@fedify/fedify 2.4.0-dev.2103 → 2.4.0-dev.2115

package/dist/sig/portable-key.test.mjs

@@ -1,11 +1,15 @@
-import "temporal-polyfill";
+import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { r as fetchKey } from "../key-I8gLBkcf.mjs";
-import { d as verifyRequest, l as signRequest } from "../http-BU-8fUrz.mjs";
-import { c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-BJp47LxN.mjs";
-import { Create, CryptographicKey, Multikey, Person } from "@fedify/vocab";
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
+import { i as fetchKey } from "../key-CkNxztNV.mjs";
+import { h as verifyJsonLd, p as signJsonLd } from "../ld-CnT0f1nU.mjs";
+import { n as createProof, u as verifyProof } from "../proof-xdPYGPaA.mjs";
+import { d as verifyRequest, f as verifyRequestDetailed, l as signRequest } from "../http-BcLnr2do.mjs";
+import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-9LiHmOv1.mjs";
+import { t as KvKeyCache } from "../keycache-BInaECGj.mjs";
+import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 import { FetchError, encodeMultibase, exportDidKey, exportSpki, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
 import serialize from "json-canon";
@@ -46,14 +50,15 @@ function createLoader(responses) {
 	};
 	return Object.assign(loader, { fetched });
 }
-async function sign(document, privateKey = ed25519PrivateKey, verificationMethod = didKeyId) {
+async function sign(document, privateKey = ed25519PrivateKey, verificationMethod = didKeyId, proofOptions = {}) {
 	const proofConfig = {
 		"@context": document["@context"],
 		type: "DataIntegrityProof",
 		cryptosuite: "eddsa-jcs-2022",
 		verificationMethod,
 		proofPurpose: "assertionMethod",
-		created: "2023-02-24T23:36:38Z"
+		created: "2023-02-24T23:36:38Z",
+		...proofOptions
 	};
 	const encoder = new TextEncoder();
 	const proofDigest = await crypto.subtle.digest("SHA-256", encoder.encode(serialize(proofConfig)));
@@ -333,32 +338,305 @@ test("keys at ordinary URLs cannot belong to portable actors", async () => {
 		keyCache
 	})).key, null);
 });
-test("gateway keys are neither cached nor accepted outside HTTP Signatures", async () => {
+const specs = ["draft-cavage-http-signatures-12", "rfc9421"];
+function fetchKeyOf(cls, options) {
+	return cls === CryptographicKey ? fetchKey(keyId, CryptographicKey, options) : fetchKey(keyId, Multikey, options);
+}
+function fetchCount(loader, url = keyId) {
+	const document = url.href.replace(/#.*$/, "");
+	return loader.fetched.filter((u) => u.replace(/#.*$/, "") === document).length;
+}
+test("verifyRequest() caches failures to fetch compatible key IDs", async () => {
+	const unreachable = {
+		"404 Not Found": createLoader({}),
+		"a network error": (url) => Promise.reject(/* @__PURE__ */ new TypeError(`${url}`))
+	};
+	for (const spec of specs) for (const [name, inner] of Object.entries(unreachable)) {
+		const fetched = [];
+		const documentLoader = Object.assign((url) => {
+			fetched.push(url);
+			return inner(url);
+		}, { fetched });
+		const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+		const options = {
+			documentLoader,
+			contextLoader,
+			keyCache,
+			spec
+		};
+		for (let i = 0; i < 3; i++) {
+			const result = await verifyRequestDetailed(await signedRequest(spec), options);
+			ok(!result.verified, `${spec}, ${name}`);
+			strictEqual(result.reason.type, "keyFetchError", `${spec}, ${name}`);
+		}
+		strictEqual(fetchCount(documentLoader), 1, `${spec}, ${name}`);
+		for (const cls of [CryptographicKey, Multikey]) {
+			const result = await fetchKeyOf(cls, options);
+			strictEqual(result.key, null);
+			ok(result.cached, `${spec}, ${name}, ${cls.name}`);
+		}
+		strictEqual(fetchCount(documentLoader), 1, `${spec}, ${name}`);
+	}
+});
+test("verifyRequest() caches gateway keys only for HTTP Signatures", async () => {
+	for (const spec of specs) {
+		const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await actorJson()) });
+		const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+		const options = {
+			documentLoader,
+			contextLoader,
+			keyCache,
+			spec
+		};
+		for (let i = 0; i < 3; i++) strictEqual((await verifyRequest(await signedRequest(spec), options))?.ownerId?.href, parseIri(actorId).href, spec);
+		strictEqual(fetchCount(documentLoader), 1, spec);
+		const document = {
+			"@context": "https://www.w3.org/ns/activitystreams",
+			type: "Create",
+			id: "https://gw1.example/activities/1",
+			actor: compatibleId(gw1)
+		};
+		const { signature } = await signJsonLd(document, rsaPrivateKey2, keyId, { contextLoader });
+		ok(!await verifyJsonLd({
+			...document,
+			signature
+		}, options), spec);
+		const note = new Note({
+			id: new URL("https://gw1.example/notes/1"),
+			attribution: new URL(compatibleId(gw1)),
+			content: "Hello"
+		});
+		const proof = await createProof(note, ed25519PrivateKey, keyId, { contextLoader });
+		strictEqual(await verifyProof(await note.toJsonLd({
+			format: "compact",
+			contextLoader
+		}), proof, options), null, spec);
+		for (const cls of [CryptographicKey, Multikey]) strictEqual((await fetchKeyOf(cls, options)).key, null, spec);
+		const fetched = fetchCount(documentLoader);
+		ok(await verifyRequest(await signedRequest(spec), options) != null, spec);
+		strictEqual(fetchCount(documentLoader), fetched, spec);
+	}
+});
+test("verifyRequest() is not rejected by other purposes' negative entries", async () => {
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await actorJson()) });
+	const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+	const options = {
+		documentLoader,
+		contextLoader,
+		keyCache
+	};
+	for (const cls of [CryptographicKey, Multikey]) strictEqual((await fetchKeyOf(cls, options)).key, null);
+	ok(await verifyRequest(await signedRequest(), options) != null);
+	const fetched = fetchCount(documentLoader);
+	for (const cls of [CryptographicKey, Multikey]) {
+		const result = await fetchKeyOf(cls, options);
+		strictEqual(result.key, null);
+		ok(result.cached);
+	}
+	strictEqual(fetchCount(documentLoader), fetched);
+});
+test("fetchKey() does not share negative entries of compatible key IDs across key classes", async () => {
+	const ownerId = new URL("https://gw1.example/users/bob");
+	const multikey = new Multikey({
+		id: keyId,
+		controller: ownerId,
+		publicKey: ed25519PublicKey.publicKey
+	});
+	const documentLoader = createLoader({
+		[compatibleId(gw1)]: await multikey.toJsonLd({ contextLoader }),
+		[ownerId.href]: await new Person({
+			id: ownerId,
+			assertionMethods: [multikey]
+		}).toJsonLd({ contextLoader })
+	});
+	const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+	const options = {
+		documentLoader,
+		contextLoader,
+		keyCache
+	};
+	strictEqual((await fetchKey(keyId, CryptographicKey, options)).key, null);
+	strictEqual(await verifyRequest(await signedRequest(), options), null);
+	const result = await fetchKey(keyId, Multikey, options);
+	strictEqual(result.key?.id?.href, keyId.href);
+	ok(!result.cached);
+	const cached = await fetchKey(keyId, Multikey, options);
+	strictEqual(cached.key?.id?.href, keyId.href);
+	ok(cached.cached);
+	const other = await fetchKey(keyId, CryptographicKey, options);
+	strictEqual(other.key, null);
+	ok(other.cached);
+});
+test("verifyRequest() caches rejected portable actor documents", async () => {
+	for (const spec of specs) {
+		const documentLoader = createLoader({ [compatibleId(gw1)]: await actorJson() });
+		const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+		const options = {
+			documentLoader,
+			contextLoader,
+			keyCache,
+			spec
+		};
+		for (let i = 0; i < 3; i++) {
+			const result = await verifyRequestDetailed(await signedRequest(spec), options);
+			ok(!result.verified, spec);
+			strictEqual(result.reason.type, "invalidSignature", spec);
+		}
+		strictEqual(fetchCount(documentLoader), 1, spec);
+	}
+});
+test("verifyRequest() refetches a cached gateway key that fails to verify", async () => {
+	for (const spec of specs) {
+		const responses = { [compatibleId(gw1)]: await sign(await actorJson()) };
+		const documentLoader = createLoader(responses);
+		const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+		const options = {
+			documentLoader,
+			contextLoader,
+			keyCache,
+			spec
+		};
+		ok(await verifyRequest(await signedRequest(spec), options) != null);
+		responses[compatibleId(gw1)] = await sign(await actorJson({
+			publicKey: rsaPublicKey3.publicKey,
+			assertionMethod: false
+		}));
+		const rotated = async () => await signRequest(new Request("https://recipient.example/inbox", {
+			method: "POST",
+			body: "{}",
+			headers: { "Content-Type": "application/activity+json" }
+		}), rsaPrivateKey3, keyId, { spec });
+		ok(await verifyRequest(await rotated(), options) != null, spec);
+		strictEqual(fetchCount(documentLoader), 2, spec);
+		ok(await verifyRequest(await rotated(), options) != null, spec);
+		strictEqual(fetchCount(documentLoader), 2, spec);
+	}
+});
+test("verifyRequest() drops a cached gateway key when its refetch fails", async () => {
+	for (const spec of specs) {
+		const responses = { [compatibleId(gw1)]: await sign(await actorJson()) };
+		const documentLoader = createLoader(responses);
+		const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+		const options = {
+			documentLoader,
+			contextLoader,
+			keyCache,
+			spec
+		};
+		ok(await verifyRequest(await signedRequest(spec), options) != null);
+		delete responses[compatibleId(gw1)];
+		const result = await verifyRequestDetailed(await signRequest(new Request("https://recipient.example/inbox", {
+			method: "POST",
+			body: "{}",
+			headers: { "Content-Type": "application/activity+json" }
+		}), rsaPrivateKey3, keyId, { spec }), options);
+		ok(!result.verified, spec);
+		strictEqual(result.reason.type, "keyFetchError", spec);
+		strictEqual(fetchCount(documentLoader), 2, spec);
+		const next = await verifyRequestDetailed(await signedRequest(spec), options);
+		ok(!next.verified, spec);
+		strictEqual(next.reason.type, "keyFetchError", spec);
+		strictEqual(fetchCount(documentLoader), 2, spec);
+	}
+});
+test("verifyRequest() does not trust a cached gateway key for longer than its proof", async () => {
+	let now = Temporal.Now.instant();
+	const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"], { now: () => now });
+	const expires = now.add({ minutes: 30 });
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await actorJson(), ed25519PrivateKey, didKeyId, { expires: expires.toString() }) });
+	const options = {
+		documentLoader,
+		contextLoader,
+		keyCache
+	};
+	ok(await verifyRequest(await signedRequest(), options) != null);
+	now = expires.subtract({ seconds: 1 });
+	ok(await verifyRequest(await signedRequest(), options) != null);
+	strictEqual(fetchCount(documentLoader), 1);
+	now = expires;
+	ok(await verifyRequest(await signedRequest(), options) != null);
+	strictEqual(fetchCount(documentLoader), 2);
+});
+test("verifyRequest() looks up a cached gateway key again after an hour", async () => {
+	let now = Temporal.Now.instant();
+	const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"], { now: () => now });
+	const responses = { [compatibleId(gw1)]: await sign(await actorJson()) };
+	const documentLoader = createLoader(responses);
+	const options = {
+		documentLoader,
+		contextLoader,
+		keyCache
+	};
+	const start = now;
+	ok(await verifyRequest(await signedRequest(), options) != null);
+	now = start.add({ minutes: 59 });
+	ok(await verifyRequest(await signedRequest(), options) != null);
+	strictEqual(fetchCount(documentLoader), 1);
+	responses[compatibleId(gw1)] = await sign(await actorJson({ gateways: [gw2] }));
+	now = start.add({ hours: 1 });
+	strictEqual(await verifyRequest(await signedRequest(), options), null);
+	strictEqual(fetchCount(documentLoader), 2);
+});
+test("verifyRequest() rejects and caches gateway keys of expired documents", async () => {
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await actorJson(), ed25519PrivateKey, didKeyId, { expires: "2000-01-01T00:00:00Z" }) });
+	const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+	const options = {
+		documentLoader,
+		contextLoader,
+		keyCache
+	};
+	strictEqual(await verifyRequest(await signedRequest(), options), null);
+	strictEqual(await verifyRequest(await signedRequest(), options), null);
+	strictEqual(fetchCount(documentLoader), 1);
+});
+test("verifyRequest() takes the expiration of a proof whatever its context", async () => {
+	let now = Temporal.Now.instant();
+	const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"], { now: () => now });
+	const expires = now.add({ minutes: 30 });
+	const actor = await actorJson();
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign({
+		...actor,
+		"@context": [...actor["@context"], { expires: "https://example.com/ns#notExpiration" }]
+	}, ed25519PrivateKey, didKeyId, { expires: expires.toString() }) });
+	const options = {
+		documentLoader,
+		contextLoader,
+		keyCache
+	};
+	ok(await verifyRequest(await signedRequest(), options) != null);
+	now = expires.subtract({ seconds: 1 });
+	ok(await verifyRequest(await signedRequest(), options) != null);
+	strictEqual(fetchCount(documentLoader), 1);
+	now = expires;
+	ok(await verifyRequest(await signedRequest(), options) != null);
+	strictEqual(fetchCount(documentLoader), 2);
+});
+test("a key cache without namespaces caches only fetch failures of compatible key IDs", async () => {
 	const calls = [];
+	const entries = /* @__PURE__ */ new Map();
 	const keyCache = {
 		get(id) {
 			calls.push(`get ${id.href}`);
-			return Promise.resolve(void 0);
+			return Promise.resolve(entries.get(id.href));
 		},
-		set(id) {
-			calls.push(`set ${id.href}`);
+		set(id, key) {
+			calls.push(`set ${id.href} ${key == null ? "null" : "key"}`);
+			entries.set(id.href, key);
 			return Promise.resolve();
 		}
 	};
-	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await actorJson()) });
-	ok(await verifyRequest(await signedRequest(), {
-		documentLoader,
-		contextLoader,
-		keyCache
-	}) != null);
-	const fetchOptions = {
-		documentLoader,
+	const options = {
+		documentLoader: createLoader({ [compatibleId(gw1)]: await sign(await actorJson()) }),
 		contextLoader,
 		keyCache
 	};
-	strictEqual((await fetchKey(keyId, CryptographicKey, fetchOptions)).key, null);
-	strictEqual((await fetchKey(keyId, Multikey, fetchOptions)).key, null);
-	deepStrictEqual(calls.filter((c) => c.includes(keyId.origin)), []);
+	ok(await verifyRequest(await signedRequest(), options) != null);
+	for (const cls of [CryptographicKey, Multikey]) strictEqual((await fetchKeyOf(cls, options)).key, null);
+	ok(await verifyRequest(await signedRequest(), options) != null);
+	deepStrictEqual(calls.filter((c) => c.startsWith("set ") && c.includes(keyId.origin)), []);
+	const unreachable = new URL(`${compatibleId(gw2)}#main-key`);
+	strictEqual((await fetchKey(unreachable, CryptographicKey, options)).key, null);
+	deepStrictEqual(calls.filter((c) => c.startsWith("set ") && c.includes(gw2)), [`set ${unreachable.href} null`]);
 });
 test("doesActorOwnKey() and getKeyOwner() resolve gateway keys to portable actors", async () => {
 	const options = {

package/dist/sig/proof.test.mjs

@@ -10,10 +10,10 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { i as signObject, n as createProof, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, u as verifyProof } from "../proof-BE4T5zF6.mjs";
-import { d as verifyRequest } from "../http-BU-8fUrz.mjs";
+import { i as signObject, n as createProof, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, u as verifyProof } from "../proof-xdPYGPaA.mjs";
+import { d as verifyRequest } from "../http-BcLnr2do.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-C1hAJnWc.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-Bby5g2iu.mjs";
 import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place, Translation } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";

package/dist/{sig-CRTRoouH.cjs → sig-Bj3fHnv0.cjs}

@@ -1,6 +1,6 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-Cala2Grs.cjs");
-require("./owner-DCt8W_Cv.cjs");
+const require_http = require("./http-B4mQvNcv.cjs");
+require("./owner-BtoMCv6Z.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");

package/dist/{sig-CJHdGk9w.js → sig-DN9pOglI.js}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { _ as verifyPortableObjectProofWithRoot, bt as name, h as verifyPortableObjectProof, xt as version } from "./http-tTlTeFa0.js";
-import "./owner-j5yrbXS1.js";
+import { _ as verifyPortableObjectProofWithRoot, bt as name, h as verifyPortableObjectProof, xt as version } from "./http-Ce6_Lf7k.js";
+import "./owner-Cb3ytrlq.js";
 import { getLogger } from "@logtape/logtape";
 import { CollectionPage, Object as Object$1, isActor } from "@fedify/vocab";
 import { trace } from "@opentelemetry/api";

package/dist/{temporal-CyDDbE4i.mjs → temporal-tAtwv6vX.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-wiJbqJHa.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CnT0f1nU.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/kv.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
-import { o as createFederation } from "../middleware-FnITXhtz.mjs";
+import { o as createFederation } from "../middleware-BpwKvOpU.mjs";
 //#region src/testing/kv.test.ts
 test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
 	const kv = new ManualClockKvStore();

package/dist/testing/mod.d.mts

@@ -387,14 +387,18 @@ type ActorAliasMapper<TContextData> = (context: RequestContext<TContextData>, re
   username: string;
 } | null>;
 /**
- * A callback that dispatches an object.
+ * A callback that dispatches an object or a {@link Tombstone}.
+ *
+ * Return a {@link Tombstone} if the object has been deleted; Fedify then
+ * responds with `410 Gone` and the serialized tombstone.  Return `null` if
+ * the object is not found.
  *
  * @template TContextData The context data to pass to the {@link Context}.
  * @template TObject The type of object to dispatch.
  * @template TParam The parameter names of the requested URL.
  * @since 0.7.0
  */
-type ObjectDispatcher<TContextData, TObject extends Object$1, TParam extends string> = (context: RequestContext<TContextData>, values: Record<TParam, string>) => TObject | null | Promise<TObject | null>;
+type ObjectDispatcher<TContextData, TObject extends Object$1, TParam extends string> = (context: RequestContext<TContextData>, values: Record<TParam, string>) => TObject | Tombstone | null | Promise<TObject | Tombstone | null>;
 /**
  * A callback that dispatches a collection.
  *
@@ -1525,7 +1529,9 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    *             based on URI Template
    *             ([RFC 6570](https://tools.ietf.org/html/rfc6570)).  The path
    *             must have one or more variables.
-   * @param dispatcher An object dispatcher callback to register.
+   * @param dispatcher An object dispatcher callback to register.  It may
+   *                   return an object, a `Tombstone` if the object has been
+   *                   deleted, or `null` if the object is not found.
    */
   setObjectDispatcher<TObject extends Object$1, TParam extends string>(cls: ConstructorWithTypeId<TObject>, path: `${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}`, dispatcher: ObjectDispatcher<TContextData, TObject, TParam>): ObjectCallbackSetters<TContextData, TObject, TParam>;
   /**
@@ -1539,7 +1545,9 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    *             based on URI Template
    *             ([RFC 6570](https://tools.ietf.org/html/rfc6570)).  The path
    *             must have one or more variables.
-   * @param dispatcher An object dispatcher callback to register.
+   * @param dispatcher An object dispatcher callback to register.  It may
+   *                   return an object, a `Tombstone` if the object has been
+   *                   deleted, or `null` if the object is not found.
    */
   setObjectDispatcher<TObject extends Object$1, TParam extends string>(cls: ConstructorWithTypeId<TObject>, path: `${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}`, dispatcher: ObjectDispatcher<TContextData, TObject, TParam>): ObjectCallbackSetters<TContextData, TObject, TParam>;
   /**
@@ -1553,7 +1561,9 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    *             based on URI Template
    *             ([RFC 6570](https://tools.ietf.org/html/rfc6570)).  The path
    *             must have one or more variables.
-   * @param dispatcher An object dispatcher callback to register.
+   * @param dispatcher An object dispatcher callback to register.  It may
+   *                   return an object, a `Tombstone` if the object has been
+   *                   deleted, or `null` if the object is not found.
    */
   setObjectDispatcher<TObject extends Object$1, TParam extends string>(cls: ConstructorWithTypeId<TObject>, path: `${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}`, dispatcher: ObjectDispatcher<TContextData, TObject, TParam>): ObjectCallbackSetters<TContextData, TObject, TParam>;
   /**
@@ -1567,7 +1577,9 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    *             based on URI Template
    *             ([RFC 6570](https://tools.ietf.org/html/rfc6570)).  The path
    *             must have one or more variables.
-   * @param dispatcher An object dispatcher callback to register.
+   * @param dispatcher An object dispatcher callback to register.  It may
+   *                   return an object, a `Tombstone` if the object has been
+   *                   deleted, or `null` if the object is not found.
    */
   setObjectDispatcher<TObject extends Object$1, TParam extends string>(cls: ConstructorWithTypeId<TObject>, path: `${string}${Rfc6570Expression<TParam>}${string}${Rfc6570Expression<TParam>}${string}${Rfc6570Expression<TParam>}${string}`, dispatcher: ObjectDispatcher<TContextData, TObject, TParam>): ObjectCallbackSetters<TContextData, TObject, TParam>;
   /**
@@ -1581,7 +1593,9 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    *             based on URI Template
    *             ([RFC 6570](https://tools.ietf.org/html/rfc6570)).  The path
    *             must have one or more variables.
-   * @param dispatcher An object dispatcher callback to register.
+   * @param dispatcher An object dispatcher callback to register.  It may
+   *                   return an object, a `Tombstone` if the object has been
+   *                   deleted, or `null` if the object is not found.
    */
   setObjectDispatcher<TObject extends Object$1, TParam extends string>(cls: ConstructorWithTypeId<TObject>, path: `${string}${Rfc6570Expression<TParam>}${string}${Rfc6570Expression<TParam>}${string}`, dispatcher: ObjectDispatcher<TContextData, TObject, TParam>): ObjectCallbackSetters<TContextData, TObject, TParam>;
   /**
@@ -1595,7 +1609,9 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    *             based on URI Template
    *             ([RFC 6570](https://tools.ietf.org/html/rfc6570)).  The path
    *             must have one or more variables.
-   * @param dispatcher An object dispatcher callback to register.
+   * @param dispatcher An object dispatcher callback to register.  It may
+   *                   return an object, a `Tombstone` if the object has been
+   *                   deleted, or `null` if the object is not found.
    */
   setObjectDispatcher<TObject extends Object$1, TParam extends string>(cls: ConstructorWithTypeId<TObject>, path: `${string}${Rfc6570Expression<TParam>}${string}`, dispatcher: ObjectDispatcher<TContextData, TObject, TParam>): ObjectCallbackSetters<TContextData, TObject, TParam>;
   /**
@@ -3357,6 +3373,23 @@ interface GetActorOptions {
    */
   readonly tombstone?: "suppress" | "passthrough";
 }
+/**
+ * Options for {@link RequestContext.getObject}.
+ * @since 2.4.0
+ */
+interface GetObjectOptions {
+  /**
+   * Controls how tombstoned objects are returned.
+   *
+   * By default, or if set to `"suppress"`, a {@link Tombstone} is returned as
+   * `null`, unless it is an instance of the requested class, e.g., when
+   * the requested class is `Object` or `Tombstone` itself.  In that case,
+   * the tombstone is returned as is, as it is an object of the requested
+   * class.  Set this to `"passthrough"` to always receive a {@link Tombstone}
+   * result instead of `null`.
+   */
+  readonly tombstone?: "suppress" | "passthrough";
+}
 /**
  * A context for a request.
  */
@@ -3522,12 +3555,61 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * @param cls The class to instantiate.
    * @param values The values to pass to the object dispatcher.
    * @returns The object of the given class with the given values, or `null`
-   *          if the object is not found.
+   *          if the object is not found.  Tombstoned objects are suppressed
+   *          unless the tombstone is an instance of `cls`.
    * @throws {Error} If no object dispatcher is available for the class.
    * @throws {TypeError} If values are invalid.
    * @since 0.7.0
    */
   getObject<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>): Promise<TObject | null>;
+  /**
+   * Gets an object of the given class, or a {@link Tombstone}, with the given
+   * values.
+   * @param cls The class to instantiate.
+   * @param values The values to pass to the object dispatcher.
+   * @param options Options for getting the object.  Set `options.tombstone`
+   *                to `"passthrough"` to receive tombstoned objects instead
+   *                of `null`.
+   * @returns The object of the given class with the given values,
+   *          a tombstone, or `null` if the object is not found.
+   * @throws {Error} If no object dispatcher is available for the class.
+   * @throws {TypeError} If values are invalid.
+   * @since 2.4.0
+   */
+  getObject<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>, options: GetObjectOptions & {
+    readonly tombstone: "passthrough";
+  }): Promise<TObject | Tombstone | null>;
+  /**
+   * Gets an object of the given class with the given values.
+   * @param cls The class to instantiate.
+   * @param values The values to pass to the object dispatcher.
+   * @param options Options for getting the object.
+   * @returns The object of the given class with the given values, or `null`
+   *          if the object is not found.  Tombstoned objects are suppressed
+   *          unless `options.tombstone` is `"passthrough"` or the tombstone
+   *          is an instance of `cls`.
+   * @throws {Error} If no object dispatcher is available for the class.
+   * @throws {TypeError} If values are invalid.
+   * @since 2.4.0
+   */
+  getObject<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>, options: GetObjectOptions & {
+    readonly tombstone?: "suppress" | undefined;
+  }): Promise<TObject | null>;
+  /**
+   * Gets an object of the given class, or a {@link Tombstone}, with the given
+   * values.
+   * @param cls The class to instantiate.
+   * @param values The values to pass to the object dispatcher.
+   * @param options Options for getting the object.
+   * @returns The object of the given class with the given values,
+   *          a tombstone, or `null` if the object is not found.  This broad
+   *          overload is used when the caller passes an options value whose
+   *          `tombstone` mode is not known statically.
+   * @throws {Error} If no object dispatcher is available for the class.
+   * @throws {TypeError} If values are invalid.
+   * @since 2.4.0
+   */
+  getObject<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>, options: GetObjectOptions): Promise<TObject | Tombstone | null>;
   /**
    * Gets the public key of the sender, if any exists and it is verified.
    * Otherwise, `null` is returned.

package/dist/utils/docloader.test.mjs

@@ -5,9 +5,9 @@ import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { d as verifyRequest } from "../http-BU-8fUrz.mjs";
+import { d as verifyRequest } from "../http-BcLnr2do.mjs";
 import { i as rsaPrivateKey2 } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-C1hAJnWc.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-Bby5g2iu.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";
 //#region src/utils/docloader.test.ts

package/dist/utils/kv-cache.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-DJFoGRWQ.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-iFaRIcIL.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { preloadedContexts } from "@fedify/vocab-runtime";

package/dist/utils/mod.cjs

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-Bl5EBFrU.cjs");
+const require_kv_cache = require("../kv-cache-Dqp_E-1g.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.d.cts

@@ -1,3 +1,3 @@
 /// <reference lib="esnext.temporal" />
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-xGFCHqq_.cjs";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-Cr79cQlc.cjs";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.d.ts

@@ -1,3 +1,3 @@
 /// <reference lib="esnext.temporal" />
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-CVZrXSdm.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-Cwdt_CWU.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-CxQu_cd4.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-DwzXzchj.js";
 export { getAuthenticatedDocumentLoader, kvCache };