@fedify/fedify 2.4.0-dev.2084 → 2.4.0-dev.2099

package/dist/{proof-ozG4HfcQ.mjs → proof-ChjBwnep.mjs}

@@ -1,16 +1,17 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-Beod6tzO.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-BJrp524f.mjs";
+import { n as version, t as name } from "./deno-dxdvl2XZ.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-BP3vdBpb.mjs";
+import { r as getPortableDid, s as isPortableId } from "./portable-key-id-Bva5iT3W.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-DYfmjnmp.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { c as getNormalizationContextLoader } from "./ld-BmFz5NLA.mjs";
+import { c as getNormalizationContextLoader } from "./ld-B00wWHzc.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
-import { encodeMultibase, formatIri, getDocumentLoader, getFe34Origin, haveSameFe34Origin, parseIri } from "@fedify/vocab-runtime";
+import { encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseIri } from "@fedify/vocab-runtime";
 import { encodeHex } from "byte-encodings/hex";
 import { isPlainJsonTree, retainSignedRepresentation } from "@fedify/vocab-runtime/internal/signed-representation";
 import jsonld from "@fedify/vocab-runtime/jsonld";
@@ -736,8 +737,37 @@ async function expandPortableObjectRoot(jsonLd, contextLoader) {
 		}
 	};
 }
+/**
+* Gets the DID of a portable object ID, which is either an `ap:` or
+* `ap+ef61:` URI or an FEP-ef61 compatible identifier.
+* @throws {TypeError} If the ID is malformed.
+*/
+function getObjectDid(id) {
+	try {
+		parseIri(id);
+		if (PORTABLE_OBJECT_ID_PATTERN.test(id)) return getFe34Origin(id);
+		const portableId = fromCompatibleEf61Id(id);
+		if (portableId != null) return getFe34Origin(portableId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		throw new InvalidPortableObjectIdError(id, { cause: error });
+	}
+	throw new InvalidPortableObjectIdError(id);
+}
+/**
+* The error thrown when a document's ID looks portable, i.e., it is an `ap:`
+* or `ap+ef61:` URI or looks like an FEP-ef61 compatible identifier, but is
+* malformed.
+* @internal
+*/
+var InvalidPortableObjectIdError = class extends TypeError {
+	constructor(id, options) {
+		super(`Invalid portable object ID: ${id}`, options);
+		this.name = "InvalidPortableObjectIdError";
+	}
+};
 async function preparePortableObjectProof(jsonLd, options) {
-	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !PORTABLE_OBJECT_ID_PATTERN.test(jsonLd["@id"])) return {
+	if (isJsonLdNode(jsonLd) && typeof jsonLd["@id"] === "string" && !isPortableId(jsonLd["@id"])) return {
 		prepared: false,
 		result: {
 			verified: false,
@@ -746,15 +776,15 @@ async function preparePortableObjectProof(jsonLd, options) {
 	};
 	const { root, proofContextLoader } = await expandPortableObjectRoot(jsonLd, options.contextLoader);
 	const id = root["@id"];
-	if (typeof id !== "string" || !PORTABLE_OBJECT_ID_PATTERN.test(id)) return {
+	if (typeof id !== "string" || !isPortableId(id)) return {
 		prepared: false,
 		result: {
 			verified: false,
 			reason: { type: "notPortableObject" }
 		}
 	};
+	const objectDid = getObjectDid(id);
 	const objectId = parseIri(id);
-	getFe34Origin(objectId);
 	const objectType = classifyFep2277CoreType(root);
 	if (objectType === "verificationMethod" || objectType === "publicKey" || objectType === "link") return {
 		prepared: false,
@@ -859,7 +889,7 @@ async function preparePortableObjectProof(jsonLd, options) {
 				}
 			};
 		}
-		if (!haveSameFe34Origin(objectId, verificationMethod)) return {
+		if (getFe34Origin(verificationMethod) !== objectDid) return {
 			prepared: false,
 			result: {
 				verified: false,
@@ -918,15 +948,24 @@ async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
 * collection without a proof is reported separately so a caller can apply a
 * gateway trust policy.  Embedded portable objects are not traversed.
 *
+* A portable object is a document whose ID is an `ap:` or `ap+ef61:` URI, or
+* an [FEP-ef61] compatible identifier such as
+* `https://gw.example/.well-known/apgateway/did:key:z6Mk…/actor`, which
+* stands for the portable ID `ap+ef61://did:key:z6Mk…/actor`.
+*
 * Every proof must use a DID URL whose DID matches the portable object's
-* authority, and every proof must pass {@link verifyProof}.
+* authority, i.e., the DID of its canonical portable ID, and every proof must
+* pass {@link verifyProof}.  The proofs are verified over the document as
+* given; a compatible identifier is never rewritten into a portable ID.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 *
 * @param jsonLd The JSON-LD document to verify.
 * @param options Additional options.  See also
 *                {@link VerifyPortableObjectProofOptions}.
 * @returns The detailed portable proof-policy result.
 * @throws {TypeError} If the input is not a single JSON-LD object or has a
-*                     malformed portable ID.
+*                     malformed portable ID or compatible identifier.
 * @since 2.4.0
 */
 async function verifyPortableObjectProof(jsonLd, options = {}) {
@@ -1026,7 +1065,7 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	};
 	const proofDocumentLoader = async (url, loaderOptions) => {
 		const remoteDocument = await baseDocumentLoader(url, loaderOptions);
-		if (PORTABLE_OBJECT_ID_PATTERN.test(url)) loadedPortableProofs++;
+		if (isPortableId(url)) loadedPortableProofs++;
 		const reference = normalizeDocumentUrl(url);
 		const candidateIndex = rawProofCandidates.findIndex((candidate, index) => !hydratedCandidates.has(index) && !rawProofCandidatePool.used.has(index) && candidate.reference === reference);
 		if (candidateIndex >= 0) {
@@ -1076,14 +1115,16 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	return object;
 }
 function deleteAuthenticatedAttribution(attributions, controllerId, verificationMethodId) {
-	const controllerHasCryptographicOrigin = hasCryptographicOrigin(controllerId.href);
-	const verificationMethodMatchesController = controllerHasCryptographicOrigin && hasCryptographicOrigin(verificationMethodId.href) && haveSameFe34Origin(controllerId, verificationMethodId);
-	if (!controllerHasCryptographicOrigin || verificationMethodMatchesController) attributions.delete(controllerId.href);
-	if (!verificationMethodMatchesController) return;
-	for (const attribution of [...attributions]) if (hasCryptographicOrigin(attribution) && haveSameFe34Origin(controllerId, attribution)) attributions.delete(attribution);
+	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) {
+		attributions.delete(controllerId.href);
+		return;
+	}
+	const did = getPortableDid(controllerId);
+	if (did == null || !hasCryptographicOrigin(verificationMethodId.href) || getPortableDid(verificationMethodId) !== did) return;
+	for (const attribution of [...attributions]) if ((hasCryptographicOrigin(attribution) || isPortableId(attribution)) && getPortableDid(attribution) === did) attributions.delete(attribution);
 }
 function hasCryptographicOrigin(iri) {
 	return /^did:/i.test(iri) || /^ap(?:\+ef61)?:\/\//i.test(iri);
 }
 //#endregion
-export { verifyObject as a, verifyPortableObjectProofWithRoot as c, verifyMapLocalProof as i, verifyProof as l, hasProofLike as n, verifyPortableObjectProof as o, signObject as r, verifyPortableObjectProofPolicy as s, createProof as t };
+export { verifyMapLocalProof as a, verifyPortableObjectProofPolicy as c, signObject as i, verifyPortableObjectProofWithRoot as l, createProof as n, verifyObject as o, hasProofLike as r, verifyPortableObjectProof as s, InvalidPortableObjectIdError as t, verifyProof as u };

package/dist/{send-ClPt8nYu.mjs → send-yFX0E-ye.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-Beod6tzO.mjs";
-import { n as doubleKnock } from "./http-B0VRNipE.mjs";
+import { n as version, t as name } from "./deno-dxdvl2XZ.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-BP3vdBpb.mjs";
+import { n as doubleKnock } from "./http-DsgawTd8.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/sig/compound-proof-discovery.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-B6Aj2kGY.mjs";
+import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-X3SxXVbc.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-discovery.test.ts

package/dist/sig/compound-proof-producer.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-B6Aj2kGY.mjs";
+import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-X3SxXVbc.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-producer.test.ts
 const portableId = "ap+ef61://did:key:z6MkAlice/objects/1";

package/dist/sig/compound-proof-verification.test.mjs

@@ -4,12 +4,14 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { i as verifyMapLocalProof, s as verifyPortableObjectProofPolicy } from "../proof-ozG4HfcQ.mjs";
-import { a as verifyCompoundPortableObjectProofs, o as verifyCompoundProofDocuments } from "../compound-proof-B6Aj2kGY.mjs";
+import { a as verifyMapLocalProof, c as verifyPortableObjectProofPolicy } from "../proof-ChjBwnep.mjs";
+import { n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-X3SxXVbc.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
+import { CryptographicKey, Multikey, Person } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
-import { encodeMultibase } from "@fedify/vocab-runtime";
+import { encodeMultibase, exportDidKey, parseIri } from "@fedify/vocab-runtime";
 import serialize from "json-canon";
 //#region src/sig/compound-proof-verification.test.ts
 const limits = {
@@ -461,5 +463,160 @@ test("verifyCompoundPortableObjectProofs() reports the policy-validated ID", asy
 	assertEquals(result.portableObjects.length, 1);
 	assertEquals(result.portableObjects[0].id, map_local_create_note_default.documents.innerUnsecuredDocument.id);
 });
+const compatibleDid = await exportDidKey(ed25519PublicKey.publicKey);
+const compatibleVerificationMethod = `${compatibleDid}#${compatibleDid.slice(8)}`;
+const compatibleActorId = `https://gw.example/.well-known/apgateway/${compatibleDid}/actor`;
+const compatibleContext = ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"];
+async function signCompatible(document) {
+	return await secureRawDocument(document, await crypto.subtle.exportKey("jwk", ed25519PrivateKey), compatibleVerificationMethod);
+}
+async function compatibleActor(id = compatibleActorId, keyBase = compatibleActorId) {
+	const actorId = parseIri(id);
+	return await new Person({
+		id: actorId,
+		inbox: new URL(`${keyBase}/inbox`),
+		outbox: new URL(`${keyBase}/outbox`),
+		gateways: [new URL("https://gw.example")],
+		publicKey: new CryptographicKey({
+			id: new URL(`${keyBase}#main-key`),
+			owner: actorId,
+			publicKey: rsaPublicKey2.publicKey
+		}),
+		assertionMethods: [new Multikey({
+			id: new URL(`${keyBase}#ed25519-key`),
+			controller: actorId,
+			publicKey: ed25519PublicKey.publicKey
+		})]
+	}).toJsonLd({
+		format: "compact",
+		contextLoader: mockDocumentLoader
+	});
+}
+test("verifyCompoundPortableObjectProofs() treats compatible-ID maps as portable", async () => {
+	const note = {
+		"@context": [...compatibleContext],
+		id: `${compatibleActorId}/notes/1`,
+		type: "Note",
+		attributedTo: compatibleActorId,
+		content: "Hello"
+	};
+	const ordinary = {
+		"@context": [...compatibleContext],
+		id: "https://social.example/activities/1",
+		type: "Announce",
+		actor: "https://social.example/users/bob",
+		object: note
+	};
+	assertEquals(inspectCompoundPortableObjectApplicability(ordinary, limits), "present");
+	assert(containsCompoundPortableObject(ordinary));
+	const result = await verifyCompoundPortableObjectProofs(ordinary, limits, options);
+	assert(result.status === "ok");
+	assertEquals(result.verified, false);
+	assertEquals(result.portableObjects.map((o) => [o.path, o.verified]), [["/object", false]]);
+	const signed = await verifyCompoundPortableObjectProofs({
+		...ordinary,
+		object: await signCompatible(note)
+	}, limits, options);
+	assert(signed.status === "ok");
+	assert(signed.verified);
+});
+test("verifyCompoundPortableObjectProofs() checks compatible activity IDs", async () => {
+	const create = (did) => ({
+		"@context": [...compatibleContext],
+		id: `https://gw.example/.well-known/apgateway/${did}/activities/1`,
+		type: "Create",
+		actor: compatibleActorId,
+		object: "https://social.example/notes/1"
+	});
+	const own = await verifyCompoundPortableObjectProofs(await signCompatible(create(compatibleDid)), limits, options);
+	assert(own.status === "ok");
+	assert(own.verified);
+	const forged = await verifyCompoundPortableObjectProofs(await signCompatible(create("did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK")), limits, options);
+	assert(forged.status === "ok");
+	assertEquals(forged.verified, false);
+	const [object] = forged.portableObjects;
+	assert(!object.verified);
+	assertEquals(object.reason.type, "verificationMethodMismatch");
+});
+test("verifyCompoundPortableObjectProofs() exempts keys embedded in portable actors", async () => {
+	let result = await verifyCompoundPortableObjectProofs(await signCompatible(await compatibleActor()), limits, options);
+	assert(result.status === "ok");
+	assert(result.verified);
+	assertEquals(result.portableObjects.map((o) => o.path), [""]);
+	result = await verifyCompoundPortableObjectProofs(await signCompatible(await compatibleActor(`ap://${compatibleDid}/actor`)), limits, options);
+	assert(result.status === "ok");
+	assert(result.verified);
+	result = await verifyCompoundPortableObjectProofs({
+		"@context": [...compatibleContext],
+		id: "https://social.example/activities/2",
+		type: "Update",
+		actor: "https://social.example/users/bob",
+		object: await signCompatible(await compatibleActor())
+	}, limits, options);
+	assert(result.status === "ok");
+	assert(result.verified);
+});
+test("verifyCompoundPortableObjectProofs() exempts only keys of the parent itself", async () => {
+	const actor = await compatibleActor();
+	const otherActorId = "https://gw.example/.well-known/apgateway/did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK/actor";
+	const publicKey = actor.publicKey;
+	const cases = {
+		"a key of another actor": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				id: `${otherActorId}#main-key`,
+				owner: otherActorId
+			}
+		},
+		"a key owned by another actor": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				owner: otherActorId
+			}
+		},
+		"a non-key object": {
+			...actor,
+			publicKey: {
+				id: `${compatibleActorId}#note`,
+				type: "Note",
+				content: "Not a key"
+			}
+		},
+		"a key with extra content": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				name: "Extra"
+			}
+		},
+		"a key under another property": {
+			...actor,
+			attachment: structuredClone(publicKey)
+		},
+		"a parent context with a keyword alias": {
+			...actor,
+			"@context": [...actor["@context"], { kind: "@type" }]
+		},
+		"a key with a scoped context": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				"@context": { CryptographicKey: {
+					"@id": "https://w3id.org/security#Key",
+					"@context": {}
+				} }
+			}
+		}
+	};
+	for (const [name, document] of Object.entries(cases)) {
+		const result = await verifyCompoundPortableObjectProofs(await signCompatible(document), limits, options);
+		assert(result.status === "ok", name);
+		assertEquals(result.verified, false, name);
+		assert(result.portableObjects.find((o) => o.path === "")?.verified, name);
+		assert(result.portableObjects.some((o) => o.path !== "" && !o.verified), name);
+	}
+});
 //#endregion
 export {};

package/dist/sig/compound-proof.test.mjs

@@ -6,9 +6,9 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { l as verifyProof, r as signObject } from "../proof-ozG4HfcQ.mjs";
+import { i as signObject, u as verifyProof } from "../proof-ChjBwnep.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { o as verifyCompoundProofDocuments } from "../compound-proof-B6Aj2kGY.mjs";
+import { o as verifyCompoundProofDocuments } from "../compound-proof-X3SxXVbc.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";

package/dist/sig/http.test.mjs

@@ -11,8 +11,8 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { t as exportJwk } from "../key-BJrp524f.mjs";
-import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-B0VRNipE.mjs";
+import { t as exportJwk } from "../key-DYfmjnmp.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-DsgawTd8.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";
@@ -2098,5 +2098,75 @@ test("doubleKnock(): Accept-Signature with multiple compatible entries fulfills
 	assertEquals(requestCount, 2);
 	esm_default.hardReset();
 });
+test("listRequestSignatures()", async (t) => {
+	const request = () => new Request("https://example.com/inbox", {
+		method: "POST",
+		body: "Test message"
+	});
+	await t.step("draft-cavage", async () => {
+		const signed = await signRequest(request(), rsaPrivateKey2, rsaPublicKey2.id);
+		const signatures = listRequestSignatures(signed);
+		assertEquals(signatures.map((s) => [s.keyId.href, s.label]), [[rsaPublicKey2.id.href, null]]);
+		const components = signatures[0].components;
+		assertEquals(components.map((c) => c.value), signed.headers.get("Signature").match(/headers="([^"]*)"/)[1].split(" "));
+		assert(components.every((c) => Object.keys(c.params).length < 1));
+	});
+	await t.step("RFC 9421", async () => {
+		const signatures = listRequestSignatures(await signRequest(request(), rsaPrivateKey2, rsaPublicKey2.id, {
+			spec: "rfc9421",
+			rfc9421: { label: "a" }
+		}));
+		assertEquals(signatures.map((s) => [s.keyId.href, s.label]), [[rsaPublicKey2.id.href, "a"]]);
+		assertEquals(signatures[0].components.map((c) => c.value), [
+			"@method",
+			"@target-uri",
+			"@authority",
+			"host",
+			"date",
+			"content-digest"
+		]);
+	});
+	await t.step("unsigned or malformed", () => {
+		assertEquals(listRequestSignatures(request()), []);
+		const malformed = request();
+		malformed.headers.set("Signature", "keyId=\"not a URL\",signature=\"AA==\"");
+		assertEquals(listRequestSignatures(malformed), []);
+		const garbage = request();
+		garbage.headers.set("Signature-Input", "((");
+		garbage.headers.set("Signature", "((");
+		assertEquals(listRequestSignatures(garbage), []);
+	});
+});
+test("selectRequestSignature()", async () => {
+	const body = "Test message";
+	const sign = (label, keyId) => signRequest(new Request("https://example.com/inbox", {
+		method: "POST",
+		body
+	}), rsaPrivateKey2, keyId, {
+		spec: "rfc9421",
+		rfc9421: { label }
+	});
+	const first = await sign("a", new URL("https://example.com/other#key"));
+	const second = await sign("b", rsaPublicKey2.id);
+	const headers = new Headers(second.headers);
+	for (const name of ["Signature-Input", "Signature"]) headers.set(name, `${first.headers.get(name)}, ${second.headers.get(name)}`);
+	const request = new Request(second.url, {
+		method: "POST",
+		headers,
+		body
+	});
+	const signatures = listRequestSignatures(request);
+	assertEquals(signatures.map((s) => s.label), ["a", "b"]);
+	const selected = selectRequestSignature(request, signatures[1]);
+	assertEquals(listRequestSignatures(selected).map((s) => [s.label, s.keyId.href]), [["b", rsaPublicKey2.id.href]]);
+	const result = await verifyRequestDetailed(selected, {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	assert(result.verified);
+	assertEquals(result.key.id, rsaPublicKey2.id);
+	assertEquals(await selected.text(), body);
+	assertEquals(await request.text(), body);
+});
 //#endregion
 export {};

package/dist/sig/key.test.mjs

@@ -6,7 +6,7 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as generateCryptoKeyPair, i as fetchKeyDetailed, o as importJwk, r as fetchKey, s as validateCryptoKey, t as exportJwk } from "../key-BJrp524f.mjs";
+import { a as generateCryptoKeyPair, i as fetchKeyDetailed, o as importJwk, r as fetchKey, s as validateCryptoKey, t as exportJwk } from "../key-DYfmjnmp.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/ld.test.mjs

@@ -8,8 +8,8 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as generateCryptoKeyPair } from "../key-BJrp524f.mjs";
-import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-BmFz5NLA.mjs";
+import { a as generateCryptoKeyPair } from "../key-DYfmjnmp.mjs";
+import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-B00wWHzc.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/mod.cjs

@@ -1,8 +1,8 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-B5q1CHtL.cjs");
-const require_owner = require("../owner-BQFZtFV4.cjs");
-const require_sig = require("../sig-k3C8sF7g.cjs");
+const require_http = require("../http-C8cZTE3Y.cjs");
+const require_owner = require("../owner-DSzH7wro.cjs");
+const require_sig = require("../sig-B689Nj7y.cjs");
 exports.attachSignature = require_http.attachSignature;
 exports.createProof = require_http.createProof;
 exports.createSignature = require_http.createSignature;

package/dist/sig/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
 import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-xlG-jRdB.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BF0L9cMt.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-HDSvS-ww.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-C8LieBzF.cjs";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
 import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-n2v6DPxu.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BSzr5-I8.js";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-C9WSpZWm.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-Coacostr.js";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { A as verifySignature, D as signJsonLd, F as fetchKeyDetailed, I as generateCryptoKeyPair, L as importJwk, M as exportJwk, P as fetchKey, a as verifyRequestDetailed, b as createSignature, c as hasProofLike, d as verifyObject, dt as fulfillAcceptSignature, f as verifyPortableObjectProof, ft as parseAcceptSignature, h as verifyProof, i as verifyRequest, k as verifyJsonLd, l as signObject, pt as validateAcceptSignature, r as signRequest, s as createProof, ut as formatAcceptSignature, v as attachSignature, w as hasSignatureLike, x as detachSignature } from "../http-4PCCvhsU.js";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-_pbbgLJK.js";
-import { t as verifyPortableObject } from "../sig-DhdomAN0.js";
+import { B as generateCryptoKeyPair, I as exportJwk, N as verifyJsonLd, O as hasSignatureLike, P as verifySignature, R as fetchKey, S as attachSignature, T as detachSignature, V as importJwk, a as signRequest, ct as formatAcceptSignature, d as hasProofLike, dt as validateAcceptSignature, f as signObject, h as verifyPortableObjectProof, j as signJsonLd, lt as fulfillAcceptSignature, m as verifyObject, o as verifyRequest, s as verifyRequestDetailed, u as createProof, ut as parseAcceptSignature, v as verifyProof, w as createSignature, z as fetchKeyDetailed } from "../http-D-rbr_Sy.js";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-U12fDpQW.js";
+import { t as verifyPortableObject } from "../sig-C85KqAcx.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-CsKVgMzk.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-BJPDRDRq.mjs";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/owner.test.ts