@fedify/fedify 2.4.0-dev.2063 → 2.4.0-dev.2071

package/dist/{http-znjq5j6a.mjs → http-DKWi8RjI.mjs}

@@ -1,10 +1,11 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CVZgG4sc.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B5spFq82.mjs";
+import { n as version, t as name } from "./deno-B-NtYZVW.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B5Rei-HC.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
-import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-BnMA6vpl.mjs";
+import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-lfcx_NaE.mjs";
+import { n as verifyPortableGatewayKeyDocument } from "./portable-key-Cw_ow5vn.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -570,7 +571,14 @@ async function verifyRequestDraft(request, span, metricsContext, { documentLoade
 		contextLoader,
 		keyCache,
 		tracerProvider,
-		meterProvider
+		meterProvider,
+		portableGatewayKeyResolver: (document, actor, keyId) => verifyPortableGatewayKeyDocument(document, actor, keyId, {
+			documentLoader,
+			contextLoader,
+			keyCache,
+			tracerProvider,
+			meterProvider
+		})
 	}));
 	if (fetchError != null) return keyFetchErrorResult(keyIdUrl, fetchError);
 	if (key == null) return invalidSignatureResult(keyIdUrl);
@@ -786,7 +794,14 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 			contextLoader,
 			keyCache,
 			tracerProvider,
-			meterProvider
+			meterProvider,
+			portableGatewayKeyResolver: (document, actor, gatewayKeyId) => verifyPortableGatewayKeyDocument(document, actor, gatewayKeyId, {
+				documentLoader,
+				contextLoader,
+				keyCache,
+				tracerProvider,
+				meterProvider
+			})
 		}));
 		if (fetchError != null) {
 			setFailure(keyFetchErrorResult(keyId, fetchError));

package/dist/{http-65PYi9jY.d.ts → http-n2v6DPxu.d.ts}

@@ -3,6 +3,28 @@ import { Actor, CryptographicKey, Multikey } from "@fedify/vocab";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader } from "@fedify/vocab-runtime";
 
+//#region src/sig/portable-key.d.ts
+/**
+* The result of resolving a gateway key of a portable actor.
+* @internal
+*/
+type PortableGatewayKeyResolution = {
+  /**
+  * The document at the key ID is not a portable actor, so the key is
+  * resolved as usual.
+  */
+  readonly type: "legacy";
+} | {
+  /** The document is a portable actor, but it does not vouch for the key. */readonly type: "rejected";
+  readonly reason: string;
+} | {
+  /** The portable actor's signed document vouches for the key. */readonly type: "verified";
+  readonly actor: Actor;
+  readonly key: CryptographicKey & {
+    publicKey: CryptoKey;
+  };
+};
+//#endregion
 //#region src/sig/key.d.ts
 /**
 * Generates a key pair which is appropriate for Fedify.
@@ -91,6 +113,18 @@ interface FetchKeyOptions {
   * @internal
   */
   keyIdBoundByCaller?: boolean;
+  /**
+  * Resolves a gateway key of an [FEP-ef61] portable actor, i.e., a key whose
+  * ID is a compatible identifier and dereferences to a portable actor's
+  * document.  Such a key is resolved only through this function, and is
+  * rejected if it is omitted, so that only HTTP Signature verification,
+  * which passes it, accepts gateway keys.  Object Integrity Proofs and
+  * Linked Data Signatures never do.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  * @internal
+  */
+  portableGatewayKeyResolver?: (document: unknown, actor: Actor, keyId: URL) => Promise<PortableGatewayKeyResolution>;
 }
 /**
 * The result of {@link fetchKey}.
@@ -139,7 +173,15 @@ type FetchableKeyClass<T extends CryptographicKey | Multikey> = (new (...args: a
 /**
 * Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
 * If the given URL contains an {@link Actor} object, it tries to find
-* the corresponding key in the `publicKey` or `assertionMethod` property.
+* the corresponding key in the `publicKey` or `assertionMethod` property. *
+* Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
+* compatible identifiers that dereference to portable actor documents, are
+* not resolved by this function, as they only authenticate HTTP requests;
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys
+* whose IDs are compatible identifiers are never read from or written to
+* the key cache.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
 *              or {@link Multikey}.
 * @param keyId The URL of the key.
@@ -153,7 +195,15 @@ declare function fetchKey<T extends CryptographicKey | Multikey>(keyId: URL | st
 /**
 * Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL,
 * preserving transport-level fetch failures for callers that need to inspect
-* why the key could not be loaded.
+* why the key could not be loaded. *
+* Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
+* compatible identifiers that dereference to portable actor documents, are
+* not resolved by this function, as they only authenticate HTTP requests;
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys
+* whose IDs are compatible identifiers are never read from or written to
+* the key cache.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 *
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
 *              or {@link Multikey}.

package/dist/{http-CP-7OdSq.d.cts → http-xlG-jRdB.d.cts}

@@ -3,6 +3,28 @@ import { Actor, CryptographicKey, Multikey } from "@fedify/vocab";
 import { DocumentLoader } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 
+//#region src/sig/portable-key.d.ts
+/**
+* The result of resolving a gateway key of a portable actor.
+* @internal
+*/
+type PortableGatewayKeyResolution = {
+  /**
+  * The document at the key ID is not a portable actor, so the key is
+  * resolved as usual.
+  */
+  readonly type: "legacy";
+} | {
+  /** The document is a portable actor, but it does not vouch for the key. */readonly type: "rejected";
+  readonly reason: string;
+} | {
+  /** The portable actor's signed document vouches for the key. */readonly type: "verified";
+  readonly actor: Actor;
+  readonly key: CryptographicKey & {
+    publicKey: CryptoKey;
+  };
+};
+//#endregion
 //#region src/sig/key.d.ts
 /**
 * Generates a key pair which is appropriate for Fedify.
@@ -91,6 +113,18 @@ interface FetchKeyOptions {
   * @internal
   */
   keyIdBoundByCaller?: boolean;
+  /**
+  * Resolves a gateway key of an [FEP-ef61] portable actor, i.e., a key whose
+  * ID is a compatible identifier and dereferences to a portable actor's
+  * document.  Such a key is resolved only through this function, and is
+  * rejected if it is omitted, so that only HTTP Signature verification,
+  * which passes it, accepts gateway keys.  Object Integrity Proofs and
+  * Linked Data Signatures never do.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  * @internal
+  */
+  portableGatewayKeyResolver?: (document: unknown, actor: Actor, keyId: URL) => Promise<PortableGatewayKeyResolution>;
 }
 /**
 * The result of {@link fetchKey}.
@@ -139,7 +173,15 @@ type FetchableKeyClass<T extends CryptographicKey | Multikey> = (new (...args: a
 /**
 * Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
 * If the given URL contains an {@link Actor} object, it tries to find
-* the corresponding key in the `publicKey` or `assertionMethod` property.
+* the corresponding key in the `publicKey` or `assertionMethod` property. *
+* Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
+* compatible identifiers that dereference to portable actor documents, are
+* not resolved by this function, as they only authenticate HTTP requests;
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys
+* whose IDs are compatible identifiers are never read from or written to
+* the key cache.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
 *              or {@link Multikey}.
 * @param keyId The URL of the key.
@@ -153,7 +195,15 @@ declare function fetchKey<T extends CryptographicKey | Multikey>(keyId: URL | st
 /**
 * Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL,
 * preserving transport-level fetch failures for callers that need to inspect
-* why the key could not be loaded.
+* why the key could not be loaded. *
+* Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
+* compatible identifiers that dereference to portable actor documents, are
+* not resolved by this function, as they only authenticate HTTP requests;
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys
+* whose IDs are compatible identifiers are never read from or written to
+* the key cache.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 *
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
 *              or {@link Multikey}.

package/dist/{key-BnMA6vpl.mjs → key-lfcx_NaE.mjs}

@@ -1,12 +1,105 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CVZgG4sc.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-B5spFq82.mjs";
+import { n as version, t as name } from "./deno-B-NtYZVW.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-B5Rei-HC.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
-import { FetchError, getDocumentLoader, parseDidKeyVerificationMethod } from "@fedify/vocab-runtime";
+import { FetchError, canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getDocumentLoader, parseDidKeyVerificationMethod, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+//#region src/sig/portable-key-id.ts
+const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+/**
+* Checks whether the URL is an `ap:` or `ap+ef61:` URI.
+* @internal
+*/
+function isPortableUri(url) {
+	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
+}
+/**
+* Checks whether an activity is performed by an FEP-ef61 portable actor,
+* i.e., any of its actors has an `ap:` or `ap+ef61:` ID.
+* @internal
+*/
+function hasPortableActor(activity) {
+	return activity.actorIds.some(isPortableUri);
+}
+/**
+* Checks whether a key ID looks like an [FEP-ef61] compatible identifier,
+* i.e., an HTTP(S) URL under a gateway's `/.well-known/apgateway/did:` path.
+* Such a key ID names a key that a gateway holds for a portable actor, so it
+* is resolved only as a gateway key, and never cached in a key cache.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isCompatibleKeyId(keyId) {
+	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
+}
+/**
+* Gets the canonical portable ID of an actor ID that is either an `ap:` or
+* `ap+ef61:` URI or a compatible identifier.
+* @returns The canonical portable ID, or `null` if the ID is neither, or is
+*          malformed.
+* @internal
+*/
+function getCanonicalPortableId(id) {
+	try {
+		if (isPortableUri(id)) return canonicalizePortableUri(formatIri(id));
+		const portable = fromCompatibleEf61Id(id);
+		if (portable == null) return null;
+		return canonicalizePortableUri(formatIri(portable));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Builds the base of the key IDs of a gateway's keys for a portable actor:
+* the actor's compatible identifier on the gateway.
+* @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
+*                or a compatible identifier.  It must not have a fragment.
+* @param gateway The gateway's origin, e.g., `https://example.com`.
+* @returns The compatible identifier without query and fragment.
+* @throws {TypeError} If the actor ID is not a portable ID, or has
+*                     a fragment.
+* @internal
+*/
+function getGatewayKeyBase(actorId, gateway) {
+	let portable;
+	if (isPortableUri(actorId)) portable = actorId;
+	else try {
+		portable = fromCompatibleEf61Id(actorId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		portable = null;
+	}
+	if (portable == null) throw new TypeError(`The portable actor ID ${actorId.href} must be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier.`);
+	if (portable.hash !== "") throw new TypeError(`The portable actor ID ${actorId.href} must not have a fragment.`);
+	const base = toCompatibleEf61Id(portable, gateway);
+	base.search = "";
+	base.hash = "";
+	return base;
+}
+/**
+* Tells whether a parsed document at a compatible key ID is a portable actor,
+* which makes the key a gateway key that only
+* {@link verifyPortableGatewayKeyDocument} can vouch for.
+* @internal
+*/
+function isPortableActorDocument(object) {
+	return isActor(object) && object.id != null && isPortableUri(object.id);
+}
+/**
+* Compares two public keys by their key material.
+* @internal
+*/
+async function isSamePublicKey(a, b) {
+	if (a.algorithm.name !== b.algorithm.name) return false;
+	const [x, y] = await Promise.all([crypto.subtle.exportKey("jwk", a), crypto.subtle.exportKey("jwk", b)]);
+	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
+}
+//#endregion
 //#region src/sig/key.ts
 /**
 * Checks if the given key is valid and supported.  No-op if the key is valid,
@@ -230,7 +323,15 @@ async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 /**
 * Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
 * If the given URL contains an {@link Actor} object, it tries to find
-* the corresponding key in the `publicKey` or `assertionMethod` property.
+* the corresponding key in the `publicKey` or `assertionMethod` property. *
+* Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
+* compatible identifiers that dereference to portable actor documents, are
+* not resolved by this function, as they only authenticate HTTP requests;
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys
+* whose IDs are compatible identifiers are never read from or written to
+* the key cache.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
 *              or {@link Multikey}.
 * @param keyId The URL of the key.
@@ -247,7 +348,15 @@ function fetchKey(keyId, cls, options = {}) {
 /**
 * Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL,
 * preserving transport-level fetch failures for callers that need to inspect
-* why the key could not be loaded.
+* why the key could not be loaded. *
+* Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
+* compatible identifiers that dereference to portable actor documents, are
+* not resolved by this function, as they only authenticate HTTP requests;
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys
+* whose IDs are compatible identifiers are never read from or written to
+* the key cache.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 *
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
 *              or {@link Multikey}.
@@ -398,7 +507,7 @@ async function resolveDidKey(cacheKey, cls, keyCache, logger) {
 		cached: false
 	};
 }
-async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller }, logger) {
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableGatewayKeyResolver }, logger) {
 	let object;
 	try {
 		object = await Object$1.fromJsonLd(document, {
@@ -427,6 +536,33 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 			throw e;
 		}
 	}
+	if (isCompatibleKeyId(cacheKey) && isPortableActorDocument(object)) {
+		if (portableGatewayKeyResolver == null || cls !== CryptographicKey) {
+			logger.debug("Failed to verify; key {keyId} is a gateway key of the portable actor {actorId}, which is only accepted for HTTP Signatures.", {
+				keyId,
+				actorId: object.id?.href
+			});
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		const resolution = await portableGatewayKeyResolver(document, object, cacheKey);
+		if (resolution.type !== "verified") {
+			logger.debug("Failed to verify; the portable actor {actorId} does not vouch for its gateway key {keyId}.", {
+				keyId,
+				actorId: object.id?.href
+			});
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		return {
+			key: resolution.key,
+			cached: false
+		};
+	}
 	let key = null;
 	let ownerDocument = null;
 	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
@@ -546,6 +682,10 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 			"key"
 		]);
 		const keyId = cacheKey.href;
+		if (isCompatibleKeyId(cacheKey)) options = {
+			...options,
+			keyCache: void 0
+		};
 		const keyCache = options.keyCache;
 		const didKey = await resolveDidKey(cacheKey, cls, keyCache, logger);
 		if (didKey != null) {
@@ -612,4 +752,4 @@ async function fetchKeyInternal(keyId, cls, options = {}) {
 	});
 }
 //#endregion
-export { generateCryptoKeyPair as a, verifyKeyOwnership as c, fetchKeyDetailed as i, fetchActorDocument as n, importJwk as o, fetchKey as r, validateCryptoKey as s, exportJwk as t };
+export { generateCryptoKeyPair as a, verifyKeyOwnership as c, hasPortableActor as d, isCompatibleKeyId as f, isSamePublicKey as h, fetchKeyDetailed as i, getCanonicalPortableId as l, isPortableUri as m, fetchActorDocument as n, importJwk as o, isPortableActorDocument as p, fetchKey as r, validateCryptoKey as s, exportJwk as t, getGatewayKeyBase as u };

package/dist/{kv-cache-aijDx_jN.js → kv-cache-BdnmnAVc.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { T as recordDocumentCache, f as validateCryptoKey, t as doubleKnock } from "./http-99KVDtMr.js";
+import { R as validateCryptoKey, nt as recordDocumentCache, t as doubleKnock } from "./http-BoWBwC0g.js";
 import { getLogger } from "@logtape/logtape";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{kv-cache-D2O0JspA.cjs → kv-cache-DE8kSNQU.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-CVjwUCCu.cjs");
+const require_http = require("./http-CuLWIJdf.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{kv-cache--REpvHgG.mjs → kv-cache-d8EjO29d.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-B5spFq82.mjs";
+import { p as recordDocumentCache } from "./metrics-B5Rei-HC.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{ld-BBVP8ock.mjs → ld-jyjdrWjG.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CVZgG4sc.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B5spFq82.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-BnMA6vpl.mjs";
+import { n as version, t as name } from "./deno-B-NtYZVW.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B5Rei-HC.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-lfcx_NaE.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-B5spFq82.mjs → metrics-B5Rei-HC.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CVZgG4sc.mjs";
+import { n as version, t as name } from "./deno-B-NtYZVW.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts