@fedify/fedify 1.7.15 → 1.7.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (129) hide show
  1. package/dist/actor-BzWaWDTY.js +146 -0
  2. package/dist/actor.js +34648 -5
  3. package/dist/{assert.js → assert-C-mZuSQl.js} +1 -1
  4. package/dist/{assert_instance_of.js → assert_instance_of-lS0Jr2iu.js} +1 -1
  5. package/dist/{assert_is_error.js → assert_is_error-CIYFACrT.js} +1 -1
  6. package/dist/{assert_not_equals.js → assert_not_equals-C1azCAB0.js} +1 -1
  7. package/dist/{assert_rejects.js → assert_rejects-Bkh5lA1a.js} +2 -2
  8. package/dist/{assert_throws.js → assert_throws-CmpfkWEM.js} +2 -2
  9. package/dist/authdocloader-1vrHbYJF.js +51 -0
  10. package/dist/authdocloader.js +2 -4
  11. package/dist/{builder.js → builder-8YjpOSrf.js} +5 -5
  12. package/dist/{client.js → client-CJ3nfMyp.js} +2 -2
  13. package/dist/compat/transformers.test.js +30 -30
  14. package/dist/{context.js → context-OXYKUfFL.js} +4 -4
  15. package/dist/docloader-I3SkMpZK.js +4421 -0
  16. package/dist/docloader.js +61 -4
  17. package/dist/{esm.js → esm-BRXvTSrx.js} +1 -1
  18. package/dist/federation/builder.test.js +17 -17
  19. package/dist/federation/collection.test.js +8 -8
  20. package/dist/federation/handler.test.js +36 -36
  21. package/dist/federation/inbox.test.js +11 -11
  22. package/dist/federation/keycache.test.js +12 -12
  23. package/dist/federation/kv.test.js +8 -8
  24. package/dist/federation/middleware.test.js +39 -39
  25. package/dist/federation/mq.test.js +10 -10
  26. package/dist/federation/retry.test.js +5 -5
  27. package/dist/federation/router.test.js +9 -9
  28. package/dist/federation/send.test.js +23 -23
  29. package/dist/http-CiQH4CF3.js +789 -0
  30. package/dist/http.js +4 -5
  31. package/dist/{inbox.js → inbox-BqBPO0vG.js} +3 -3
  32. package/dist/key-Ba-IjS2c.js +259 -0
  33. package/dist/key-CdNa4Um6.js +16 -0
  34. package/dist/key.js +1 -7
  35. package/dist/key2.js +2 -4
  36. package/dist/{keycache.js → keycache-BdgRTisV.js} +1 -1
  37. package/dist/{keys.js → keys-CLFIvF3E.js} +1 -1
  38. package/dist/{ld.js → ld-Dm1tdWDX.js} +4 -4
  39. package/dist/{lookup2.js → lookup-BumKjgCt.js} +4 -4
  40. package/dist/lookup-CoCshjhM.js +129 -0
  41. package/dist/lookup.js +1 -3
  42. package/dist/middleware-Dvd4BUlF.js +2661 -0
  43. package/dist/middleware-pC0Ld2I6.js +32 -0
  44. package/dist/middleware.js +1222 -364
  45. package/dist/middleware2.js +6 -21
  46. package/dist/nodeinfo/client.test.js +12 -12
  47. package/dist/nodeinfo/handler.test.js +34 -34
  48. package/dist/nodeinfo/semver.test.js +8 -8
  49. package/dist/nodeinfo/types.test.js +9 -9
  50. package/dist/{owner.js → owner-BO3ZhyYg.js} +3 -3
  51. package/dist/proof-Btlfk6hr.js +255 -0
  52. package/dist/proof.js +330 -8
  53. package/dist/runtime/authdocloader.test.js +20 -20
  54. package/dist/runtime/docloader.test.js +13 -13
  55. package/dist/runtime/key.test.js +15 -15
  56. package/dist/runtime/langstr.test.js +8 -8
  57. package/dist/runtime/multibase/multibase.test.js +8 -8
  58. package/dist/runtime/url.test.js +7 -7
  59. package/dist/{send.js → send-Dj-482tr.js} +2 -2
  60. package/dist/sig/http.test.js +20 -20
  61. package/dist/sig/key.test.js +17 -17
  62. package/dist/sig/ld.test.js +18 -18
  63. package/dist/sig/owner.test.js +20 -20
  64. package/dist/sig/proof.test.js +19 -19
  65. package/dist/{std__assert.js → std__assert-BdP_WkD-.js} +1 -1
  66. package/dist/testing/docloader.test.js +8 -8
  67. package/dist/testing/mod.js +2 -2
  68. package/dist/{testing.js → testing-qaAD4B0t.js} +1 -1
  69. package/dist/types-CB_2uuCA.js +51 -0
  70. package/dist/types.js +397 -3
  71. package/dist/vocab/actor.test.js +16 -16
  72. package/dist/vocab/lookup.test.js +17 -17
  73. package/dist/vocab/type.test.js +9 -9
  74. package/dist/vocab/vocab.test.js +17 -17
  75. package/dist/vocab-B8zleLsO.js +34386 -0
  76. package/dist/vocab.js +133 -34351
  77. package/dist/webfinger/handler.test.js +34 -34
  78. package/dist/webfinger/lookup.test.js +11 -11
  79. package/dist/x/cfworkers.test.js +7 -7
  80. package/package.json +1 -1
  81. /package/dist/{assert_equals.js → assert_equals-Dy0MG_Zw.js} +0 -0
  82. /package/dist/{chunk.js → chunk-DvTpRkcT.js} +0 -0
  83. /package/dist/{collection.js → collection-XNLQhehO.js} +0 -0
  84. /package/dist/compat/{transformers.test.d.ts → transformers.test-DnJbd34u.d.ts} +0 -0
  85. /package/dist/{denokv.js → denokv-NcJeZ6rP.js} +0 -0
  86. /package/dist/{docloader2.js → docloader-BDSHZfTJ.js} +0 -0
  87. /package/dist/federation/{builder.test.d.ts → builder.test-Bpt6NOZ6.d.ts} +0 -0
  88. /package/dist/federation/{collection.test.d.ts → collection.test-DKJ6JOZz.d.ts} +0 -0
  89. /package/dist/federation/{handler.test.d.ts → handler.test-BMT7uLC0.d.ts} +0 -0
  90. /package/dist/federation/{inbox.test.d.ts → inbox.test-Do6i02Qp.d.ts} +0 -0
  91. /package/dist/federation/{keycache.test.d.ts → keycache.test-BT83IPZY.d.ts} +0 -0
  92. /package/dist/federation/{kv.test.d.ts → kv.test-kFzzF2VN.d.ts} +0 -0
  93. /package/dist/federation/{middleware.test.d.ts → middleware.test-B1R4_e3-.d.ts} +0 -0
  94. /package/dist/federation/{mq.test.d.ts → mq.test-l79EQQOe.d.ts} +0 -0
  95. /package/dist/federation/{retry.test.d.ts → retry.test-BqS50VCX.d.ts} +0 -0
  96. /package/dist/federation/{router.test.d.ts → router.test-CYQl4po-.d.ts} +0 -0
  97. /package/dist/federation/{send.test.d.ts → send.test-COUnNUzv.d.ts} +0 -0
  98. /package/dist/{kv.js → kv-QeuZ51go.js} +0 -0
  99. /package/dist/{langstr.js → langstr-pFHBDU4y.js} +0 -0
  100. /package/dist/{multibase.js → multibase-DBcKTV2a.js} +0 -0
  101. /package/dist/nodeinfo/{client.test.d.ts → client.test-CZLe79hL.d.ts} +0 -0
  102. /package/dist/nodeinfo/{handler.test.d.ts → handler.test-B-EDZ_hK.d.ts} +0 -0
  103. /package/dist/nodeinfo/{semver.test.d.ts → semver.test-BEuuQSEM.d.ts} +0 -0
  104. /package/dist/nodeinfo/{types.test.d.ts → types.test-B5AT89WV.d.ts} +0 -0
  105. /package/dist/{retry.js → retry-BQet39_l.js} +0 -0
  106. /package/dist/{router.js → router-BuDkN4RQ.js} +0 -0
  107. /package/dist/runtime/{authdocloader.test.d.ts → authdocloader.test-hCRKzn9v.d.ts} +0 -0
  108. /package/dist/runtime/{docloader.test.d.ts → docloader.test-CVd7i_5h.d.ts} +0 -0
  109. /package/dist/runtime/{key.test.d.ts → key.test-DBsILYSD.d.ts} +0 -0
  110. /package/dist/runtime/{langstr.test.d.ts → langstr.test-CiKxuuRY.d.ts} +0 -0
  111. /package/dist/runtime/multibase/{multibase.test.d.ts → multibase.test-Brh6gPBP.d.ts} +0 -0
  112. /package/dist/runtime/{url.test.d.ts → url.test-DlRqkU2j.d.ts} +0 -0
  113. /package/dist/{semver.js → semver-D9d-VO-_.js} +0 -0
  114. /package/dist/sig/{http.test.d.ts → http.test-BpXNAWNI.d.ts} +0 -0
  115. /package/dist/sig/{key.test.d.ts → key.test-B2iLIugy.d.ts} +0 -0
  116. /package/dist/sig/{ld.test.d.ts → ld.test-D-cI70Gw.d.ts} +0 -0
  117. /package/dist/sig/{owner.test.d.ts → owner.test-B_YRjMPj.d.ts} +0 -0
  118. /package/dist/sig/{proof.test.d.ts → proof.test-BagEM_-4.d.ts} +0 -0
  119. /package/dist/testing/{docloader.test.d.ts → docloader.test-lrzf6sDZ.d.ts} +0 -0
  120. /package/dist/testing/{mod.d.ts → mod-3uM8ZvS7.d.ts} +0 -0
  121. /package/dist/{type.js → type-DFsmi-p1.js} +0 -0
  122. /package/dist/{url.js → url-BdNvnK9P.js} +0 -0
  123. /package/dist/vocab/{actor.test.d.ts → actor.test-ClC-iVWk.d.ts} +0 -0
  124. /package/dist/vocab/{lookup.test.d.ts → lookup.test-Cq1I-27w.d.ts} +0 -0
  125. /package/dist/vocab/{type.test.d.ts → type.test-bfFiYGcs.d.ts} +0 -0
  126. /package/dist/vocab/{vocab.test.d.ts → vocab.test-h-ZTisfu.d.ts} +0 -0
  127. /package/dist/webfinger/{handler.test.d.ts → handler.test-DiUeEDDD.d.ts} +0 -0
  128. /package/dist/webfinger/{lookup.test.d.ts → lookup.test-D9onm3U3.d.ts} +0 -0
  129. /package/dist/x/{cfworkers.test.d.ts → cfworkers.test-KXHlJ29z.d.ts} +0 -0
package/dist/proof.js CHANGED
@@ -1,17 +1,339 @@
1
1
 
2
2
  import { Temporal } from "@js-temporal/polyfill";
3
3
  import { URLPattern } from "urlpattern-polyfill";
4
- globalThis.addEventListener = () => {};
5
4
 
6
- import { d as version, u as name } from "./docloader.js";
7
- import { h as Multikey, s as DataIntegrityProof, t as Activity } from "./vocab.js";
8
- import { t as getTypeId } from "./type.js";
5
+ import { d as name, f as version, i as getDocumentLoader } from "./docloader.js";
6
+ import { G as Multikey, Tt as getTypeId, b as DataIntegrityProof, i as isActor, q as Object$1, s as Activity, y as CryptographicKey } from "./actor.js";
9
7
  import { a as validateCryptoKey, n as fetchKey } from "./key2.js";
10
8
  import { getLogger } from "@logtape/logtape";
11
9
  import { SpanStatusCode, trace } from "@opentelemetry/api";
10
+ import jsonld from "jsonld";
11
+ import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
12
12
  import { encodeHex } from "byte-encodings/hex";
13
13
  import serialize from "json-canon";
14
14
 
15
+ //#region sig/ld.ts
16
+ const logger$1 = getLogger([
17
+ "fedify",
18
+ "sig",
19
+ "ld"
20
+ ]);
21
+ /**
22
+ * Attaches a LD signature to the given JSON-LD document.
23
+ * @param jsonLd The JSON-LD document to attach the signature to. It is not
24
+ * modified.
25
+ * @param signature The signature to attach.
26
+ * @returns The JSON-LD document with the attached signature.
27
+ * @throws {TypeError} If the input document is not a valid JSON-LD document.
28
+ * @since 1.0.0
29
+ */
30
+ function attachSignature(jsonLd, signature) {
31
+ if (typeof jsonLd !== "object" || jsonLd == null) throw new TypeError("Failed to attach signature; invalid JSON-LD document.");
32
+ return {
33
+ ...jsonLd,
34
+ signature
35
+ };
36
+ }
37
+ /**
38
+ * Creates a LD signature for the given JSON-LD document.
39
+ * @param jsonLd The JSON-LD document to sign.
40
+ * @param privateKey The private key to sign the document.
41
+ * @param keyId The ID of the public key that corresponds to the private key.
42
+ * @param options Additional options for creating the signature.
43
+ * See also {@link CreateSignatureOptions}.
44
+ * @return The created signature.
45
+ * @throws {TypeError} If the private key is invalid or unsupported.
46
+ * @since 1.0.0
47
+ */
48
+ async function createSignature(jsonLd, privateKey, keyId, { contextLoader, created } = {}) {
49
+ validateCryptoKey(privateKey, "private");
50
+ if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
51
+ const options = {
52
+ "@context": "https://w3id.org/identity/v1",
53
+ creator: keyId.href,
54
+ created: created?.toString() ?? (/* @__PURE__ */ new Date()).toISOString()
55
+ };
56
+ const message = await hashJsonLd(options, contextLoader) + await hashJsonLd(jsonLd, contextLoader);
57
+ const messageBytes = new TextEncoder().encode(message);
58
+ const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, messageBytes);
59
+ return {
60
+ ...options,
61
+ type: "RsaSignature2017",
62
+ signatureValue: encodeBase64(signature)
63
+ };
64
+ }
65
+ /**
66
+ * Signs the given JSON-LD document with the private key and returns the signed
67
+ * JSON-LD document.
68
+ * @param jsonLd The JSON-LD document to sign.
69
+ * @param privateKey The private key to sign the document.
70
+ * @param keyId The key ID to use in the signature. It will be used by the
71
+ * verifier to fetch the corresponding public key.
72
+ * @param options Additional options for signing the document.
73
+ * See also {@link SignJsonLdOptions}.
74
+ * @returns The signed JSON-LD document.
75
+ * @throws {TypeError} If the private key is invalid or unsupported.
76
+ * @since 1.0.0
77
+ */
78
+ async function signJsonLd(jsonLd, privateKey, keyId, options) {
79
+ return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.sign", { attributes: { "ld_signatures.key_id": keyId.href } }, async (span) => {
80
+ try {
81
+ const signature = await createSignature(jsonLd, privateKey, keyId, options);
82
+ if (span.isRecording()) {
83
+ span.setAttribute("ld_signatures.type", signature.type);
84
+ span.setAttribute("ld_signatures.signature", encodeHex(decodeBase64(signature.signatureValue)));
85
+ }
86
+ return attachSignature(jsonLd, signature);
87
+ } catch (error) {
88
+ span.setStatus({
89
+ code: SpanStatusCode.ERROR,
90
+ message: String(error)
91
+ });
92
+ throw error;
93
+ } finally {
94
+ span.end();
95
+ }
96
+ });
97
+ }
98
+ /**
99
+ * Checks if the given JSON-LD document has a Linked Data Signature.
100
+ * @param jsonLd The JSON-LD document to check.
101
+ * @returns `true` if the document has a signature; `false` otherwise.
102
+ * @since 1.0.0
103
+ */
104
+ function hasSignature(jsonLd) {
105
+ if (typeof jsonLd !== "object" || jsonLd == null) return false;
106
+ if ("signature" in jsonLd) {
107
+ const signature = jsonLd.signature;
108
+ if (typeof signature !== "object" || signature == null) return false;
109
+ return "type" in signature && signature.type === "RsaSignature2017" && "creator" in signature && typeof signature.creator === "string" && "created" in signature && typeof signature.created === "string" && "signatureValue" in signature && typeof signature.signatureValue === "string";
110
+ }
111
+ return false;
112
+ }
113
+ /**
114
+ * Detaches Linked Data Signatures from the given JSON-LD document.
115
+ * @param jsonLd The JSON-LD document to modify.
116
+ * @returns The modified JSON-LD document. If the input document does not
117
+ * contain a signature, the original document is returned.
118
+ * @since 1.0.0
119
+ */
120
+ function detachSignature(jsonLd) {
121
+ if (typeof jsonLd !== "object" || jsonLd == null) return jsonLd;
122
+ const doc = { ...jsonLd };
123
+ delete doc.signature;
124
+ return doc;
125
+ }
126
+ /**
127
+ * Verifies Linked Data Signatures of the given JSON-LD document.
128
+ * @param jsonLd The JSON-LD document to verify.
129
+ * @param options Options for verifying the signature.
130
+ * @returns The public key that signed the document or `null` if the signature
131
+ * is invalid or the key is not found.
132
+ * @since 1.0.0
133
+ */
134
+ async function verifySignature(jsonLd, options = {}) {
135
+ if (!hasSignature(jsonLd)) return null;
136
+ const sig = jsonLd.signature;
137
+ let signature;
138
+ try {
139
+ signature = decodeBase64(sig.signatureValue);
140
+ } catch (error) {
141
+ logger$1.debug("Failed to verify; invalid base64 signatureValue: {signatureValue}", {
142
+ ...sig,
143
+ error
144
+ });
145
+ return null;
146
+ }
147
+ const { key, cached } = await fetchKey(new URL(sig.creator), CryptographicKey, options);
148
+ if (key == null) return null;
149
+ const sigOpts = {
150
+ ...sig,
151
+ "@context": "https://w3id.org/identity/v1"
152
+ };
153
+ delete sigOpts.type;
154
+ delete sigOpts.id;
155
+ delete sigOpts.signatureValue;
156
+ let sigOptsHash;
157
+ try {
158
+ sigOptsHash = await hashJsonLd(sigOpts, options.contextLoader);
159
+ } catch (error) {
160
+ logger$1.warn("Failed to verify; failed to hash the signature options: {signatureOptions}\n{error}", {
161
+ signatureOptions: sigOpts,
162
+ error
163
+ });
164
+ return null;
165
+ }
166
+ const document = { ...jsonLd };
167
+ delete document.signature;
168
+ let docHash;
169
+ try {
170
+ docHash = await hashJsonLd(document, options.contextLoader);
171
+ } catch (error) {
172
+ logger$1.warn("Failed to verify; failed to hash the document: {document}\n{error}", {
173
+ document,
174
+ error
175
+ });
176
+ return null;
177
+ }
178
+ const encoder = new TextEncoder();
179
+ const message = sigOptsHash + docHash;
180
+ const messageBytes = encoder.encode(message);
181
+ if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes)) return key;
182
+ if (cached) {
183
+ logger$1.debug("Failed to verify with the cached key {keyId}; signature {signatureValue} is invalid. Retrying with the freshly fetched key...", {
184
+ keyId: sig.creator,
185
+ ...sig
186
+ });
187
+ const { key: key$1 } = await fetchKey(new URL(sig.creator), CryptographicKey, {
188
+ ...options,
189
+ keyCache: {
190
+ get: () => Promise.resolve(void 0),
191
+ set: async (keyId, key$2) => await options.keyCache?.set(keyId, key$2)
192
+ }
193
+ });
194
+ if (key$1 == null) return null;
195
+ return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key$1.publicKey, signature.slice(), messageBytes) ? key$1 : null;
196
+ }
197
+ logger$1.debug("Failed to verify with the fetched key {keyId}; signature {signatureValue} is invalid. Check if the key is correct or if the signed message is correct. The message to sign is:\n{message}", {
198
+ keyId: sig.creator,
199
+ ...sig,
200
+ message
201
+ });
202
+ return null;
203
+ }
204
+ /**
205
+ * Verify the authenticity of the given JSON-LD document using Linked Data
206
+ * Signatures. If the document is signed, this function verifies the signature
207
+ * and checks if the document is attributed to the owner of the public key.
208
+ * If the document is not signed, this function returns `false`.
209
+ * @param jsonLd The JSON-LD document to verify.
210
+ * @param options Options for verifying the document.
211
+ * @returns `true` if the document is authentic; `false` otherwise.
212
+ */
213
+ async function verifyJsonLd(jsonLd, options = {}) {
214
+ return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
215
+ try {
216
+ const object = await Object$1.fromJsonLd(jsonLd, options);
217
+ if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
218
+ span.setAttribute("activitypub.object.type", getTypeId(object).href);
219
+ if (typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd && typeof jsonLd.signature === "object" && jsonLd.signature != null) {
220
+ if ("creator" in jsonLd.signature && typeof jsonLd.signature.creator === "string") span.setAttribute("ld_signatures.key_id", jsonLd.signature.creator);
221
+ if ("signatureValue" in jsonLd.signature && typeof jsonLd.signature.signatureValue === "string") span.setAttribute("ld_signatures.signature", jsonLd.signature.signatureValue);
222
+ if ("type" in jsonLd.signature && typeof jsonLd.signature.type === "string") span.setAttribute("ld_signatures.type", jsonLd.signature.type);
223
+ }
224
+ const attributions = new Set(object.attributionIds.map((uri) => uri.href));
225
+ if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
226
+ const key = await verifySignature(jsonLd, options);
227
+ if (key == null) return false;
228
+ if (key.ownerId == null) {
229
+ logger$1.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
230
+ return false;
231
+ }
232
+ attributions.delete(key.ownerId.href);
233
+ if (attributions.size > 0) {
234
+ logger$1.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
235
+ return false;
236
+ }
237
+ return true;
238
+ } catch (error) {
239
+ span.setStatus({
240
+ code: SpanStatusCode.ERROR,
241
+ message: String(error)
242
+ });
243
+ throw error;
244
+ } finally {
245
+ span.end();
246
+ }
247
+ });
248
+ }
249
+ async function hashJsonLd(jsonLd, contextLoader) {
250
+ const canon = await jsonld.canonize(jsonLd, {
251
+ format: "application/n-quads",
252
+ documentLoader: contextLoader ?? getDocumentLoader()
253
+ });
254
+ const encoder = new TextEncoder();
255
+ return encodeHex(await crypto.subtle.digest("SHA-256", encoder.encode(canon)));
256
+ }
257
+
258
+ //#endregion
259
+ //#region sig/owner.ts
260
+ /**
261
+ * Checks if the actor of the given activity owns the specified key.
262
+ * @param activity The activity to check.
263
+ * @param key The public key to check.
264
+ * @param options Options for checking the key ownership.
265
+ * @returns Whether the actor is the owner of the key.
266
+ */
267
+ async function doesActorOwnKey(activity, key, options) {
268
+ if (key.ownerId != null) return key.ownerId.href === activity.actorId?.href;
269
+ const actor = await activity.getActor(options);
270
+ if (actor == null || !isActor(actor)) return false;
271
+ for (const publicKeyId of actor.publicKeyIds) if (key.id != null && publicKeyId.href === key.id.href) return true;
272
+ return false;
273
+ }
274
+ /**
275
+ * Gets the actor that owns the specified key. Returns `null` if the key has no
276
+ * known owner.
277
+ *
278
+ * @param keyId The ID of the key to check, or the key itself.
279
+ * @param options Options for getting the key owner.
280
+ * @returns The actor that owns the key, or `null` if the key has no known
281
+ * owner.
282
+ * @since 0.7.0
283
+ */
284
+ async function getKeyOwner(keyId, options) {
285
+ const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
286
+ const documentLoader = options.documentLoader ?? getDocumentLoader();
287
+ const contextLoader = options.contextLoader ?? getDocumentLoader();
288
+ let object;
289
+ if (keyId instanceof CryptographicKey) {
290
+ object = keyId;
291
+ if (object.id == null) return null;
292
+ keyId = object.id;
293
+ } else {
294
+ let keyDoc;
295
+ try {
296
+ const { document } = await documentLoader(keyId.href);
297
+ keyDoc = document;
298
+ } catch (_) {
299
+ return null;
300
+ }
301
+ try {
302
+ object = await Object$1.fromJsonLd(keyDoc, {
303
+ documentLoader,
304
+ contextLoader,
305
+ tracerProvider
306
+ });
307
+ } catch (e) {
308
+ if (!(e instanceof TypeError)) throw e;
309
+ try {
310
+ object = await CryptographicKey.fromJsonLd(keyDoc, {
311
+ documentLoader,
312
+ contextLoader,
313
+ tracerProvider
314
+ });
315
+ } catch (e$1) {
316
+ if (e$1 instanceof TypeError) return null;
317
+ throw e$1;
318
+ }
319
+ }
320
+ }
321
+ let owner = null;
322
+ if (object instanceof CryptographicKey) {
323
+ if (object.ownerId == null) return null;
324
+ owner = await object.getOwner({
325
+ documentLoader,
326
+ contextLoader,
327
+ tracerProvider
328
+ });
329
+ } else if (isActor(object)) owner = object;
330
+ else return null;
331
+ if (owner == null) return null;
332
+ for (const kid of owner.publicKeyIds) if (kid.href === keyId.href) return owner;
333
+ return null;
334
+ }
335
+
336
+ //#endregion
15
337
  //#region sig/proof.ts
16
338
  const logger = getLogger([
17
339
  "fedify",
@@ -227,7 +549,7 @@ async function verifyProofInternal(jsonLd, proof, options) {
227
549
  * @since 0.10.0
228
550
  */
229
551
  async function verifyObject(cls, jsonLd, options = {}) {
230
- const logger$1 = getLogger([
552
+ const logger$2 = getLogger([
231
553
  "fedify",
232
554
  "sig",
233
555
  "proof"
@@ -239,17 +561,17 @@ async function verifyObject(cls, jsonLd, options = {}) {
239
561
  const key = await verifyProof(jsonLd, proof, options);
240
562
  if (key === null) return null;
241
563
  if (key.controllerId == null) {
242
- logger$1.debug("Key {keyId} does not have a controller.", { keyId: key.id?.href });
564
+ logger$2.debug("Key {keyId} does not have a controller.", { keyId: key.id?.href });
243
565
  continue;
244
566
  }
245
567
  attributions.delete(key.controllerId.href);
246
568
  }
247
569
  if (attributions.size > 0) {
248
- logger$1.debug("Some attributions are not authenticated by the proofs: {attributions}.", { attributions: [...attributions] });
570
+ logger$2.debug("Some attributions are not authenticated by the proofs: {attributions}.", { attributions: [...attributions] });
249
571
  return null;
250
572
  }
251
573
  return object;
252
574
  }
253
575
 
254
576
  //#endregion
255
- export { verifyProof as i, signObject as n, verifyObject as r, createProof as t };
577
+ export { doesActorOwnKey as a, createSignature as c, signJsonLd as d, verifyJsonLd as f, verifyProof as i, detachSignature as l, signObject as n, getKeyOwner as o, verifySignature as p, verifyObject as r, attachSignature as s, createProof as t, hasSignature as u };
@@ -3,26 +3,26 @@
3
3
  import { URLPattern } from "urlpattern-polyfill";
4
4
  globalThis.addEventListener = () => {};
5
5
 
6
- import "../chunk.js";
7
- import { t as assertEquals } from "../assert_equals.js";
8
- import "../docloader.js";
9
- import { t as UrlError } from "../url.js";
10
- import "../multibase.js";
11
- import "../vocab.js";
12
- import "../langstr.js";
13
- import "../lookup.js";
14
- import "../actor.js";
15
- import "../key2.js";
16
- import { l as verifyRequest } from "../http.js";
17
- import { t as getAuthenticatedDocumentLoader } from "../authdocloader.js";
18
- import { t as test } from "../testing.js";
19
- import "../std__assert.js";
20
- import { t as assertRejects } from "../assert_rejects.js";
21
- import "../assert_is_error.js";
22
- import "../assert_throws.js";
23
- import { t as mockDocumentLoader } from "../docloader2.js";
24
- import { i as rsaPrivateKey2 } from "../keys.js";
25
- import { t as esm_default } from "../esm.js";
6
+ import "../chunk-DvTpRkcT.js";
7
+ import { t as assertEquals } from "../assert_equals-Dy0MG_Zw.js";
8
+ import "../docloader-I3SkMpZK.js";
9
+ import { t as UrlError } from "../url-BdNvnK9P.js";
10
+ import "../multibase-DBcKTV2a.js";
11
+ import "../vocab-B8zleLsO.js";
12
+ import "../langstr-pFHBDU4y.js";
13
+ import "../lookup-CoCshjhM.js";
14
+ import "../actor-BzWaWDTY.js";
15
+ import "../key-Ba-IjS2c.js";
16
+ import { l as verifyRequest } from "../http-CiQH4CF3.js";
17
+ import { t as getAuthenticatedDocumentLoader } from "../authdocloader-1vrHbYJF.js";
18
+ import { t as test } from "../testing-qaAD4B0t.js";
19
+ import "../std__assert-BdP_WkD-.js";
20
+ import { t as assertRejects } from "../assert_rejects-Bkh5lA1a.js";
21
+ import "../assert_is_error-CIYFACrT.js";
22
+ import "../assert_throws-CmpfkWEM.js";
23
+ import { t as mockDocumentLoader } from "../docloader-BDSHZfTJ.js";
24
+ import { i as rsaPrivateKey2 } from "../keys-CLFIvF3E.js";
25
+ import { t as esm_default } from "../esm-BRXvTSrx.js";
26
26
 
27
27
  //#region runtime/authdocloader.test.ts
28
28
  test("getAuthenticatedDocumentLoader()", async (t) => {
@@ -3,19 +3,19 @@
3
3
  import { URLPattern } from "urlpattern-polyfill";
4
4
  globalThis.addEventListener = () => {};
5
5
 
6
- import "../chunk.js";
7
- import { t as assertEquals } from "../assert_equals.js";
8
- import { t as assert } from "../assert.js";
9
- import { t as MemoryKvStore } from "../kv.js";
10
- import { d as version, i as getDocumentLoader, l as contexts_default, o as getUserAgent, s as kvCache, t as FetchError } from "../docloader.js";
11
- import { t as UrlError } from "../url.js";
12
- import { t as test } from "../testing.js";
13
- import "../std__assert.js";
14
- import { t as assertRejects } from "../assert_rejects.js";
15
- import "../assert_is_error.js";
16
- import { t as assertThrows } from "../assert_throws.js";
17
- import { t as mockDocumentLoader } from "../docloader2.js";
18
- import { t as esm_default } from "../esm.js";
6
+ import "../chunk-DvTpRkcT.js";
7
+ import { t as assertEquals } from "../assert_equals-Dy0MG_Zw.js";
8
+ import { t as assert } from "../assert-C-mZuSQl.js";
9
+ import { t as MemoryKvStore } from "../kv-QeuZ51go.js";
10
+ import { d as version, i as getDocumentLoader, l as contexts_default, o as getUserAgent, s as kvCache, t as FetchError } from "../docloader-I3SkMpZK.js";
11
+ import { t as UrlError } from "../url-BdNvnK9P.js";
12
+ import { t as test } from "../testing-qaAD4B0t.js";
13
+ import "../std__assert-BdP_WkD-.js";
14
+ import { t as assertRejects } from "../assert_rejects-Bkh5lA1a.js";
15
+ import "../assert_is_error-CIYFACrT.js";
16
+ import { t as assertThrows } from "../assert_throws-CmpfkWEM.js";
17
+ import { t as mockDocumentLoader } from "../docloader-BDSHZfTJ.js";
18
+ import { t as esm_default } from "../esm-BRXvTSrx.js";
19
19
  import process from "node:process";
20
20
 
21
21
  //#region runtime/docloader.test.ts
@@ -3,21 +3,21 @@
3
3
  import { URLPattern } from "urlpattern-polyfill";
4
4
  globalThis.addEventListener = () => {};
5
5
 
6
- import "../chunk.js";
7
- import { t as assertEquals } from "../assert_equals.js";
8
- import "../docloader.js";
9
- import "../url.js";
10
- import "../multibase.js";
11
- import { A as exportSpki, M as importPem, N as importPkcs1, P as importSpki, j as importMultibaseKey, k as exportMultibaseKey } from "../vocab.js";
12
- import "../langstr.js";
13
- import "../lookup.js";
14
- import "../actor.js";
15
- import { i as importJwk, t as exportJwk } from "../key2.js";
16
- import { t as test } from "../testing.js";
17
- import "../std__assert.js";
18
- import "../assert_rejects.js";
19
- import "../assert_is_error.js";
20
- import "../assert_throws.js";
6
+ import "../chunk-DvTpRkcT.js";
7
+ import { t as assertEquals } from "../assert_equals-Dy0MG_Zw.js";
8
+ import "../docloader-I3SkMpZK.js";
9
+ import "../url-BdNvnK9P.js";
10
+ import "../multibase-DBcKTV2a.js";
11
+ import { A as exportSpki, M as importPem, N as importPkcs1, P as importSpki, j as importMultibaseKey, k as exportMultibaseKey } from "../vocab-B8zleLsO.js";
12
+ import "../langstr-pFHBDU4y.js";
13
+ import "../lookup-CoCshjhM.js";
14
+ import "../actor-BzWaWDTY.js";
15
+ import { i as importJwk, t as exportJwk } from "../key-Ba-IjS2c.js";
16
+ import { t as test } from "../testing-qaAD4B0t.js";
17
+ import "../std__assert-BdP_WkD-.js";
18
+ import "../assert_rejects-Bkh5lA1a.js";
19
+ import "../assert_is_error-CIYFACrT.js";
20
+ import "../assert_throws-CmpfkWEM.js";
21
21
 
22
22
  //#region runtime/key.test.ts
23
23
  const rsaSpki = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxsRuvCkgJtflBTl4OVsm\nnt/J1mQfZasfJtN33dcZ3d1lJroxmgmMu69zjGEAwkNbMQaWNLqC4eogkJaeJ4RR\n5MHYXkL9nNilVoTkjX5BVit3puzs7XJ7WQnKQgQMI+ezn24GHsZ/v1JIo77lerX5\nk4HNwTNVt+yaZVQWaOMR3+6FwziQR6kd0VuG9/a9dgAnz2cEoORRC1i4W7IZaB1s\nZnh1WbHbevlGd72HSXll5rocPIHn8gq6xpBgpHwRphlRsgn4KHaJ6brXDIJjrnQh\nIe/YUBOGj/ImSEXhRwlFerKsoAVnZ0Hwbfa46qk44TAt8CyoPMWmpK6pt0ng4pQ2\nuwIDAQAB\n-----END PUBLIC KEY-----\n";
@@ -3,14 +3,14 @@
3
3
  import { URLPattern } from "urlpattern-polyfill";
4
4
  globalThis.addEventListener = () => {};
5
5
 
6
- import "../chunk.js";
7
- import { t as assertEquals } from "../assert_equals.js";
8
- import { t as LanguageString } from "../langstr.js";
9
- import { t as test } from "../testing.js";
10
- import "../std__assert.js";
11
- import "../assert_rejects.js";
12
- import "../assert_is_error.js";
13
- import "../assert_throws.js";
6
+ import "../chunk-DvTpRkcT.js";
7
+ import { t as assertEquals } from "../assert_equals-Dy0MG_Zw.js";
8
+ import { t as LanguageString } from "../langstr-pFHBDU4y.js";
9
+ import { t as test } from "../testing-qaAD4B0t.js";
10
+ import "../std__assert-BdP_WkD-.js";
11
+ import "../assert_rejects-Bkh5lA1a.js";
12
+ import "../assert_is_error-CIYFACrT.js";
13
+ import "../assert_throws-CmpfkWEM.js";
14
14
  import { parseLanguageTag } from "@phensley/language-tag";
15
15
  import util from "node:util";
16
16
 
@@ -3,14 +3,14 @@
3
3
  import { URLPattern } from "urlpattern-polyfill";
4
4
  globalThis.addEventListener = () => {};
5
5
 
6
- import "../../chunk.js";
7
- import { t as assertEquals } from "../../assert_equals.js";
8
- import { a as decodeText, i as names, n as encode, o as encodeText, r as codes, t as decode } from "../../multibase.js";
9
- import { t as test } from "../../testing.js";
10
- import "../../std__assert.js";
11
- import "../../assert_rejects.js";
12
- import "../../assert_is_error.js";
13
- import "../../assert_throws.js";
6
+ import "../../chunk-DvTpRkcT.js";
7
+ import { t as assertEquals } from "../../assert_equals-Dy0MG_Zw.js";
8
+ import { a as decodeText, i as names, n as encode, o as encodeText, r as codes, t as decode } from "../../multibase-DBcKTV2a.js";
9
+ import { t as test } from "../../testing-qaAD4B0t.js";
10
+ import "../../std__assert-BdP_WkD-.js";
11
+ import "../../assert_rejects-Bkh5lA1a.js";
12
+ import "../../assert_is_error-CIYFACrT.js";
13
+ import "../../assert_throws-CmpfkWEM.js";
14
14
 
15
15
  //#region runtime/multibase/multibase.test.ts
16
16
  test("multibase.encode and decode", async (t) => {
@@ -3,13 +3,13 @@
3
3
  import { URLPattern } from "urlpattern-polyfill";
4
4
  globalThis.addEventListener = () => {};
5
5
 
6
- import "../chunk.js";
7
- import { t as assertEquals } from "../assert_equals.js";
8
- import { t as assert } from "../assert.js";
9
- import { a as validatePublicUrl, i as isValidPublicIPv6Address, n as expandIPv6Address, r as isValidPublicIPv4Address, t as UrlError } from "../url.js";
10
- import { t as test } from "../testing.js";
11
- import { n as assertFalse, t as assertRejects } from "../assert_rejects.js";
12
- import "../assert_is_error.js";
6
+ import "../chunk-DvTpRkcT.js";
7
+ import { t as assertEquals } from "../assert_equals-Dy0MG_Zw.js";
8
+ import { t as assert } from "../assert-C-mZuSQl.js";
9
+ import { a as validatePublicUrl, i as isValidPublicIPv6Address, n as expandIPv6Address, r as isValidPublicIPv4Address, t as UrlError } from "../url-BdNvnK9P.js";
10
+ import { t as test } from "../testing-qaAD4B0t.js";
11
+ import { n as assertFalse, t as assertRejects } from "../assert_rejects-Bkh5lA1a.js";
12
+ import "../assert_is_error-CIYFACrT.js";
13
13
 
14
14
  //#region runtime/url.test.ts
15
15
  test("validatePublicUrl()", async () => {
@@ -3,8 +3,8 @@
3
3
  import { URLPattern } from "urlpattern-polyfill";
4
4
  globalThis.addEventListener = () => {};
5
5
 
6
- import { d as version, u as name } from "./docloader.js";
7
- import { n as doubleKnock } from "./http.js";
6
+ import { d as version, u as name } from "./docloader-I3SkMpZK.js";
7
+ import { n as doubleKnock } from "./http-CiQH4CF3.js";
8
8
  import { getLogger } from "@logtape/logtape";
9
9
  import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
10
10
 
@@ -3,26 +3,26 @@
3
3
  import { URLPattern } from "urlpattern-polyfill";
4
4
  globalThis.addEventListener = () => {};
5
5
 
6
- import "../chunk.js";
7
- import { t as assertEquals } from "../assert_equals.js";
8
- import { t as assert } from "../assert.js";
9
- import "../docloader.js";
10
- import "../url.js";
11
- import "../multibase.js";
12
- import { A as exportSpki } from "../vocab.js";
13
- import "../langstr.js";
14
- import "../lookup.js";
15
- import "../actor.js";
16
- import { t as exportJwk } from "../key2.js";
17
- import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase } from "../http.js";
18
- import { t as test } from "../testing.js";
19
- import { a as assertExists, t as assertStringIncludes } from "../std__assert.js";
20
- import { n as assertFalse } from "../assert_rejects.js";
21
- import "../assert_is_error.js";
22
- import { t as assertThrows } from "../assert_throws.js";
23
- import { t as mockDocumentLoader } from "../docloader2.js";
24
- import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys.js";
25
- import { t as esm_default } from "../esm.js";
6
+ import "../chunk-DvTpRkcT.js";
7
+ import { t as assertEquals } from "../assert_equals-Dy0MG_Zw.js";
8
+ import { t as assert } from "../assert-C-mZuSQl.js";
9
+ import "../docloader-I3SkMpZK.js";
10
+ import "../url-BdNvnK9P.js";
11
+ import "../multibase-DBcKTV2a.js";
12
+ import { A as exportSpki } from "../vocab-B8zleLsO.js";
13
+ import "../langstr-pFHBDU4y.js";
14
+ import "../lookup-CoCshjhM.js";
15
+ import "../actor-BzWaWDTY.js";
16
+ import { t as exportJwk } from "../key-Ba-IjS2c.js";
17
+ import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase } from "../http-CiQH4CF3.js";
18
+ import { t as test } from "../testing-qaAD4B0t.js";
19
+ import { a as assertExists, t as assertStringIncludes } from "../std__assert-BdP_WkD-.js";
20
+ import { n as assertFalse } from "../assert_rejects-Bkh5lA1a.js";
21
+ import "../assert_is_error-CIYFACrT.js";
22
+ import { t as assertThrows } from "../assert_throws-CmpfkWEM.js";
23
+ import { t as mockDocumentLoader } from "../docloader-BDSHZfTJ.js";
24
+ import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-CLFIvF3E.js";
25
+ import { t as esm_default } from "../esm-BRXvTSrx.js";
26
26
  import { encodeBase64 } from "byte-encodings/base64";
27
27
 
28
28
  //#region sig/http.test.ts