@fedify/fedify 2.4.0-dev.2077 → 2.4.0-dev.2093

package/dist/{mod-HDSvS-ww.d.cts → mod-C8LieBzF.d.cts}

@@ -289,7 +289,11 @@ interface VerifyPortableObjectProofOptions extends VerifyProofOptions {}
 * @since 2.4.0
 */
 type VerifyPortableObjectProofFailureReason = {
-  /** The document does not have a portable `ap:` or `ap+ef61:` ID. */readonly type: "notPortableObject";
+  /**
+  * The document has neither a portable `ap:` or `ap+ef61:` ID nor an
+  * FEP-ef61 compatible identifier.
+  */
+  readonly type: "notPortableObject";
 } | {
   /**
   * The document is a portable collection without an Object Integrity
@@ -347,15 +351,24 @@ declare function verifyProof(jsonLd: unknown, proof: DataIntegrityProof, options
 * collection without a proof is reported separately so a caller can apply a
 * gateway trust policy.  Embedded portable objects are not traversed.
 *
+* A portable object is a document whose ID is an `ap:` or `ap+ef61:` URI, or
+* an [FEP-ef61] compatible identifier such as
+* `https://gw.example/.well-known/apgateway/did:key:z6Mk…/actor`, which
+* stands for the portable ID `ap+ef61://did:key:z6Mk…/actor`.
+*
 * Every proof must use a DID URL whose DID matches the portable object's
-* authority, and every proof must pass {@link verifyProof}.
+* authority, i.e., the DID of its canonical portable ID, and every proof must
+* pass {@link verifyProof}.  The proofs are verified over the document as
+* given; a compatible identifier is never rewritten into a portable ID.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 *
 * @param jsonLd The JSON-LD document to verify.
 * @param options Additional options.  See also
 *                {@link VerifyPortableObjectProofOptions}.
 * @returns The detailed portable proof-policy result.
 * @throws {TypeError} If the input is not a single JSON-LD object or has a
-*                     malformed portable ID.
+*                     malformed portable ID or compatible identifier.
 * @since 2.4.0
 */
 declare function verifyPortableObjectProof(jsonLd: unknown, options?: VerifyPortableObjectProofOptions): Promise<VerifyPortableObjectProofResult>;

package/dist/{mod-C9WSpZWm.d.ts → mod-Coacostr.d.ts}

@@ -289,7 +289,11 @@ interface VerifyPortableObjectProofOptions extends VerifyProofOptions {}
 * @since 2.4.0
 */
 type VerifyPortableObjectProofFailureReason = {
-  /** The document does not have a portable `ap:` or `ap+ef61:` ID. */readonly type: "notPortableObject";
+  /**
+  * The document has neither a portable `ap:` or `ap+ef61:` ID nor an
+  * FEP-ef61 compatible identifier.
+  */
+  readonly type: "notPortableObject";
 } | {
   /**
   * The document is a portable collection without an Object Integrity
@@ -347,15 +351,24 @@ declare function verifyProof(jsonLd: unknown, proof: DataIntegrityProof, options
 * collection without a proof is reported separately so a caller can apply a
 * gateway trust policy.  Embedded portable objects are not traversed.
 *
+* A portable object is a document whose ID is an `ap:` or `ap+ef61:` URI, or
+* an [FEP-ef61] compatible identifier such as
+* `https://gw.example/.well-known/apgateway/did:key:z6Mk…/actor`, which
+* stands for the portable ID `ap+ef61://did:key:z6Mk…/actor`.
+*
 * Every proof must use a DID URL whose DID matches the portable object's
-* authority, and every proof must pass {@link verifyProof}.
+* authority, i.e., the DID of its canonical portable ID, and every proof must
+* pass {@link verifyProof}.  The proofs are verified over the document as
+* given; a compatible identifier is never rewritten into a portable ID.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 *
 * @param jsonLd The JSON-LD document to verify.
 * @param options Additional options.  See also
 *                {@link VerifyPortableObjectProofOptions}.
 * @returns The detailed portable proof-policy result.
 * @throws {TypeError} If the input is not a single JSON-LD object or has a
-*                     malformed portable ID.
+*                     malformed portable ID or compatible identifier.
 * @since 2.4.0
 */
 declare function verifyPortableObjectProof(jsonLd: unknown, options?: VerifyPortableObjectProofOptions): Promise<VerifyPortableObjectProofResult>;

package/dist/mod.cjs

@@ -3,14 +3,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-Dvy_IwRa.cjs");
-const require_federation = require("./federation-CFd0Jhhv.cjs");
+const require_http = require("./http-DSaSAN7X.cjs");
+const require_federation = require("./federation-aSHO04ob.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-BpOxL5PG.cjs");
-const require_kv_cache = require("./kv-cache-BP69NV0P.cjs");
+const require_owner = require("./owner-szIZl4qI.cjs");
+const require_kv_cache = require("./kv-cache-BSJAlP4C.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
-const require_sig = require("./sig-xoqy3ATq.cjs");
+const require_sig = require("./sig-CXOKN4Br.cjs");
 require("./utils/mod.cjs");
 //#endregion
 exports.CircuitBreaker = require_federation.CircuitBreaker;

package/dist/mod.d.cts

@@ -6,7 +6,7 @@ import { $ as InProcessMessageQueueOptions, A as ObjectCallbackSetters, At as In
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-BhNbN8Ed.cjs";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.cjs";
 import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-JzkaEXsi.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-HDSvS-ww.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-C8LieBzF.cjs";
 import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-xGFCHqq_.cjs";
 export * from "@fedify/vocab-runtime";
 

package/dist/mod.d.ts

@@ -6,7 +6,7 @@ import { $ as InProcessMessageQueueOptions, A as ObjectCallbackSetters, At as In
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-BhNbN8Ed.js";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.js";
 import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-B2h2KY0q.js";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-C9WSpZWm.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-Coacostr.js";
 import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-CVZrXSdm.js";
 export * from "@fedify/vocab-runtime";
 

package/dist/mod.js

@@ -3,15 +3,15 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./rolldown-runtime-BC-Eo5Mj.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-DAtXl_Kc.js";
 import "./compat/mod.js";
-import { A as verifySignature, D as signJsonLd, F as fetchKeyDetailed, I as generateCryptoKeyPair, L as importJwk, M as exportJwk, P as fetchKey, a as verifyRequestDetailed, b as createSignature, c as hasProofLike, d as verifyObject, dt as fulfillAcceptSignature, f as verifyPortableObjectProof, ft as parseAcceptSignature, h as verifyProof, i as verifyRequest, k as verifyJsonLd, l as signObject, pt as validateAcceptSignature, r as signRequest, s as createProof, ut as formatAcceptSignature, v as attachSignature, w as hasSignatureLike, x as detachSignature } from "./http-aqh3yFdM.js";
-import { a as respondWithObject, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as SendActivityError, l as CircuitBreaker, n as handleWebFinger, o as respondWithObjectIfAcceptable, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-SSfryVzY.js";
+import { C as detachSignature, E as hasSignatureLike, I as fetchKey, L as fetchKeyDetailed, M as verifySignature, P as exportJwk, R as generateCryptoKeyPair, S as createSignature, a as verifyRequestDetailed, b as attachSignature, c as createProof, ct as parseAcceptSignature, f as verifyObject, g as verifyProof, i as verifyRequest, j as verifyJsonLd, k as signJsonLd, l as hasProofLike, lt as validateAcceptSignature, ot as formatAcceptSignature, p as verifyPortableObjectProof, r as signRequest, st as fulfillAcceptSignature, u as signObject, z as importJwk } from "./http-DyT7DP1Y.js";
+import { a as respondWithObject, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as SendActivityError, l as CircuitBreaker, n as handleWebFinger, o as respondWithObjectIfAcceptable, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-Blq0882d.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-jH1z_YfD.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-Y6SDRSX6.js";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-DAGSC5gX.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DmroAz3M.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";
-import { t as verifyPortableObject } from "./sig-Dpy1B1Ad.js";
+import { t as verifyPortableObject } from "./sig-B5Ell7pO.js";
 import "./utils/mod.js";
 export * from "@fedify/vocab-runtime";
 //#endregion

package/dist/nodeinfo/handler.test.mjs

@@ -5,7 +5,7 @@ import { r as createRequestContext } from "../context-DlZhxdFT.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { S as handleNodeInfoJrd, o as createFederation, x as handleNodeInfo } from "../middleware-BMgzqBtr.mjs";
+import { C as handleNodeInfoJrd, S as handleNodeInfo, o as createFederation } from "../middleware-E_0IH72m.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {

package/dist/{owner-DGbYmXqU.mjs → owner-Cgx2Dc7I.mjs}

@@ -1,9 +1,10 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Djkzd-G_.mjs";
-import { c as verifyKeyOwnership, f as isCompatibleKeyId, h as isSamePublicKey$1, l as getCanonicalPortableId, n as fetchActorDocument, t as exportJwk } from "./key-IxTTC8Yf.mjs";
-import { t as fetchPortableGatewayKey } from "./portable-key-CCwJGSsU.mjs";
+import { n as version, t as name } from "./deno-8t8k_6Yv.mjs";
+import { a as isCompatibleKeyId, l as isSamePublicKey$1, s as isPortableId, t as getCanonicalPortableId } from "./portable-key-id-Bva5iT3W.mjs";
+import { c as verifyKeyOwnership, n as fetchActorDocument, t as exportJwk } from "./key-Dwm4VswT.mjs";
+import { t as fetchPortableGatewayKey } from "./portable-key-Cn1WJSN1.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
@@ -176,7 +177,7 @@ async function getKeyOwner(keyId, options) {
 		return await verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
 	}
 	if (!isActor(object)) return null;
-	if (object.id == null || object.id.origin !== documentUrl.origin) {
+	if (object.id == null || isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
 		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
 			documentUrl: documentUrl.href,
 			actorId: object.id?.href,

package/dist/{owner-jH1z_YfD.js → owner-DAGSC5gX.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { B as getCanonicalPortableId, G as isSamePublicKey$1, M as exportJwk, N as fetchActorDocument, U as isCompatibleKeyId, ht as version, mt as name, o as fetchPortableGatewayKey, z as verifyKeyOwnership } from "./http-aqh3yFdM.js";
+import { F as fetchActorDocument, P as exportJwk, V as verifyKeyOwnership, _t as isSamePublicKey$1, ht as isPortableId, mt as isCompatibleKeyId, o as fetchPortableGatewayKey, ut as getCanonicalPortableId, vt as name, yt as version } from "./http-DyT7DP1Y.js";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
@@ -173,7 +173,7 @@ async function getKeyOwner(keyId, options) {
 		return await verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
 	}
 	if (!isActor(object)) return null;
-	if (object.id == null || object.id.origin !== documentUrl.origin) {
+	if (object.id == null || isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
 		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
 			documentUrl: documentUrl.href,
 			actorId: object.id?.href,

package/dist/{owner-BpOxL5PG.cjs → owner-szIZl4qI.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-Dvy_IwRa.cjs");
+const require_http = require("./http-DSaSAN7X.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
@@ -172,7 +172,7 @@ async function getKeyOwner(keyId, options) {
 		return await require_http.verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
 	}
 	if (!(0, _fedify_vocab.isActor)(object)) return null;
-	if (object.id == null || object.id.origin !== documentUrl.origin) {
+	if (object.id == null || require_http.isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
 		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
 			documentUrl: documentUrl.href,
 			actorId: object.id?.href,

package/dist/{portable-key-CCwJGSsU.mjs → portable-key-Cn1WJSN1.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { h as isSamePublicKey, l as getCanonicalPortableId, p as isPortableActorDocument } from "./key-IxTTC8Yf.mjs";
-import { c as verifyPortableObjectProofWithRoot } from "./proof-CVL7JnZd.mjs";
+import { l as isSamePublicKey, o as isPortableActorDocument, t as getCanonicalPortableId } from "./portable-key-id-Bva5iT3W.mjs";
+import { l as verifyPortableObjectProofWithRoot } from "./proof-DVXC6nYz.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { getDocumentLoader, isGatewayUrl } from "@fedify/vocab-runtime";
@@ -19,13 +19,19 @@ const SEC = "https://w3id.org/security#";
 *
 * A gateway key is accepted only if:
 *
-*  -  the document is an actor whose portable ID is the one the key ID is
-*     the compatible identifier of;
+*  -  the document is an actor whose portable ID, i.e., its `ap:` ID or
+*     the canonical portable ID of its compatible identifier, is the one
+*     the key ID is the compatible identifier of;
 *  -  the document has a valid [FEP-8b32] Object Integrity Proof made by
 *     the DID of its ID, i.e., it satisfies the [FEP-ef61] proof policy;
 *  -  the document embeds a `Multikey` with that ID in its `assertionMethod`,
-*     whose `controller` is the actor, as [FEP-521a] requires; a key
-*     embedded in its `publicKey` with the same ID must agree with it; and
+*     whose `controller` is the actor, as [FEP-521a] requires, and a key
+*     embedded in its `publicKey` with the same ID agrees with it; or, if
+*     no `assertionMethod` entry has that ID, the document embeds
+*     a `CryptographicKey` with that ID in its `publicKey`, whose `owner` is
+*     the actor, as some publishers, e.g., tootik, list their RSA keys only
+*     there;
+*  -  no more than one entry of either property has that ID; and
 *  -  the key ID's origin is one of the actor's `gateways`.
 *
 * [FEP-8b32]: https://w3id.org/fep/8b32
@@ -74,6 +80,21 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 	if (!result.verified) return reject("The actor document does not satisfy the FEP-ef61 proof policy: " + result.reason.type);
 	if (root == null) return reject("The actor document could not be expanded.");
 	const refuse = (url) => Promise.reject(/* @__PURE__ */ new Error(`Refusing to fetch ${url}.`));
+	const parseEmbeddedPublicKey = async (node) => {
+		if (isReference(node)) return null;
+		let key;
+		try {
+			key = await CryptographicKey.fromJsonLd(node, {
+				documentLoader: refuse,
+				contextLoader: options.contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			return null;
+		}
+		return key.publicKey == null ? null : key;
+	};
 	let verifiedActor;
 	try {
 		verifiedActor = await Object$1.fromJsonLd(root, {
@@ -87,41 +108,42 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 	}
 	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
 	actor = verifiedActor;
-	const multikeyNode = findEmbeddedNode(root[`${SEC}assertionMethod`], keyId);
-	if (multikeyNode == null) return reject("The actor document does not embed the key in its assertionMethod.");
-	let multikey;
-	try {
-		multikey = await Multikey.fromJsonLd(multikeyNode, {
-			documentLoader: refuse,
-			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider
-		});
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		return reject("The key in the assertionMethod is malformed.");
-	}
-	if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
-	if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
-	const publicKeyNode = findEmbeddedNode(root[`${SEC}publicKey`], keyId);
-	if (publicKeyNode != null) {
-		let publicKey;
+	const assertionNodes = findNodes(root[`${SEC}assertionMethod`], keyId);
+	const publicKeyNodes = findNodes(root[`${SEC}publicKey`], keyId);
+	if (assertionNodes.length > 1 || publicKeyNodes.length > 1) return reject("The actor document has more than one key with the ID.");
+	let publicKey;
+	if (assertionNodes.length > 0) {
+		if (isReference(assertionNodes[0])) return reject("The actor document does not embed the key in its assertionMethod.");
+		let multikey;
 		try {
-			publicKey = await CryptographicKey.fromJsonLd(publicKeyNode, {
+			multikey = await Multikey.fromJsonLd(assertionNodes[0], {
 				documentLoader: refuse,
 				contextLoader: options.contextLoader,
 				tracerProvider: options.tracerProvider
 			});
 		} catch (error) {
 			if (!(error instanceof TypeError)) throw error;
-			return reject("The key in the publicKey is malformed.");
+			return reject("The key in the assertionMethod is malformed.");
+		}
+		if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
+		if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
+		publicKey = multikey.publicKey;
+		if (publicKeyNodes.length > 0 && !isReference(publicKeyNodes[0])) {
+			const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
+			if (embedded == null || !await isSamePublicKey(embedded.publicKey, publicKey) || embedded.ownerId != null && getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
 		}
-		if (publicKey.publicKey == null || !await isSamePublicKey(publicKey.publicKey, multikey.publicKey) || publicKey.ownerId != null && getCanonicalPortableId(publicKey.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
+	} else {
+		if (publicKeyNodes.length < 1) return reject("The actor document embeds the key in neither its assertionMethod nor its publicKey.");
+		const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
+		if (embedded == null) return reject("The key in the publicKey is not embedded or malformed.");
+		if (embedded.ownerId == null || getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The owner of the key is not the actor.");
+		publicKey = embedded.publicKey;
 	}
 	if (!actor.gateways.some((gateway) => isGatewayUrl(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
 	const key = new CryptographicKey({
 		id: keyId,
 		owner: actor.id,
-		publicKey: multikey.publicKey
+		publicKey
 	});
 	return {
 		type: "verified",
@@ -171,24 +193,21 @@ async function fetchPortableGatewayKey(keyId, options = {}) {
 		contextLoader
 	});
 }
-function findEmbeddedNode(values, id) {
-	if (!Array.isArray(values)) return null;
+function findNodes(values, id) {
+	if (!Array.isArray(values)) return [];
+	const nodes = [];
 	for (const value of values) {
 		if (value == null || typeof value !== "object" || Array.isArray(value)) continue;
 		const node = value;
 		const nodeId = node["@id"];
-		if (typeof nodeId !== "string") continue;
-		let parsed;
-		try {
-			parsed = new URL(nodeId);
-		} catch {
-			continue;
-		}
-		if (parsed.href !== id.href) continue;
-		if (Object.keys(node).every((key) => key === "@id")) continue;
-		return node;
+		if (typeof nodeId !== "string" || !URL.canParse(nodeId)) continue;
+		if (new URL(nodeId).href === id.href) nodes.push(node);
 	}
-	return null;
+	return nodes;
+}
+/** A node with nothing but an `@id` is a reference, not an embedded key. */
+function isReference(node) {
+	return Object.keys(node).every((key) => key === "@id");
 }
 //#endregion
 export { verifyPortableGatewayKeyDocument as n, fetchPortableGatewayKey as t };

package/dist/portable-key-id-Bva5iT3W.mjs

@@ -0,0 +1,136 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { isActor } from "@fedify/vocab";
+import { canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getFe34Origin, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
+//#region src/sig/portable-key-id.ts
+const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+/**
+* Checks whether the URL is an `ap:` or `ap+ef61:` URI.
+* @internal
+*/
+function isPortableUri(url) {
+	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
+}
+/**
+* Checks whether an ID identifies an [FEP-ef61] portable object, i.e., it is
+* an `ap:` or `ap+ef61:` URI, or looks like a compatible identifier.
+* A malformed compatible identifier counts too, so that it is rejected as
+* a portable object that no proof can match, rather than trusted by its web
+* origin.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isPortableId(id) {
+	if (typeof id === "string") {
+		if (/^ap(?:\+ef61)?:\/\//i.test(id)) return true;
+	} else if (isPortableUri(id)) return true;
+	return isCompatibleEf61Iri(id);
+}
+/**
+* Gets the DID, i.e., the FEP-fe34 cryptographic origin, of an `ap:` or
+* `ap+ef61:` URI, a DID URL, or a compatible identifier.
+* @returns The DID, or `null` if the ID is none of them, or is malformed.
+* @internal
+*/
+function getPortableDid(id) {
+	try {
+		const raw = typeof id === "string" ? id : id.href;
+		if (/^(?:did:|ap(?:\+ef61)?:\/\/)/i.test(raw)) return getFe34Origin(id);
+		const portable = fromCompatibleEf61Id(id);
+		return portable == null ? null : getFe34Origin(portable);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Checks whether an activity is performed by an FEP-ef61 portable actor,
+* i.e., any of its actors has an `ap:` or `ap+ef61:` ID, or a compatible
+* identifier.
+* @internal
+*/
+function hasPortableActor(activity) {
+	return activity.actorIds.some((id) => isPortableId(id));
+}
+/**
+* Checks whether a key ID looks like an [FEP-ef61] compatible identifier,
+* i.e., an HTTP(S) URL under a gateway's `/.well-known/apgateway/did:` path.
+* Such a key ID names a key that a gateway holds for a portable actor, so it
+* is resolved only as a gateway key, and never cached in a key cache.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isCompatibleKeyId(keyId) {
+	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
+}
+/**
+* Gets the canonical portable ID of an actor ID that is either an `ap:` or
+* `ap+ef61:` URI or a compatible identifier.
+* @returns The canonical portable ID, or `null` if the ID is neither, or is
+*          malformed.
+* @internal
+*/
+function getCanonicalPortableId(id) {
+	try {
+		if (isPortableUri(id)) return canonicalizePortableUri(formatIri(id));
+		const portable = fromCompatibleEf61Id(id);
+		if (portable == null) return null;
+		return canonicalizePortableUri(formatIri(portable));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Builds the base of the key IDs of a gateway's keys for a portable actor:
+* the actor's compatible identifier on the gateway.
+* @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
+*                or a compatible identifier.  It must not have a fragment.
+* @param gateway The gateway's origin, e.g., `https://example.com`.
+* @returns The compatible identifier without query and fragment.
+* @throws {TypeError} If the actor ID is not a portable ID, or has
+*                     a fragment.
+* @internal
+*/
+function getGatewayKeyBase(actorId, gateway) {
+	let portable;
+	if (isPortableUri(actorId)) portable = actorId;
+	else try {
+		portable = fromCompatibleEf61Id(actorId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		portable = null;
+	}
+	if (portable == null) throw new TypeError(`The portable actor ID ${actorId.href} must be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier.`);
+	if (portable.hash !== "") throw new TypeError(`The portable actor ID ${actorId.href} must not have a fragment.`);
+	const base = toCompatibleEf61Id(portable, gateway);
+	base.search = "";
+	base.hash = "";
+	return base;
+}
+/**
+* Tells whether a parsed document is a portable actor, i.e., an actor whose
+* ID is an `ap:` or `ap+ef61:` URI or a compatible identifier.  Such an actor
+* is never authenticated by the web origin that served it; at a compatible
+* key ID, it makes the key a gateway key that only
+* {@link verifyPortableGatewayKeyDocument} can vouch for.
+* @internal
+*/
+function isPortableActorDocument(object) {
+	return isActor(object) && object.id != null && isPortableId(object.id);
+}
+/**
+* Compares two public keys by their key material.
+* @internal
+*/
+async function isSamePublicKey(a, b) {
+	if (a.algorithm.name !== b.algorithm.name) return false;
+	const [x, y] = await Promise.all([crypto.subtle.exportKey("jwk", a), crypto.subtle.exportKey("jwk", b)]);
+	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
+}
+//#endregion
+export { isCompatibleKeyId as a, isPortableUri as c, hasPortableActor as i, isSamePublicKey as l, getGatewayKeyBase as n, isPortableActorDocument as o, getPortableDid as r, isPortableId as s, getCanonicalPortableId as t };