@fedify/fedify 2.4.0-dev.2063 → 2.4.0-dev.2071

package/dist/portable-key-Cw_ow5vn.mjs

@@ -0,0 +1,194 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { h as isSamePublicKey, l as getCanonicalPortableId, p as isPortableActorDocument } from "./key-lfcx_NaE.mjs";
+import { c as verifyPortableObjectProofWithRoot } from "./proof-B6gwdhN5.mjs";
+import { getLogger } from "@logtape/logtape";
+import { CryptographicKey, Multikey, Object as Object$1 } from "@fedify/vocab";
+import { getDocumentLoader, isGatewayUrl } from "@fedify/vocab-runtime";
+//#region src/sig/portable-key.ts
+const logger = getLogger([
+	"fedify",
+	"sig",
+	"key"
+]);
+const SEC = "https://w3id.org/security#";
+/**
+* Verifies that the signed document of a portable actor vouches for
+* the gateway key with the given ID.
+*
+* A gateway key is accepted only if:
+*
+*  -  the document is an actor whose portable ID is the one the key ID is
+*     the compatible identifier of;
+*  -  the document has a valid [FEP-8b32] Object Integrity Proof made by
+*     the DID of its ID, i.e., it satisfies the [FEP-ef61] proof policy;
+*  -  the document embeds a `Multikey` with that ID in its `assertionMethod`,
+*     whose `controller` is the actor, as [FEP-521a] requires; a key
+*     embedded in its `publicKey` with the same ID must agree with it; and
+*  -  the key ID's origin is one of the actor's `gateways`.
+*
+* [FEP-8b32]: https://w3id.org/fep/8b32
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* [FEP-521a]: https://w3id.org/fep/521a
+*
+* @param document The raw JSON-LD document served at the key ID.
+* @param actor The parsed document, which must be a portable actor.
+* @param keyId The key ID, which must be a compatible key ID.
+* @param options Loaders and telemetry providers.
+* @returns The verification result, which is never `legacy`.
+* @internal
+*/
+async function verifyPortableGatewayKeyDocument(document, actor, keyId, options = {}) {
+	const reject = (reason) => {
+		logger.debug("Failed to verify gateway key {keyId} of the portable actor {actorId}: {reason}", {
+			keyId: keyId.href,
+			actorId: actor.id?.href,
+			reason
+		});
+		return {
+			type: "rejected",
+			reason
+		};
+	};
+	const keyBase = new URL(keyId.href);
+	keyBase.hash = "";
+	const claimedActorId = getCanonicalPortableId(keyBase);
+	const actorId = actor.id == null ? null : getCanonicalPortableId(actor.id);
+	if (claimedActorId == null || actorId == null) return reject("The key ID or the actor ID is not a valid portable ID.");
+	if (claimedActorId !== actorId) return reject("The key ID is not a compatible identifier of the actor it dereferences to.");
+	let verification;
+	try {
+		verification = await verifyPortableObjectProofWithRoot(document, {
+			documentLoader: options.documentLoader,
+			contextLoader: options.contextLoader,
+			keyCache: options.keyCache,
+			tracerProvider: options.tracerProvider,
+			meterProvider: options.meterProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject(`The actor document is malformed: ${error.message}`);
+	}
+	const { result, root } = verification;
+	if (!result.verified) return reject("The actor document does not satisfy the FEP-ef61 proof policy: " + result.reason.type);
+	if (root == null) return reject("The actor document could not be expanded.");
+	const refuse = (url) => Promise.reject(/* @__PURE__ */ new Error(`Refusing to fetch ${url}.`));
+	let verifiedActor;
+	try {
+		verifiedActor = await Object$1.fromJsonLd(root, {
+			documentLoader: refuse,
+			contextLoader: options.contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject("The verified actor document is malformed.");
+	}
+	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
+	actor = verifiedActor;
+	const multikeyNode = findEmbeddedNode(root[`${SEC}assertionMethod`], keyId);
+	if (multikeyNode == null) return reject("The actor document does not embed the key in its assertionMethod.");
+	let multikey;
+	try {
+		multikey = await Multikey.fromJsonLd(multikeyNode, {
+			documentLoader: refuse,
+			contextLoader: options.contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject("The key in the assertionMethod is malformed.");
+	}
+	if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
+	if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
+	const publicKeyNode = findEmbeddedNode(root[`${SEC}publicKey`], keyId);
+	if (publicKeyNode != null) {
+		let publicKey;
+		try {
+			publicKey = await CryptographicKey.fromJsonLd(publicKeyNode, {
+				documentLoader: refuse,
+				contextLoader: options.contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			return reject("The key in the publicKey is malformed.");
+		}
+		if (publicKey.publicKey == null || !await isSamePublicKey(publicKey.publicKey, multikey.publicKey) || publicKey.ownerId != null && getCanonicalPortableId(publicKey.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
+	}
+	if (!actor.gateways.some((gateway) => isGatewayUrl(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
+	const key = new CryptographicKey({
+		id: keyId,
+		owner: actor.id,
+		publicKey: multikey.publicKey
+	});
+	return {
+		type: "verified",
+		actor,
+		key
+	};
+}
+/**
+* Fetches the document at a compatible key ID, and resolves the key as
+* a gateway key if the document is a portable actor.
+*
+* @param keyId The key ID, which must be a compatible key ID.
+* @param options Loaders and telemetry providers.
+* @returns `legacy` if the document cannot be fetched or is not a portable
+*          actor, which leaves the key to the usual resolution; otherwise,
+*          the result of {@link verifyPortableGatewayKeyDocument}.
+* @internal
+*/
+async function fetchPortableGatewayKey(keyId, options = {}) {
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	let remoteDocument;
+	try {
+		remoteDocument = await documentLoader(keyId.href);
+	} catch (error) {
+		logger.debug("Failed to fetch key {keyId}: {error}", {
+			keyId: keyId.href,
+			error
+		});
+		return { type: "legacy" };
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(remoteDocument.document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return { type: "legacy" };
+	}
+	if (!isPortableActorDocument(object)) return { type: "legacy" };
+	return await verifyPortableGatewayKeyDocument(remoteDocument.document, object, keyId, {
+		...options,
+		documentLoader,
+		contextLoader
+	});
+}
+function findEmbeddedNode(values, id) {
+	if (!Array.isArray(values)) return null;
+	for (const value of values) {
+		if (value == null || typeof value !== "object" || Array.isArray(value)) continue;
+		const node = value;
+		const nodeId = node["@id"];
+		if (typeof nodeId !== "string") continue;
+		let parsed;
+		try {
+			parsed = new URL(nodeId);
+		} catch {
+			continue;
+		}
+		if (parsed.href !== id.href) continue;
+		if (Object.keys(node).every((key) => key === "@id")) continue;
+		return node;
+	}
+	return null;
+}
+//#endregion
+export { verifyPortableGatewayKeyDocument as n, fetchPortableGatewayKey as t };

package/dist/{proof-B69bJaSn.mjs → proof-B6gwdhN5.mjs}

@@ -1,19 +1,19 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CVZgG4sc.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B5spFq82.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-BnMA6vpl.mjs";
+import { n as version, t as name } from "./deno-B-NtYZVW.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B5Rei-HC.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-lfcx_NaE.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { c as getNormalizationContextLoader } from "./ld-BBVP8ock.mjs";
+import { c as getNormalizationContextLoader } from "./ld-jyjdrWjG.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { encodeMultibase, formatIri, getDocumentLoader, getFe34Origin, haveSameFe34Origin, parseIri } from "@fedify/vocab-runtime";
 import { encodeHex } from "byte-encodings/hex";
-import jsonld from "@fedify/vocab-runtime/jsonld";
 import { isPlainJsonTree, retainSignedRepresentation } from "@fedify/vocab-runtime/internal/signed-representation";
+import jsonld from "@fedify/vocab-runtime/jsonld";
 import serialize from "json-canon";
 //#region src/sig/proof.ts
 /**

package/dist/{send-BB5rBhvN.mjs → send-DsK7xevO.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CVZgG4sc.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-B5spFq82.mjs";
-import { n as doubleKnock } from "./http-znjq5j6a.mjs";
+import { n as version, t as name } from "./deno-B-NtYZVW.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-B5Rei-HC.mjs";
+import { n as doubleKnock } from "./http-DKWi8RjI.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/sig/compound-proof-discovery.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-BrSXP5so.mjs";
+import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-KmXDfWFp.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-discovery.test.ts

package/dist/sig/compound-proof-producer.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-BrSXP5so.mjs";
+import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-KmXDfWFp.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-producer.test.ts
 const portableId = "ap+ef61://did:key:z6MkAlice/objects/1";

package/dist/sig/compound-proof-verification.test.mjs

@@ -4,8 +4,8 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { i as verifyMapLocalProof, s as verifyPortableObjectProofPolicy } from "../proof-B69bJaSn.mjs";
-import { a as verifyCompoundPortableObjectProofs, o as verifyCompoundProofDocuments } from "../compound-proof-BrSXP5so.mjs";
+import { i as verifyMapLocalProof, s as verifyPortableObjectProofPolicy } from "../proof-B6gwdhN5.mjs";
+import { a as verifyCompoundPortableObjectProofs, o as verifyCompoundProofDocuments } from "../compound-proof-KmXDfWFp.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/compound-proof.test.mjs

@@ -4,11 +4,11 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { l as verifyProof, r as signObject } from "../proof-B69bJaSn.mjs";
-import { o as verifyCompoundProofDocuments } from "../compound-proof-BrSXP5so.mjs";
+import { l as verifyProof, r as signObject } from "../proof-B6gwdhN5.mjs";
+import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
+import { o as verifyCompoundProofDocuments } from "../compound-proof-KmXDfWFp.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";

package/dist/sig/http.test.mjs

@@ -11,8 +11,8 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { t as exportJwk } from "../key-BnMA6vpl.mjs";
-import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-znjq5j6a.mjs";
+import { t as exportJwk } from "../key-lfcx_NaE.mjs";
+import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-DKWi8RjI.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";

package/dist/sig/key.test.mjs

@@ -6,7 +6,7 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as generateCryptoKeyPair, i as fetchKeyDetailed, o as importJwk, r as fetchKey, s as validateCryptoKey, t as exportJwk } from "../key-BnMA6vpl.mjs";
+import { a as generateCryptoKeyPair, i as fetchKeyDetailed, o as importJwk, r as fetchKey, s as validateCryptoKey, t as exportJwk } from "../key-lfcx_NaE.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/ld.test.mjs

@@ -8,9 +8,9 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as generateCryptoKeyPair } from "../key-BnMA6vpl.mjs";
+import { a as generateCryptoKeyPair } from "../key-lfcx_NaE.mjs";
+import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-jyjdrWjG.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-BBVP8ock.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { encodeBase64 } from "byte-encodings/base64";

package/dist/sig/mod.cjs

@@ -1,12 +1,12 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-CVjwUCCu.cjs");
-const require_owner = require("../owner-CHBQ0sSj.cjs");
-const require_sig = require("../sig-dut4BzEW.cjs");
-exports.attachSignature = require_owner.attachSignature;
-exports.createProof = require_owner.createProof;
-exports.createSignature = require_owner.createSignature;
-exports.detachSignature = require_owner.detachSignature;
+const require_http = require("../http-CuLWIJdf.cjs");
+const require_owner = require("../owner-BXufwAzm.cjs");
+const require_sig = require("../sig-TTn9wYrE.cjs");
+exports.attachSignature = require_http.attachSignature;
+exports.createProof = require_http.createProof;
+exports.createSignature = require_http.createSignature;
+exports.detachSignature = require_http.detachSignature;
 exports.doesActorOwnKey = require_owner.doesActorOwnKey;
 exports.exportJwk = require_http.exportJwk;
 exports.fetchKey = require_http.fetchKey;
@@ -15,19 +15,19 @@ exports.formatAcceptSignature = require_http.formatAcceptSignature;
 exports.fulfillAcceptSignature = require_http.fulfillAcceptSignature;
 exports.generateCryptoKeyPair = require_http.generateCryptoKeyPair;
 exports.getKeyOwner = require_owner.getKeyOwner;
-exports.hasProofLike = require_owner.hasProofLike;
-exports.hasSignatureLike = require_owner.hasSignatureLike;
+exports.hasProofLike = require_http.hasProofLike;
+exports.hasSignatureLike = require_http.hasSignatureLike;
 exports.importJwk = require_http.importJwk;
 exports.parseAcceptSignature = require_http.parseAcceptSignature;
-exports.signJsonLd = require_owner.signJsonLd;
-exports.signObject = require_owner.signObject;
+exports.signJsonLd = require_http.signJsonLd;
+exports.signObject = require_http.signObject;
 exports.signRequest = require_http.signRequest;
 exports.validateAcceptSignature = require_http.validateAcceptSignature;
-exports.verifyJsonLd = require_owner.verifyJsonLd;
-exports.verifyObject = require_owner.verifyObject;
+exports.verifyJsonLd = require_http.verifyJsonLd;
+exports.verifyObject = require_http.verifyObject;
 exports.verifyPortableObject = require_sig.verifyPortableObject;
-exports.verifyPortableObjectProof = require_owner.verifyPortableObjectProof;
-exports.verifyProof = require_owner.verifyProof;
+exports.verifyPortableObjectProof = require_http.verifyPortableObjectProof;
+exports.verifyProof = require_http.verifyProof;
 exports.verifyRequest = require_http.verifyRequest;
 exports.verifyRequestDetailed = require_http.verifyRequestDetailed;
-exports.verifySignature = require_owner.verifySignature;
+exports.verifySignature = require_http.verifySignature;

package/dist/sig/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-CP-7OdSq.cjs";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-xlG-jRdB.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BF0L9cMt.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-pLbeNwcC.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-HDSvS-ww.cjs";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-65PYi9jY.js";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-n2v6DPxu.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BSzr5-I8.js";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-Dhm7SqyE.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-C9WSpZWm.js";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { F as validateAcceptSignature, M as formatAcceptSignature, N as fulfillAcceptSignature, P as parseAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, i as verifyRequest, l as fetchKeyDetailed, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "../http-99KVDtMr.js";
-import { C as signJsonLd, E as verifySignature, T as verifyJsonLd, _ as detachSignature, a as signObject, b as hasSignatureLike, c as verifyPortableObjectProof, d as verifyProof, g as createSignature, i as hasProofLike, m as attachSignature, n as getKeyOwner, r as createProof, s as verifyObject, t as doesActorOwnKey } from "../owner-Cu_KMvQN.js";
-import { t as verifyPortableObject } from "../sig-B8WDBV-h.js";
+import { A as verifySignature, D as signJsonLd, F as fetchKeyDetailed, I as generateCryptoKeyPair, L as importJwk, M as exportJwk, P as fetchKey, a as verifyRequestDetailed, b as createSignature, c as hasProofLike, d as verifyObject, dt as fulfillAcceptSignature, f as verifyPortableObjectProof, ft as parseAcceptSignature, h as verifyProof, i as verifyRequest, k as verifyJsonLd, l as signObject, pt as validateAcceptSignature, r as signRequest, s as createProof, ut as formatAcceptSignature, v as attachSignature, w as hasSignatureLike, x as detachSignature } from "../http-BoWBwC0g.js";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-1TFakcTF.js";
+import { t as verifyPortableObject } from "../sig-BR_Z6mpY.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-Hc0hvbbX.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-ByqNQVaa.mjs";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/owner.test.ts

package/dist/sig/portable-collection.test.mjs

@@ -1,16 +1,16 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "../deno-CVZgG4sc.mjs";
+import { n as version, t as name } from "../deno-B-NtYZVW.mjs";
+import { c as verifyPortableObjectProofWithRoot, o as verifyPortableObjectProof } from "../proof-B6gwdhN5.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { c as verifyPortableObjectProofWithRoot, o as verifyPortableObjectProof } from "../proof-B69bJaSn.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Collection, CollectionPage, Note, Object as Object$1, OrderedCollection, Person, isActor, traverseCollection } from "@fedify/vocab";
 import { trace } from "@opentelemetry/api";
 import { test } from "@fedify/fixture";
 import { FetchError, canonicalizePortableUri, encodeMultibase, exportDidKey, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
-import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
 import serialize from "json-canon";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
 import { dereferencePortableIri, getPortableGatewayCandidates } from "@fedify/vocab-runtime/internal/portable-dereference";
 //#region src/sig/portable-collection.ts
 const logger = getLogger([
@@ -967,5 +967,78 @@ test("verifyPortableObject() fetches the owner through attributedTo hints", asyn
 	strictEqual(result.method, "gateway");
 	deepStrictEqual(documentLoader.fetched, [gatewayUrl(gw2, actorId)]);
 });
+test("verifyPortableObject() applies to compatible identifiers in accessors", async (t) => {
+	const noteId = `ap://${did}/notes/1`;
+	const signedNote = await sign({
+		"@context": context$1,
+		id: noteId,
+		type: "Note",
+		attributedTo: actorId,
+		content: "Hello"
+	});
+	const forgedNote = {
+		"@context": context$1,
+		id: noteId,
+		type: "Note",
+		attributedTo: actorId,
+		content: "Forged"
+	};
+	const collection = (items) => Collection.fromJsonLd({
+		"@context": context$1,
+		id: "https://example.com/collection",
+		type: "Collection",
+		items
+	}, { contextLoader });
+	const getItems = async (items, documentLoader) => await Array.fromAsync((await collection(items)).getItems({
+		documentLoader,
+		contextLoader,
+		verifyPortableObject
+	}));
+	await t.step("signed objects", async () => {
+		const documentLoader = createLoader({ [gatewayUrl(gw1, noteId)]: signedNote });
+		deepStrictEqual((await getItems([gatewayUrl(gw1, noteId)], documentLoader)).map((item) => item instanceof Note ? item.content : null), ["Hello"]);
+	});
+	await t.step("forged objects", async () => {
+		const documentLoader = createLoader({
+			[gatewayUrl(evil, noteId)]: forgedNote,
+			[gatewayUrl(evil, `ap://${did}/notes/2`)]: {
+				...forgedNote,
+				id: gatewayUrl(evil, `ap://${did}/notes/2`),
+				attributedTo: gatewayUrl(evil, actorId)
+			},
+			"https://evil.example/notes/1": { redirect: gatewayUrl(evil, noteId) },
+			[gatewayUrl("https://example.com", noteId)]: forgedNote
+		});
+		deepStrictEqual(await getItems([
+			gatewayUrl(evil, noteId),
+			gatewayUrl(evil, `ap://${did}/notes/2`),
+			"https://evil.example/notes/1",
+			{
+				id: gatewayUrl("https://example.com", noteId),
+				type: "Note",
+				content: "Forged"
+			}
+		], documentLoader), []);
+	});
+	await t.step("unsecured collections", async () => {
+		const unsecured = outbox({ attributedTo: actorId });
+		const documentLoader = createLoader({
+			[gatewayUrl(gw1, actorId)]: signedActor,
+			[gatewayUrl(gw1, outboxId)]: unsecured,
+			[gatewayUrl(evil, actorId)]: signedActor,
+			[gatewayUrl(evil, outboxId)]: unsecured
+		});
+		const items = await getItems([gatewayUrl(gw1, outboxId)], documentLoader);
+		strictEqual(items.length, 1);
+		ok(items[0] instanceof OrderedCollection);
+		deepStrictEqual(documentLoader.fetched, [gatewayUrl(gw1, outboxId), gatewayUrl(gw1, actorId)]);
+		deepStrictEqual(await getItems([gatewayUrl(evil, outboxId)], documentLoader), []);
+		deepStrictEqual(await getItems([gatewayUrl(gw1, outboxId)], createLoader({
+			[gatewayUrl(gw1, actorId)]: signedActor,
+			[gatewayUrl(gw1, outboxId)]: { redirect: gatewayUrl(evil, outboxId) },
+			[gatewayUrl(evil, outboxId)]: unsecured
+		})), []);
+	});
+});
 //#endregion
 export {};

package/dist/sig/portable-key.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";