@fedify/fedify 2.4.0-dev.2054 → 2.4.0-dev.2063

package/dist/{middleware-BtwW3G41.mjs → middleware-Cw8EWwAT.mjs}

@@ -1,27 +1,27 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Bz6KTcon.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-CTAe8lYz.mjs";
+import { n as version, t as name } from "./deno-CVZgG4sc.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-B5spFq82.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
-import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-BMc-2eW0.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-Ty805y3A.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-DS54zLD1.mjs";
-import { n as kvCache } from "./kv-cache-BhPPtHg7.mjs";
+import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-BnMA6vpl.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-znjq5j6a.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-DBb8z7_l.mjs";
+import { n as kvCache } from "./kv-cache--REpvHgG.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-OpXWt-80.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-RxB_eQpU.mjs";
-import { a as verifyObject, n as hasProofLike, o as verifyPortableObjectProof, r as signObject } from "./proof-CVf2XbEa.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-DF9KzhJH.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-C86Z3BKs.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-BBVP8ock.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-Hc0hvbbX.mjs";
+import { a as verifyObject, n as hasProofLike, o as verifyPortableObjectProof, r as signObject } from "./proof-B69bJaSn.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-BB5rBhvN.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-BzS4brdy.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-BcZqTCwy.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-BrSXP5so.mjs";
 import { t as KvKeyCache } from "./keycache-BUDHB5rY.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-B6U3fEUW.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CcRkOx3C.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -30,7 +30,7 @@ import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey,
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 import { uniq } from "es-toolkit";
-import { FetchError, canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, haveSameFe34Origin, isGatewayUrl, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { FetchError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, haveSameFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import { DataPointType, MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
@@ -520,6 +520,12 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 const PORTABLE_OBJECT_CONTENT_TYPE = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"";
 const GATEWAY_OBJECT_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
 const BARE_DID_PATTERN = /^did:[a-z0-9]+:[^/?#]+$/i;
+const GATEWAY_PATH_PREFIX = "/.well-known/apgateway/";
+const HASHLINK_SCHEME_PATTERN = /^hl(?::|%3A)/i;
+/**
+* The route template of hashlink media requests, used for metrics and traces.
+*/
+const HASHLINK_MEDIA_ROUTE_TEMPLATE = "/.well-known/apgateway/hl:{digestMultibase}";
 /**
 * Recognizes an FEP-ef61 gateway request for a portable object, e.g.,
 * `GET /.well-known/apgateway/did:key:z6Mk.../notes/123`.
@@ -574,6 +580,55 @@ function buildPortableUri(authority, path) {
 	getFe34Origin(authority);
 	return parseIri(`ap+ef61://${authority}${path}`);
 }
+/**
+* Recognizes an FEP-ef61 gateway request for a resource addressed by
+* a hashlink, e.g.,
+* `GET /.well-known/apgateway/hl:zQmdfTbBqBPQ7VNxZEYEj14VmRuZBkqFbiwReogJgS1zR1n`.
+*
+* The rest of the path, including any slashes, is taken as the hashlink, as
+* a digest in a multibase encoding like base64 may contain slashes.  The query
+* is not part of the hashlink, so it is ignored here.
+*
+* @param url The request URL.
+* @returns The parsed request, or `null` if the URL is not a gateway request
+*          for a hashlink, e.g., a request for a portable object.
+*/
+function parseHashlinkGatewayRequest(url) {
+	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+	if (!url.pathname.startsWith(GATEWAY_PATH_PREFIX)) return null;
+	const encoded = url.pathname.slice(23);
+	if (!HASHLINK_SCHEME_PATTERN.test(encoded)) return null;
+	let digestMultibase;
+	let digest;
+	let multihash;
+	try {
+		let hashlink;
+		try {
+			hashlink = decodeURIComponent(encoded);
+		} catch (error) {
+			throw new TypeError("Invalid percent-encoding in the hashlink.", { cause: error });
+		}
+		({digestMultibase} = parseHashlink(hashlink));
+		({digest} = parseDigestMultibase(digestMultibase));
+		multihash = decodeMultibase(digestMultibase);
+	} catch (error) {
+		if (error instanceof TypeError) return {
+			type: "malformed",
+			error
+		};
+		throw error;
+	}
+	return {
+		type: "media",
+		media: Object.freeze({
+			hashlink: `hl:${digestMultibase}`,
+			digestMultibase,
+			algorithm: "sha2-256",
+			digest,
+			multihash
+		})
+	};
+}
 //#endregion
 //#region src/federation/handler.ts
 const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
@@ -4441,7 +4496,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 							tracer,
 							metricState
 						});
-						if (acceptsJsonLd(request)) response.headers.set("Vary", "Accept");
+						if (metricState.endpoint !== "hashlink_media" && acceptsJsonLd(request)) response.headers.set("Vary", "Accept");
 					} catch (error) {
 						this.metrics.recordHttpServerRequest(request.method, metricState.endpoint ?? "error", getDurationMs(metricStart), { routeTemplate: metricState.routeTemplate });
 						span.setStatus({
@@ -4492,24 +4547,22 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const url = new URL(request.url);
 		const route = this.router.route(url.pathname);
 		if (route == null) {
+			const media = this.hashlinkMediaDispatcher == null ? null : parseHashlinkGatewayRequest(url);
+			if (media != null) return await this.#fetchHashlinkMedia(request, media, {
+				onNotFound,
+				contextData,
+				span,
+				metricState
+			});
 			const portable = request.method === "GET" || request.method === "HEAD" ? parsePortableGatewayRequest(url) : null;
-			if (portable != null) {
-				const response = await this.#fetchPortableObject(request, portable, {
-					onNotFound,
-					onNotAcceptable,
-					onUnauthorized,
-					contextData,
-					span,
-					metricState
-				});
-				if (request.method !== "HEAD" || response.body == null) return response;
-				await response.body.cancel();
-				return new Response(null, {
-					status: response.status,
-					statusText: response.statusText,
-					headers: response.headers
-				});
-			}
+			if (portable != null) return await discardBodyForHead(request, await this.#fetchPortableObject(request, portable, {
+				onNotFound,
+				onNotAcceptable,
+				onUnauthorized,
+				contextData,
+				span,
+				metricState
+			}));
 			metricState.endpoint = "not_found";
 			return await onNotFound(request);
 		}
@@ -4833,8 +4886,67 @@ var FederationImpl = class extends FederationBuilderImpl {
 			onNotFound
 		});
 	}
+	async #fetchHashlinkMedia(request, media, { onNotFound, contextData, span, metricState }) {
+		metricState.endpoint = "hashlink_media";
+		metricState.routeTemplate = HASHLINK_MEDIA_ROUTE_TEMPLATE;
+		span.updateName(`${request.method} ${HASHLINK_MEDIA_ROUTE_TEMPLATE}`);
+		if (request.method !== "GET" && request.method !== "HEAD") return new Response("Method not allowed.", {
+			status: 405,
+			headers: {
+				Allow: "GET, HEAD",
+				"Content-Type": "text/plain; charset=utf-8"
+			}
+		});
+		if (media.type === "malformed") {
+			getLogger([
+				"fedify",
+				"federation",
+				"hashlinkMedia"
+			]).debug("Malformed FEP-ef61 hashlink media request {url}: {error}", {
+				url: request.url,
+				error: media.error
+			});
+			return new Response(request.method === "HEAD" ? null : "Malformed hashlink.", {
+				status: 400,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+		const context = this.#createContext(request, contextData);
+		const response = await this.hashlinkMediaDispatcher(context, media.media);
+		if (response == null) return await onNotFound(request);
+		return await discardBodyForHead(request, response, false);
+	}
 };
 const PORTABLE_GATEWAY_ROUTE_PREFIX = "/.well-known/apgateway/{did}";
+/**
+* Removes the body of a response to a `HEAD` request.
+* @param request The request.
+* @param response The response to the request.
+* @param waitForCancel Whether to wait until the discarded body is cancelled.
+* @returns The response without a body if the request is a `HEAD` request,
+*          or the response itself otherwise.
+*/
+async function discardBodyForHead(request, response, waitForCancel = true) {
+	if (request.method !== "HEAD" || response.body == null) return response;
+	const cancelled = response.body.cancel();
+	if (waitForCancel) await cancelled;
+	else cancelled.catch((error) => {
+		getLogger([
+			"fedify",
+			"federation",
+			"http"
+		]).debug("Failed to cancel the body of a response to {method} {url}: {error}", {
+			method: request.method,
+			url: request.url,
+			error
+		});
+	});
+	return new Response(null, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: response.headers
+	});
+}
 function getEndpointCategory(routeName) {
 	if (routeName.startsWith("object:")) return "object";
 	if (routeName.startsWith("collection:") || routeName.startsWith("orderedCollection:")) return "collection";
@@ -5974,4 +6086,4 @@ function getRequestId(request) {
 	return `req_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
 }
 //#endregion
-export { handleBenchmarkTrigger as _, OutboxContextImpl as a, actorDehydrator as b, handleActor as c, handleInbox as d, handleObject as f, PORTABLE_OBJECT_CONTENT_TYPE as g, respondWithObjectIfAcceptable as h, KvSpecDeterminer as i, handleCollection as l, respondWithObject as m, FederationImpl as n, createFederation as o, handleOutbox as p, InboxContextImpl as r, handleWebFinger as s, ContextImpl as t, handleCustomCollection as u, handleNodeInfo as v, autoIdAssigner as x, handleNodeInfoJrd as y };
+export { autoIdAssigner as S, parseHashlinkGatewayRequest as _, OutboxContextImpl as a, handleNodeInfoJrd as b, handleActor as c, handleInbox as d, handleObject as f, PORTABLE_OBJECT_CONTENT_TYPE as g, respondWithObjectIfAcceptable as h, KvSpecDeterminer as i, handleCollection as l, respondWithObject as m, FederationImpl as n, createFederation as o, handleOutbox as p, InboxContextImpl as r, handleWebFinger as s, ContextImpl as t, handleCustomCollection as u, handleBenchmarkTrigger as v, actorDehydrator as x, handleNodeInfo as y };

package/dist/{middleware-_CMav1o7.js → middleware-CzYM4cJI.js}

@@ -2,16 +2,16 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { A as recordWebFingerHandle, C as recordCollectionRequest, D as recordInboxActivity, E as recordFanoutRecipients, I as name, L as version, M as formatAcceptSignature, O as recordOutboxActivity, S as recordCollectionPageItems, _ as instrumentDocumentLoader, a as verifyRequestDetailed, b as recordCircuitBreakerStateChange, d as importJwk, f as validateCryptoKey, g as getRemoteHost, h as getFederationMetrics, i as verifyRequest, j as registerQueueDepthGauge, k as recordOutboxEnqueue, m as getDurationMs, n as parseRfc9421SignatureInput, o as exportJwk, t as doubleKnock, v as isAbortError, w as recordCollectionTotalItems, x as recordCollectionDispatchDuration } from "./http-C3WGK1dL.js";
+import { A as recordWebFingerHandle, C as recordCollectionRequest, D as recordInboxActivity, E as recordFanoutRecipients, I as name, L as version, M as formatAcceptSignature, O as recordOutboxActivity, S as recordCollectionPageItems, _ as instrumentDocumentLoader, a as verifyRequestDetailed, b as recordCircuitBreakerStateChange, d as importJwk, f as validateCryptoKey, g as getRemoteHost, h as getFederationMetrics, i as verifyRequest, j as registerQueueDepthGauge, k as recordOutboxEnqueue, m as getDurationMs, n as parseRfc9421SignatureInput, o as exportJwk, t as doubleKnock, v as isAbortError, w as recordCollectionTotalItems, x as recordCollectionDispatchDuration } from "./http-99KVDtMr.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { C as verifyCompactJsonLd, D as normalizeOutgoingActivityJsonLd, E as wrapContextLoaderForJsonLd, S as signJsonLd, _ as getNormalizationContextLoader, a as signObject, b as isClearlyMalformedContextReference, c as verifyPortableObjectProof, d as InvalidContextReferenceError, f as assertSafeJsonLd, g as detachSignature, i as hasProofLike, l as verifyPortableObjectProofPolicy, m as compactJsonLd, n as getKeyOwner, o as verifyMapLocalProof, s as verifyObject, t as doesActorOwnKey, v as hasSignature, x as isInvalidUrlTypeError, y as hasSignatureLike } from "./owner-B-TLr-1I.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-BcHCmrC8.js";
+import { C as signJsonLd, D as wrapContextLoaderForJsonLd, O as normalizeOutgoingActivityJsonLd, S as isInvalidUrlTypeError, _ as detachSignature, a as signObject, b as hasSignatureLike, c as verifyPortableObjectProof, f as InvalidContextReferenceError, h as compactJsonLd, i as hasProofLike, l as verifyPortableObjectProofPolicy, n as getKeyOwner, o as verifyMapLocalProof, p as assertSafeJsonLd, s as verifyObject, t as doesActorOwnKey, v as getNormalizationContextLoader, w as verifyCompactJsonLd, x as isClearlyMalformedContextReference, y as hasSignature } from "./owner-Cu_KMvQN.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-aijDx_jN.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 import { encodeHex } from "byte-encodings/hex";
-import { FetchError, UrlError, canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, haveSameFe34Origin, isGatewayUrl, parseIri, toCompatibleEf61Id, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, haveSameFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, toCompatibleEf61Id, validatePublicUrl } from "@fedify/vocab-runtime";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import { uniq } from "es-toolkit";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
@@ -105,6 +105,7 @@ var FederationBuilderImpl = class {
 	mediaUploaderPath;
 	mediaUploaderCallback;
 	mediaUploaderAuthorizePredicate;
+	hashlinkMediaDispatcher;
 	sharedInboxKeyDispatcher;
 	unverifiedActivityHandler;
 	outboxPermanentFailureHandler;
@@ -162,6 +163,7 @@ var FederationBuilderImpl = class {
 		f.mediaUploaderPath = this.mediaUploaderPath;
 		f.mediaUploaderCallback = this.mediaUploaderCallback;
 		f.mediaUploaderAuthorizePredicate = this.mediaUploaderAuthorizePredicate;
+		f.hashlinkMediaDispatcher = this.hashlinkMediaDispatcher;
 		f.sharedInboxKeyDispatcher = this.sharedInboxKeyDispatcher;
 		f.unverifiedActivityHandler = this.unverifiedActivityHandler;
 		f.outboxPermanentFailureHandler = this.outboxPermanentFailureHandler;
@@ -469,6 +471,10 @@ var FederationBuilderImpl = class {
 		} };
 		return setters;
 	}
+	setHashlinkMediaDispatcher(dispatcher) {
+		if (this.hashlinkMediaDispatcher != null) throw new RouterError("Hashlink media dispatcher already set.");
+		this.hashlinkMediaDispatcher = dispatcher;
+	}
 	setFollowingDispatcher(path, dispatcher) {
 		if (this.router.has("following")) throw new RouterError("Following collection dispatcher already set.");
 		assertPath(path);
@@ -2196,6 +2202,12 @@ function acceptsJsonLd(request) {
 const PORTABLE_OBJECT_CONTENT_TYPE = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"";
 const GATEWAY_OBJECT_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
 const BARE_DID_PATTERN = /^did:[a-z0-9]+:[^/?#]+$/i;
+const GATEWAY_PATH_PREFIX = "/.well-known/apgateway/";
+const HASHLINK_SCHEME_PATTERN = /^hl(?::|%3A)/i;
+/**
+* The route template of hashlink media requests, used for metrics and traces.
+*/
+const HASHLINK_MEDIA_ROUTE_TEMPLATE = "/.well-known/apgateway/hl:{digestMultibase}";
 /**
 * Recognizes an FEP-ef61 gateway request for a portable object, e.g.,
 * `GET /.well-known/apgateway/did:key:z6Mk.../notes/123`.
@@ -2250,6 +2262,55 @@ function buildPortableUri(authority, path) {
 	getFe34Origin(authority);
 	return parseIri(`ap+ef61://${authority}${path}`);
 }
+/**
+* Recognizes an FEP-ef61 gateway request for a resource addressed by
+* a hashlink, e.g.,
+* `GET /.well-known/apgateway/hl:zQmdfTbBqBPQ7VNxZEYEj14VmRuZBkqFbiwReogJgS1zR1n`.
+*
+* The rest of the path, including any slashes, is taken as the hashlink, as
+* a digest in a multibase encoding like base64 may contain slashes.  The query
+* is not part of the hashlink, so it is ignored here.
+*
+* @param url The request URL.
+* @returns The parsed request, or `null` if the URL is not a gateway request
+*          for a hashlink, e.g., a request for a portable object.
+*/
+function parseHashlinkGatewayRequest(url) {
+	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+	if (!url.pathname.startsWith(GATEWAY_PATH_PREFIX)) return null;
+	const encoded = url.pathname.slice(23);
+	if (!HASHLINK_SCHEME_PATTERN.test(encoded)) return null;
+	let digestMultibase;
+	let digest;
+	let multihash;
+	try {
+		let hashlink;
+		try {
+			hashlink = decodeURIComponent(encoded);
+		} catch (error) {
+			throw new TypeError("Invalid percent-encoding in the hashlink.", { cause: error });
+		}
+		({digestMultibase} = parseHashlink(hashlink));
+		({digest} = parseDigestMultibase(digestMultibase));
+		multihash = decodeMultibase(digestMultibase);
+	} catch (error) {
+		if (error instanceof TypeError) return {
+			type: "malformed",
+			error
+		};
+		throw error;
+	}
+	return {
+		type: "media",
+		media: Object.freeze({
+			hashlink: `hl:${digestMultibase}`,
+			digestMultibase,
+			algorithm: "sha2-256",
+			digest,
+			multihash
+		})
+	};
+}
 //#endregion
 //#region src/federation/temporal.ts
 function isPlainObject$1(value) {
@@ -6901,7 +6962,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 							tracer,
 							metricState
 						});
-						if (acceptsJsonLd(request)) response.headers.set("Vary", "Accept");
+						if (metricState.endpoint !== "hashlink_media" && acceptsJsonLd(request)) response.headers.set("Vary", "Accept");
 					} catch (error) {
 						this.metrics.recordHttpServerRequest(request.method, metricState.endpoint ?? "error", getDurationMs(metricStart), { routeTemplate: metricState.routeTemplate });
 						span.setStatus({
@@ -6952,24 +7013,22 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const url = new URL(request.url);
 		const route = this.router.route(url.pathname);
 		if (route == null) {
+			const media = this.hashlinkMediaDispatcher == null ? null : parseHashlinkGatewayRequest(url);
+			if (media != null) return await this.#fetchHashlinkMedia(request, media, {
+				onNotFound,
+				contextData,
+				span,
+				metricState
+			});
 			const portable = request.method === "GET" || request.method === "HEAD" ? parsePortableGatewayRequest(url) : null;
-			if (portable != null) {
-				const response = await this.#fetchPortableObject(request, portable, {
-					onNotFound,
-					onNotAcceptable,
-					onUnauthorized,
-					contextData,
-					span,
-					metricState
-				});
-				if (request.method !== "HEAD" || response.body == null) return response;
-				await response.body.cancel();
-				return new Response(null, {
-					status: response.status,
-					statusText: response.statusText,
-					headers: response.headers
-				});
-			}
+			if (portable != null) return await discardBodyForHead(request, await this.#fetchPortableObject(request, portable, {
+				onNotFound,
+				onNotAcceptable,
+				onUnauthorized,
+				contextData,
+				span,
+				metricState
+			}));
 			metricState.endpoint = "not_found";
 			return await onNotFound(request);
 		}
@@ -7293,8 +7352,67 @@ var FederationImpl = class extends FederationBuilderImpl {
 			onNotFound
 		});
 	}
+	async #fetchHashlinkMedia(request, media, { onNotFound, contextData, span, metricState }) {
+		metricState.endpoint = "hashlink_media";
+		metricState.routeTemplate = HASHLINK_MEDIA_ROUTE_TEMPLATE;
+		span.updateName(`${request.method} ${HASHLINK_MEDIA_ROUTE_TEMPLATE}`);
+		if (request.method !== "GET" && request.method !== "HEAD") return new Response("Method not allowed.", {
+			status: 405,
+			headers: {
+				Allow: "GET, HEAD",
+				"Content-Type": "text/plain; charset=utf-8"
+			}
+		});
+		if (media.type === "malformed") {
+			getLogger([
+				"fedify",
+				"federation",
+				"hashlinkMedia"
+			]).debug("Malformed FEP-ef61 hashlink media request {url}: {error}", {
+				url: request.url,
+				error: media.error
+			});
+			return new Response(request.method === "HEAD" ? null : "Malformed hashlink.", {
+				status: 400,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+		const context = this.#createContext(request, contextData);
+		const response = await this.hashlinkMediaDispatcher(context, media.media);
+		if (response == null) return await onNotFound(request);
+		return await discardBodyForHead(request, response, false);
+	}
 };
 const PORTABLE_GATEWAY_ROUTE_PREFIX = "/.well-known/apgateway/{did}";
+/**
+* Removes the body of a response to a `HEAD` request.
+* @param request The request.
+* @param response The response to the request.
+* @param waitForCancel Whether to wait until the discarded body is cancelled.
+* @returns The response without a body if the request is a `HEAD` request,
+*          or the response itself otherwise.
+*/
+async function discardBodyForHead(request, response, waitForCancel = true) {
+	if (request.method !== "HEAD" || response.body == null) return response;
+	const cancelled = response.body.cancel();
+	if (waitForCancel) await cancelled;
+	else cancelled.catch((error) => {
+		getLogger([
+			"fedify",
+			"federation",
+			"http"
+		]).debug("Failed to cancel the body of a response to {method} {url}: {error}", {
+			method: request.method,
+			url: request.url,
+			error
+		});
+	});
+	return new Response(null, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: response.headers
+	});
+}
 function getEndpointCategory(routeName) {
 	if (routeName.startsWith("object:")) return "object";
 	if (routeName.startsWith("collection:") || routeName.startsWith("orderedCollection:")) return "collection";

package/dist/{mod-DU8aVzQJ.d.cts → mod-Bfenkg_c.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Bt as WebFingerLinksDispatcher, _t as ActorDispatcher, gt as ActorAliasMapper, u as RequestContext, vt as ActorHandleMapper } from "./context-Bh_mJfbD.cjs";
+import { Ht as WebFingerLinksDispatcher, _t as ActorDispatcher, gt as ActorAliasMapper, u as RequestContext, vt as ActorHandleMapper } from "./context-b36TpPoG.cjs";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 

package/dist/{mod-BofpDIcU.d.ts → mod-BhMvsgdF.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Bt as WebFingerLinksDispatcher, _t as ActorDispatcher, gt as ActorAliasMapper, u as RequestContext, vt as ActorHandleMapper } from "./context-BJPHhBmD.js";
+import { Ht as WebFingerLinksDispatcher, _t as ActorDispatcher, gt as ActorAliasMapper, u as RequestContext, vt as ActorHandleMapper } from "./context-D_gg4M0n.js";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 

package/dist/{mod-CNRAxXEb.d.ts → mod-Dhm7SqyE.d.ts}

@@ -2,7 +2,7 @@
 import { S as KeyCache } from "./http-65PYi9jY.js";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
-import { DocumentLoader } from "@fedify/vocab-runtime";
+import { DocumentLoader, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
 
 //#region src/sig/ld.d.ts
 /**
@@ -382,4 +382,152 @@ declare function verifyObject<T extends Object$1>(cls: (new (...args: any[]) =>
   fromJsonLd(jsonLd: unknown, options: VerifyObjectOptions): Promise<T>;
 }, jsonLd: unknown, options?: VerifyObjectOptions): Promise<T | null>;
 //#endregion
-export { verifyJsonLd as C, signJsonLd as S, VerifySignatureOptions as _, VerifyPortableObjectProofOptions as a, detachSignature as b, createProof as c, verifyObject as d, verifyPortableObjectProof as f, VerifyJsonLdOptions as g, SignJsonLdOptions as h, VerifyPortableObjectProofFailureReason as i, hasProofLike as l, CreateSignatureOptions as m, SignObjectOptions as n, VerifyPortableObjectProofResult as o, verifyProof as p, VerifyObjectOptions as r, VerifyProofOptions as s, CreateProofOptions as t, signObject as u, attachSignature as v, verifySignature as w, hasSignatureLike as x, createSignature as y };
+//#region src/sig/portable-collection.d.ts
+/**
+* Options for {@link verifyPortableObject}.
+*
+* Besides the options for {@link verifyPortableObjectProof}, it takes where
+* the document came from, which property accessors pass automatically when
+* `verifyPortableObject()` is used as their `verifyPortableObject` option.
+* @since 2.4.0
+*/
+interface VerifyPortableObjectOptions extends VerifyPortableObjectProofOptions, Omit<PortableObjectVerifierOptions, "documentLoader" | "contextLoader" | "tracerProvider"> {}
+/**
+* The reason why {@link verifyPortableObject} did not accept a document.
+*
+* Besides the reasons of {@link verifyPortableObjectProof}, it describes why
+* an unsecured portable collection was not trusted.  The
+* `unsecuredCollection` reason itself never appears, since such collections
+* are judged by the gateway trust policy instead.
+* @since 2.4.0
+*/
+type VerifyPortableObjectFailureReason = Exclude<VerifyPortableObjectProofFailureReason, {
+  readonly type: "unsecuredCollection";
+}> | {
+  /**
+  * The unsecured collection was not retrieved from a gateway, i.e., the
+  * document's final URL is missing or is not a compatible identifier for
+  * the same portable collection.
+  */
+  readonly type: "unknownCollectionSource"; /** The final URL of the document, if known. */
+  readonly documentUrl: URL | null;
+} | {
+  /**
+  * The actor that owns the unsecured collection cannot be determined
+  * unambiguously.
+  */
+  readonly type: "unknownCollectionOwner";
+} | {
+  /** The collection, its pages, or its referrer disagree on its owner. */readonly type: "conflictingCollectionOwners"; /** The owner candidates that disagree. */
+  readonly candidates: readonly URL[];
+} | {
+  /**
+  * A collection page does not belong to the collection it was reached
+  * from: its `partOf` names another collection, or its cryptographic
+  * origin differs.
+  */
+  readonly type: "collectionPageMismatch"; /** The page. */
+  readonly pageId: URL; /** The collection that the page was reached from. */
+  readonly collectionId: URL; /** The mismatching `partOf`, or `null` if the origin differs. */
+  readonly partOf: URL | null;
+} | {
+  /**
+  * The owner's actor document could not be retrieved or verified, or it
+  * lists no gateways.
+  */
+  readonly type: "collectionOwnerUnavailable"; /** The owner candidate. */
+  readonly owner: URL;
+} | {
+  /**
+  * The owner's actor document does not list the collection as its
+  * `inbox`, `outbox`, `followers`, `following`, or `liked`.
+  */
+  readonly type: "collectionNotListedByOwner"; /** The owner. */
+  readonly owner: URL; /** The collection. */
+  readonly collectionId: URL;
+} | {
+  /**
+  * The unsecured collection was retrieved from a gateway that its owner
+  * does not list in its `gateways`.
+  */
+  readonly type: "untrustedGateway"; /** The owner. */
+  readonly owner: URL; /** The gateway that served the collection. */
+  readonly gateway: URL; /** The owner's gateways. */
+  readonly gateways: readonly URL[];
+};
+/**
+* The result of {@link verifyPortableObject}.
+* @since 2.4.0
+*/
+type VerifyPortableObjectResult = {
+  /** Whether the document is accepted. */readonly verified: true; /** The document carries valid Object Integrity Proofs. */
+  readonly method: "proof"; /** The public keys used by the verified proofs, in proof order. */
+  readonly keys: readonly Multikey[];
+  /**
+  * Opaque state for verifying the pages of a portable collection.  Do not
+  * inspect it; property accessors pass it back automatically.
+  */
+  readonly collectionContext?: unknown;
+} | {
+  /** Whether the document is accepted. */readonly verified: true;
+  /**
+  * The document is an unsecured portable collection served by a gateway
+  * that its owner lists.
+  */
+  readonly method: "gateway"; /** The document has no integrity proof. */
+  readonly unsecured: true; /** The actor that owns the collection. */
+  readonly owner: URL; /** The gateway that served the collection. */
+  readonly gateway: URL;
+  /**
+  * Opaque state for verifying the pages of a portable collection.  Do not
+  * inspect it; property accessors pass it back automatically.
+  */
+  readonly collectionContext: unknown;
+} | {
+  /** Whether the document is accepted. */readonly verified: false; /** Why the document was not accepted. */
+  readonly reason: VerifyPortableObjectFailureReason;
+};
+/**
+* Applies the [FEP-ef61] trust policy to a portable object fetched through
+* a gateway.
+*
+* Portable actors, activities, objects, and collections with proofs are
+* verified by {@link verifyPortableObjectProof}.  A portable collection or
+* collection page without a proof is accepted only if all of the following
+* hold:
+*
+*  -  It was retrieved from a gateway: its final URL (`documentUrl`) is
+*     a compatible identifier for the same portable collection.
+*  -  Its owner is determined unambiguously: the actor whose `inbox`,
+*     `outbox`, `followers`, `following`, or `liked` property referred to
+*     the collection, or the single actor in its `attributedTo`.  A page
+*     inherits the owner of the collection it was reached from through
+*     `first`, `last`, `current`, `next`, or `prev`, and must not name
+*     another collection in `partOf`.
+*  -  The owner's actor document is verified by its proof and lists the
+*     collection as its `inbox`, `outbox`, `followers`, `following`, or
+*     `liked`.
+*  -  The gateway that served the collection is in the owner's `gateways`.
+*
+* Where the document came from and which object referred to it are passed
+* by property accessors when this function is used as their
+* `verifyPortableObject` option.  Objects embedded in an unsecured
+* collection accepted this way are not trusted: accessors dereference and
+* verify them one by one.
+*
+* Note that acceptance through the gateway policy does not verify anything
+* cryptographically; it only means that the owner trusts the gateway.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param jsonLd The JSON-LD document to verify.
+* @param options Additional options.  See also
+*                {@link VerifyPortableObjectOptions}.
+* @returns The detailed result.
+* @throws {TypeError} If the input is not a single JSON-LD object or has a
+*                     malformed portable ID.
+* @since 2.4.0
+*/
+declare function verifyPortableObject(jsonLd: unknown, options?: VerifyPortableObjectOptions): Promise<VerifyPortableObjectResult>;
+//#endregion
+export { createSignature as C, verifyJsonLd as D, signJsonLd as E, verifySignature as O, attachSignature as S, hasSignatureLike as T, verifyProof as _, CreateProofOptions as a, VerifyJsonLdOptions as b, VerifyPortableObjectProofFailureReason as c, VerifyProofOptions as d, createProof as f, verifyPortableObjectProof as g, verifyObject as h, verifyPortableObject as i, VerifyPortableObjectProofOptions as l, signObject as m, VerifyPortableObjectOptions as n, SignObjectOptions as o, hasProofLike as p, VerifyPortableObjectResult as r, VerifyObjectOptions as s, VerifyPortableObjectFailureReason as t, VerifyPortableObjectProofResult as u, CreateSignatureOptions as v, detachSignature as w, VerifySignatureOptions as x, SignJsonLdOptions as y };