@fedify/fedify 2.4.0-dev.2084 → 2.4.0-dev.2093

package/dist/{owner-_pbbgLJK.js → owner-DAGSC5gX.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { B as getCanonicalPortableId, G as isSamePublicKey$1, M as exportJwk, N as fetchActorDocument, U as isCompatibleKeyId, ht as version, mt as name, o as fetchPortableGatewayKey, z as verifyKeyOwnership } from "./http-4PCCvhsU.js";
+import { F as fetchActorDocument, P as exportJwk, V as verifyKeyOwnership, _t as isSamePublicKey$1, ht as isPortableId, mt as isCompatibleKeyId, o as fetchPortableGatewayKey, ut as getCanonicalPortableId, vt as name, yt as version } from "./http-DyT7DP1Y.js";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
@@ -173,7 +173,7 @@ async function getKeyOwner(keyId, options) {
 		return await verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
 	}
 	if (!isActor(object)) return null;
-	if (object.id == null || object.id.origin !== documentUrl.origin) {
+	if (object.id == null || isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
 		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
 			documentUrl: documentUrl.href,
 			actorId: object.id?.href,

package/dist/{owner-BQFZtFV4.cjs → owner-szIZl4qI.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-B5q1CHtL.cjs");
+const require_http = require("./http-DSaSAN7X.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
@@ -172,7 +172,7 @@ async function getKeyOwner(keyId, options) {
 		return await require_http.verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
 	}
 	if (!(0, _fedify_vocab.isActor)(object)) return null;
-	if (object.id == null || object.id.origin !== documentUrl.origin) {
+	if (object.id == null || require_http.isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
 		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
 			documentUrl: documentUrl.href,
 			actorId: object.id?.href,

package/dist/{portable-key-B4R-CiIV.mjs → portable-key-Cn1WJSN1.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { h as isSamePublicKey, l as getCanonicalPortableId, p as isPortableActorDocument } from "./key-BJrp524f.mjs";
-import { c as verifyPortableObjectProofWithRoot } from "./proof-ozG4HfcQ.mjs";
+import { l as isSamePublicKey, o as isPortableActorDocument, t as getCanonicalPortableId } from "./portable-key-id-Bva5iT3W.mjs";
+import { l as verifyPortableObjectProofWithRoot } from "./proof-DVXC6nYz.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { getDocumentLoader, isGatewayUrl } from "@fedify/vocab-runtime";
@@ -19,13 +19,19 @@ const SEC = "https://w3id.org/security#";
 *
 * A gateway key is accepted only if:
 *
-*  -  the document is an actor whose portable ID is the one the key ID is
-*     the compatible identifier of;
+*  -  the document is an actor whose portable ID, i.e., its `ap:` ID or
+*     the canonical portable ID of its compatible identifier, is the one
+*     the key ID is the compatible identifier of;
 *  -  the document has a valid [FEP-8b32] Object Integrity Proof made by
 *     the DID of its ID, i.e., it satisfies the [FEP-ef61] proof policy;
 *  -  the document embeds a `Multikey` with that ID in its `assertionMethod`,
-*     whose `controller` is the actor, as [FEP-521a] requires; a key
-*     embedded in its `publicKey` with the same ID must agree with it; and
+*     whose `controller` is the actor, as [FEP-521a] requires, and a key
+*     embedded in its `publicKey` with the same ID agrees with it; or, if
+*     no `assertionMethod` entry has that ID, the document embeds
+*     a `CryptographicKey` with that ID in its `publicKey`, whose `owner` is
+*     the actor, as some publishers, e.g., tootik, list their RSA keys only
+*     there;
+*  -  no more than one entry of either property has that ID; and
 *  -  the key ID's origin is one of the actor's `gateways`.
 *
 * [FEP-8b32]: https://w3id.org/fep/8b32
@@ -74,6 +80,21 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 	if (!result.verified) return reject("The actor document does not satisfy the FEP-ef61 proof policy: " + result.reason.type);
 	if (root == null) return reject("The actor document could not be expanded.");
 	const refuse = (url) => Promise.reject(/* @__PURE__ */ new Error(`Refusing to fetch ${url}.`));
+	const parseEmbeddedPublicKey = async (node) => {
+		if (isReference(node)) return null;
+		let key;
+		try {
+			key = await CryptographicKey.fromJsonLd(node, {
+				documentLoader: refuse,
+				contextLoader: options.contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			return null;
+		}
+		return key.publicKey == null ? null : key;
+	};
 	let verifiedActor;
 	try {
 		verifiedActor = await Object$1.fromJsonLd(root, {
@@ -87,41 +108,42 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 	}
 	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
 	actor = verifiedActor;
-	const multikeyNode = findEmbeddedNode(root[`${SEC}assertionMethod`], keyId);
-	if (multikeyNode == null) return reject("The actor document does not embed the key in its assertionMethod.");
-	let multikey;
-	try {
-		multikey = await Multikey.fromJsonLd(multikeyNode, {
-			documentLoader: refuse,
-			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider
-		});
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		return reject("The key in the assertionMethod is malformed.");
-	}
-	if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
-	if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
-	const publicKeyNode = findEmbeddedNode(root[`${SEC}publicKey`], keyId);
-	if (publicKeyNode != null) {
-		let publicKey;
+	const assertionNodes = findNodes(root[`${SEC}assertionMethod`], keyId);
+	const publicKeyNodes = findNodes(root[`${SEC}publicKey`], keyId);
+	if (assertionNodes.length > 1 || publicKeyNodes.length > 1) return reject("The actor document has more than one key with the ID.");
+	let publicKey;
+	if (assertionNodes.length > 0) {
+		if (isReference(assertionNodes[0])) return reject("The actor document does not embed the key in its assertionMethod.");
+		let multikey;
 		try {
-			publicKey = await CryptographicKey.fromJsonLd(publicKeyNode, {
+			multikey = await Multikey.fromJsonLd(assertionNodes[0], {
 				documentLoader: refuse,
 				contextLoader: options.contextLoader,
 				tracerProvider: options.tracerProvider
 			});
 		} catch (error) {
 			if (!(error instanceof TypeError)) throw error;
-			return reject("The key in the publicKey is malformed.");
+			return reject("The key in the assertionMethod is malformed.");
+		}
+		if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
+		if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
+		publicKey = multikey.publicKey;
+		if (publicKeyNodes.length > 0 && !isReference(publicKeyNodes[0])) {
+			const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
+			if (embedded == null || !await isSamePublicKey(embedded.publicKey, publicKey) || embedded.ownerId != null && getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
 		}
-		if (publicKey.publicKey == null || !await isSamePublicKey(publicKey.publicKey, multikey.publicKey) || publicKey.ownerId != null && getCanonicalPortableId(publicKey.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
+	} else {
+		if (publicKeyNodes.length < 1) return reject("The actor document embeds the key in neither its assertionMethod nor its publicKey.");
+		const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
+		if (embedded == null) return reject("The key in the publicKey is not embedded or malformed.");
+		if (embedded.ownerId == null || getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The owner of the key is not the actor.");
+		publicKey = embedded.publicKey;
 	}
 	if (!actor.gateways.some((gateway) => isGatewayUrl(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
 	const key = new CryptographicKey({
 		id: keyId,
 		owner: actor.id,
-		publicKey: multikey.publicKey
+		publicKey
 	});
 	return {
 		type: "verified",
@@ -171,24 +193,21 @@ async function fetchPortableGatewayKey(keyId, options = {}) {
 		contextLoader
 	});
 }
-function findEmbeddedNode(values, id) {
-	if (!Array.isArray(values)) return null;
+function findNodes(values, id) {
+	if (!Array.isArray(values)) return [];
+	const nodes = [];
 	for (const value of values) {
 		if (value == null || typeof value !== "object" || Array.isArray(value)) continue;
 		const node = value;
 		const nodeId = node["@id"];
-		if (typeof nodeId !== "string") continue;
-		let parsed;
-		try {
-			parsed = new URL(nodeId);
-		} catch {
-			continue;
-		}
-		if (parsed.href !== id.href) continue;
-		if (Object.keys(node).every((key) => key === "@id")) continue;
-		return node;
+		if (typeof nodeId !== "string" || !URL.canParse(nodeId)) continue;
+		if (new URL(nodeId).href === id.href) nodes.push(node);
 	}
-	return null;
+	return nodes;
+}
+/** A node with nothing but an `@id` is a reference, not an embedded key. */
+function isReference(node) {
+	return Object.keys(node).every((key) => key === "@id");
 }
 //#endregion
 export { verifyPortableGatewayKeyDocument as n, fetchPortableGatewayKey as t };

package/dist/portable-key-id-Bva5iT3W.mjs

@@ -0,0 +1,136 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { isActor } from "@fedify/vocab";
+import { canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getFe34Origin, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
+//#region src/sig/portable-key-id.ts
+const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+/**
+* Checks whether the URL is an `ap:` or `ap+ef61:` URI.
+* @internal
+*/
+function isPortableUri(url) {
+	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
+}
+/**
+* Checks whether an ID identifies an [FEP-ef61] portable object, i.e., it is
+* an `ap:` or `ap+ef61:` URI, or looks like a compatible identifier.
+* A malformed compatible identifier counts too, so that it is rejected as
+* a portable object that no proof can match, rather than trusted by its web
+* origin.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isPortableId(id) {
+	if (typeof id === "string") {
+		if (/^ap(?:\+ef61)?:\/\//i.test(id)) return true;
+	} else if (isPortableUri(id)) return true;
+	return isCompatibleEf61Iri(id);
+}
+/**
+* Gets the DID, i.e., the FEP-fe34 cryptographic origin, of an `ap:` or
+* `ap+ef61:` URI, a DID URL, or a compatible identifier.
+* @returns The DID, or `null` if the ID is none of them, or is malformed.
+* @internal
+*/
+function getPortableDid(id) {
+	try {
+		const raw = typeof id === "string" ? id : id.href;
+		if (/^(?:did:|ap(?:\+ef61)?:\/\/)/i.test(raw)) return getFe34Origin(id);
+		const portable = fromCompatibleEf61Id(id);
+		return portable == null ? null : getFe34Origin(portable);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Checks whether an activity is performed by an FEP-ef61 portable actor,
+* i.e., any of its actors has an `ap:` or `ap+ef61:` ID, or a compatible
+* identifier.
+* @internal
+*/
+function hasPortableActor(activity) {
+	return activity.actorIds.some((id) => isPortableId(id));
+}
+/**
+* Checks whether a key ID looks like an [FEP-ef61] compatible identifier,
+* i.e., an HTTP(S) URL under a gateway's `/.well-known/apgateway/did:` path.
+* Such a key ID names a key that a gateway holds for a portable actor, so it
+* is resolved only as a gateway key, and never cached in a key cache.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isCompatibleKeyId(keyId) {
+	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
+}
+/**
+* Gets the canonical portable ID of an actor ID that is either an `ap:` or
+* `ap+ef61:` URI or a compatible identifier.
+* @returns The canonical portable ID, or `null` if the ID is neither, or is
+*          malformed.
+* @internal
+*/
+function getCanonicalPortableId(id) {
+	try {
+		if (isPortableUri(id)) return canonicalizePortableUri(formatIri(id));
+		const portable = fromCompatibleEf61Id(id);
+		if (portable == null) return null;
+		return canonicalizePortableUri(formatIri(portable));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Builds the base of the key IDs of a gateway's keys for a portable actor:
+* the actor's compatible identifier on the gateway.
+* @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
+*                or a compatible identifier.  It must not have a fragment.
+* @param gateway The gateway's origin, e.g., `https://example.com`.
+* @returns The compatible identifier without query and fragment.
+* @throws {TypeError} If the actor ID is not a portable ID, or has
+*                     a fragment.
+* @internal
+*/
+function getGatewayKeyBase(actorId, gateway) {
+	let portable;
+	if (isPortableUri(actorId)) portable = actorId;
+	else try {
+		portable = fromCompatibleEf61Id(actorId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		portable = null;
+	}
+	if (portable == null) throw new TypeError(`The portable actor ID ${actorId.href} must be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier.`);
+	if (portable.hash !== "") throw new TypeError(`The portable actor ID ${actorId.href} must not have a fragment.`);
+	const base = toCompatibleEf61Id(portable, gateway);
+	base.search = "";
+	base.hash = "";
+	return base;
+}
+/**
+* Tells whether a parsed document is a portable actor, i.e., an actor whose
+* ID is an `ap:` or `ap+ef61:` URI or a compatible identifier.  Such an actor
+* is never authenticated by the web origin that served it; at a compatible
+* key ID, it makes the key a gateway key that only
+* {@link verifyPortableGatewayKeyDocument} can vouch for.
+* @internal
+*/
+function isPortableActorDocument(object) {
+	return isActor(object) && object.id != null && isPortableId(object.id);
+}
+/**
+* Compares two public keys by their key material.
+* @internal
+*/
+async function isSamePublicKey(a, b) {
+	if (a.algorithm.name !== b.algorithm.name) return false;
+	const [x, y] = await Promise.all([crypto.subtle.exportKey("jwk", a), crypto.subtle.exportKey("jwk", b)]);
+	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
+}
+//#endregion
+export { isCompatibleKeyId as a, isPortableUri as c, hasPortableActor as i, isSamePublicKey as l, getGatewayKeyBase as n, isPortableActorDocument as o, getPortableDid as r, isPortableId as s, getCanonicalPortableId as t };

package/dist/{proof-ozG4HfcQ.mjs → proof-DVXC6nYz.mjs}

@@ -1,16 +1,17 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-Beod6tzO.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-BJrp524f.mjs";
+import { n as version, t as name } from "./deno-8t8k_6Yv.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B7YwKTFr.mjs";
+import { r as getPortableDid, s as isPortableId } from "./portable-key-id-Bva5iT3W.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-Dwm4VswT.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { c as getNormalizationContextLoader } from "./ld-BmFz5NLA.mjs";
+import { c as getNormalizationContextLoader } from "./ld-BYZOoDzZ.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
-import { encodeMultibase, formatIri, getDocumentLoader, getFe34Origin, haveSameFe34Origin, parseIri } from "@fedify/vocab-runtime";
+import { encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseIri } from "@fedify/vocab-runtime";
 import { encodeHex } from "byte-encodings/hex";
 import { isPlainJsonTree, retainSignedRepresentation } from "@fedify/vocab-runtime/internal/signed-representation";
 import jsonld from "@fedify/vocab-runtime/jsonld";
@@ -736,8 +737,37 @@ async function expandPortableObjectRoot(jsonLd, contextLoader) {
 		}
 	};
 }
+/**
+* Gets the DID of a portable object ID, which is either an `ap:` or
+* `ap+ef61:` URI or an FEP-ef61 compatible identifier.
+* @throws {TypeError} If the ID is malformed.
+*/
+function getObjectDid(id) {
+	try {
+		parseIri(id);
+		if (PORTABLE_OBJECT_ID_PATTERN.test(id)) return getFe34Origin(id);
+		const portableId = fromCompatibleEf61Id(id);
+		if (portableId != null) return getFe34Origin(portableId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		throw new InvalidPortableObjectIdError(id, { cause: error });
+	}
+	throw new InvalidPortableObjectIdError(id);
+}
+/**
+* The error thrown when a document's ID looks portable, i.e., it is an `ap:`
+* or `ap+ef61:` URI or looks like an FEP-ef61 compatible identifier, but is
+* malformed.
+* @internal
+*/
+var InvalidPortableObjectIdError = class extends TypeError {
+	constructor(id, options) {
+		super(`Invalid portable object ID: ${id}`, options);
+		this.name = "InvalidPortableObjectIdError";
+	}
+};
 async function preparePortableObjectProof(jsonLd, options) {
-	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !PORTABLE_OBJECT_ID_PATTERN.test(jsonLd["@id"])) return {
+	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !isPortableId(jsonLd["@id"])) return {
 		prepared: false,
 		result: {
 			verified: false,
@@ -746,15 +776,15 @@ async function preparePortableObjectProof(jsonLd, options) {
 	};
 	const { root, proofContextLoader } = await expandPortableObjectRoot(jsonLd, options.contextLoader);
 	const id = root["@id"];
-	if (typeof id !== "string" || !PORTABLE_OBJECT_ID_PATTERN.test(id)) return {
+	if (typeof id !== "string" || !isPortableId(id)) return {
 		prepared: false,
 		result: {
 			verified: false,
 			reason: { type: "notPortableObject" }
 		}
 	};
+	const objectDid = getObjectDid(id);
 	const objectId = parseIri(id);
-	getFe34Origin(objectId);
 	const objectType = classifyFep2277CoreType(root);
 	if (objectType === "verificationMethod" || objectType === "publicKey" || objectType === "link") return {
 		prepared: false,
@@ -859,7 +889,7 @@ async function preparePortableObjectProof(jsonLd, options) {
 				}
 			};
 		}
-		if (!haveSameFe34Origin(objectId, verificationMethod)) return {
+		if (getFe34Origin(verificationMethod) !== objectDid) return {
 			prepared: false,
 			result: {
 				verified: false,
@@ -918,15 +948,24 @@ async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
 * collection without a proof is reported separately so a caller can apply a
 * gateway trust policy.  Embedded portable objects are not traversed.
 *
+* A portable object is a document whose ID is an `ap:` or `ap+ef61:` URI, or
+* an [FEP-ef61] compatible identifier such as
+* `https://gw.example/.well-known/apgateway/did:key:z6Mk…/actor`, which
+* stands for the portable ID `ap+ef61://did:key:z6Mk…/actor`.
+*
 * Every proof must use a DID URL whose DID matches the portable object's
-* authority, and every proof must pass {@link verifyProof}.
+* authority, i.e., the DID of its canonical portable ID, and every proof must
+* pass {@link verifyProof}.  The proofs are verified over the document as
+* given; a compatible identifier is never rewritten into a portable ID.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 *
 * @param jsonLd The JSON-LD document to verify.
 * @param options Additional options.  See also
 *                {@link VerifyPortableObjectProofOptions}.
 * @returns The detailed portable proof-policy result.
 * @throws {TypeError} If the input is not a single JSON-LD object or has a
-*                     malformed portable ID.
+*                     malformed portable ID or compatible identifier.
 * @since 2.4.0
 */
 async function verifyPortableObjectProof(jsonLd, options = {}) {
@@ -1026,7 +1065,7 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	};
 	const proofDocumentLoader = async (url, loaderOptions) => {
 		const remoteDocument = await baseDocumentLoader(url, loaderOptions);
-		if (PORTABLE_OBJECT_ID_PATTERN.test(url)) loadedPortableProofs++;
+		if (isPortableId(url)) loadedPortableProofs++;
 		const reference = normalizeDocumentUrl(url);
 		const candidateIndex = rawProofCandidates.findIndex((candidate, index) => !hydratedCandidates.has(index) && !rawProofCandidatePool.used.has(index) && candidate.reference === reference);
 		if (candidateIndex >= 0) {
@@ -1076,14 +1115,16 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	return object;
 }
 function deleteAuthenticatedAttribution(attributions, controllerId, verificationMethodId) {
-	const controllerHasCryptographicOrigin = hasCryptographicOrigin(controllerId.href);
-	const verificationMethodMatchesController = controllerHasCryptographicOrigin && hasCryptographicOrigin(verificationMethodId.href) && haveSameFe34Origin(controllerId, verificationMethodId);
-	if (!controllerHasCryptographicOrigin || verificationMethodMatchesController) attributions.delete(controllerId.href);
-	if (!verificationMethodMatchesController) return;
-	for (const attribution of [...attributions]) if (hasCryptographicOrigin(attribution) && haveSameFe34Origin(controllerId, attribution)) attributions.delete(attribution);
+	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) {
+		attributions.delete(controllerId.href);
+		return;
+	}
+	const did = getPortableDid(controllerId);
+	if (did == null || !hasCryptographicOrigin(verificationMethodId.href) || getPortableDid(verificationMethodId) !== did) return;
+	for (const attribution of [...attributions]) if ((hasCryptographicOrigin(attribution) || isPortableId(attribution)) && getPortableDid(attribution) === did) attributions.delete(attribution);
 }
 function hasCryptographicOrigin(iri) {
 	return /^did:/i.test(iri) || /^ap(?:\+ef61)?:\/\//i.test(iri);
 }
 //#endregion
-export { verifyObject as a, verifyPortableObjectProofWithRoot as c, verifyMapLocalProof as i, verifyProof as l, hasProofLike as n, verifyPortableObjectProof as o, signObject as r, verifyPortableObjectProofPolicy as s, createProof as t };
+export { verifyMapLocalProof as a, verifyPortableObjectProofPolicy as c, signObject as i, verifyPortableObjectProofWithRoot as l, createProof as n, verifyObject as o, hasProofLike as r, verifyPortableObjectProof as s, InvalidPortableObjectIdError as t, verifyProof as u };

package/dist/{send-ClPt8nYu.mjs → send-D-hOvYKy.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-Beod6tzO.mjs";
-import { n as doubleKnock } from "./http-B0VRNipE.mjs";
+import { n as version, t as name } from "./deno-8t8k_6Yv.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-B7YwKTFr.mjs";
+import { n as doubleKnock } from "./http-B2ftY0Ha.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/sig/compound-proof-discovery.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-B6Aj2kGY.mjs";
+import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-CTx_lewQ.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-discovery.test.ts

package/dist/sig/compound-proof-producer.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-B6Aj2kGY.mjs";
+import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-CTx_lewQ.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-producer.test.ts
 const portableId = "ap+ef61://did:key:z6MkAlice/objects/1";