@fedify/fedify 2.4.0-dev.2027 → 2.4.0-dev.2030

package/dist/{federation-C0ijTwhx.cjs → federation-CTnaljmy.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-CWXKwHPv.cjs");
+const require_http = require("./http-B5F1JMh0.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-DffLVeYC.cjs");
-const require_kv_cache = require("./kv-cache-Dos4tOWb.cjs");
+const require_owner = require("./owner-WUYke16i.cjs");
+const require_kv_cache = require("./kv-cache-8K70pjtX.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -1644,6 +1644,78 @@ function inspectCompoundPortableObjectApplicability(json, limits) {
 	return "absent";
 }
 /**
+* Walks every JSON map in a finite, already-materialized JSON tree, depth
+* first in insertion order, skipping the values of `proof` and `@context`
+* members.  A map reached a second time through a repeated reference is not
+* visited again, so a cyclic input terminates.  The walk stops as soon as
+* the visitor returns a value other than `undefined`.
+*/
+function findInJsonMaps(json, visit) {
+	const seen = /* @__PURE__ */ new Set();
+	const pending = [{
+		value: json,
+		path: ""
+	}];
+	while (pending.length > 0) {
+		const { value, path } = pending.pop();
+		if (typeof value !== "object" || value == null || seen.has(value)) continue;
+		seen.add(value);
+		if (Array.isArray(value)) {
+			for (let index = value.length - 1; index >= 0; index--) pending.push({
+				value: value[index],
+				path: childPath(path, String(index))
+			});
+			continue;
+		}
+		const map = value;
+		const result = visit(map, path);
+		if (result !== void 0) return result;
+		const keys = Object.keys(map);
+		for (let index = keys.length - 1; index >= 0; index--) {
+			const key = keys[index];
+			if (key === "proof" || key === "@context") continue;
+			pending.push({
+				value: map[key],
+				path: childPath(path, key)
+			});
+		}
+	}
+}
+/**
+* Determines whether an outgoing JSON tree contains portable content that
+* requires producer-side proof-shape checks: a map, outside proof and context
+* values, whose direct `id` or `@id` is a portable ActivityPub URI.
+*
+* This deliberately differs from
+* {@link inspectCompoundPortableObjectApplicability}: it applies no resource
+* limits, so a portable map or an unsupported proof beyond the inbox limits
+* is still found, and a large document without portable maps stays outside
+* the compound-proof profile.  The input must be a finite JSON tree that has
+* already been materialized, such as a compact JSON-LD document about to be
+* sent.
+*
+* @internal
+*/
+function containsCompoundPortableObject(json) {
+	return findInJsonMaps(json, (map) => [map.id, map["@id"]].some((id) => typeof id === "string" && PORTABLE_OBJECT_ID_PATTERN.test(id)) ? true : void 0) ?? false;
+}
+/**
+* Finds the first direct `proof` member whose value the map-local
+* compound-proof profile does not accept, i.e., anything other than a single
+* JSON map: a proof set, `null`, or a scalar.  Like the inbox discovery, it
+* does not look inside proof or context values.
+*
+* The input must be a finite, already-materialized JSON tree; see
+* {@link containsCompoundPortableObject}.
+*
+* @returns The RFC 6901 JSON Pointer to the unsupported `proof` member, or
+*          `null` if every direct proof is a single JSON map.
+* @internal
+*/
+function findUnsupportedCompoundProofShape(json) {
+	return findInJsonMaps(json, (map, path) => Object.hasOwn(map, "proof") && !isJsonMap(map.proof) ? childPath(path, "proof") : void 0) ?? null;
+}
+/**
 * Discovers direct literal proof-bearing maps in an immutable JSON snapshot.
 *
 * Discovery is bounded and atomic.  Unsupported proof shapes, non-JSON input,
@@ -4628,6 +4700,102 @@ function serializeDataPointType(dataPointType) {
 	}
 }
 //#endregion
+//#region src/federation/outgoing-proof.ts
+function isPortableUrl(url) {
+	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
+}
+function formatKeyIds(candidates) {
+	return candidates.map((c) => c.verificationMethod.href).join(", ");
+}
+/**
+* Creates the Object Integrity Proofs Fedify attaches to an outgoing activity.
+*
+* Outside the map-local compound-proof profile, i.e., when the activity
+* embeds no portable object, every Ed25519 key signs the activity, as it
+* always has.  Inside the profile, which accepts exactly one direct proof per
+* map, Fedify creates at most one proof:
+*
+*  -  An activity that already carries a proof is kept as is.
+*  -  A single Ed25519 key signs the activity.
+*  -  With several Ed25519 keys, a portable activity is signed by the one key
+*     whose verification method is a DID URL for the activity's DID, the only
+*     proof the FEP-ef61 policy can accept.  If no key or more than one key
+*     qualifies, or the activity is not portable itself, the choice is
+*     ambiguous and this function throws.
+*
+* @throws {TypeError} If a single proof key cannot be chosen.
+* @internal
+*/
+async function signOutgoingActivity(activity, candidates, options) {
+	const { contextLoader, tracerProvider } = options;
+	let hasProof = false;
+	for await (const _ of activity.getProofs({ contextLoader })) {
+		hasProof = true;
+		break;
+	}
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519");
+	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
+		activity,
+		hasProof,
+		proofCreated: false
+	};
+	const sign = async (selected) => {
+		for (const { verificationMethod, privateKey } of selected) activity = await require_owner.signObject(activity, privateKey, verificationMethod, {
+			contextLoader,
+			tracerProvider
+		});
+		return {
+			activity,
+			hasProof: true,
+			proofCreated: true
+		};
+	};
+	if (keys.length < 2 && !hasProof) return await sign(keys);
+	if (!containsCompoundPortableObject(await activity.toJsonLd({
+		format: "compact",
+		contextLoader
+	}))) return await sign(keys);
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"outbox"
+	]);
+	const activityId = activity.id?.href;
+	if (hasProof) {
+		logger.debug("The activity {activityId} embeds portable objects and already carries a proof, so no further proof is added; the map-local compound-proof profile accepts exactly one direct proof per map.", { activityId });
+		return {
+			activity,
+			hasProof,
+			proofCreated: false
+		};
+	}
+	if (activity.id == null || !isPortableUrl(activity.id)) throw new TypeError(`Cannot choose an Object Integrity Proof key for the activity ${activityId}: it embeds portable objects, so it falls under the map-local compound-proof profile, which accepts exactly one direct proof per map, but ${keys.length} Ed25519 keys were supplied (${formatKeyIds(keys)}).  Send it with explicit sender keys that contain exactly one Ed25519 key (RSA keys for HTTP Signatures may stay), or sign it with signObject() before sending it.`);
+	const activityDid = (0, _fedify_vocab_runtime.getFe34Origin)(activity.id);
+	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && (0, _fedify_vocab_runtime.haveSameFe34Origin)(activity.id, c.verificationMethod));
+	if (eligible.length !== 1) throw new TypeError(`Cannot choose an Object Integrity Proof key for the portable activity ${activityId}: ` + (eligible.length < 1 ? `none of its ${keys.length} Ed25519 keys (${formatKeyIds(keys)}) ` : `${eligible.length} of its Ed25519 keys (${formatKeyIds(eligible)}) `) + `${eligible.length < 1 ? "is" : "are"} a DID URL verification method for ${activityDid}.  The map-local compound-proof profile accepts exactly one direct proof per map, and FEP-ef61 requires that proof's verification method to be a DID URL for the activity's DID.  Supply exactly one Ed25519 key whose key ID is a DID URL for ${activityDid}, or sign the activity with signObject() before sending it.`);
+	logger.debug("The portable activity {activityId} is signed only by {keyId}, the one Ed25519 key whose verification method matches its DID; the map-local compound-proof profile accepts exactly one direct proof per map.", {
+		activityId,
+		keyId: eligible[0].verificationMethod.href
+	});
+	return await sign(eligible);
+}
+/**
+* Rejects an outgoing activity whose proofs Fedify's own inbox would reject
+* as unsupported: a document with portable objects in which some map carries
+* a proof set or another value that is not a single proof map.
+*
+* @param jsonLd The compact JSON-LD document about to be delivered.
+* @param activityId The activity ID, for the error message.
+* @throws {TypeError} If the document has an unsupported proof shape.
+* @internal
+*/
+function assertSupportedCompoundProofShape(jsonLd, activityId) {
+	if (!containsCompoundPortableObject(jsonLd)) return;
+	const path = findUnsupportedCompoundProofShape(jsonLd);
+	if (path == null) return;
+	throw new TypeError(`Cannot send the activity ${activityId}: it embeds portable objects, but its proof at the JSON Pointer ${JSON.stringify(path)} is not a single proof map.  The map-local compound-proof profile accepts exactly one direct proof per map, so Fedify inboxes would reject the activity.  Sign each object with exactly one key.`);
+}
+//#endregion
 //#region src/federation/retry.ts
 const Temporal$4 = require_http.Temporal;
 /**
@@ -6438,8 +6606,6 @@ var FederationImpl = class extends FederationBuilderImpl {
 		else if (keys.length < 1) throw new TypeError("The keys must not be empty.");
 		const contextLoader = this.contextLoaderFactory(this.#getLoaderOptions(ctx.origin));
 		const activityId = activity.id.href;
-		let hasProof = false;
-		let proofCreated = false;
 		let rsaKey = null;
 		for (const { keyId, privateKey } of keys) {
 			require_http.validateCryptoKey(privateKey, "private");
@@ -6448,25 +6614,22 @@ var FederationImpl = class extends FederationBuilderImpl {
 				privateKey
 			};
 		}
-		for await (const _ of activity.getProofs({ contextLoader })) {
-			hasProof = true;
-			break;
-		}
-		if (!hasProof) {
-			for (const { keyId, privateKey } of keys) if (privateKey.algorithm.name === "Ed25519") {
-				activity = await require_owner.signObject(activity, privateKey, keyId, {
-					contextLoader,
-					tracerProvider: this.tracerProvider
-				});
-				hasProof = true;
-				proofCreated = true;
-			}
-		}
+		const signed = await signOutgoingActivity(activity, keys.map(({ keyId, privateKey }) => ({
+			verificationMethod: keyId,
+			privateKey
+		})), {
+			contextLoader,
+			tracerProvider: this.tracerProvider,
+			appendToExistingProofs: false
+		});
+		activity = signed.activity;
+		const { hasProof, proofCreated } = signed;
 		let jsonLd = !proofCreated && options.activityJsonLd != null ? options.activityJsonLd : await activity.toJsonLd({
 			format: "compact",
 			contextLoader
 		});
 		if (proofCreated || !hasProof || options.normalizeExistingProofs) jsonLd = await require_owner.normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, { preserveNestedSecuredDocuments: true });
+		assertSupportedCompoundProofShape(jsonLd, activityId);
 		if (rsaKey == null) logger.warn("No supported key found to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.  In order to create a Linked Data signature, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 			activityId,
 			keys: keys.map((pair) => ({
@@ -7438,33 +7601,18 @@ var ContextImpl = class ContextImpl {
 			});
 			throw new TypeError("The activity to send must have at least one actor property.");
 		}
-		let proofCreated = false;
-		if (actorKeyPairs != null) {
-			const contextLoader = this.contextLoader;
-			for (const kp of actorKeyPairs) {
-				if (kp.privateKey.algorithm.name !== "Ed25519" || kp.multikey.id == null) continue;
-				activity = await require_owner.signObject(activity, kp.privateKey, kp.multikey.id, {
-					contextLoader,
-					tracerProvider: this.tracerProvider
-				});
-				proofCreated = true;
-			}
-		} else {
-			const contextLoader = this.contextLoader;
-			let hasProof = false;
-			for await (const _ of activity.getProofs({ contextLoader })) {
-				hasProof = true;
-				break;
-			}
-			if (!hasProof) for (const { keyId, privateKey } of keys) {
-				if (privateKey.algorithm.name !== "Ed25519") continue;
-				activity = await require_owner.signObject(activity, privateKey, keyId, {
-					contextLoader,
-					tracerProvider: this.tracerProvider
-				});
-				proofCreated = true;
-			}
-		}
+		const { activity: signedActivity, proofCreated } = await signOutgoingActivity(activity, actorKeyPairs == null ? keys.map(({ keyId, privateKey }) => ({
+			verificationMethod: keyId,
+			privateKey
+		})) : actorKeyPairs.flatMap((kp) => kp.multikey.id == null ? [] : [{
+			verificationMethod: kp.multikey.id,
+			privateKey: kp.privateKey
+		}]), {
+			contextLoader: this.contextLoader,
+			tracerProvider: this.tracerProvider,
+			appendToExistingProofs: actorKeyPairs != null
+		});
+		activity = signedActivity;
 		const inboxes = extractInboxes({
 			recipients: expandedRecipients,
 			preferSharedInbox: options.preferSharedInbox,
@@ -7489,6 +7637,11 @@ var ContextImpl = class ContextImpl {
 			});
 			return true;
 		}
+		const activityJsonLd = await activity.toJsonLd({
+			format: "compact",
+			contextLoader: this.contextLoader
+		});
+		assertSupportedCompoundProofShape(activityJsonLd, activity.id?.href);
 		const keyJwkPairs = await Promise.all(keys.map(async ({ keyId, privateKey }) => ({
 			keyId: keyId.href,
 			privateKey: await require_http.exportJwk(privateKey)
@@ -7504,10 +7657,7 @@ var ContextImpl = class ContextImpl {
 				actorIds: [...actorIds],
 				sharedInbox
 			}])),
-			activity: await activity.toJsonLd({
-				format: "compact",
-				contextLoader: this.contextLoader
-			}),
+			activity: activityJsonLd,
 			activityId: activity.id?.href,
 			activityType: (0, _fedify_vocab.getTypeId)(activity).href,
 			collectionSync: opts.collectionSync,

package/dist/{http-CWXKwHPv.cjs → http-B5F1JMh0.cjs}

@@ -9,7 +9,7 @@ let byte_encodings_base64 = require("byte-encodings/base64");
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2027+fcf88bfc";
+var version = "2.4.0-dev.2030+e6b3de3d";
 //#endregion
 //#region ../../node_modules/.pnpm/temporal-polyfill@1.0.1/node_modules/temporal-polyfill/chunks/root.js
 const NativeTemporal = globalThis.Temporal;

package/dist/{http-KZWtR1H8.js → http-By8tnmEr.js}

@@ -10,7 +10,7 @@ import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2027+fcf88bfc";
+var version = "2.4.0-dev.2030+e6b3de3d";
 //#endregion
 //#region src/sig/accept.ts
 /**

package/dist/{http-fIK5D83n.mjs → http-D4WPcJUe.mjs}

@@ -1,10 +1,10 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BcZNXlJn.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-D7RydU_p.mjs";
+import { n as version, t as name } from "./deno-Vj_9wePq.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DpQqUAmh.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
-import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-Xb1hVVZO.mjs";
+import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-B_Zc5Jbd.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{key-Xb1hVVZO.mjs → key-B_Zc5Jbd.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BcZNXlJn.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-D7RydU_p.mjs";
+import { n as version, t as name } from "./deno-Vj_9wePq.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DpQqUAmh.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{kv-cache-Dos4tOWb.cjs → kv-cache-8K70pjtX.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-CWXKwHPv.cjs");
+const require_http = require("./http-B5F1JMh0.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{kv-cache-CU1rmQFB.mjs → kv-cache-BXdT7pJQ.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-D7RydU_p.mjs";
+import { p as recordDocumentCache } from "./metrics-DpQqUAmh.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-HOO6BsuW.js → kv-cache-BswMKQjC.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { T as recordDocumentCache, f as validateCryptoKey, t as doubleKnock } from "./http-KZWtR1H8.js";
+import { T as recordDocumentCache, f as validateCryptoKey, t as doubleKnock } from "./http-By8tnmEr.js";
 import { getLogger } from "@logtape/logtape";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{ld-DFHvxLtx.mjs → ld-B16KUSIQ.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BcZNXlJn.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-D7RydU_p.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-Xb1hVVZO.mjs";
+import { n as version, t as name } from "./deno-Vj_9wePq.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DpQqUAmh.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-B_Zc5Jbd.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-D7RydU_p.mjs → metrics-DpQqUAmh.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BcZNXlJn.mjs";
+import { n as version, t as name } from "./deno-Vj_9wePq.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-DgU5bJnn.mjs → middleware-BL5HFFVU.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-BsYD_ufs.mjs";
+import { n as FederationImpl } from "./middleware-C7_hqDnl.mjs";
 export { FederationImpl };