@fedify/fedify 2.4.0-dev.1988 → 2.4.0-dev.1995

package/dist/{middleware-CeCj5caM.js → middleware-DsfWajaD.js}

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { A as recordWebFingerHandle, C as recordCollectionRequest, D as recordInboxActivity, E as recordFanoutRecipients, I as name, L as version, M as formatAcceptSignature, O as recordOutboxActivity, S as recordCollectionPageItems, _ as instrumentDocumentLoader, a as verifyRequestDetailed, b as recordCircuitBreakerStateChange, d as importJwk, f as validateCryptoKey, g as getRemoteHost, h as getFederationMetrics, i as verifyRequest, j as registerQueueDepthGauge, k as recordOutboxEnqueue, m as getDurationMs, n as parseRfc9421SignatureInput, o as exportJwk, t as doubleKnock, v as isAbortError, w as recordCollectionTotalItems, x as recordCollectionDispatchDuration } from "./http-CgwqtxAy.js";
+import { A as recordWebFingerHandle, C as recordCollectionRequest, D as recordInboxActivity, E as recordFanoutRecipients, I as name, L as version, M as formatAcceptSignature, O as recordOutboxActivity, S as recordCollectionPageItems, _ as instrumentDocumentLoader, a as verifyRequestDetailed, b as recordCircuitBreakerStateChange, d as importJwk, f as validateCryptoKey, g as getRemoteHost, h as getFederationMetrics, i as verifyRequest, j as registerQueueDepthGauge, k as recordOutboxEnqueue, m as getDurationMs, n as parseRfc9421SignatureInput, o as exportJwk, t as doubleKnock, v as isAbortError, w as recordCollectionTotalItems, x as recordCollectionDispatchDuration } from "./http-9WyuldYh.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { S as verifyCompactJsonLd, T as wrapContextLoaderForJsonLd, _ as hasSignature, b as isInvalidUrlTypeError, c as doesActorOwnKey, d as assertSafeJsonLd, g as getNormalizationContextLoader, h as detachSignature, i as verifyObject, l as getKeyOwner, n as hasProofLike, p as compactJsonLd, r as signObject, s as normalizeOutgoingActivityJsonLd, u as InvalidContextReferenceError, v as hasSignatureLike, x as signJsonLd, y as isClearlyMalformedContextReference } from "./proof-CUghqhAf.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-CykuL0ya.js";
+import { C as verifyCompactJsonLd, D as normalizeOutgoingActivityJsonLd, E as wrapContextLoaderForJsonLd, S as signJsonLd, _ as getNormalizationContextLoader, a as signObject, b as isClearlyMalformedContextReference, d as InvalidContextReferenceError, f as assertSafeJsonLd, g as detachSignature, i as hasProofLike, l as verifyPortableObjectProofPolicy, m as compactJsonLd, n as getKeyOwner, o as verifyMapLocalProof, s as verifyObject, t as doesActorOwnKey, v as hasSignature, x as isInvalidUrlTypeError, y as hasSignatureLike } from "./owner-BIPEZGiU.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DtmXhPXG.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -13,8 +13,8 @@ import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "
 import { encodeHex } from "byte-encodings/hex";
 import { FetchError, UrlError, getDocumentLoader, validatePublicUrl } from "@fedify/vocab-runtime";
 import { uniq } from "es-toolkit";
-import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 import jsonld from "@fedify/vocab-runtime/jsonld";
+import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { DataPointType, MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 import { parse, stringifyAsync } from "devalue";
@@ -1296,6 +1296,474 @@ async function buildCollectionSynchronizationHeader(collectionId, actorIds) {
 	return `collectionId="${collectionId}", url="${url}", digest="${encodeHex(await digest(actorIds))}"`;
 }
 //#endregion
+//#region src/sig/compound-proof.ts
+const textEncoder = new TextEncoder();
+const PORTABLE_OBJECT_ID_PATTERN = /^ap(?:\+ef61)?:\/\//i;
+function isJsonMap(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
+function isCompoundProofJsonObject(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
+function hasOnlyDataProperties(value) {
+	try {
+		return Reflect.ownKeys(value).every((key) => {
+			if (typeof key !== "string") return false;
+			const descriptor = Object.getOwnPropertyDescriptor(value, key);
+			return descriptor != null && "value" in descriptor && descriptor.enumerable;
+		});
+	} catch {
+		return false;
+	}
+}
+function hasOnlyJsonArrayProperties(value) {
+	try {
+		const keys = Reflect.ownKeys(value);
+		if (keys.length !== value.length + 1) return false;
+		for (const key of keys) {
+			if (key === "length") continue;
+			if (typeof key !== "string") return false;
+			const index = Number(key);
+			if (!Number.isInteger(index) || index < 0 || index >= value.length || String(index) !== key) return false;
+			const descriptor = Object.getOwnPropertyDescriptor(value, key);
+			if (descriptor == null || !descriptor.enumerable || !("value" in descriptor)) return false;
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}
+function escapeJsonPointerSegment(segment) {
+	return segment.replaceAll("~", "~0").replaceAll("/", "~1");
+}
+function childPath(path, segment) {
+	return `${path}/${escapeJsonPointerSegment(segment)}`;
+}
+function comparePaths(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+function encodedLength(value) {
+	return textEncoder.encode(value).byteLength;
+}
+function validateLimits(limits) {
+	for (const [name, value] of Object.entries(limits)) if (!Number.isSafeInteger(value) || value < 0) throw new RangeError(`${name} must be a non-negative safe integer.`);
+}
+function limitExceeded(limit, maximum, actual, path) {
+	return {
+		status: "unsupported",
+		reason: {
+			type: "limitExceeded",
+			limit,
+			maximum,
+			actual,
+			path
+		}
+	};
+}
+function addBytes(statistics, bytes, limits, path) {
+	statistics.byteLength += bytes;
+	if (statistics.byteLength > limits.maxBytes) return limitExceeded("bytes", limits.maxBytes, statistics.byteLength, path);
+}
+function inspectJsonTree(root, limits) {
+	if (!isJsonMap(root)) return {
+		status: "unsupported",
+		reason: {
+			type: "invalidJsonTree",
+			path: ""
+		}
+	};
+	const statistics = {
+		byteLength: 0,
+		mapCount: 0,
+		proofCount: 0,
+		maxDepth: 0
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const pending = [{
+		value: root,
+		path: "",
+		depth: 0,
+		insideProof: false,
+		insideContext: false
+	}];
+	while (pending.length > 0) {
+		const current = pending.pop();
+		statistics.maxDepth = Math.max(statistics.maxDepth, current.depth);
+		if (current.depth > limits.maxDepth) return limitExceeded("depth", limits.maxDepth, current.depth, current.path);
+		const value = current.value;
+		if (value === null) {
+			const failure = addBytes(statistics, 4, limits, current.path);
+			if (failure != null) return failure;
+		} else if (typeof value === "boolean") {
+			const failure = addBytes(statistics, value ? 4 : 5, limits, current.path);
+			if (failure != null) return failure;
+		} else if (typeof value === "string") {
+			const failure = addBytes(statistics, encodedLength(JSON.stringify(value)), limits, current.path);
+			if (failure != null) return failure;
+		} else if (typeof value === "number") {
+			if (!Number.isFinite(value)) return {
+				status: "unsupported",
+				reason: {
+					type: "invalidJsonTree",
+					path: current.path
+				}
+			};
+			const failure = addBytes(statistics, encodedLength(JSON.stringify(value)), limits, current.path);
+			if (failure != null) return failure;
+		} else if (Array.isArray(value)) {
+			if (seen.has(value) || !hasOnlyJsonArrayProperties(value)) return {
+				status: "unsupported",
+				reason: {
+					type: "invalidJsonTree",
+					path: current.path
+				}
+			};
+			seen.add(value);
+			const failure = addBytes(statistics, 2 + Math.max(0, value.length - 1), limits, current.path);
+			if (failure != null) return failure;
+			for (let index = value.length - 1; index >= 0; index--) pending.push({
+				value: value[index],
+				path: childPath(current.path, String(index)),
+				depth: current.depth + 1,
+				insideProof: current.insideProof,
+				insideContext: current.insideContext
+			});
+		} else if (isJsonMap(value)) {
+			const prototype = Object.getPrototypeOf(value);
+			if (seen.has(value) || !hasOnlyDataProperties(value) || prototype !== Object.prototype && prototype !== null) return {
+				status: "unsupported",
+				reason: {
+					type: "invalidJsonTree",
+					path: current.path
+				}
+			};
+			seen.add(value);
+			statistics.mapCount++;
+			if (statistics.mapCount > limits.maxMaps) return limitExceeded("maps", limits.maxMaps, statistics.mapCount, current.path);
+			const entries = Object.entries(value).sort(([left], [right]) => comparePaths(left, right));
+			let objectBytes = 2 + Math.max(0, entries.length - 1);
+			for (const [key] of entries) objectBytes += encodedLength(JSON.stringify(key)) + 1;
+			const failure = addBytes(statistics, objectBytes, limits, current.path);
+			if (failure != null) return failure;
+			const hasDirectProof = !current.insideProof && !current.insideContext && Object.hasOwn(value, "proof");
+			if (hasDirectProof) {
+				statistics.proofCount++;
+				if (statistics.proofCount > limits.maxProofs) return limitExceeded("proofs", limits.maxProofs, statistics.proofCount, childPath(current.path, "proof"));
+				if (!isJsonMap(value.proof)) return {
+					status: "unsupported",
+					reason: {
+						type: "unsupportedProofShape",
+						path: childPath(current.path, "proof")
+					}
+				};
+			}
+			for (let index = entries.length - 1; index >= 0; index--) {
+				const [key, child] = entries[index];
+				pending.push({
+					value: child,
+					path: childPath(current.path, key),
+					depth: current.depth + 1,
+					insideProof: current.insideProof || hasDirectProof && key === "proof",
+					insideContext: current.insideContext || key === "@context"
+				});
+			}
+		} else return {
+			status: "unsupported",
+			reason: {
+				type: "invalidJsonTree",
+				path: current.path
+			}
+		};
+	}
+	return statistics;
+}
+function freezeJsonTree(root) {
+	const pending = [root];
+	while (pending.length > 0) {
+		const value = pending.pop();
+		if (typeof value !== "object" || value == null) continue;
+		if (Array.isArray(value)) for (const child of value) pending.push(child);
+		else for (const child of Object.values(value)) pending.push(child);
+		Object.freeze(value);
+	}
+}
+function collectDocuments(snapshot) {
+	const documents = [];
+	const pending = [{
+		value: snapshot,
+		path: "",
+		depth: 0
+	}];
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (Array.isArray(current.value)) {
+			for (let index = current.value.length - 1; index >= 0; index--) pending.push({
+				value: current.value[index],
+				path: childPath(current.path, String(index)),
+				depth: current.depth + 1
+			});
+			continue;
+		}
+		if (!isCompoundProofJsonObject(current.value)) continue;
+		const document = current.value;
+		if (Object.hasOwn(document, "proof")) {
+			const proof = document.proof;
+			const id = typeof document.id === "string" ? document.id : typeof document["@id"] === "string" ? document["@id"] : void 0;
+			documents.push(Object.freeze({
+				path: current.path,
+				id,
+				depth: current.depth,
+				securedDocument: document,
+				proof
+			}));
+		}
+		const entries = Object.entries(document).sort(([left], [right]) => comparePaths(left, right));
+		for (let index = entries.length - 1; index >= 0; index--) {
+			const [key, value] = entries[index];
+			if (key === "proof" || key === "@context") continue;
+			pending.push({
+				value,
+				path: childPath(current.path, key),
+				depth: current.depth + 1
+			});
+		}
+	}
+	documents.sort((left, right) => right.depth - left.depth || comparePaths(left.path, right.path));
+	return documents;
+}
+function collectPortableObjects(snapshot) {
+	const objects = [];
+	const pending = [{
+		value: snapshot,
+		path: "",
+		depth: 0
+	}];
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (Array.isArray(current.value)) {
+			for (let index = current.value.length - 1; index >= 0; index--) pending.push({
+				value: current.value[index],
+				path: childPath(current.path, String(index)),
+				depth: current.depth + 1
+			});
+			continue;
+		}
+		if (!isCompoundProofJsonObject(current.value)) continue;
+		const document = current.value;
+		const id = [document.id, document["@id"]].find((value) => typeof value === "string" && PORTABLE_OBJECT_ID_PATTERN.test(value));
+		if (typeof id === "string") objects.push(Object.freeze({
+			path: current.path,
+			id,
+			depth: current.depth,
+			document
+		}));
+		const entries = Object.entries(document).sort(([left], [right]) => comparePaths(left, right));
+		for (let index = entries.length - 1; index >= 0; index--) {
+			const [key, value] = entries[index];
+			if (key === "proof" || key === "@context") continue;
+			pending.push({
+				value,
+				path: childPath(current.path, key),
+				depth: current.depth + 1
+			});
+		}
+	}
+	objects.sort((left, right) => right.depth - left.depth || comparePaths(left.path, right.path));
+	return objects;
+}
+/**
+* Determines whether a received JSON tree contains a portable object ID
+* outside a proof or context definition, without exceeding discovery limits.
+*
+* This is only an applicability check.  It does not authenticate the input;
+* callers must still use {@link verifyCompoundPortableObjectProofs} to obtain
+* an atomic result from an immutable snapshot.  `indeterminate` means the
+* applicability scan itself reached a limit, so a caller must not treat the
+* document as outside the compound profile.
+*
+* @internal
+*/
+function inspectCompoundPortableObjectApplicability(json, limits) {
+	validateLimits(limits);
+	let byteLength = 0;
+	let mapCount = 0;
+	const pending = [{
+		iterator: [json].values(),
+		depth: 0
+	}];
+	const addByteLength = (length) => {
+		byteLength += length;
+		return byteLength <= limits.maxBytes;
+	};
+	while (pending.length > 0) {
+		const frame = pending[pending.length - 1];
+		const next = frame.iterator.next();
+		if (next.done) {
+			pending.pop();
+			if (byteLength > limits.maxBytes) return "indeterminate";
+			continue;
+		}
+		const value = next.value;
+		if (frame.depth > limits.maxDepth) return "indeterminate";
+		if (value === null) {
+			if (!addByteLength(4)) return "indeterminate";
+		} else if (typeof value === "boolean") {
+			if (!addByteLength(value ? 4 : 5)) return "indeterminate";
+		} else if (typeof value === "string" || typeof value === "number") {
+			if (!addByteLength(encodedLength(JSON.stringify(value)))) return "indeterminate";
+		} else if (Array.isArray(value)) {
+			if (!addByteLength(2 + Math.max(0, value.length - 1))) return "indeterminate";
+			pending.push({
+				iterator: value.values(),
+				depth: frame.depth + 1
+			});
+		} else if (isJsonMap(value)) {
+			mapCount++;
+			if (mapCount > limits.maxMaps) return "indeterminate";
+			if ([value.id, value["@id"]].some((id) => typeof id === "string" && PORTABLE_OBJECT_ID_PATTERN.test(id))) return "present";
+			if (!addByteLength(2)) return "indeterminate";
+			const children = function* () {
+				let first = true;
+				for (const key in value) {
+					if (!Object.hasOwn(value, key)) continue;
+					if (key === "proof" || key === "@context") continue;
+					if (!first && !addByteLength(1)) return;
+					first = false;
+					if (!addByteLength(encodedLength(JSON.stringify(key)) + 1)) return;
+					yield value[key];
+				}
+			}();
+			pending.push({
+				iterator: children,
+				depth: frame.depth + 1
+			});
+		}
+		if (byteLength > limits.maxBytes) return "indeterminate";
+	}
+	return "absent";
+}
+/**
+* Discovers direct literal proof-bearing maps in an immutable JSON snapshot.
+*
+* Discovery is bounded and atomic.  Unsupported proof shapes, non-JSON input,
+* or a resource-limit failure return no partial candidate list.  Proof
+* configuration subtrees are validated and counted as JSON, but are not
+* themselves searched for secured documents.
+*/
+function discoverCompoundProofDocuments(json, limits) {
+	validateLimits(limits);
+	let inspected;
+	try {
+		inspected = inspectJsonTree(json, limits);
+	} catch {
+		return {
+			status: "unsupported",
+			reason: {
+				type: "invalidJsonTree",
+				path: ""
+			}
+		};
+	}
+	if ("status" in inspected) return inspected;
+	let snapshot;
+	try {
+		snapshot = structuredClone(json);
+	} catch {
+		return {
+			status: "unsupported",
+			reason: {
+				type: "invalidJsonTree",
+				path: ""
+			}
+		};
+	}
+	freezeJsonTree(snapshot);
+	return {
+		status: "ok",
+		snapshot,
+		documents: Object.freeze(collectDocuments(snapshot)),
+		statistics: Object.freeze({ ...inspected })
+	};
+}
+async function verifyDiscoveredProofDocuments(discovered, options) {
+	const documents = await Promise.all(discovered.documents.map(async (document) => {
+		const metadata = {
+			path: document.path,
+			...document.id == null ? {} : { id: document.id },
+			depth: document.depth
+		};
+		if (document.depth > 0 && !Object.hasOwn(document.securedDocument, "@context")) return Object.freeze({
+			...metadata,
+			verified: false,
+			reason: { type: "missingContext" }
+		});
+		const key = await verifyMapLocalProof(document.securedDocument, options);
+		return key == null ? Object.freeze({
+			...metadata,
+			verified: false,
+			reason: { type: "invalidProof" }
+		}) : Object.freeze({
+			...metadata,
+			verified: true,
+			key
+		});
+	}));
+	return Object.freeze(documents);
+}
+/**
+* Applies FEP-ef61 portable-object policy to every portable map in a compound
+* snapshot without changing the map-local cryptographic inputs.
+*
+* @internal
+*/
+async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
+	const discovered = discoverCompoundProofDocuments(json, limits);
+	if (discovered.status !== "ok") return discovered;
+	const proofs = await verifyDiscoveredProofDocuments(discovered, options);
+	const proofByPath = new Map(proofs.map((proof) => [proof.path, proof]));
+	const portableObjects = await Promise.all(collectPortableObjects(discovered.snapshot).map(async (object) => {
+		const metadata = {
+			path: object.path,
+			id: object.id,
+			depth: object.depth
+		};
+		if (object.depth > 0 && !Object.hasOwn(object.document, "@context")) return Object.freeze({
+			...metadata,
+			verified: false,
+			reason: { type: "missingContext" }
+		});
+		const proof = proofByPath.get(object.path);
+		const key = proof?.verified === true ? proof.key : null;
+		try {
+			const policy = await verifyPortableObjectProofPolicy(object.document, key, options);
+			return policy.verified ? Object.freeze({
+				...metadata,
+				id: policy.objectId,
+				verified: true,
+				keys: policy.keys
+			}) : Object.freeze({
+				...metadata,
+				verified: false,
+				reason: policy.reason
+			});
+		} catch {
+			return Object.freeze({
+				...metadata,
+				verified: false,
+				reason: { type: "invalidPortableObject" }
+			});
+		}
+	}));
+	return {
+		status: "ok",
+		verified: portableObjects.length > 0 && proofs.every((proof) => proof.verified) && portableObjects.every((object) => object.verified),
+		snapshot: discovered.snapshot,
+		proofs,
+		portableObjects: Object.freeze(portableObjects),
+		statistics: discovered.statistics
+	};
+}
+//#endregion
 //#region src/federation/inbox.ts
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
 	const logger = getLogger([
@@ -1739,6 +2207,12 @@ async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
 //#endregion
 //#region src/federation/handler.ts
 const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
+const INBOX_COMPOUND_PROOF_LIMITS = {
+	maxDepth: 64,
+	maxMaps: 1e4,
+	maxProofs: 32,
+	maxBytes: 10 * 1024 * 1024
+};
 function isRemoteContextLoadingFailure$1(error) {
 	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
 }
@@ -1863,13 +2337,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -1910,7 +2384,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -1950,7 +2424,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -1966,7 +2440,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -2860,6 +3334,31 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (!skipSignatureVerification) {
+		if (inspectCompoundPortableObjectApplicability(json, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
+			const compoundProof = await verifyCompoundPortableObjectProofs(json, INBOX_COMPOUND_PROOF_LIMITS, {
+				documentLoader: ctx.documentLoader,
+				keyCache,
+				meterProvider,
+				tracerProvider
+			});
+			if (compoundProof.status !== "ok" || !compoundProof.verified) {
+				logger.error("Failed to verify compound portable Object Integrity Proofs.", {
+					recipient,
+					activity: json,
+					reason: compoundProof.status === "unsupported" ? compoundProof.reason.type : "invalidProof"
+				});
+				span.setStatus({
+					code: SpanStatusCode.ERROR,
+					message: "Failed to verify compound portable Object Integrity Proofs."
+				});
+				return new Response("Failed to verify compound portable Object Integrity Proofs.", {
+					status: 401,
+					headers: { "Content-Type": "text/plain; charset=utf-8" }
+				});
+			}
+		}
+	}
 	if (pendingNonceLabel != null) {
 		if (!await verifySignatureNonce(request, kv, kvPrefixes.acceptSignatureNonce, pendingNonceLabel)) {
 			getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("invalidNonce", httpSigKey?.id == null ? void 0 : getRemoteHost(httpSigKey.id));
@@ -3034,8 +3533,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;

package/dist/mod.cjs

@@ -3,11 +3,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-Z3anvCd-.cjs");
-const require_federation = require("./federation-DzPUG_AP.cjs");
+const require_http = require("./http-CRFns-UE.cjs");
+const require_federation = require("./federation-DCEHQk4G.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_proof = require("./proof-DHu5zI0Z.cjs");
-const require_kv_cache = require("./kv-cache-BM2-w-Wq.cjs");
+const require_owner = require("./owner-CVA7L9MA.cjs");
+const require_kv_cache = require("./kv-cache-DXT9vmIg.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
 require("./sig/mod.cjs");
@@ -21,17 +21,17 @@ exports.Router = require_federation.Router;
 exports.RouterError = require_federation.RouterError;
 exports.SendActivityError = require_federation.SendActivityError;
 exports.actorDehydrator = require_transformers.actorDehydrator;
-exports.attachSignature = require_proof.attachSignature;
+exports.attachSignature = require_owner.attachSignature;
 exports.autoIdAssigner = require_transformers.autoIdAssigner;
 exports.buildCollectionSynchronizationHeader = require_federation.buildCollectionSynchronizationHeader;
 exports.createExponentialBackoffPolicy = require_federation.createExponentialBackoffPolicy;
 exports.createFederation = require_federation.createFederation;
 exports.createFederationBuilder = require_federation.createFederationBuilder;
-exports.createProof = require_proof.createProof;
-exports.createSignature = require_proof.createSignature;
-exports.detachSignature = require_proof.detachSignature;
+exports.createProof = require_owner.createProof;
+exports.createSignature = require_owner.createSignature;
+exports.detachSignature = require_owner.detachSignature;
 exports.digest = require_federation.digest;
-exports.doesActorOwnKey = require_proof.doesActorOwnKey;
+exports.doesActorOwnKey = require_owner.doesActorOwnKey;
 exports.exportJwk = require_http.exportJwk;
 exports.fetchKey = require_http.fetchKey;
 exports.fetchKeyDetailed = require_http.fetchKeyDetailed;
@@ -40,11 +40,11 @@ exports.fulfillAcceptSignature = require_http.fulfillAcceptSignature;
 exports.generateCryptoKeyPair = require_http.generateCryptoKeyPair;
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.getDefaultActivityTransformers = require_transformers.getDefaultActivityTransformers;
-exports.getKeyOwner = require_proof.getKeyOwner;
+exports.getKeyOwner = require_owner.getKeyOwner;
 exports.getNodeInfo = require_types.getNodeInfo;
 exports.handleWebFinger = require_federation.handleWebFinger;
-exports.hasProofLike = require_proof.hasProofLike;
-exports.hasSignatureLike = require_proof.hasSignatureLike;
+exports.hasProofLike = require_owner.hasProofLike;
+exports.hasSignatureLike = require_owner.hasSignatureLike;
 exports.importJwk = require_http.importJwk;
 exports.kvCache = require_kv_cache.kvCache;
 exports.nodeInfoToJson = require_types.nodeInfoToJson;
@@ -54,17 +54,17 @@ exports.parseCircuitBreakerKvState = require_federation.parseCircuitBreakerKvSta
 exports.parseNodeInfo = require_types.parseNodeInfo;
 exports.respondWithObject = require_federation.respondWithObject;
 exports.respondWithObjectIfAcceptable = require_federation.respondWithObjectIfAcceptable;
-exports.signJsonLd = require_proof.signJsonLd;
-exports.signObject = require_proof.signObject;
+exports.signJsonLd = require_owner.signJsonLd;
+exports.signObject = require_owner.signObject;
 exports.signRequest = require_http.signRequest;
 exports.validateAcceptSignature = require_http.validateAcceptSignature;
-exports.verifyJsonLd = require_proof.verifyJsonLd;
-exports.verifyObject = require_proof.verifyObject;
-exports.verifyPortableObjectProof = require_proof.verifyPortableObjectProof;
-exports.verifyProof = require_proof.verifyProof;
+exports.verifyJsonLd = require_owner.verifyJsonLd;
+exports.verifyObject = require_owner.verifyObject;
+exports.verifyPortableObjectProof = require_owner.verifyPortableObjectProof;
+exports.verifyProof = require_owner.verifyProof;
 exports.verifyRequest = require_http.verifyRequest;
 exports.verifyRequestDetailed = require_http.verifyRequestDetailed;
-exports.verifySignature = require_proof.verifySignature;
+exports.verifySignature = require_owner.verifySignature;
 var _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 Object.keys(_fedify_vocab_runtime).forEach(function(k) {
 	if (k !== "default" && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {