@fedify/fedify 2.4.0-dev.2065 → 2.4.0-dev.2073

package/dist/owner-DfGz0cXm.js

@@ -0,0 +1,215 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";
+import { B as getCanonicalPortableId, G as isSamePublicKey$1, M as exportJwk, N as fetchActorDocument, U as isCompatibleKeyId, ht as version, mt as name, o as fetchPortableGatewayKey, z as verifyKeyOwnership } from "./http-vfTpzGEq.js";
+import { getLogger } from "@logtape/logtape";
+import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
+import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+import { getDocumentLoader } from "@fedify/vocab-runtime";
+//#region src/sig/owner.ts
+const logger = getLogger([
+	"fedify",
+	"sig",
+	"owner"
+]);
+/**
+* Checks if the actor of the given activity owns the specified key.
+*
+* Ownership is never taken from what the activity or the key say about
+* themselves, as both are written by whoever sent the activity.  It is
+* established from a document that the owner itself serves: either the key's
+* claimed owner links back to the key, or the actor the activity claims lists
+* the key as its own.
+*
+* @param activity The activity to check.
+* @param key The public key to check.
+* @param options Options for checking the key ownership.
+* @returns Whether the actor is the owner of the key.
+*/
+async function doesActorOwnKey(activity, key, options) {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("activitypub.verify_key_ownership", {
+		kind: SpanKind.INTERNAL,
+		attributes: {
+			"activitypub.actor.id": activity.actorId?.href ?? "",
+			"activitypub.key.id": key.id?.href ?? ""
+		}
+	}, async (span) => {
+		try {
+			const actorId = activity.actorId;
+			if (actorId == null) {
+				span.setAttribute("activitypub.key_ownership.verified", false);
+				span.setAttribute("activitypub.key_ownership.method", "none");
+				return false;
+			}
+			if (key.id != null && isCompatibleKeyId(key.id)) {
+				const owner = await getPortableGatewayKeyOwner(key, options);
+				if (owner !== void 0) {
+					const ownerId = owner?.id == null ? null : getCanonicalPortableId(owner.id);
+					const verified = ownerId != null && ownerId === getCanonicalPortableId(actorId);
+					span.setAttribute("activitypub.key_ownership.verified", verified);
+					span.setAttribute("activitypub.key_ownership.method", "portable_gateway_key");
+					return verified;
+				}
+			}
+			if (key.ownerId != null) {
+				const owner = await verifyKeyOwnership(key, options);
+				if (owner?.id != null && owner.id.href === actorId.href) {
+					span.setAttribute("activitypub.key_ownership.verified", true);
+					span.setAttribute("activitypub.key_ownership.method", "key_owner");
+					return true;
+				}
+			}
+			const actor = await fetchActorDocument(actorId, options);
+			if (actor != null && await doesActorListKey(actor, key, options)) {
+				span.setAttribute("activitypub.key_ownership.verified", true);
+				span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
+				return true;
+			}
+			logger.debug("The actor {actorId} does not own key {keyId}: neither the owner the key claims nor the actor's own document links the two to each other.", {
+				actorId: actorId.href,
+				keyId: key.id?.href
+			});
+			span.setAttribute("activitypub.key_ownership.verified", false);
+			span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
+			return false;
+		} catch (error) {
+			span.recordException(error);
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
+/**
+* Determines whether the given actor's own document lists the given key among
+* its public keys.
+*
+* Keys are matched by id, which is what an actor document links to.  A key
+* document may leave its id implicit, though, and then there is no id for the
+* actor to link to; the key material itself is the only thing the two can
+* have in common, so that is what gets compared.
+*/
+async function doesActorListKey(actor, key, options) {
+	if (key.id != null) {
+		for (const publicKeyId of actor.publicKeyIds) if (publicKeyId.href === key.id.href) return true;
+		return false;
+	}
+	if (key.publicKey == null) return false;
+	const publicKeys = actor.getPublicKeys({
+		...options,
+		suppressError: true
+	});
+	for await (const publicKey of publicKeys) {
+		if (publicKey.publicKey == null) continue;
+		if (await isSamePublicKey(publicKey.publicKey, key.publicKey)) return true;
+	}
+	return false;
+}
+/**
+* Compares two public keys by their key material, ignoring the metadata that
+* surrounds it.
+*/
+async function isSamePublicKey(a, b) {
+	const [x, y] = await Promise.all([exportJwk(a), exportJwk(b)]);
+	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
+}
+/**
+* Gets the actor that owns the specified key.  Returns `null` if the key has no
+* known owner.
+*
+* The owner is only returned when the key and the owner link to each other:
+* a document that merely claims to own a key is not enough, as the claim and
+* the key can come from the same host.
+*
+* @param keyId The ID of the key to check, or the key itself.
+* @param options Options for getting the key owner.
+* @returns The actor that owns the key, or `null` if the key has no known
+*          owner.
+* @since 0.7.0
+*/
+async function getKeyOwner(keyId, options) {
+	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const fetchOptions = {
+		documentLoader,
+		contextLoader: options.contextLoader ?? getDocumentLoader(),
+		tracerProvider
+	};
+	const id = keyId instanceof CryptographicKey ? keyId.id : keyId;
+	if (id != null && isCompatibleKeyId(id)) {
+		const owner = await getPortableGatewayKeyOwner(keyId, fetchOptions);
+		if (owner !== void 0) return owner;
+	}
+	if (keyId instanceof CryptographicKey) return await verifyKeyOwnership(keyId, fetchOptions);
+	let keyDoc;
+	let documentUrl = keyId;
+	try {
+		const remoteDocument = await documentLoader(keyId.href);
+		keyDoc = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", keyId);
+	} catch (_) {
+		return null;
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(keyDoc, {
+			...fetchOptions,
+			baseUrl: documentUrl
+		});
+	} catch (e) {
+		if (!(e instanceof TypeError)) throw e;
+		try {
+			object = await CryptographicKey.fromJsonLd(keyDoc, fetchOptions);
+		} catch (e) {
+			if (e instanceof TypeError) return null;
+			throw e;
+		}
+	}
+	if (object instanceof CryptographicKey) {
+		if (object.id != null && object.id.href !== keyId.href) return null;
+		return await verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
+	}
+	if (!isActor(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href,
+			keyId: keyId.href
+		});
+		return null;
+	}
+	for (const kid of object.publicKeyIds) if (kid.href === keyId.href) return object;
+	return null;
+}
+/**
+* Resolves the owner of a key at a compatible identifier, if the key turns
+* out to be a gateway key of an [FEP-ef61] portable actor.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param key The key, or its ID, which must be a compatible identifier.
+* @param options Options for fetching the key.
+* @returns `undefined` if the key is not a gateway key, i.e., the document at
+*          the key ID is not a portable actor, so the usual checks apply.
+*          Otherwise, the portable actor if its signed document vouches for
+*          the key, and the given key, if any, has the same key material, or
+*          `null` if not.
+*/
+async function getPortableGatewayKeyOwner(key, options) {
+	const keyId = key instanceof CryptographicKey ? key.id : key;
+	if (keyId == null) return void 0;
+	const resolution = await fetchPortableGatewayKey(keyId, options);
+	if (resolution.type === "legacy") return void 0;
+	if (resolution.type === "rejected") return null;
+	if (key instanceof CryptographicKey) {
+		if (key.publicKey == null || !await isSamePublicKey$1(key.publicKey, resolution.key.publicKey)) {
+			logger.debug("The key {keyId} does not have the same key material as the gateway key its portable actor vouches for.", { keyId: keyId.href });
+			return null;
+		}
+	}
+	return resolution.actor;
+}
+//#endregion
+export { getKeyOwner as n, doesActorOwnKey as t };

package/dist/portable-key-DCyKGCQd.mjs

@@ -0,0 +1,194 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { h as isSamePublicKey, l as getCanonicalPortableId, p as isPortableActorDocument } from "./key-BYXnTGro.mjs";
+import { c as verifyPortableObjectProofWithRoot } from "./proof-CxsVG6vM.mjs";
+import { getLogger } from "@logtape/logtape";
+import { CryptographicKey, Multikey, Object as Object$1 } from "@fedify/vocab";
+import { getDocumentLoader, isGatewayUrl } from "@fedify/vocab-runtime";
+//#region src/sig/portable-key.ts
+const logger = getLogger([
+	"fedify",
+	"sig",
+	"key"
+]);
+const SEC = "https://w3id.org/security#";
+/**
+* Verifies that the signed document of a portable actor vouches for
+* the gateway key with the given ID.
+*
+* A gateway key is accepted only if:
+*
+*  -  the document is an actor whose portable ID is the one the key ID is
+*     the compatible identifier of;
+*  -  the document has a valid [FEP-8b32] Object Integrity Proof made by
+*     the DID of its ID, i.e., it satisfies the [FEP-ef61] proof policy;
+*  -  the document embeds a `Multikey` with that ID in its `assertionMethod`,
+*     whose `controller` is the actor, as [FEP-521a] requires; a key
+*     embedded in its `publicKey` with the same ID must agree with it; and
+*  -  the key ID's origin is one of the actor's `gateways`.
+*
+* [FEP-8b32]: https://w3id.org/fep/8b32
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* [FEP-521a]: https://w3id.org/fep/521a
+*
+* @param document The raw JSON-LD document served at the key ID.
+* @param actor The parsed document, which must be a portable actor.
+* @param keyId The key ID, which must be a compatible key ID.
+* @param options Loaders and telemetry providers.
+* @returns The verification result, which is never `legacy`.
+* @internal
+*/
+async function verifyPortableGatewayKeyDocument(document, actor, keyId, options = {}) {
+	const reject = (reason) => {
+		logger.debug("Failed to verify gateway key {keyId} of the portable actor {actorId}: {reason}", {
+			keyId: keyId.href,
+			actorId: actor.id?.href,
+			reason
+		});
+		return {
+			type: "rejected",
+			reason
+		};
+	};
+	const keyBase = new URL(keyId.href);
+	keyBase.hash = "";
+	const claimedActorId = getCanonicalPortableId(keyBase);
+	const actorId = actor.id == null ? null : getCanonicalPortableId(actor.id);
+	if (claimedActorId == null || actorId == null) return reject("The key ID or the actor ID is not a valid portable ID.");
+	if (claimedActorId !== actorId) return reject("The key ID is not a compatible identifier of the actor it dereferences to.");
+	let verification;
+	try {
+		verification = await verifyPortableObjectProofWithRoot(document, {
+			documentLoader: options.documentLoader,
+			contextLoader: options.contextLoader,
+			keyCache: options.keyCache,
+			tracerProvider: options.tracerProvider,
+			meterProvider: options.meterProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject(`The actor document is malformed: ${error.message}`);
+	}
+	const { result, root } = verification;
+	if (!result.verified) return reject("The actor document does not satisfy the FEP-ef61 proof policy: " + result.reason.type);
+	if (root == null) return reject("The actor document could not be expanded.");
+	const refuse = (url) => Promise.reject(/* @__PURE__ */ new Error(`Refusing to fetch ${url}.`));
+	let verifiedActor;
+	try {
+		verifiedActor = await Object$1.fromJsonLd(root, {
+			documentLoader: refuse,
+			contextLoader: options.contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject("The verified actor document is malformed.");
+	}
+	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
+	actor = verifiedActor;
+	const multikeyNode = findEmbeddedNode(root[`${SEC}assertionMethod`], keyId);
+	if (multikeyNode == null) return reject("The actor document does not embed the key in its assertionMethod.");
+	let multikey;
+	try {
+		multikey = await Multikey.fromJsonLd(multikeyNode, {
+			documentLoader: refuse,
+			contextLoader: options.contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject("The key in the assertionMethod is malformed.");
+	}
+	if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
+	if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
+	const publicKeyNode = findEmbeddedNode(root[`${SEC}publicKey`], keyId);
+	if (publicKeyNode != null) {
+		let publicKey;
+		try {
+			publicKey = await CryptographicKey.fromJsonLd(publicKeyNode, {
+				documentLoader: refuse,
+				contextLoader: options.contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			return reject("The key in the publicKey is malformed.");
+		}
+		if (publicKey.publicKey == null || !await isSamePublicKey(publicKey.publicKey, multikey.publicKey) || publicKey.ownerId != null && getCanonicalPortableId(publicKey.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
+	}
+	if (!actor.gateways.some((gateway) => isGatewayUrl(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
+	const key = new CryptographicKey({
+		id: keyId,
+		owner: actor.id,
+		publicKey: multikey.publicKey
+	});
+	return {
+		type: "verified",
+		actor,
+		key
+	};
+}
+/**
+* Fetches the document at a compatible key ID, and resolves the key as
+* a gateway key if the document is a portable actor.
+*
+* @param keyId The key ID, which must be a compatible key ID.
+* @param options Loaders and telemetry providers.
+* @returns `legacy` if the document cannot be fetched or is not a portable
+*          actor, which leaves the key to the usual resolution; otherwise,
+*          the result of {@link verifyPortableGatewayKeyDocument}.
+* @internal
+*/
+async function fetchPortableGatewayKey(keyId, options = {}) {
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	let remoteDocument;
+	try {
+		remoteDocument = await documentLoader(keyId.href);
+	} catch (error) {
+		logger.debug("Failed to fetch key {keyId}: {error}", {
+			keyId: keyId.href,
+			error
+		});
+		return { type: "legacy" };
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(remoteDocument.document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return { type: "legacy" };
+	}
+	if (!isPortableActorDocument(object)) return { type: "legacy" };
+	return await verifyPortableGatewayKeyDocument(remoteDocument.document, object, keyId, {
+		...options,
+		documentLoader,
+		contextLoader
+	});
+}
+function findEmbeddedNode(values, id) {
+	if (!Array.isArray(values)) return null;
+	for (const value of values) {
+		if (value == null || typeof value !== "object" || Array.isArray(value)) continue;
+		const node = value;
+		const nodeId = node["@id"];
+		if (typeof nodeId !== "string") continue;
+		let parsed;
+		try {
+			parsed = new URL(nodeId);
+		} catch {
+			continue;
+		}
+		if (parsed.href !== id.href) continue;
+		if (Object.keys(node).every((key) => key === "@id")) continue;
+		return node;
+	}
+	return null;
+}
+//#endregion
+export { verifyPortableGatewayKeyDocument as n, fetchPortableGatewayKey as t };

package/dist/{proof-B03JXhrk.mjs → proof-CxsVG6vM.mjs}

@@ -1,19 +1,19 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BuRFI7wk.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DOqknlZd.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-BxHsA1s9.mjs";
+import { n as version, t as name } from "./deno-LYTbBhYV.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DvlvYpq_.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-BYXnTGro.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { c as getNormalizationContextLoader } from "./ld-CqJq5erX.mjs";
+import { c as getNormalizationContextLoader } from "./ld-DT3e2hOv.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { encodeMultibase, formatIri, getDocumentLoader, getFe34Origin, haveSameFe34Origin, parseIri } from "@fedify/vocab-runtime";
 import { encodeHex } from "byte-encodings/hex";
-import jsonld from "@fedify/vocab-runtime/jsonld";
 import { isPlainJsonTree, retainSignedRepresentation } from "@fedify/vocab-runtime/internal/signed-representation";
+import jsonld from "@fedify/vocab-runtime/jsonld";
 import serialize from "json-canon";
 //#region src/sig/proof.ts
 /**

package/dist/{send-NNkfKtVN.mjs → send-BZJ7NsVV.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BuRFI7wk.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-DOqknlZd.mjs";
-import { n as doubleKnock } from "./http-f1qaBtOh.mjs";
+import { n as version, t as name } from "./deno-LYTbBhYV.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-DvlvYpq_.mjs";
+import { n as doubleKnock } from "./http-C7qHlv-b.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";
@@ -146,7 +146,11 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 		rsaKey = key;
 		break;
 	}
-	if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
+	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
+		activityId,
+		inbox: inbox.href
+	});
+	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 		inbox: inbox.href,
 		keys: keys.map((pair) => ({
 			keyId: pair.keyId.href,

package/dist/sig/compound-proof-discovery.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-Dj3DCsoj.mjs";
+import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-B5Skp-vE.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-discovery.test.ts

package/dist/sig/compound-proof-producer.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-Dj3DCsoj.mjs";
+import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-B5Skp-vE.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-producer.test.ts
 const portableId = "ap+ef61://did:key:z6MkAlice/objects/1";

package/dist/sig/compound-proof-verification.test.mjs

@@ -4,8 +4,8 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { i as verifyMapLocalProof, s as verifyPortableObjectProofPolicy } from "../proof-B03JXhrk.mjs";
-import { a as verifyCompoundPortableObjectProofs, o as verifyCompoundProofDocuments } from "../compound-proof-Dj3DCsoj.mjs";
+import { i as verifyMapLocalProof, s as verifyPortableObjectProofPolicy } from "../proof-CxsVG6vM.mjs";
+import { a as verifyCompoundPortableObjectProofs, o as verifyCompoundProofDocuments } from "../compound-proof-B5Skp-vE.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/compound-proof.test.mjs

@@ -4,11 +4,11 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { l as verifyProof, r as signObject } from "../proof-B03JXhrk.mjs";
-import { o as verifyCompoundProofDocuments } from "../compound-proof-Dj3DCsoj.mjs";
+import { l as verifyProof, r as signObject } from "../proof-CxsVG6vM.mjs";
+import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
+import { o as verifyCompoundProofDocuments } from "../compound-proof-B5Skp-vE.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";

package/dist/sig/http.test.mjs

@@ -11,8 +11,8 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { t as exportJwk } from "../key-BxHsA1s9.mjs";
-import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-f1qaBtOh.mjs";
+import { t as exportJwk } from "../key-BYXnTGro.mjs";
+import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-C7qHlv-b.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";

package/dist/sig/key.test.mjs

@@ -6,7 +6,7 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as generateCryptoKeyPair, i as fetchKeyDetailed, o as importJwk, r as fetchKey, s as validateCryptoKey, t as exportJwk } from "../key-BxHsA1s9.mjs";
+import { a as generateCryptoKeyPair, i as fetchKeyDetailed, o as importJwk, r as fetchKey, s as validateCryptoKey, t as exportJwk } from "../key-BYXnTGro.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/ld.test.mjs

@@ -8,9 +8,9 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as generateCryptoKeyPair } from "../key-BxHsA1s9.mjs";
+import { a as generateCryptoKeyPair } from "../key-BYXnTGro.mjs";
+import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-DT3e2hOv.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-CqJq5erX.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { encodeBase64 } from "byte-encodings/base64";

package/dist/sig/mod.cjs

@@ -1,12 +1,12 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-BGShIsd6.cjs");
-const require_owner = require("../owner-D8ZpRusc.cjs");
-const require_sig = require("../sig-B1E2uyhQ.cjs");
-exports.attachSignature = require_owner.attachSignature;
-exports.createProof = require_owner.createProof;
-exports.createSignature = require_owner.createSignature;
-exports.detachSignature = require_owner.detachSignature;
+const require_http = require("../http-DGk8XI38.cjs");
+const require_owner = require("../owner-DCIH7Iq0.cjs");
+const require_sig = require("../sig-C6TnADze.cjs");
+exports.attachSignature = require_http.attachSignature;
+exports.createProof = require_http.createProof;
+exports.createSignature = require_http.createSignature;
+exports.detachSignature = require_http.detachSignature;
 exports.doesActorOwnKey = require_owner.doesActorOwnKey;
 exports.exportJwk = require_http.exportJwk;
 exports.fetchKey = require_http.fetchKey;
@@ -15,19 +15,19 @@ exports.formatAcceptSignature = require_http.formatAcceptSignature;
 exports.fulfillAcceptSignature = require_http.fulfillAcceptSignature;
 exports.generateCryptoKeyPair = require_http.generateCryptoKeyPair;
 exports.getKeyOwner = require_owner.getKeyOwner;
-exports.hasProofLike = require_owner.hasProofLike;
-exports.hasSignatureLike = require_owner.hasSignatureLike;
+exports.hasProofLike = require_http.hasProofLike;
+exports.hasSignatureLike = require_http.hasSignatureLike;
 exports.importJwk = require_http.importJwk;
 exports.parseAcceptSignature = require_http.parseAcceptSignature;
-exports.signJsonLd = require_owner.signJsonLd;
-exports.signObject = require_owner.signObject;
+exports.signJsonLd = require_http.signJsonLd;
+exports.signObject = require_http.signObject;
 exports.signRequest = require_http.signRequest;
 exports.validateAcceptSignature = require_http.validateAcceptSignature;
-exports.verifyJsonLd = require_owner.verifyJsonLd;
-exports.verifyObject = require_owner.verifyObject;
+exports.verifyJsonLd = require_http.verifyJsonLd;
+exports.verifyObject = require_http.verifyObject;
 exports.verifyPortableObject = require_sig.verifyPortableObject;
-exports.verifyPortableObjectProof = require_owner.verifyPortableObjectProof;
-exports.verifyProof = require_owner.verifyProof;
+exports.verifyPortableObjectProof = require_http.verifyPortableObjectProof;
+exports.verifyProof = require_http.verifyProof;
 exports.verifyRequest = require_http.verifyRequest;
 exports.verifyRequestDetailed = require_http.verifyRequestDetailed;
-exports.verifySignature = require_owner.verifySignature;
+exports.verifySignature = require_http.verifySignature;

package/dist/sig/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-CP-7OdSq.cjs";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-xlG-jRdB.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BF0L9cMt.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-pLbeNwcC.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-HDSvS-ww.cjs";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-65PYi9jY.js";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-n2v6DPxu.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BSzr5-I8.js";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-Dhm7SqyE.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-C9WSpZWm.js";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { F as validateAcceptSignature, M as formatAcceptSignature, N as fulfillAcceptSignature, P as parseAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, i as verifyRequest, l as fetchKeyDetailed, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "../http-z5n7chWw.js";
-import { C as signJsonLd, E as verifySignature, T as verifyJsonLd, _ as detachSignature, a as signObject, b as hasSignatureLike, c as verifyPortableObjectProof, d as verifyProof, g as createSignature, i as hasProofLike, m as attachSignature, n as getKeyOwner, r as createProof, s as verifyObject, t as doesActorOwnKey } from "../owner-BLBWXCNt.js";
-import { t as verifyPortableObject } from "../sig-Bb20Pyrd.js";
+import { A as verifySignature, D as signJsonLd, F as fetchKeyDetailed, I as generateCryptoKeyPair, L as importJwk, M as exportJwk, P as fetchKey, a as verifyRequestDetailed, b as createSignature, c as hasProofLike, d as verifyObject, dt as fulfillAcceptSignature, f as verifyPortableObjectProof, ft as parseAcceptSignature, h as verifyProof, i as verifyRequest, k as verifyJsonLd, l as signObject, pt as validateAcceptSignature, r as signRequest, s as createProof, ut as formatAcceptSignature, v as attachSignature, w as hasSignatureLike, x as detachSignature } from "../http-vfTpzGEq.js";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DfGz0cXm.js";
+import { t as verifyPortableObject } from "../sig-Cs9_ecdh.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };