@fedify/fedify 2.4.0-dev.2065 → 2.4.0-dev.2071

package/dist/mod.d.ts

@@ -1,18 +1,18 @@
 /// <reference lib="esnext.temporal" />
 import { a as InboundService, c as OutboundService, d as Software, f as Usage, i as parseNodeInfo, l as Protocol, n as ParseNodeInfoOptions, o as JsonValue, p as nodeInfoToJson, r as getNodeInfo, s as NodeInfo, t as GetNodeInfoOptions, u as Services } from "./client-D-XP_Ccb.js";
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-65PYi9jY.js";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-n2v6DPxu.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "./owner-BSzr5-I8.js";
-import { $ as MessageQueue, A as ObjectCallbackSetters, At as InboxListener, B as TaskDefinitionOptions, Bt as UnverifiedActivityHandler, C as FederationOptions, Ct as CollectionDispatcher, D as InboxChallengePolicy, Dt as HashlinkMediaDispatcher, E as IdempotencyStrategy, Et as CustomCollectionDispatcher, F as FederationQueueOptions, Ft as OutboxErrorHandler, G as RetryContext, Gt as PageItems, H as TaskHandler, Ht as WebFingerLinksDispatcher, I as createFederation, It as OutboxListener, J as RespondWithObjectOptions, Jt as ActivityTransformer, K as RetryPolicy, Kt as buildCollectionSynchronizationHeader, L as Message, Lt as OutboxListenerErrorHandler, M as Rfc6570Expression, Mt as NodeInfoDispatcher, N as FederationKvPrefixes, Nt as ObjectAuthorizePredicate, O as InboxListenerSetters, Ot as HashlinkMediaRequest, P as FederationOrigin, Pt as ObjectDispatcher, Q as InProcessMessageQueueOptions, R as createFederationBuilder, Rt as OutboxPermanentFailureHandler, S as FederationFetchOptions, St as CollectionCursor, T as IdempotencyKeyCallback, Tt as CustomCollectionCursor, U as TaskRegistry, Ut as SendActivityError, V as TaskEnqueueOptions, Vt as UnverifiedActivityReason, W as CreateExponentialBackoffPolicyOptions, Wt as SenderKeyPair, X as respondWithObjectIfAcceptable, Y as respondWithObject, Z as InProcessMessageQueue, _ as CustomCollectionCallbackSetters, _t as ActorDispatcher, a as GetSignedKeyOptions, at as CircuitBreakerActivityDrop, b as FederationBenchmarkOptions, bt as AuthorizePredicate, c as ParseUriResult, ct as CircuitBreakerFailurePolicy, d as RouteActivityOptions, dt as CircuitBreakerState, et as MessageQueueDepth, f as SendActivityOptions, ft as CircuitBreakerStateChange, g as ConstructorWithTypeId, gt as ActorAliasMapper, h as CollectionCallbackSetters, ht as parseCircuitBreakerKvState, i as GetActorOptions, it as CircuitBreaker, j as OutboxListenerSetters, jt as MediaUploaderCallback, k as MediaUploaderSetters, kt as InboxErrorHandler, l as PortableRequest, lt as CircuitBreakerKvState, m as ActorCallbackSetters, mt as normalizeCircuitBreakerOptions, n as Context, nt as MessageQueueListenOptions, o as InboxContext, ot as CircuitBreakerBeforeSendDecision, p as SendActivityOptionsForCollection, pt as NormalizedCircuitBreakerOptions, q as createExponentialBackoffPolicy, qt as digest, r as ForwardActivityOptions, rt as ParallelMessageQueue, s as OutboxContext, st as CircuitBreakerCreateOptions, t as ActorKeyPair, tt as MessageQueueEnqueueOptions, u as RequestContext, ut as CircuitBreakerOptions, v as Federatable, vt as ActorHandleMapper, w as FederationStartQueueOptions, wt as CustomCollectionCounter, x as FederationBuilder, xt as CollectionCounter, y as Federation, yt as ActorKeyPairsDispatcher, z as TaskDefinition, zt as SharedInboxKeyDispatcher } from "./context-D_gg4M0n.js";
+import { $ as MessageQueue, A as ObjectCallbackSetters, At as InboxListener, B as TaskDefinitionOptions, Bt as SharedInboxKeyDispatcher, C as FederationOptions, Ct as CollectionDispatcher, D as InboxChallengePolicy, Dt as HashlinkMediaDispatcher, E as IdempotencyStrategy, Et as CustomCollectionDispatcher, F as FederationQueueOptions, Ft as OutboxErrorHandler, G as RetryContext, Gt as SenderKeyPair, H as TaskHandler, Ht as UnverifiedActivityReason, I as createFederation, It as OutboxListener, J as RespondWithObjectOptions, Jt as digest, K as RetryPolicy, Kt as PageItems, L as Message, Lt as OutboxListenerErrorHandler, M as Rfc6570Expression, Mt as NodeInfoDispatcher, N as FederationKvPrefixes, Nt as ObjectAuthorizePredicate, O as InboxListenerSetters, Ot as HashlinkMediaRequest, P as FederationOrigin, Pt as ObjectDispatcher, Q as InProcessMessageQueueOptions, R as createFederationBuilder, Rt as OutboxPermanentFailureHandler, S as FederationFetchOptions, St as CollectionCursor, T as IdempotencyKeyCallback, Tt as CustomCollectionCursor, U as TaskRegistry, Ut as WebFingerLinksDispatcher, V as TaskEnqueueOptions, Vt as UnverifiedActivityHandler, W as CreateExponentialBackoffPolicyOptions, Wt as SendActivityError, X as respondWithObjectIfAcceptable, Y as respondWithObject, Yt as ActivityTransformer, Z as InProcessMessageQueue, _ as CustomCollectionCallbackSetters, _t as ActorDispatcher, a as GetSignedKeyOptions, at as CircuitBreakerActivityDrop, b as FederationBenchmarkOptions, bt as AuthorizePredicate, c as ParseUriResult, ct as CircuitBreakerFailurePolicy, d as RouteActivityOptions, dt as CircuitBreakerState, et as MessageQueueDepth, f as SendActivityOptions, ft as CircuitBreakerStateChange, g as ConstructorWithTypeId, gt as ActorAliasMapper, h as CollectionCallbackSetters, ht as parseCircuitBreakerKvState, i as GetActorOptions, it as CircuitBreaker, j as OutboxListenerSetters, jt as MediaUploaderCallback, k as MediaUploaderSetters, kt as InboxErrorHandler, l as PortableRequest, lt as CircuitBreakerKvState, m as ActorCallbackSetters, mt as normalizeCircuitBreakerOptions, n as Context, nt as MessageQueueListenOptions, o as InboxContext, ot as CircuitBreakerBeforeSendDecision, p as SendActivityOptionsForCollection, pt as NormalizedCircuitBreakerOptions, q as createExponentialBackoffPolicy, qt as buildCollectionSynchronizationHeader, r as ForwardActivityOptions, rt as ParallelMessageQueue, s as OutboxContext, st as CircuitBreakerCreateOptions, t as ActorKeyPair, tt as MessageQueueEnqueueOptions, u as RequestContext, ut as CircuitBreakerOptions, v as Federatable, vt as ActorHandleMapper, w as FederationStartQueueOptions, wt as CustomCollectionCounter, x as FederationBuilder, xt as CollectionCounter, y as Federation, yt as ActorKeyPairsDispatcher, z as TaskDefinition, zt as PortableActorIdMapper } from "./context-DsB9kF6q.js";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-BhNbN8Ed.js";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.js";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-BhMvsgdF.js";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-Dhm7SqyE.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-C0BYc0OU.js";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-DMkflQdF.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-C9WSpZWm.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-CVZrXSdm.js";
 export * from "@fedify/vocab-runtime";
 
 //#region src/mod.d.ts
 declare namespace mod_d_exports {
-  export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
+  export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableActorIdMapper, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
 }
 //#endregion
-export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };
+export { AcceptSignatureMember, AcceptSignatureParameters, ActivityTransformer, ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CreateProofOptions, CreateSignatureOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, DoesActorOwnKeyOptions, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, ForwardActivityOptions, FulfillAcceptSignatureResult, GetActorOptions, GetKeyOwnerOptions, GetNodeInfoOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboundService, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, JsonValue, KeyCache, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfo, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboundService, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseNodeInfoOptions, ParseUriResult, PortableActorIdMapper, PortableRequest, Protocol, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, Rfc9421SignRequestOptions, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, Services, SharedInboxKeyDispatcher, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, Software, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, Usage, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, WebFingerHandlerParameters, WebFingerLinksDispatcher, actorDehydrator, attachSignature, autoIdAssigner, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, createProof, createSignature, detachSignature, digest, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getAuthenticatedDocumentLoader, getDefaultActivityTransformers, getKeyOwner, getNodeInfo, handleWebFinger, hasProofLike, hasSignatureLike, importJwk, kvCache, nodeInfoToJson, normalizeCircuitBreakerOptions, parseAcceptSignature, parseCircuitBreakerKvState, parseNodeInfo, respondWithObject, respondWithObjectIfAcceptable, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/mod.js

@@ -3,15 +3,15 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./rolldown-runtime-BC-Eo5Mj.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-DAtXl_Kc.js";
 import "./compat/mod.js";
-import { F as validateAcceptSignature, M as formatAcceptSignature, N as fulfillAcceptSignature, P as parseAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, i as verifyRequest, l as fetchKeyDetailed, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "./http-z5n7chWw.js";
-import { a as respondWithObject, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as SendActivityError, l as CircuitBreaker, n as handleWebFinger, o as respondWithObjectIfAcceptable, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-1h_LgwXC.js";
+import { A as verifySignature, D as signJsonLd, F as fetchKeyDetailed, I as generateCryptoKeyPair, L as importJwk, M as exportJwk, P as fetchKey, a as verifyRequestDetailed, b as createSignature, c as hasProofLike, d as verifyObject, dt as fulfillAcceptSignature, f as verifyPortableObjectProof, ft as parseAcceptSignature, h as verifyProof, i as verifyRequest, k as verifyJsonLd, l as signObject, pt as validateAcceptSignature, r as signRequest, s as createProof, ut as formatAcceptSignature, v as attachSignature, w as hasSignatureLike, x as detachSignature } from "./http-BoWBwC0g.js";
+import { a as respondWithObject, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as SendActivityError, l as CircuitBreaker, n as handleWebFinger, o as respondWithObjectIfAcceptable, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-CAObohey.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { C as signJsonLd, E as verifySignature, T as verifyJsonLd, _ as detachSignature, a as signObject, b as hasSignatureLike, c as verifyPortableObjectProof, d as verifyProof, g as createSignature, i as hasProofLike, m as attachSignature, n as getKeyOwner, r as createProof, s as verifyObject, t as doesActorOwnKey } from "./owner-BLBWXCNt.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-Cgj-kpQS.js";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-1TFakcTF.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-BdnmnAVc.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";
-import { t as verifyPortableObject } from "./sig-Bb20Pyrd.js";
+import { t as verifyPortableObject } from "./sig-BR_Z6mpY.js";
 import "./utils/mod.js";
 export * from "@fedify/vocab-runtime";
 //#endregion

package/dist/nodeinfo/handler.test.mjs

@@ -5,7 +5,7 @@ import { r as createRequestContext } from "../context-DG5QeQ8W.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { b as handleNodeInfoJrd, o as createFederation, y as handleNodeInfo } from "../middleware-s-AZzx4r.mjs";
+import { b as handleNodeInfoJrd, o as createFederation, y as handleNodeInfo } from "../middleware-CPx4ZWwt.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {

package/dist/owner-1TFakcTF.js

@@ -0,0 +1,215 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";
+import { B as getCanonicalPortableId, G as isSamePublicKey$1, M as exportJwk, N as fetchActorDocument, U as isCompatibleKeyId, ht as version, mt as name, o as fetchPortableGatewayKey, z as verifyKeyOwnership } from "./http-BoWBwC0g.js";
+import { getLogger } from "@logtape/logtape";
+import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
+import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+import { getDocumentLoader } from "@fedify/vocab-runtime";
+//#region src/sig/owner.ts
+const logger = getLogger([
+	"fedify",
+	"sig",
+	"owner"
+]);
+/**
+* Checks if the actor of the given activity owns the specified key.
+*
+* Ownership is never taken from what the activity or the key say about
+* themselves, as both are written by whoever sent the activity.  It is
+* established from a document that the owner itself serves: either the key's
+* claimed owner links back to the key, or the actor the activity claims lists
+* the key as its own.
+*
+* @param activity The activity to check.
+* @param key The public key to check.
+* @param options Options for checking the key ownership.
+* @returns Whether the actor is the owner of the key.
+*/
+async function doesActorOwnKey(activity, key, options) {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("activitypub.verify_key_ownership", {
+		kind: SpanKind.INTERNAL,
+		attributes: {
+			"activitypub.actor.id": activity.actorId?.href ?? "",
+			"activitypub.key.id": key.id?.href ?? ""
+		}
+	}, async (span) => {
+		try {
+			const actorId = activity.actorId;
+			if (actorId == null) {
+				span.setAttribute("activitypub.key_ownership.verified", false);
+				span.setAttribute("activitypub.key_ownership.method", "none");
+				return false;
+			}
+			if (key.id != null && isCompatibleKeyId(key.id)) {
+				const owner = await getPortableGatewayKeyOwner(key, options);
+				if (owner !== void 0) {
+					const ownerId = owner?.id == null ? null : getCanonicalPortableId(owner.id);
+					const verified = ownerId != null && ownerId === getCanonicalPortableId(actorId);
+					span.setAttribute("activitypub.key_ownership.verified", verified);
+					span.setAttribute("activitypub.key_ownership.method", "portable_gateway_key");
+					return verified;
+				}
+			}
+			if (key.ownerId != null) {
+				const owner = await verifyKeyOwnership(key, options);
+				if (owner?.id != null && owner.id.href === actorId.href) {
+					span.setAttribute("activitypub.key_ownership.verified", true);
+					span.setAttribute("activitypub.key_ownership.method", "key_owner");
+					return true;
+				}
+			}
+			const actor = await fetchActorDocument(actorId, options);
+			if (actor != null && await doesActorListKey(actor, key, options)) {
+				span.setAttribute("activitypub.key_ownership.verified", true);
+				span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
+				return true;
+			}
+			logger.debug("The actor {actorId} does not own key {keyId}: neither the owner the key claims nor the actor's own document links the two to each other.", {
+				actorId: actorId.href,
+				keyId: key.id?.href
+			});
+			span.setAttribute("activitypub.key_ownership.verified", false);
+			span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
+			return false;
+		} catch (error) {
+			span.recordException(error);
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
+/**
+* Determines whether the given actor's own document lists the given key among
+* its public keys.
+*
+* Keys are matched by id, which is what an actor document links to.  A key
+* document may leave its id implicit, though, and then there is no id for the
+* actor to link to; the key material itself is the only thing the two can
+* have in common, so that is what gets compared.
+*/
+async function doesActorListKey(actor, key, options) {
+	if (key.id != null) {
+		for (const publicKeyId of actor.publicKeyIds) if (publicKeyId.href === key.id.href) return true;
+		return false;
+	}
+	if (key.publicKey == null) return false;
+	const publicKeys = actor.getPublicKeys({
+		...options,
+		suppressError: true
+	});
+	for await (const publicKey of publicKeys) {
+		if (publicKey.publicKey == null) continue;
+		if (await isSamePublicKey(publicKey.publicKey, key.publicKey)) return true;
+	}
+	return false;
+}
+/**
+* Compares two public keys by their key material, ignoring the metadata that
+* surrounds it.
+*/
+async function isSamePublicKey(a, b) {
+	const [x, y] = await Promise.all([exportJwk(a), exportJwk(b)]);
+	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
+}
+/**
+* Gets the actor that owns the specified key.  Returns `null` if the key has no
+* known owner.
+*
+* The owner is only returned when the key and the owner link to each other:
+* a document that merely claims to own a key is not enough, as the claim and
+* the key can come from the same host.
+*
+* @param keyId The ID of the key to check, or the key itself.
+* @param options Options for getting the key owner.
+* @returns The actor that owns the key, or `null` if the key has no known
+*          owner.
+* @since 0.7.0
+*/
+async function getKeyOwner(keyId, options) {
+	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const fetchOptions = {
+		documentLoader,
+		contextLoader: options.contextLoader ?? getDocumentLoader(),
+		tracerProvider
+	};
+	const id = keyId instanceof CryptographicKey ? keyId.id : keyId;
+	if (id != null && isCompatibleKeyId(id)) {
+		const owner = await getPortableGatewayKeyOwner(keyId, fetchOptions);
+		if (owner !== void 0) return owner;
+	}
+	if (keyId instanceof CryptographicKey) return await verifyKeyOwnership(keyId, fetchOptions);
+	let keyDoc;
+	let documentUrl = keyId;
+	try {
+		const remoteDocument = await documentLoader(keyId.href);
+		keyDoc = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", keyId);
+	} catch (_) {
+		return null;
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(keyDoc, {
+			...fetchOptions,
+			baseUrl: documentUrl
+		});
+	} catch (e) {
+		if (!(e instanceof TypeError)) throw e;
+		try {
+			object = await CryptographicKey.fromJsonLd(keyDoc, fetchOptions);
+		} catch (e) {
+			if (e instanceof TypeError) return null;
+			throw e;
+		}
+	}
+	if (object instanceof CryptographicKey) {
+		if (object.id != null && object.id.href !== keyId.href) return null;
+		return await verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
+	}
+	if (!isActor(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href,
+			keyId: keyId.href
+		});
+		return null;
+	}
+	for (const kid of object.publicKeyIds) if (kid.href === keyId.href) return object;
+	return null;
+}
+/**
+* Resolves the owner of a key at a compatible identifier, if the key turns
+* out to be a gateway key of an [FEP-ef61] portable actor.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param key The key, or its ID, which must be a compatible identifier.
+* @param options Options for fetching the key.
+* @returns `undefined` if the key is not a gateway key, i.e., the document at
+*          the key ID is not a portable actor, so the usual checks apply.
+*          Otherwise, the portable actor if its signed document vouches for
+*          the key, and the given key, if any, has the same key material, or
+*          `null` if not.
+*/
+async function getPortableGatewayKeyOwner(key, options) {
+	const keyId = key instanceof CryptographicKey ? key.id : key;
+	if (keyId == null) return void 0;
+	const resolution = await fetchPortableGatewayKey(keyId, options);
+	if (resolution.type === "legacy") return void 0;
+	if (resolution.type === "rejected") return null;
+	if (key instanceof CryptographicKey) {
+		if (key.publicKey == null || !await isSamePublicKey$1(key.publicKey, resolution.key.publicKey)) {
+			logger.debug("The key {keyId} does not have the same key material as the gateway key its portable actor vouches for.", { keyId: keyId.href });
+			return null;
+		}
+	}
+	return resolution.actor;
+}
+//#endregion
+export { getKeyOwner as n, doesActorOwnKey as t };

package/dist/owner-BXufwAzm.cjs

@@ -0,0 +1,225 @@
+const { URLPattern } = require("urlpattern-polyfill");
+const require_http = require("./http-CuLWIJdf.cjs");
+let _logtape_logtape = require("@logtape/logtape");
+let _fedify_vocab = require("@fedify/vocab");
+let _opentelemetry_api = require("@opentelemetry/api");
+let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+//#region src/sig/owner.ts
+const logger = (0, _logtape_logtape.getLogger)([
+	"fedify",
+	"sig",
+	"owner"
+]);
+/**
+* Checks if the actor of the given activity owns the specified key.
+*
+* Ownership is never taken from what the activity or the key say about
+* themselves, as both are written by whoever sent the activity.  It is
+* established from a document that the owner itself serves: either the key's
+* claimed owner links back to the key, or the actor the activity claims lists
+* the key as its own.
+*
+* @param activity The activity to check.
+* @param key The public key to check.
+* @param options Options for checking the key ownership.
+* @returns Whether the actor is the owner of the key.
+*/
+async function doesActorOwnKey(activity, key, options) {
+	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(require_http.name, require_http.version).startActiveSpan("activitypub.verify_key_ownership", {
+		kind: _opentelemetry_api.SpanKind.INTERNAL,
+		attributes: {
+			"activitypub.actor.id": activity.actorId?.href ?? "",
+			"activitypub.key.id": key.id?.href ?? ""
+		}
+	}, async (span) => {
+		try {
+			const actorId = activity.actorId;
+			if (actorId == null) {
+				span.setAttribute("activitypub.key_ownership.verified", false);
+				span.setAttribute("activitypub.key_ownership.method", "none");
+				return false;
+			}
+			if (key.id != null && require_http.isCompatibleKeyId(key.id)) {
+				const owner = await getPortableGatewayKeyOwner(key, options);
+				if (owner !== void 0) {
+					const ownerId = owner?.id == null ? null : require_http.getCanonicalPortableId(owner.id);
+					const verified = ownerId != null && ownerId === require_http.getCanonicalPortableId(actorId);
+					span.setAttribute("activitypub.key_ownership.verified", verified);
+					span.setAttribute("activitypub.key_ownership.method", "portable_gateway_key");
+					return verified;
+				}
+			}
+			if (key.ownerId != null) {
+				const owner = await require_http.verifyKeyOwnership(key, options);
+				if (owner?.id != null && owner.id.href === actorId.href) {
+					span.setAttribute("activitypub.key_ownership.verified", true);
+					span.setAttribute("activitypub.key_ownership.method", "key_owner");
+					return true;
+				}
+			}
+			const actor = await require_http.fetchActorDocument(actorId, options);
+			if (actor != null && await doesActorListKey(actor, key, options)) {
+				span.setAttribute("activitypub.key_ownership.verified", true);
+				span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
+				return true;
+			}
+			logger.debug("The actor {actorId} does not own key {keyId}: neither the owner the key claims nor the actor's own document links the two to each other.", {
+				actorId: actorId.href,
+				keyId: key.id?.href
+			});
+			span.setAttribute("activitypub.key_ownership.verified", false);
+			span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
+			return false;
+		} catch (error) {
+			span.recordException(error);
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
+/**
+* Determines whether the given actor's own document lists the given key among
+* its public keys.
+*
+* Keys are matched by id, which is what an actor document links to.  A key
+* document may leave its id implicit, though, and then there is no id for the
+* actor to link to; the key material itself is the only thing the two can
+* have in common, so that is what gets compared.
+*/
+async function doesActorListKey(actor, key, options) {
+	if (key.id != null) {
+		for (const publicKeyId of actor.publicKeyIds) if (publicKeyId.href === key.id.href) return true;
+		return false;
+	}
+	if (key.publicKey == null) return false;
+	const publicKeys = actor.getPublicKeys({
+		...options,
+		suppressError: true
+	});
+	for await (const publicKey of publicKeys) {
+		if (publicKey.publicKey == null) continue;
+		if (await isSamePublicKey(publicKey.publicKey, key.publicKey)) return true;
+	}
+	return false;
+}
+/**
+* Compares two public keys by their key material, ignoring the metadata that
+* surrounds it.
+*/
+async function isSamePublicKey(a, b) {
+	const [x, y] = await Promise.all([require_http.exportJwk(a), require_http.exportJwk(b)]);
+	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
+}
+/**
+* Gets the actor that owns the specified key.  Returns `null` if the key has no
+* known owner.
+*
+* The owner is only returned when the key and the owner link to each other:
+* a document that merely claims to own a key is not enough, as the claim and
+* the key can come from the same host.
+*
+* @param keyId The ID of the key to check, or the key itself.
+* @param options Options for getting the key owner.
+* @returns The actor that owns the key, or `null` if the key has no known
+*          owner.
+* @since 0.7.0
+*/
+async function getKeyOwner(keyId, options) {
+	const tracerProvider = options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
+	const documentLoader = options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
+	const fetchOptions = {
+		documentLoader,
+		contextLoader: options.contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)(),
+		tracerProvider
+	};
+	const id = keyId instanceof _fedify_vocab.CryptographicKey ? keyId.id : keyId;
+	if (id != null && require_http.isCompatibleKeyId(id)) {
+		const owner = await getPortableGatewayKeyOwner(keyId, fetchOptions);
+		if (owner !== void 0) return owner;
+	}
+	if (keyId instanceof _fedify_vocab.CryptographicKey) return await require_http.verifyKeyOwnership(keyId, fetchOptions);
+	let keyDoc;
+	let documentUrl = keyId;
+	try {
+		const remoteDocument = await documentLoader(keyId.href);
+		keyDoc = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", keyId);
+	} catch (_) {
+		return null;
+	}
+	let object;
+	try {
+		object = await _fedify_vocab.Object.fromJsonLd(keyDoc, {
+			...fetchOptions,
+			baseUrl: documentUrl
+		});
+	} catch (e) {
+		if (!(e instanceof TypeError)) throw e;
+		try {
+			object = await _fedify_vocab.CryptographicKey.fromJsonLd(keyDoc, fetchOptions);
+		} catch (e) {
+			if (e instanceof TypeError) return null;
+			throw e;
+		}
+	}
+	if (object instanceof _fedify_vocab.CryptographicKey) {
+		if (object.id != null && object.id.href !== keyId.href) return null;
+		return await require_http.verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
+	}
+	if (!(0, _fedify_vocab.isActor)(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href,
+			keyId: keyId.href
+		});
+		return null;
+	}
+	for (const kid of object.publicKeyIds) if (kid.href === keyId.href) return object;
+	return null;
+}
+/**
+* Resolves the owner of a key at a compatible identifier, if the key turns
+* out to be a gateway key of an [FEP-ef61] portable actor.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param key The key, or its ID, which must be a compatible identifier.
+* @param options Options for fetching the key.
+* @returns `undefined` if the key is not a gateway key, i.e., the document at
+*          the key ID is not a portable actor, so the usual checks apply.
+*          Otherwise, the portable actor if its signed document vouches for
+*          the key, and the given key, if any, has the same key material, or
+*          `null` if not.
+*/
+async function getPortableGatewayKeyOwner(key, options) {
+	const keyId = key instanceof _fedify_vocab.CryptographicKey ? key.id : key;
+	if (keyId == null) return void 0;
+	const resolution = await require_http.fetchPortableGatewayKey(keyId, options);
+	if (resolution.type === "legacy") return void 0;
+	if (resolution.type === "rejected") return null;
+	if (key instanceof _fedify_vocab.CryptographicKey) {
+		if (key.publicKey == null || !await require_http.isSamePublicKey(key.publicKey, resolution.key.publicKey)) {
+			logger.debug("The key {keyId} does not have the same key material as the gateway key its portable actor vouches for.", { keyId: keyId.href });
+			return null;
+		}
+	}
+	return resolution.actor;
+}
+//#endregion
+Object.defineProperty(exports, "doesActorOwnKey", {
+	enumerable: true,
+	get: function() {
+		return doesActorOwnKey;
+	}
+});
+Object.defineProperty(exports, "getKeyOwner", {
+	enumerable: true,
+	get: function() {
+		return getKeyOwner;
+	}
+});

package/dist/{owner-D_F22lfM.mjs → owner-ByqNQVaa.mjs}

@@ -1,8 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BuRFI7wk.mjs";
-import { c as verifyKeyOwnership, n as fetchActorDocument, t as exportJwk } from "./key-BxHsA1s9.mjs";
+import { n as version, t as name } from "./deno-B-NtYZVW.mjs";
+import { c as verifyKeyOwnership, f as isCompatibleKeyId, h as isSamePublicKey$1, l as getCanonicalPortableId, n as fetchActorDocument, t as exportJwk } from "./key-lfcx_NaE.mjs";
+import { t as fetchPortableGatewayKey } from "./portable-key-Cw_ow5vn.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
@@ -42,6 +43,16 @@ async function doesActorOwnKey(activity, key, options) {
 				span.setAttribute("activitypub.key_ownership.method", "none");
 				return false;
 			}
+			if (key.id != null && isCompatibleKeyId(key.id)) {
+				const owner = await getPortableGatewayKeyOwner(key, options);
+				if (owner !== void 0) {
+					const ownerId = owner?.id == null ? null : getCanonicalPortableId(owner.id);
+					const verified = ownerId != null && ownerId === getCanonicalPortableId(actorId);
+					span.setAttribute("activitypub.key_ownership.verified", verified);
+					span.setAttribute("activitypub.key_ownership.method", "portable_gateway_key");
+					return verified;
+				}
+			}
 			if (key.ownerId != null) {
 				const owner = await verifyKeyOwnership(key, options);
 				if (owner?.id != null && owner.id.href === actorId.href) {
@@ -130,6 +141,11 @@ async function getKeyOwner(keyId, options) {
 		contextLoader: options.contextLoader ?? getDocumentLoader(),
 		tracerProvider
 	};
+	const id = keyId instanceof CryptographicKey ? keyId.id : keyId;
+	if (id != null && isCompatibleKeyId(id)) {
+		const owner = await getPortableGatewayKeyOwner(keyId, fetchOptions);
+		if (owner !== void 0) return owner;
+	}
 	if (keyId instanceof CryptographicKey) return await verifyKeyOwnership(keyId, fetchOptions);
 	let keyDoc;
 	let documentUrl = keyId;
@@ -171,5 +187,32 @@ async function getKeyOwner(keyId, options) {
 	for (const kid of object.publicKeyIds) if (kid.href === keyId.href) return object;
 	return null;
 }
+/**
+* Resolves the owner of a key at a compatible identifier, if the key turns
+* out to be a gateway key of an [FEP-ef61] portable actor.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param key The key, or its ID, which must be a compatible identifier.
+* @param options Options for fetching the key.
+* @returns `undefined` if the key is not a gateway key, i.e., the document at
+*          the key ID is not a portable actor, so the usual checks apply.
+*          Otherwise, the portable actor if its signed document vouches for
+*          the key, and the given key, if any, has the same key material, or
+*          `null` if not.
+*/
+async function getPortableGatewayKeyOwner(key, options) {
+	const keyId = key instanceof CryptographicKey ? key.id : key;
+	if (keyId == null) return void 0;
+	const resolution = await fetchPortableGatewayKey(keyId, options);
+	if (resolution.type === "legacy") return void 0;
+	if (resolution.type === "rejected") return null;
+	if (key instanceof CryptographicKey) {
+		if (key.publicKey == null || !await isSamePublicKey$1(key.publicKey, resolution.key.publicKey)) {
+			logger.debug("The key {keyId} does not have the same key material as the gateway key its portable actor vouches for.", { keyId: keyId.href });
+			return null;
+		}
+	}
+	return resolution.actor;
+}
 //#endregion
 export { getKeyOwner as n, doesActorOwnKey as t };