@originator-profile/verify 0.7.0-beta.4 → 0.7.0-beta.5

package/dist/index.js

@@ -1,5 +1,5 @@
 import { JwtVcVerifier, VcValidateFailed, VcVerifyFailed, JwtVcDecoder } from '@originator-profile/securing-mechanism';
-import { createDigestSri, selectByIntegrity, fetchExternalResource, selectByCss, fetchVisibleTextContent, fetchTextContent, fetchHtmlContent, FetchFailed } from '@originator-profile/sign';
+import { createDigestSri, selectByCssOrIntegrity, fetchExternalResource, selectByCss, fetchVisibleTextContent, fetchTextContent, fetchHtmlContent, FetchFailed } from '@originator-profile/sign';
 import { LocalKeys } from '@originator-profile/cryptography';
 import { ContentAttestation, JapaneseExistencePA, ProfileAnnotationIssuerRegistration, ProfileAnnotation, JapaneseExistenceCertificate, Certificate, WebMediaProfile, CoreProfile, WebsiteProfile } from '@originator-profile/model';
 import { z } from 'zod';
@@ -299,6 +299,27 @@ async function createIntegrityMetadataSet(hashAlgorithms, data, options = {
   return new IntegrityMetadataSet(set, options);
 }
 
+const REFERENCE = "https://docs.originator-profile.org/error-reference/";
+const problemType = (code) => `${REFERENCE}${code}/`;
+const ProblemType = {
+  /** 非推奨の Certificate を検出した */
+  CertificateDeprecated: problemType("WARN_CERTIFICATE_DEPRECATED"),
+  /** Content Attestation の allowedOrigin は非推奨 */
+  AllowedOriginDeprecated: problemType("WARN_ALLOWED_ORIGIN_DEPRECATED"),
+  /** Content Attestation の VisibleTextTargetIntegrity は非推奨 */
+  VisibleTextTargetIntegrityDeprecated: problemType(
+    "WARN_VISIBLE_TEXT_TARGET_INTEGRITY_DEPRECATED"
+  ),
+  /** digestSRI が設定されていない */
+  DigestSriMissing: problemType("WARN_DIGEST_SRI_MISSING"),
+  /** digestSRI の検証に失敗した */
+  DigestSriInvalid: problemType("WARN_DIGEST_SRI_INVALID"),
+  /** Profile Annotation Issuer がその認証制度の発行を認可されていない */
+  PaIssuerNotRegistered: problemType("INFO_PA_ISSUER_NOT_REGISTERED"),
+  /** 種類が特定されていない通知 */
+  Unspecified: problemType("UNSPECIFIED")
+};
+
 const WARN_SUFFIX = `This will become an error after 2027. See: https://docs.originator-profile.org/en/opb/context/#the-image-datatype`;
 async function verifyDigestSri(content, fetcher = fetch) {
   const integrity = new IntegrityMetadataSet(content.digestSRI);
@@ -316,10 +337,16 @@ async function verifyDigestSri(content, fetcher = fetch) {
   }
 }
 async function verifyImageDigestSri(value, options = {}) {
-  const { fetcher = fetch, logger = console } = options;
+  const { fetcher = fetch, logger = console, at } = options;
   if (!value) return;
   if (!value.digestSRI) {
-    logger.warn(`digestSRI is missing. ${WARN_SUFFIX}`);
+    const message = `digestSRI is missing. ${WARN_SUFFIX}`;
+    logger.warn(message, {
+      type: ProblemType.DigestSriMissing,
+      title: message,
+      detail: value.id,
+      ...at && { pointer: at }
+    });
     return;
   }
   const valid = await verifyDigestSri(
@@ -327,7 +354,13 @@ async function verifyImageDigestSri(value, options = {}) {
     fetcher
   );
   if (!valid) {
-    logger.warn(`digestSRI verification failed. ${WARN_SUFFIX}`);
+    const message = `digestSRI verification failed. ${WARN_SUFFIX}`;
+    logger.warn(message, {
+      type: ProblemType.DigestSriInvalid,
+      title: message,
+      detail: value.id,
+      ...at && { pointer: at }
+    });
   }
 }
 
@@ -395,7 +428,7 @@ const TargetIntegrityAlgorithm = {
   },
   ExternalResourceTargetIntegrity: {
     contentFetcher: fetchExternalResource,
-    elementSelector: selectByIntegrity
+    elementSelector: selectByCssOrIntegrity
   }
 };
 async function verifyIntegrity(content, doc = document, fetcher = fetch) {
@@ -447,14 +480,42 @@ async function verifyAllowedUrl(url, allowedUrl) {
   });
 }
 
-async function checkUrlAndOrigin(result, url) {
+function warnAllowedOriginDeprecated(logger, subject, at) {
+  const message = "[OP Warning] allowedOrigin is deprecated in Content Attestation and will be removed after September 2026. Please use allowedUrl instead. See: https://docs.originator-profile.org/";
+  logger.warn(message, {
+    type: ProblemType.AllowedOriginDeprecated,
+    title: message,
+    detail: subject,
+    ...at && { pointer: at }
+  });
+}
+function warnVisibleTextTargetIntegrityDeprecated(logger, subject, at) {
+  const message = `[OP Warning] VisibleTextTargetIntegrity is deprecated in Content Attestation and will be removed after October 2027. innerText-based rendering is platform-dependent and incompatible across browser implementations and cannot serve as a basis for integrity verification. See: https://docs.originator-profile.org/opb/content-integrity-descriptor/visible-text/`;
+  logger.warn(message, {
+    type: ProblemType.VisibleTextTargetIntegrityDeprecated,
+    title: message,
+    detail: subject,
+    ...at && { pointer: at }
+  });
+}
+function warnDeprecatedTargets(result, logger, at) {
+  const hasVisibleTextTarget = result.doc.target?.some(
+    (t) => t.type === "VisibleTextTargetIntegrity"
+  );
+  if (hasVisibleTextTarget) {
+    warnVisibleTextTargetIntegrityDeprecated(
+      logger,
+      result.doc.credentialSubject.id,
+      at
+    );
+  }
+}
+async function checkUrlAndOrigin(result, url, logger, at) {
   if (result.doc.allowedUrl && result.doc.allowedOrigin) {
     return new CaInvalid("allowedUrl and allowedOrigin are exclusive", result);
   }
   if (result.doc.allowedOrigin) {
-    console.warn(
-      "[OP Warning] allowedOrigin is deprecated in Content Attestation and will be removed after September 2026. Please use allowedUrl instead. See: https://docs.originator-profile.org/"
-    );
+    warnAllowedOriginDeprecated(logger, result.doc.credentialSubject.id, at);
   }
   if (result.doc.allowedUrl && !await verifyAllowedUrl(url.toString(), result.doc.allowedUrl)) {
     return new CaVerifyFailed(
@@ -496,7 +557,7 @@ function checkIntegrityResults(integrityResults, urlResult) {
     );
   }
 }
-function CaVerifier(ca, keys, issuer, url, verifyIntegrity$1 = verifyIntegrity, validator) {
+function CaVerifier(ca, keys, issuer, url, verifyIntegrity$1 = verifyIntegrity, validator, logger = console, at) {
   const verifyCa = JwtVcVerifier(keys, issuer, validator);
   return async () => {
     const result = await verifyCa(ca);
@@ -506,17 +567,19 @@ function CaVerifier(ca, keys, issuer, url, verifyIntegrity$1 = verifyIntegrity,
     if (result instanceof VcVerifyFailed) {
       return new CaVerifyFailed("Content Attestation verify failed", result);
     }
-    const urlResult = await checkUrlAndOrigin(result, url);
+    const urlResult = await checkUrlAndOrigin(result, url, logger, at);
     if (urlResult instanceof Error) {
       return urlResult;
     }
     await verifyImageDigestSri(
-      urlResult.doc.credentialSubject.image
+      urlResult.doc.credentialSubject.image,
+      { logger, ...at && { at } }
     );
     if (urlResult.doc.target) {
       if (urlResult.doc.target.length === 0) {
         return new CaInvalid("Target is empty", urlResult);
       }
+      warnDeprecatedTargets(urlResult, logger, at);
       const integrityResults = await Promise.all(
         urlResult.doc.target.map(async (t, index) => ({
           index,
@@ -569,10 +632,17 @@ function normalizeCasItem(ca) {
   return { main: false, attestation: ca };
 }
 
-async function verifyCas(cas, verifiedOps, url, verifyIntegrity, validator) {
+const append = (path, segments) => segments.reduce(
+  (acc, segment) => typeof segment === "number" ? `${acc}[${segment}]` : `${acc}.${segment}`,
+  path
+);
+const pointer = (...segments) => append("$", segments);
+const childPointer = (base, ...segments) => append(base, segments);
+
+async function verifyCas(cas, verifiedOps, url, verifyIntegrity, validator, logger, at) {
   const decodeCa = JwtVcDecoder();
   const resultCas = await Promise.all(
-    cas.map(async (ca) => {
+    cas.map(async (ca, index) => {
       const { main, attestation: source } = normalizeCasItem(ca);
       const decodedCa = decodeCa(source);
       if (decodedCa instanceof Error) {
@@ -596,7 +666,9 @@ async function verifyCas(cas, verifiedOps, url, verifyIntegrity, validator) {
         decodedCa.doc.issuer,
         new URL(url),
         verifyIntegrity,
-        validator?.(ContentAttestation)
+        validator?.(ContentAttestation),
+        logger,
+        at ? childPointer(at, "cas", index, "attestation") : void 0
       );
       return { main, attestation: await verify() };
     })
@@ -612,244 +684,6 @@ async function verifyCas(cas, verifiedOps, url, verifyIntegrity, validator) {
   return resultCas;
 }
 
-var REMOVE = "remove";
-var REPLACE = "replace";
-var ADD = "add";
-var MOVE = "move";
-function diffApply(obj, diff, pathConverter) {
-  if (!obj || typeof obj != "object") {
-    throw new Error("base object must be an object or an array");
-  }
-  if (!Array.isArray(diff)) {
-    throw new Error("diff must be an array");
-  }
-  var diffLength = diff.length;
-  for (var i = 0; i < diffLength; i++) {
-    var thisDiff = diff[i];
-    var subObject = obj;
-    var thisOp = thisDiff.op;
-    var thisPath = transformPath(pathConverter, thisDiff.path);
-    var thisFromPath = thisDiff.from && transformPath(pathConverter, thisDiff.from);
-    var toPath, toPathCopy, lastToProp, subToObject, valueToMove;
-    if (thisFromPath) {
-      toPath = thisPath;
-      thisPath = thisFromPath;
-      toPathCopy = toPath.slice();
-      lastToProp = toPathCopy.pop();
-      prototypeCheck(lastToProp);
-      if (lastToProp == null) {
-        return false;
-      }
-      var thisToProp;
-      while ((thisToProp = toPathCopy.shift()) != null) {
-        prototypeCheck(thisToProp);
-        if (!(thisToProp in subToObject)) {
-          subToObject[thisToProp] = {};
-        }
-        subToObject = subToObject[thisToProp];
-      }
-    }
-    var pathCopy = thisPath.slice();
-    var lastProp = pathCopy.pop();
-    prototypeCheck(lastProp);
-    if (lastProp == null) {
-      return false;
-    }
-    var thisProp;
-    while ((thisProp = pathCopy.shift()) != null) {
-      prototypeCheck(thisProp);
-      if (!(thisProp in subObject)) {
-        subObject[thisProp] = {};
-      }
-      subObject = subObject[thisProp];
-    }
-    if (thisOp === REMOVE || thisOp === REPLACE || thisOp === MOVE) {
-      var path = thisOp === MOVE ? thisDiff.from : thisDiff.path;
-      if (!subObject.hasOwnProperty(lastProp)) {
-        throw new Error(["expected to find property", path, "in object", obj].join(" "));
-      }
-    }
-    if (thisOp === REMOVE || thisOp === MOVE) {
-      if (thisOp === MOVE) {
-        valueToMove = subObject[lastProp];
-      }
-      Array.isArray(subObject) ? subObject.splice(lastProp, 1) : delete subObject[lastProp];
-    }
-    if (thisOp === REPLACE || thisOp === ADD) {
-      subObject[lastProp] = thisDiff.value;
-    }
-    if (thisOp === MOVE) {
-      subObject[lastToProp] = valueToMove;
-    }
-  }
-  return subObject;
-}
-function transformPath(pathConverter, thisPath) {
-  {
-    if (!Array.isArray(thisPath)) {
-      throw new Error([
-        "diff path",
-        thisPath,
-        "must be an array, consider supplying a path converter"
-      ].join(" "));
-    }
-  }
-  return thisPath;
-}
-function prototypeCheck(prop) {
-  if (prop == "__proto__" || prop == "constructor" || prop == "prototype") {
-    throw new Error("setting of prototype values not supported");
-  }
-}
-
-const patch = (...args) => {
-  const [source, diff] = args;
-  const patched = structuredClone(source);
-  diffApply(patched, diff);
-  return patched;
-};
-const VerifyResultFactory = (issuedAt, expiredAt) => ({
-  create: (vc, jwt, verificationKey, validated = false) => {
-    const unverified = {
-      doc: vc,
-      issuedAt,
-      expiredAt,
-      algorithm: "ES256",
-      mediaType: "application/vc+jwt",
-      source: jwt
-    };
-    if (!verificationKey) return unverified;
-    return { ...unverified, verificationKey, validated };
-  }
-});
-const opId = {
-  /** CP 発行者 */
-  authority: "dns:cp-issuer.example.org",
-  /** PA 発行者 */
-  certifier: "dns:pa-issuer.example.org",
-  /** CA 発行者 */
-  originator: "dns:originator.example.org",
-  /** 無効な第三者 */
-  invalid: "dns:invalid.example.org"
-};
-const cp = {
-  "@context": [
-    "https://www.w3.org/ns/credentials/v2",
-    "https://originator-profile.org/ns/credentials/v1"
-  ],
-  type: ["VerifiableCredential", "CoreProfile"],
-  issuer: opId.authority,
-  credentialSubject: {
-    id: opId.originator,
-    type: "Core",
-    jwks: {
-      keys: []
-    }
-  }
-};
-const certificate = {
-  "@context": [
-    "https://www.w3.org/ns/credentials/v2",
-    "https://originator-profile.org/ns/credentials/v1",
-    "https://originator-profile.org/ns/cip/v1",
-    {
-      "@language": "ja"
-    }
-  ],
-  type: ["VerifiableCredential", "Certificate"],
-  issuer: opId.certifier,
-  credentialSubject: {
-    id: opId.originator,
-    type: "CertificateProperties",
-    description: "Example Certificate",
-    certificationSystem: {
-      id: "urn:uuid:de5d6e80-10a5-404f-b4d3-e9f0e6926a21",
-      type: "CertificationSystem",
-      name: "Example Certification System",
-      description: "Example Certification System Description"
-    }
-  }
-};
-const wmp = {
-  "@context": [
-    "https://www.w3.org/ns/credentials/v2",
-    "https://originator-profile.org/ns/credentials/v1",
-    "https://originator-profile.org/ns/cip/v1",
-    {
-      "@language": "ja"
-    }
-  ],
-  type: ["VerifiableCredential", "WebMediaProfile"],
-  issuer: opId.authority,
-  credentialSubject: {
-    id: opId.originator,
-    type: "OnlineBusiness",
-    name: "Example OP Holder",
-    url: "https://op-originator.example.org/"
-  }
-};
-const wsp = {
-  "@context": [
-    "https://www.w3.org/ns/credentials/v2",
-    "https://originator-profile.org/ns/credentials/v1",
-    "https://originator-profile.org/ns/cip/v1",
-    {
-      "@language": "ja"
-    }
-  ],
-  type: ["VerifiableCredential", "WebsiteProfile"],
-  issuer: opId.originator,
-  credentialSubject: {
-    id: "https://originator.example.org",
-    type: "WebSite",
-    name: "Example Website",
-    description: "Example Website Description",
-    allowedOrigin: ["https://originator.example.org"]
-  }
-};
-const caId = "urn:uuid:78550fa7-f846-4e0f-ad5c-8d34461cb95b";
-const caUrl = new URL("https://www.example.org/articles/example");
-const article = {
-  "@context": [
-    "https://www.w3.org/ns/credentials/v2",
-    "https://originator-profile.org/ns/credentials/v1",
-    "https://originator-profile.org/ns/cip/v1",
-    { "@language": "ja" }
-  ],
-  type: ["VerifiableCredential", "ContentAttestation"],
-  issuer: opId.originator,
-  target: [],
-  allowedUrl: ["https://www.example.org/articles*"],
-  credentialSubject: {
-    id: caId,
-    type: "Article",
-    headline: "\u30C6\u30B9\u30C8\u8A18\u4E8B",
-    description: "\u8A18\u4E8B\u306E\u8AAC\u660E"
-  }
-};
-
-function getMappedKeys(ops) {
-  const groupedOps = Object.groupBy(
-    ops,
-    (op) => op.core.doc.credentialSubject.id
-  );
-  const keyMap = {};
-  for (const [opId, ops2] of Object.entries(groupedOps)) {
-    if (!ops2) continue;
-    const kidSet = /* @__PURE__ */ new Set();
-    const keys = ops2.flatMap((op) => op.core.doc.credentialSubject.jwks.keys).filter(({ kid }) => !kidSet.has(kid) && kidSet.add(kid));
-    keyMap[opId] = { keys };
-  }
-  return keyMap;
-}
-function getTupledKeys(ops) {
-  const keyMap = getMappedKeys(ops);
-  const kidSet = /* @__PURE__ */ new Set();
-  const opId = Object.keys(keyMap);
-  const keys = Object.values(keyMap).flatMap((jwks) => jwks.keys).filter(({ kid }) => !kidSet.has(kid) && kidSet.add(kid));
-  return [opId.length === 1 ? opId[0] : opId, LocalKeys({ keys })];
-}
-
 class OpsInvalid extends Error {
   constructor(message, result) {
     super(message);
@@ -1029,16 +863,27 @@ function reportUnauthorizedAnnotation({
   const { doc } = annotation;
   const { issuer: profileAnnotationIssuer } = doc;
   const location = `OP[${opIndex}].PA[${paIndex}]`;
+  const at = pointer("originators", opIndex, "annotations", paIndex);
   if (!isProfileAnnotation(doc)) {
-    logger.warn(`Certificate is deprecated (${location})`);
+    const message = `Certificate is deprecated (${location})`;
+    logger.warn(message, {
+      type: ProblemType.CertificateDeprecated,
+      title: message,
+      pointer: at
+    });
     return;
   }
   const policyId = getAnnotationPolicy(doc)?.id;
   const isAllowed = policyId && policy.get(profileAnnotationIssuer)?.has(policyId);
   if (!isAllowed) {
-    logger.info(
-      `Profile Annotation Issuer is not registered for this annotation scheme (${location} issuer: ${profileAnnotationIssuer}, scheme: ${policyId ?? "unknown"})`
-    );
+    const scheme = policyId ?? "unknown";
+    const message = `Profile Annotation Issuer is not registered for this annotation scheme (${location} issuer: ${profileAnnotationIssuer}, scheme: ${scheme})`;
+    logger.info(message, {
+      type: ProblemType.PaIssuerNotRegistered,
+      title: message,
+      detail: `issuer: ${profileAnnotationIssuer}, scheme: ${scheme}`,
+      pointer: at
+    });
   }
 }
 function verifyAnnotationIssuerRegistration(verifiedOps, paIssuerRegistrationIssuer, logger = console) {
@@ -1063,7 +908,29 @@ function verifyAnnotationIssuerRegistration(verifiedOps, paIssuerRegistrationIss
   return verifiedOps;
 }
 
-function OpVerifier(paOrWmpIssuerKeys, vc, validator) {
+function getMappedKeys(ops) {
+  const groupedOps = Object.groupBy(
+    ops,
+    (op) => op.core.doc.credentialSubject.id
+  );
+  const keyMap = {};
+  for (const [opId, ops2] of Object.entries(groupedOps)) {
+    if (!ops2) continue;
+    const kidSet = /* @__PURE__ */ new Set();
+    const keys = ops2.flatMap((op) => op.core.doc.credentialSubject.jwks.keys).filter(({ kid }) => !kidSet.has(kid) && kidSet.add(kid));
+    keyMap[opId] = { keys };
+  }
+  return keyMap;
+}
+function getTupledKeys(ops) {
+  const keyMap = getMappedKeys(ops);
+  const kidSet = /* @__PURE__ */ new Set();
+  const opId = Object.keys(keyMap);
+  const keys = Object.values(keyMap).flatMap((jwks) => jwks.keys).filter(({ kid }) => !kidSet.has(kid) && kidSet.add(kid));
+  return [opId.length === 1 ? opId[0] : opId, LocalKeys({ keys })];
+}
+
+function OpVerifier(paOrWmpIssuerKeys, vc, validator) {
   const issuer = vc.doc.issuer;
   const jwks = paOrWmpIssuerKeys[issuer];
   if (!jwks) {
@@ -1086,10 +953,10 @@ function validateCertificateExpiry(verifiedVc) {
   return verifiedVc;
 }
 async function verifyAnnotations(paIssuerKeys, annotations, options = {}) {
-  const { validator, logger = console } = options;
+  const { validator, logger = console, at } = options;
   if (!annotations) return;
   return await Promise.all(
-    annotations.map(async (annotation) => {
+    annotations.map(async (annotation, index) => {
       const verify = OpVerifier(
         paIssuerKeys,
         annotation,
@@ -1113,7 +980,8 @@ async function verifyAnnotations(paIssuerKeys, annotations, options = {}) {
         return valid;
       }
       await verifyImageDigestSri(valid.doc.credentialSubject.image, {
-        logger
+        logger,
+        ...at && { at: childPointer(at, "annotations", index) }
       });
       return valid;
     })
@@ -1121,10 +989,10 @@ async function verifyAnnotations(paIssuerKeys, annotations, options = {}) {
 }
 
 async function verifyMedia(wmpIssuerKeys, media, options = {}) {
-  const { validator, logger = console } = options;
+  const { validator, logger = console, at } = options;
   if (!media) return;
   return await Promise.all(
-    media.map(async (m) => {
+    media.map(async (m, index) => {
       const verify = OpVerifier(
         wmpIssuerKeys,
         m,
@@ -1135,7 +1003,8 @@ async function verifyMedia(wmpIssuerKeys, media, options = {}) {
         return result;
       }
       await verifyImageDigestSri(result.doc.credentialSubject.logo, {
-        logger
+        logger,
+        ...at && { at: childPointer(at, "media", index) }
       });
       return result;
     })
@@ -1167,15 +1036,17 @@ function OpsVerifier(ops, keys, issuer, options = {}) {
     const paOrWmpIssuerKeys = getMappedKeys(decoded);
     const resultOps = await Promise.all(
       decoded.map(async (op, opIndex) => {
+        const at = pointer("originators", opIndex);
         const core = await verifyCp(op.core.source);
         const annotations = await verifyAnnotations(
           paOrWmpIssuerKeys,
           op.annotations,
-          { validator, logger }
+          { validator, logger, at }
         );
         const media = await verifyMedia(paOrWmpIssuerKeys, op.media, {
           validator,
-          logger
+          logger,
+          at
         });
         const resultOp = { core, annotations, media };
         if (core instanceof Error) {
@@ -1216,6 +1087,436 @@ function OpsVerifier(ops, keys, issuer, options = {}) {
   return verify;
 }
 
+const unspecified = (title) => ({
+  type: ProblemType.Unspecified,
+  title
+});
+function collectProblems(delegate = console) {
+  const warnings = [];
+  const info = [];
+  return {
+    logger: {
+      warn(message, details) {
+        delegate.warn(message);
+        warnings.push(details ?? unspecified(message));
+      },
+      info(message, details) {
+        delegate.info(message);
+        info.push(details ?? unspecified(message));
+      }
+    },
+    warnings,
+    info
+  };
+}
+
+const hasCode = (error) => "code" in error && typeof error.code === "string";
+const isObject$1 = (value) => typeof value === "object" && value !== null;
+const innerErrorOf = (error) => {
+  if (error.cause instanceof Error) return error.cause;
+  const result = "result" in error ? error.result : void 0;
+  return isObject$1(result) && result.error instanceof Error ? result.error : void 0;
+};
+function toProblemDetails(error, at) {
+  const pointer = at ? { pointer: at } : {};
+  if (!(error instanceof Error)) {
+    return { type: ProblemType.Unspecified, title: String(error), ...pointer };
+  }
+  const type = hasCode(error) ? problemType(error.code) : ProblemType.Unspecified;
+  const inner = innerErrorOf(error);
+  return inner ? { type, title: error.message, detail: inner.message, ...pointer } : { type, title: error.message, ...pointer };
+}
+
+const createCollector = () => ({
+  securingResults: [],
+  errors: []
+});
+const isObject = (value) => typeof value === "object" && value !== null;
+const failureOf = (error) => {
+  const result = "result" in error ? error.result : void 0;
+  return isObject(result) ? result : void 0;
+};
+const asRecord = (value) => isObject(value) ? value : void 0;
+const asString = (value) => typeof value === "string" ? value : void 0;
+const asIsoString = (value) => value instanceof Date ? value.toISOString() : void 0;
+const asJwk = (value) => isObject(value) ? value : void 0;
+const compact = (value) => Object.fromEntries(
+  Object.entries(value).filter(([, v]) => v !== void 0)
+);
+function toSecuringResult(vc, at, status) {
+  const doc = asRecord(vc?.doc);
+  return compact({
+    pointer: at,
+    status,
+    source: asString(vc?.source),
+    mediaType: asString(vc?.mediaType),
+    algorithm: asString(vc?.algorithm),
+    issuedAt: asIsoString(vc?.issuedAt),
+    expiredAt: asIsoString(vc?.expiredAt),
+    verificationKey: asJwk(vc?.verificationKey),
+    controller: asString(doc?.issuer)
+  });
+}
+function convertVc(value, at, collect) {
+  if (value instanceof Error) {
+    const failure = failureOf(value);
+    collect.securingResults.push(toSecuringResult(failure, at, false));
+    collect.errors.push(toProblemDetails(value, at));
+    return failure?.doc ?? null;
+  }
+  if (!isObject(value)) return null;
+  collect.securingResults.push(toSecuringResult(value, at, true));
+  return value.doc ?? null;
+}
+function convertOp(op, at, collect) {
+  if (op instanceof Error) {
+    collect.errors.push(toProblemDetails(op, at));
+  }
+  const source = op instanceof Error ? failureOf(op) : op;
+  if (!source) return { core: null };
+  return {
+    core: convertVc(
+      source.core,
+      childPointer(at, "core"),
+      collect
+    ),
+    ...source.annotations && {
+      annotations: source.annotations.map(
+        (annotation, index) => convertVc(
+          annotation,
+          childPointer(at, "annotations", index),
+          collect
+        )
+      )
+    },
+    ...source.media && {
+      media: source.media.map(
+        (m, index) => convertVc(
+          m,
+          childPointer(at, "media", index),
+          collect
+        )
+      )
+    }
+  };
+}
+function convertOps(ops, collect) {
+  if (ops instanceof Error) {
+    collect.errors.push(toProblemDetails(ops, pointer("originators")));
+  }
+  const list = ops instanceof Error ? failureOf(ops) : ops;
+  if (!Array.isArray(list)) return [];
+  return list.map(
+    (op, index) => convertOp(op, pointer("originators", index), collect)
+  );
+}
+function convertCas(cas, at, collect) {
+  return cas.map(({ main, attestation }, index) => ({
+    main,
+    attestation: convertVc(
+      attestation,
+      childPointer(at, "cas", index, "attestation"),
+      collect
+    )
+  }));
+}
+
+async function verifyDocuments(targets, options) {
+  const { registry, websiteOriginators, validator, logger } = options;
+  const { logger: collecting, warnings, info } = collectProblems(logger);
+  const collect = createCollector();
+  const opsVerifier = OpsVerifier(
+    [
+      ...registry.ops,
+      ...websiteOriginators ?? [],
+      ...targets.flatMap((target) => target.ops)
+    ],
+    registry.keys,
+    registry.issuer,
+    { validator, logger: collecting }
+  );
+  const verifiedOps = await opsVerifier();
+  if (verifiedOps instanceof OpsInvalid || verifiedOps instanceof OpsVerifyFailed) {
+    return {
+      status: false,
+      outcome: { originators: convertOps(verifiedOps, collect), documents: [] },
+      securingResults: collect.securingResults,
+      warnings,
+      info,
+      errors: [toProblemDetails(verifiedOps), ...collect.errors]
+    };
+  }
+  const results = await Promise.all(
+    targets.map(async (target, index) => {
+      const at = pointer("documents", index);
+      return {
+        target,
+        at,
+        cas: await verifyCas(
+          target.cas,
+          verifiedOps,
+          target.url,
+          target.verifyIntegrity,
+          validator,
+          collecting,
+          at
+        )
+      };
+    })
+  );
+  const outcome = {
+    originators: convertOps(verifiedOps, collect),
+    documents: results.map(({ target, at, cas }) => ({
+      target,
+      cas: convertCas(
+        cas instanceof CasVerifyFailed ? cas.result : cas,
+        at,
+        collect
+      )
+    }))
+  };
+  const failed = results.find(({ cas }) => cas instanceof CasVerifyFailed);
+  return failed ? {
+    status: false,
+    outcome,
+    securingResults: collect.securingResults,
+    warnings,
+    info,
+    errors: [toProblemDetails(failed.cas, failed.at), ...collect.errors]
+  } : {
+    status: true,
+    outcome,
+    securingResults: collect.securingResults,
+    warnings,
+    info
+  };
+}
+
+var REMOVE = "remove";
+var REPLACE = "replace";
+var ADD = "add";
+var MOVE = "move";
+function diffApply(obj, diff, pathConverter) {
+  if (!obj || typeof obj != "object") {
+    throw new Error("base object must be an object or an array");
+  }
+  if (!Array.isArray(diff)) {
+    throw new Error("diff must be an array");
+  }
+  var diffLength = diff.length;
+  for (var i = 0; i < diffLength; i++) {
+    var thisDiff = diff[i];
+    var subObject = obj;
+    var thisOp = thisDiff.op;
+    var thisPath = transformPath(pathConverter, thisDiff.path);
+    var thisFromPath = thisDiff.from && transformPath(pathConverter, thisDiff.from);
+    var toPath, toPathCopy, lastToProp, subToObject, valueToMove;
+    if (thisFromPath) {
+      toPath = thisPath;
+      thisPath = thisFromPath;
+      toPathCopy = toPath.slice();
+      lastToProp = toPathCopy.pop();
+      prototypeCheck(lastToProp);
+      if (lastToProp == null) {
+        return false;
+      }
+      var thisToProp;
+      while ((thisToProp = toPathCopy.shift()) != null) {
+        prototypeCheck(thisToProp);
+        if (!(thisToProp in subToObject)) {
+          subToObject[thisToProp] = {};
+        }
+        subToObject = subToObject[thisToProp];
+      }
+    }
+    var pathCopy = thisPath.slice();
+    var lastProp = pathCopy.pop();
+    prototypeCheck(lastProp);
+    if (lastProp == null) {
+      return false;
+    }
+    var thisProp;
+    while ((thisProp = pathCopy.shift()) != null) {
+      prototypeCheck(thisProp);
+      if (!(thisProp in subObject)) {
+        subObject[thisProp] = {};
+      }
+      subObject = subObject[thisProp];
+    }
+    if (thisOp === REMOVE || thisOp === REPLACE || thisOp === MOVE) {
+      var path = thisOp === MOVE ? thisDiff.from : thisDiff.path;
+      if (!subObject.hasOwnProperty(lastProp)) {
+        throw new Error(["expected to find property", path, "in object", obj].join(" "));
+      }
+    }
+    if (thisOp === REMOVE || thisOp === MOVE) {
+      if (thisOp === MOVE) {
+        valueToMove = subObject[lastProp];
+      }
+      Array.isArray(subObject) ? subObject.splice(lastProp, 1) : delete subObject[lastProp];
+    }
+    if (thisOp === REPLACE || thisOp === ADD) {
+      subObject[lastProp] = thisDiff.value;
+    }
+    if (thisOp === MOVE) {
+      subObject[lastToProp] = valueToMove;
+    }
+  }
+  return subObject;
+}
+function transformPath(pathConverter, thisPath) {
+  {
+    if (!Array.isArray(thisPath)) {
+      throw new Error([
+        "diff path",
+        thisPath,
+        "must be an array, consider supplying a path converter"
+      ].join(" "));
+    }
+  }
+  return thisPath;
+}
+function prototypeCheck(prop) {
+  if (prop == "__proto__" || prop == "constructor" || prop == "prototype") {
+    throw new Error("setting of prototype values not supported");
+  }
+}
+
+const patch = (...args) => {
+  const [source, diff] = args;
+  const patched = structuredClone(source);
+  diffApply(patched, diff);
+  return patched;
+};
+const VerifyResultFactory = (issuedAt, expiredAt) => ({
+  create: (vc, jwt, verificationKey, validated = false) => {
+    const unverified = {
+      doc: vc,
+      issuedAt,
+      expiredAt,
+      algorithm: "ES256",
+      mediaType: "application/vc+jwt",
+      source: jwt
+    };
+    if (!verificationKey) return unverified;
+    return { ...unverified, verificationKey, validated };
+  }
+});
+const opId = {
+  /** CP 発行者 */
+  authority: "dns:cp-issuer.example.org",
+  /** PA 発行者 */
+  certifier: "dns:pa-issuer.example.org",
+  /** CA 発行者 */
+  originator: "dns:originator.example.org",
+  /** 無効な第三者 */
+  invalid: "dns:invalid.example.org"
+};
+const cp = {
+  "@context": [
+    "https://www.w3.org/ns/credentials/v2",
+    "https://originator-profile.org/ns/credentials/v1"
+  ],
+  type: ["VerifiableCredential", "CoreProfile"],
+  issuer: opId.authority,
+  credentialSubject: {
+    id: opId.originator,
+    type: "Core",
+    jwks: {
+      keys: []
+    }
+  }
+};
+const certificate = {
+  "@context": [
+    "https://www.w3.org/ns/credentials/v2",
+    "https://originator-profile.org/ns/credentials/v1",
+    "https://originator-profile.org/ns/cip/v1",
+    {
+      "@language": "ja"
+    }
+  ],
+  type: ["VerifiableCredential", "Certificate"],
+  issuer: opId.certifier,
+  credentialSubject: {
+    id: opId.originator,
+    type: "CertificateProperties",
+    description: "Example Certificate",
+    certificationSystem: {
+      id: "urn:uuid:de5d6e80-10a5-404f-b4d3-e9f0e6926a21",
+      type: "CertificationSystem",
+      name: "Example Certification System",
+      description: "Example Certification System Description"
+    }
+  }
+};
+const wmp = {
+  "@context": [
+    "https://www.w3.org/ns/credentials/v2",
+    "https://originator-profile.org/ns/credentials/v1",
+    "https://originator-profile.org/ns/cip/v1",
+    {
+      "@language": "ja"
+    }
+  ],
+  type: ["VerifiableCredential", "WebMediaProfile"],
+  issuer: opId.authority,
+  credentialSubject: {
+    id: opId.originator,
+    type: "OnlineBusiness",
+    name: "Example OP Holder",
+    url: "https://op-originator.example.org/"
+  }
+};
+const wsp = {
+  "@context": [
+    "https://www.w3.org/ns/credentials/v2",
+    "https://originator-profile.org/ns/credentials/v1",
+    "https://originator-profile.org/ns/cip/v1",
+    {
+      "@language": "ja"
+    }
+  ],
+  type: ["VerifiableCredential", "WebsiteProfile"],
+  issuer: opId.originator,
+  credentialSubject: {
+    id: "https://originator.example.org",
+    type: "WebSite",
+    name: "Example Website",
+    description: "Example Website Description",
+    allowedOrigin: ["https://originator.example.org"]
+  }
+};
+const caId = "urn:uuid:78550fa7-f846-4e0f-ad5c-8d34461cb95b";
+const caUrl = new URL("https://www.example.org/articles/example");
+const article = {
+  "@context": [
+    "https://www.w3.org/ns/credentials/v2",
+    "https://originator-profile.org/ns/credentials/v1",
+    "https://originator-profile.org/ns/cip/v1",
+    { "@language": "ja" }
+  ],
+  type: ["VerifiableCredential", "ContentAttestation"],
+  issuer: opId.originator,
+  target: [],
+  allowedUrl: ["https://www.example.org/articles*"],
+  credentialSubject: {
+    id: caId,
+    type: "Article",
+    headline: "\u30C6\u30B9\u30C8\u8A18\u4E8B",
+    description: "\u8A18\u4E8B\u306E\u8AAC\u660E"
+  }
+};
+
+function prepareRegistry(ops) {
+  const decoded = decodeOps(ops);
+  if (decoded instanceof OpsInvalid) {
+    return decoded;
+  }
+  const [issuer, keys] = getTupledKeys(decoded);
+  return { ops, keys, issuer };
+}
+
 class SiteProfileInvalid extends Error {
   constructor(message, result) {
     super(message);
@@ -1315,7 +1616,8 @@ function SpVerifier(sp, keys, issuer, origin, options = {}) {
           }
         }
         await verifyImageDigestSri(verified.doc.credentialSubject.image, {
-          logger
+          logger,
+          at: pointer("sites", index)
         });
         return verified;
       })
@@ -1344,4 +1646,43 @@ function SpVerifier(sp, keys, issuer, origin, options = {}) {
   return verify;
 }
 
-export { CaInvalid, CaVerifier, CaVerifyFailed, CasVerifyFailed, CertificateExpired, CoreProfileNotFound, IntegrityFetchFailed, IntegrityVerificationFailed, OpInvalid, OpVerifyFailed, OpsInvalid, OpsVerifier, OpsVerifyFailed, SiteProfileInvalid, SiteProfileVerifyFailed, SpVerifier, TargetIntegrityAlgorithm, VerifyResultFactory, article, caId, caUrl, certificate, cp, decodeOps, getAnnotationPolicy, getMappedKeys, getTupledKeys, isProfileAnnotationIssuerRegistration, normalizeCasItem, opId, patch, verifyAllowedOrigin, verifyAnnotationIssuerRegistration, verifyCas, verifyDigestSri, verifyImageDigestSri, verifyIntegrity, wmp, wsp };
+async function verifyWebsite(origin, options) {
+  const { siteProfile, registry, logger, ...verifierOptions } = options;
+  const { logger: collecting, warnings, info } = collectProblems(logger);
+  const verifySp = SpVerifier(
+    {
+      ...siteProfile,
+      originators: [...registry.ops, ...siteProfile.originators]
+    },
+    registry.keys,
+    registry.issuer,
+    origin,
+    { ...verifierOptions, logger: collecting }
+  );
+  const verified = await verifySp();
+  const failed = verified instanceof Error;
+  const sp = failed ? verified.result : verified;
+  const collect = createCollector();
+  const outcome = {
+    originators: convertOps(sp.originators, collect),
+    sites: sp.sites.map(
+      (site, index) => convertVc(site, pointer("sites", index), collect)
+    )
+  };
+  return failed ? {
+    status: false,
+    outcome,
+    securingResults: collect.securingResults,
+    warnings,
+    info,
+    errors: [toProblemDetails(verified), ...collect.errors]
+  } : {
+    status: true,
+    outcome,
+    securingResults: collect.securingResults,
+    warnings,
+    info
+  };
+}
+
+export { CaInvalid, CaVerifier, CaVerifyFailed, CasVerifyFailed, CertificateExpired, CoreProfileNotFound, IntegrityFetchFailed, IntegrityVerificationFailed, OpInvalid, OpVerifyFailed, OpsInvalid, OpsVerifier, OpsVerifyFailed, ProblemType, SiteProfileInvalid, SiteProfileVerifyFailed, SpVerifier, TargetIntegrityAlgorithm, VerifyResultFactory, article, caId, caUrl, certificate, childPointer, collectProblems, convertCas, convertOp, convertOps, convertVc, cp, createCollector, decodeOps, getAnnotationPolicy, getMappedKeys, getTupledKeys, isProfileAnnotationIssuerRegistration, normalizeCasItem, opId, patch, pointer, prepareRegistry, problemType, toProblemDetails, verifyAllowedOrigin, verifyAnnotationIssuerRegistration, verifyCas, verifyDigestSri, verifyDocuments, verifyImageDigestSri, verifyIntegrity, verifyWebsite, wmp, wsp };