifier;
-exports.CaVerifyFailed = CaVerifyFailed;
-exports.CasVerifyFailed = CasVerifyFailed;
-exports.CertificateExpired = CertificateExpired;
-exports.CoreProfileNotFound = CoreProfileNotFound;
-exports.IntegrityFetchFailed = IntegrityFetchFailed;
-exports.IntegrityVerificationFailed = IntegrityVerificationFailed;
-exports.OpInvalid = OpInvalid;
-exports.OpVerifyFailed = OpVerifyFailed;
-exports.OpsInvalid = OpsInvalid;
-exports.OpsVerifier = OpsVerifier;
-exports.OpsVerifyFailed = OpsVerifyFailed;
-exports.SiteProfileInvalid = SiteProfileInvalid;
-exports.SiteProfileVerifyFailed = SiteProfileVerifyFailed;
-exports.SpVerifier = SpVerifier;
-exports.TargetIntegrityAlgorithm = TargetIntegrityAlgorithm;
-exports.VerifyResultFactory = VerifyResultFactory;
-exports.article = article;
-exports.caId = caId;
-exports.caUrl = caUrl;
-exports.certificate = certificate;
-exports.cp = cp;
-exports.decodeOps = decodeOps;
-exports.getMappedKeys = getMappedKeys;
-exports.getTupledKeys = getTupledKeys;
-exports.normalizeCasItem = normalizeCasItem;
-exports.opId = opId;
-exports.patch = patch;
-exports.verifyAllowedOrigin = verifyAllowedOrigin;
-exports.verifyCas = verifyCas;
-exports.verifyDigestSri = verifyDigestSri;
-exports.verifyImageDigestSri = verifyImageDigestSri;
-exports.verifyIntegrity = verifyIntegrity;
-exports.wmp = wmp;
-exports.wsp = wsp;