@fedify/fedify 2.4.0-dev.2115 → 2.4.0-dev.2127

package/dist/{middleware-BpwKvOpU.mjs → middleware-BdhvduR9.mjs}

@@ -1,28 +1,29 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CCABdw7r.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-em_7lwhG.mjs";
+import { n as version, t as name } from "./deno-Be9xoxps.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DDE9S63Q.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
 import { a as isCompatibleKeyId, c as isPortableUri, i as hasPortableActor, n as getGatewayKeyBase, r as getPortableDid, s as isPortableId, t as getCanonicalPortableId } from "./portable-key-id-T7lecIbt.mjs";
-import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-CkNxztNV.mjs";
+import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-Cc1b6pW9.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-CnT0f1nU.mjs";
-import { i as signObject, l as verifyPortableObjectProofWithRoot, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, t as InvalidPortableObjectIdError } from "./proof-xdPYGPaA.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-BcLnr2do.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-Bby5g2iu.mjs";
-import { n as kvCache } from "./kv-cache-iFaRIcIL.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-DQNTIrAe.mjs";
+import { i as signObject, l as verifyPortableObjectProofWithRoot, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, t as InvalidPortableObjectIdError } from "./proof-CW8k0R1G.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-BFeK9sBg.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-Dtuyb0ps.mjs";
+import { n as kvCache } from "./kv-cache-tLKBfxHc.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-9LiHmOv1.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-Bf8rSWch.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-CZcBWrBd.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CCfdL83M.mjs";
+import { t as verifyPortableObject } from "./portable-collection-WXaHkNqC.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send--FORaIc4.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-B2bgGYbP.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-CDuP9MIX.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-SVlHSzV7.mjs";
 import { t as KvKeyCache } from "./keycache-BInaECGj.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-tAtwv6vX.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CffY_XOJ.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -1173,6 +1174,11 @@ async function handleObject(request, { values, context, objectDispatcher, author
 * dispatcher, or the actor dispatcher adapted to one.  The object is served
 * only if its ID canonically matches the requested portable ID and it
 * satisfies the FEP-ef61 proof policy.
+*
+* A {@link Tombstone} is served with `410 Gone` if it has an Object Integrity
+* Proof made with a key of the DID in its ID.  An unsigned tombstone cannot
+* be served as a portable object, so the response is the same as for
+* an object that this server does not store, i.e., `404 Not Found`.
 * @template TContextData The context data to pass to the context.
 * @param request The HTTP request.
 * @param parameters The parameters for handling the portable object.
@@ -1220,17 +1226,27 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
 		return await onNotFound(request);
 	}
-	if (!result.verified && result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
-		logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, and objects need an Object Integrity Proof made with a key of the DID in their ID.", {
-			portableId: canonicalId,
-			reason: result.reason.type
-		});
-		return portableObjectInternalServerError(request);
+	const tombstone = object instanceof Tombstone;
+	if (!result.verified) {
+		if (tombstone && result.reason.type === "missingProof") {
+			logger.debug("Not serving the tombstone of the portable object {portableId}, as it has no Object Integrity Proof; responding as if this server did not store the object.", { portableId: canonicalId });
+			return await onNotFound(request);
+		}
+		if (tombstone || result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
+			logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, objects, and tombstones need an Object Integrity Proof made with a key of the DID in their ID.", {
+				portableId: canonicalId,
+				reason: result.reason.type
+			});
+			return portableObjectInternalServerError(request);
+		}
 	}
-	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), { headers: {
-		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
-		Vary: "Accept"
-	} });
+	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), {
+		status: tombstone ? 410 : 200,
+		headers: {
+			"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
+			Vary: "Accept"
+		}
+	});
 }
 function isRequestedPortableObject(object, canonicalId) {
 	return object.id != null && getCanonicalPortableId(object.id) === canonicalId;
@@ -2134,7 +2150,8 @@ async function handleInboxInternal(request, parameters, span) {
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
-				tracerProvider
+				tracerProvider,
+				verifyPortableObject: ctx.verifyPortableObject
 			});
 		} catch (error) {
 			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
@@ -4333,11 +4350,16 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			return parsedActorIds;
 		};
-		const parseActivity = () => Activity.fromJsonLd(message.activity, {
-			contextLoader: this.contextLoaderFactory(loaderOptions),
-			documentLoader: rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions),
-			tracerProvider: this.tracerProvider
-		});
+		const parseActivity = () => {
+			const contextLoader = this.contextLoaderFactory(loaderOptions);
+			const documentLoader = rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions);
+			return Activity.fromJsonLd(message.activity, {
+				contextLoader,
+				documentLoader,
+				tracerProvider: this.tracerProvider,
+				verifyPortableObject: createPortableObjectVerifier(documentLoader, contextLoader, this)
+			});
+		};
 		const enqueueHeldOutboxMessage = async (delay, heldSince) => {
 			const { outboxQueue } = this;
 			if (outboxQueue == null) return;
@@ -5525,10 +5547,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			return await handlePortableObject(request, {
 				values: { identifier },
 				context,
-				objectDispatcher: actorDispatcher == null ? void 0 : async (ctx) => {
-					const actor = await actorDispatcher(ctx, identifier);
-					return actor instanceof Tombstone ? null : actor;
-				},
+				objectDispatcher: actorDispatcher == null ? void 0 : (ctx) => actorDispatcher(ctx, identifier),
 				authorizePredicate: authorizePredicate == null ? void 0 : (ctx) => authorizePredicate(ctx, identifier),
 				canonicalId: portable.canonicalId,
 				onUnauthorized,
@@ -5816,12 +5835,28 @@ function getCollectionMetricRoute(routeName) {
 	}
 }
 const FANOUT_THRESHOLD = 5;
+/**
+* Creates the FEP-ef61 portable object verifier that a context applies to
+* portable objects it dereferences: `verifyPortableObject()` with the given
+* loaders and the federation's tracer provider as defaults.  Other options,
+* such as the document URL, gateways, and referrer, are passed through as
+* they are.
+*/
+function createPortableObjectVerifier(documentLoader, contextLoader, federation) {
+	return (document, options = {}) => verifyPortableObject(document, {
+		...options,
+		documentLoader: options.documentLoader ?? documentLoader,
+		contextLoader: options.contextLoader ?? contextLoader,
+		tracerProvider: options.tracerProvider ?? federation.tracerProvider
+	});
+}
 var ContextImpl = class ContextImpl {
 	url;
 	federation;
 	data;
 	documentLoader;
 	contextLoader;
+	verifyPortableObject;
 	invokedFromActorKeyPairsDispatcher;
 	#codec;
 	constructor({ url, federation, data, documentLoader, contextLoader, invokedFromActorKeyPairsDispatcher }) {
@@ -5830,6 +5865,7 @@ var ContextImpl = class ContextImpl {
 		this.data = data;
 		this.documentLoader = documentLoader;
 		this.contextLoader = contextLoader;
+		this.verifyPortableObject = createPortableObjectVerifier(documentLoader, contextLoader, federation);
 		this.invokedFromActorKeyPairsDispatcher = invokedFromActorKeyPairsDispatcher;
 	}
 	/**
@@ -6181,7 +6217,7 @@ var ContextImpl = class ContextImpl {
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			meterProvider: options.meterProvider ?? this.meterProvider,
-			verifyPortableObject: options.verifyPortableObject ?? verifyPortableObjectProof,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
@@ -6189,7 +6225,8 @@ var ContextImpl = class ContextImpl {
 		return traverseCollection(collection, {
 			...options,
 			documentLoader: options.documentLoader ?? this.documentLoader,
-			contextLoader: options.contextLoader ?? this.contextLoader
+			contextLoader: options.contextLoader ?? this.contextLoader,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject
 		});
 	}
 	lookupNodeInfo(url, options = {}) {

package/dist/{middleware-U9IuzvDO.mjs → middleware-CsQorLC_.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-BpwKvOpU.mjs";
+import { n as FederationImpl } from "./middleware-BdhvduR9.mjs";
 export { FederationImpl };

package/dist/{middleware-DhIBngkj.js → middleware-K9aLnf57.js}

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as recordCollectionTotalItems, A as isInvalidUrlTypeError, C as compactJsonLd, D as hasSignature, E as getNormalizationContextLoader, F as wrapContextLoaderForJsonLd, G as getFederationMetrics, H as validateCryptoKey, I as exportJwk, J as isAbortError, K as getRemoteHost, M as verifyCompactJsonLd, O as hasSignatureLike, Q as recordCollectionRequest, T as detachSignature, V as importJwk, W as getDurationMs, X as recordCollectionDispatchDuration, Y as recordCircuitBreakerStateChange, Z as recordCollectionPageItems, _ as verifyPortableObjectProofWithRoot, _t as isPortableId, at as recordWebFingerHandle, b as InvalidContextReferenceError, bt as name, ct as formatAcceptSignature, d as hasProofLike, f as signObject, ft as getCanonicalPortableId, g as verifyPortableObjectProofPolicy, gt as isCompatibleKeyId, h as verifyPortableObjectProof, ht as hasPortableActor, i as selectRequestSignature, it as recordOutboxEnqueue, j as signJsonLd, k as isClearlyMalformedContextReference, l as InvalidPortableObjectIdError, m as verifyObject, mt as getPortableDid, n as listRequestSignatures, nt as recordInboxActivity, o as verifyRequest, ot as registerQueueDepthGauge, p as verifyMapLocalProof, pt as getGatewayKeyBase, q as instrumentDocumentLoader, r as parseRfc9421SignatureInput, rt as recordOutboxActivity, s as verifyRequestDetailed, st as preloadedOnlyDocumentLoader, t as doubleKnock, tt as recordFanoutRecipients, vt as isPortableUri, x as assertSafeJsonLd, xt as version, y as normalizeOutgoingActivityJsonLd } from "./http-Ce6_Lf7k.js";
+import { $ as recordCollectionTotalItems, A as isInvalidUrlTypeError, C as compactJsonLd, D as hasSignature, E as getNormalizationContextLoader, F as wrapContextLoaderForJsonLd, G as getFederationMetrics, H as validateCryptoKey, I as exportJwk, J as isAbortError, K as getRemoteHost, M as verifyCompactJsonLd, O as hasSignatureLike, Q as recordCollectionRequest, T as detachSignature, V as importJwk, W as getDurationMs, X as recordCollectionDispatchDuration, Y as recordCircuitBreakerStateChange, Z as recordCollectionPageItems, _ as verifyPortableObjectProofWithRoot, _t as isPortableId, at as recordWebFingerHandle, b as InvalidContextReferenceError, bt as name, ct as formatAcceptSignature, d as hasProofLike, f as signObject, ft as getCanonicalPortableId, g as verifyPortableObjectProofPolicy, gt as isCompatibleKeyId, h as verifyPortableObjectProof, ht as hasPortableActor, i as selectRequestSignature, it as recordOutboxEnqueue, j as signJsonLd, k as isClearlyMalformedContextReference, l as InvalidPortableObjectIdError, m as verifyObject, mt as getPortableDid, n as listRequestSignatures, nt as recordInboxActivity, o as verifyRequest, ot as registerQueueDepthGauge, p as verifyMapLocalProof, pt as getGatewayKeyBase, q as instrumentDocumentLoader, r as parseRfc9421SignatureInput, rt as recordOutboxActivity, s as verifyRequestDetailed, st as preloadedOnlyDocumentLoader, t as doubleKnock, tt as recordFanoutRecipients, vt as isPortableUri, x as assertSafeJsonLd, xt as version, y as normalizeOutgoingActivityJsonLd } from "./http-Rmbiu-5S.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-Cb3ytrlq.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DwzXzchj.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-DdXsKBg4.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-BweDce2I.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -750,7 +750,7 @@ function warnMismatchedTombstoneId(context, cls, values, tombstone) {
 		});
 		return;
 	}
-	if (tombstone.id.protocol === "ap:" || tombstone.id.protocol === "ap+ef61:") return;
+	if (isPortableId(tombstone.id)) return;
 	const expected = context.getObjectUri(cls, values);
 	if (tombstone.id.href !== expected.href) logger.warn("Object dispatcher for {class} returned a tombstone with an id property {tombstoneId} that does not match the object URI {objectUri}.  Set the property with Context.getObjectUri().", {
 		class: cls.name,
@@ -3530,6 +3530,11 @@ async function handleObject(request, { values, context, objectDispatcher, author
 * dispatcher, or the actor dispatcher adapted to one.  The object is served
 * only if its ID canonically matches the requested portable ID and it
 * satisfies the FEP-ef61 proof policy.
+*
+* A {@link Tombstone} is served with `410 Gone` if it has an Object Integrity
+* Proof made with a key of the DID in its ID.  An unsigned tombstone cannot
+* be served as a portable object, so the response is the same as for
+* an object that this server does not store, i.e., `404 Not Found`.
 * @template TContextData The context data to pass to the context.
 * @param request The HTTP request.
 * @param parameters The parameters for handling the portable object.
@@ -3577,17 +3582,27 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
 		return await onNotFound(request);
 	}
-	if (!result.verified && result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
-		logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, and objects need an Object Integrity Proof made with a key of the DID in their ID.", {
-			portableId: canonicalId,
-			reason: result.reason.type
-		});
-		return portableObjectInternalServerError(request);
+	const tombstone = object instanceof Tombstone;
+	if (!result.verified) {
+		if (tombstone && result.reason.type === "missingProof") {
+			logger.debug("Not serving the tombstone of the portable object {portableId}, as it has no Object Integrity Proof; responding as if this server did not store the object.", { portableId: canonicalId });
+			return await onNotFound(request);
+		}
+		if (tombstone || result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
+			logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, objects, and tombstones need an Object Integrity Proof made with a key of the DID in their ID.", {
+				portableId: canonicalId,
+				reason: result.reason.type
+			});
+			return portableObjectInternalServerError(request);
+		}
 	}
-	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), { headers: {
-		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
-		Vary: "Accept"
-	} });
+	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), {
+		status: tombstone ? 410 : 200,
+		headers: {
+			"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
+			Vary: "Accept"
+		}
+	});
 }
 function isRequestedPortableObject(object, canonicalId) {
 	return object.id != null && getCanonicalPortableId(object.id) === canonicalId;
@@ -4491,7 +4506,8 @@ async function handleInboxInternal(request, parameters, span) {
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
-				tracerProvider
+				tracerProvider,
+				verifyPortableObject: ctx.verifyPortableObject
 			});
 		} catch (error) {
 			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
@@ -7099,11 +7115,16 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			return parsedActorIds;
 		};
-		const parseActivity = () => Activity.fromJsonLd(message.activity, {
-			contextLoader: this.contextLoaderFactory(loaderOptions),
-			documentLoader: rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions),
-			tracerProvider: this.tracerProvider
-		});
+		const parseActivity = () => {
+			const contextLoader = this.contextLoaderFactory(loaderOptions);
+			const documentLoader = rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions);
+			return Activity.fromJsonLd(message.activity, {
+				contextLoader,
+				documentLoader,
+				tracerProvider: this.tracerProvider,
+				verifyPortableObject: createPortableObjectVerifier(documentLoader, contextLoader, this)
+			});
+		};
 		const enqueueHeldOutboxMessage = async (delay, heldSince) => {
 			const { outboxQueue } = this;
 			if (outboxQueue == null) return;
@@ -8291,10 +8312,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			return await handlePortableObject(request, {
 				values: { identifier },
 				context,
-				objectDispatcher: actorDispatcher == null ? void 0 : async (ctx) => {
-					const actor = await actorDispatcher(ctx, identifier);
-					return actor instanceof Tombstone ? null : actor;
-				},
+				objectDispatcher: actorDispatcher == null ? void 0 : (ctx) => actorDispatcher(ctx, identifier),
 				authorizePredicate: authorizePredicate == null ? void 0 : (ctx) => authorizePredicate(ctx, identifier),
 				canonicalId: portable.canonicalId,
 				onUnauthorized,
@@ -8582,12 +8600,28 @@ function getCollectionMetricRoute(routeName) {
 	}
 }
 const FANOUT_THRESHOLD = 5;
+/**
+* Creates the FEP-ef61 portable object verifier that a context applies to
+* portable objects it dereferences: `verifyPortableObject()` with the given
+* loaders and the federation's tracer provider as defaults.  Other options,
+* such as the document URL, gateways, and referrer, are passed through as
+* they are.
+*/
+function createPortableObjectVerifier(documentLoader, contextLoader, federation) {
+	return (document, options = {}) => verifyPortableObject(document, {
+		...options,
+		documentLoader: options.documentLoader ?? documentLoader,
+		contextLoader: options.contextLoader ?? contextLoader,
+		tracerProvider: options.tracerProvider ?? federation.tracerProvider
+	});
+}
 var ContextImpl = class ContextImpl {
 	url;
 	federation;
 	data;
 	documentLoader;
 	contextLoader;
+	verifyPortableObject;
 	invokedFromActorKeyPairsDispatcher;
 	#codec;
 	constructor({ url, federation, data, documentLoader, contextLoader, invokedFromActorKeyPairsDispatcher }) {
@@ -8596,6 +8630,7 @@ var ContextImpl = class ContextImpl {
 		this.data = data;
 		this.documentLoader = documentLoader;
 		this.contextLoader = contextLoader;
+		this.verifyPortableObject = createPortableObjectVerifier(documentLoader, contextLoader, federation);
 		this.invokedFromActorKeyPairsDispatcher = invokedFromActorKeyPairsDispatcher;
 	}
 	/**
@@ -8947,7 +8982,7 @@ var ContextImpl = class ContextImpl {
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			meterProvider: options.meterProvider ?? this.meterProvider,
-			verifyPortableObject: options.verifyPortableObject ?? verifyPortableObjectProof,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
@@ -8955,7 +8990,8 @@ var ContextImpl = class ContextImpl {
 		return traverseCollection(collection, {
 			...options,
 			documentLoader: options.documentLoader ?? this.documentLoader,
-			contextLoader: options.contextLoader ?? this.contextLoader
+			contextLoader: options.contextLoader ?? this.contextLoader,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject
 		});
 	}
 	lookupNodeInfo(url, options = {}) {

package/dist/{mod-DnElMslb.d.cts → mod-AVir5nVI.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-SMNOiiY6.cjs";
+import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-Bm6ldGvx.cjs";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 

package/dist/{mod-DMdGFMEl.d.cts → mod-Byt5tvAS.d.cts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { S as KeyCache } from "./http-D76Py0M4.cjs";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
-import { DocumentLoader, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
+import { DocumentLoader, PortableObjectVerifier, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 
 //#region src/sig/ld.d.ts
@@ -376,7 +376,18 @@ declare function verifyPortableObjectProof(jsonLd: unknown, options?: VerifyPort
 * Options for {@link verifyObject}.
 * @since 0.10.0
 */
-interface VerifyObjectOptions extends VerifyProofOptions {}
+interface VerifyObjectOptions extends VerifyProofOptions {
+  /**
+  * The default [FEP-ef61] portable object verifier for the property
+  * accessors of the returned object and the objects obtained from it, e.g.,
+  * `Context.verifyPortableObject`.  It is not used to verify the given
+  * object itself.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  * @since 2.4.0
+  */
+  verifyPortableObject?: PortableObjectVerifier;
+}
 /**
 * Verifies the given object.  It will verify all the proofs in the object,
 * and succeed only if all the proofs are valid and all attributions and

package/dist/{mod-CTh7ijx5.d.ts → mod-Co53r-VP.d.ts}

@@ -2,7 +2,7 @@
 import { S as KeyCache } from "./http-BrQgkJay.js";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
-import { DocumentLoader, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
+import { DocumentLoader, PortableObjectVerifier, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
 
 //#region src/sig/ld.d.ts
 /**
@@ -376,7 +376,18 @@ declare function verifyPortableObjectProof(jsonLd: unknown, options?: VerifyPort
 * Options for {@link verifyObject}.
 * @since 0.10.0
 */
-interface VerifyObjectOptions extends VerifyProofOptions {}
+interface VerifyObjectOptions extends VerifyProofOptions {
+  /**
+  * The default [FEP-ef61] portable object verifier for the property
+  * accessors of the returned object and the objects obtained from it, e.g.,
+  * `Context.verifyPortableObject`.  It is not used to verify the given
+  * object itself.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  * @since 2.4.0
+  */
+  verifyPortableObject?: PortableObjectVerifier;
+}
 /**
 * Verifies the given object.  It will verify all the proofs in the object,
 * and succeed only if all the proofs are valid and all attributions and

package/dist/{mod-COWgSo2v.d.ts → mod-eVOUPbQE.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-tOiJfBoD.js";
+import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-Ci5vuUr_.js";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 

package/dist/mod.cjs

@@ -3,14 +3,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-B4mQvNcv.cjs");
-const require_federation = require("./federation-DYr384xz.cjs");
+const require_http = require("./http-o8l4QeUY.cjs");
+const require_federation = require("./federation-B6IHuS6n.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-BtoMCv6Z.cjs");
-const require_kv_cache = require("./kv-cache-Dqp_E-1g.cjs");
+const require_portable_collection = require("./portable-collection-DXogVs__.cjs");
+const require_kv_cache = require("./kv-cache-BUkgZAcX.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
-const require_sig = require("./sig-Bj3fHnv0.cjs");
+require("./sig/mod.cjs");
 require("./utils/mod.cjs");
 //#endregion
 exports.CircuitBreaker = require_federation.CircuitBreaker;
@@ -31,7 +31,7 @@ exports.createProof = require_http.createProof;
 exports.createSignature = require_http.createSignature;
 exports.detachSignature = require_http.detachSignature;
 exports.digest = require_federation.digest;
-exports.doesActorOwnKey = require_owner.doesActorOwnKey;
+exports.doesActorOwnKey = require_portable_collection.doesActorOwnKey;
 exports.exportJwk = require_http.exportJwk;
 exports.fetchKey = require_http.fetchKey;
 exports.fetchKeyDetailed = require_http.fetchKeyDetailed;
@@ -40,7 +40,7 @@ exports.fulfillAcceptSignature = require_http.fulfillAcceptSignature;
 exports.generateCryptoKeyPair = require_http.generateCryptoKeyPair;
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.getDefaultActivityTransformers = require_transformers.getDefaultActivityTransformers;
-exports.getKeyOwner = require_owner.getKeyOwner;
+exports.getKeyOwner = require_portable_collection.getKeyOwner;
 exports.getNodeInfo = require_types.getNodeInfo;
 exports.handleWebFinger = require_federation.handleWebFinger;
 exports.hasProofLike = require_http.hasProofLike;
@@ -60,7 +60,7 @@ exports.signRequest = require_http.signRequest;
 exports.validateAcceptSignature = require_http.validateAcceptSignature;
 exports.verifyJsonLd = require_http.verifyJsonLd;
 exports.verifyObject = require_http.verifyObject;
-exports.verifyPortableObject = require_sig.verifyPortableObject;
+exports.verifyPortableObject = require_portable_collection.verifyPortableObject;
 exports.verifyPortableObjectProof = require_http.verifyPortableObjectProof;
 exports.verifyProof = require_http.verifyProof;
 exports.verifyRequest = require_http.verifyRequest;

package/dist/mod.d.cts

@@ -2,11 +2,11 @@
 import { a as InboundService, c as OutboundService, d as Software, f as Usage, i as parseNodeInfo, l as Protocol, n as ParseNodeInfoOptions, o as JsonValue, p as nodeInfoToJson, r as getNodeInfo, s as NodeInfo, t as GetNodeInfoOptions, u as Services } from "./client-D-XP_Ccb.cjs";
 import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-D76Py0M4.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "./owner-BF0L9cMt.cjs";
-import { $ as InProcessMessageQueue, A as MediaUploaderSetters, At as HashlinkMediaRequest, B as createFederationBuilder, Bt as OutboxPermanentFailureHandler, C as FederationFetchOptions, Ct as CollectionCounter, D as IdempotencyStrategy, Dt as CustomCollectionCursor, E as IdempotencyKeyCallback, Et as CustomCollectionCounter, F as FederationKvPrefixes, Ft as ObjectAuthorizePredicate, G as TaskRegistry, Gt as WebFingerLinksDispatcher, H as TaskDefinitionOptions, Ht as SharedInboxKeyDispatcher, I as FederationOrigin, It as ObjectDispatcher, J as RetryPolicy, Jt as PageItems, K as CreateExponentialBackoffPolicyOptions, Kt as SendActivityError, L as FederationQueueOptions, Lt as OutboxErrorHandler, M as OutboxListenerSetters, Mt as InboxListener, N as PortableInboxForwardingOptions, Nt as MediaUploaderCallback, O as InboxChallengePolicy, Ot as CustomCollectionDispatcher, P as Rfc6570Expression, Pt as NodeInfoDispatcher, Q as respondWithObjectIfAcceptable, R as createFederation, Rt as OutboxListener, S as FederationBuilder, St as AuthorizePredicate, T as FederationStartQueueOptions, Tt as CollectionDispatcher, U as TaskEnqueueOptions, Ut as UnverifiedActivityHandler, V as TaskDefinition, Vt as PortableActorIdMapper, W as TaskHandler, Wt as UnverifiedActivityReason, X as RespondWithObjectOptions, Xt as digest, Y as createExponentialBackoffPolicy, Yt as buildCollectionSynchronizationHeader, Z as respondWithObject, Zt as ActivityTransformer, _ as ConstructorWithTypeId, _t as parseCircuitBreakerKvState, a as GetObjectOptions, at as ParallelMessageQueue, b as Federation, bt as ActorHandleMapper, c as OutboxContext, ct as CircuitBreakerBeforeSendDecision, d as RequestContext, dt as CircuitBreakerKvState, et as InProcessMessageQueueOptions, f as RouteActivityOptions, ft as CircuitBreakerOptions, g as CollectionCallbackSetters, gt as normalizeCircuitBreakerOptions, h as ActorCallbackSetters, ht as NormalizedCircuitBreakerOptions, i as GetActorOptions, it as MessageQueueListenOptions, j as ObjectCallbackSetters, jt as InboxErrorHandler, k as InboxListenerSetters, kt as HashlinkMediaDispatcher, l as ParseUriResult, lt as CircuitBreakerCreateOptions, m as SendActivityOptionsForCollection, mt as CircuitBreakerStateChange, n as Context, nt as MessageQueueDepth, o as GetSignedKeyOptions, ot as CircuitBreaker, p as SendActivityOptions, pt as CircuitBreakerState, q as RetryContext, qt as SenderKeyPair, r as ForwardActivityOptions, rt as MessageQueueEnqueueOptions, s as InboxContext, st as CircuitBreakerActivityDrop, t as ActorKeyPair, tt as MessageQueue, u as PortableRequest, ut as CircuitBreakerFailurePolicy, v as CustomCollectionCallbackSetters, vt as ActorAliasMapper, w as FederationOptions, wt as CollectionCursor, x as FederationBenchmarkOptions, xt as ActorKeyPairsDispatcher, y as Federatable, yt as ActorDispatcher, z as Message, zt as OutboxListenerErrorHandler } from "./context-SMNOiiY6.cjs";
+import { $ as InProcessMessageQueue, A as MediaUploaderSetters, At as HashlinkMediaRequest, B as createFederationBuilder, Bt as OutboxPermanentFailureHandler, C as FederationFetchOptions, Ct as CollectionCounter, D as IdempotencyStrategy, Dt as CustomCollectionCursor, E as IdempotencyKeyCallback, Et as CustomCollectionCounter, F as FederationKvPrefixes, Ft as ObjectAuthorizePredicate, G as TaskRegistry, Gt as WebFingerLinksDispatcher, H as TaskDefinitionOptions, Ht as SharedInboxKeyDispatcher, I as FederationOrigin, It as ObjectDispatcher, J as RetryPolicy, Jt as PageItems, K as CreateExponentialBackoffPolicyOptions, Kt as SendActivityError, L as FederationQueueOptions, Lt as OutboxErrorHandler, M as OutboxListenerSetters, Mt as InboxListener, N as PortableInboxForwardingOptions, Nt as MediaUploaderCallback, O as InboxChallengePolicy, Ot as CustomCollectionDispatcher, P as Rfc6570Expression, Pt as NodeInfoDispatcher, Q as respondWithObjectIfAcceptable, R as createFederation, Rt as OutboxListener, S as FederationBuilder, St as AuthorizePredicate, T as FederationStartQueueOptions, Tt as CollectionDispatcher, U as TaskEnqueueOptions, Ut as UnverifiedActivityHandler, V as TaskDefinition, Vt as PortableActorIdMapper, W as TaskHandler, Wt as UnverifiedActivityReason, X as RespondWithObjectOptions, Xt as digest, Y as createExponentialBackoffPolicy, Yt as buildCollectionSynchronizationHeader, Z as respondWithObject, Zt as ActivityTransformer, _ as ConstructorWithTypeId, _t as parseCircuitBreakerKvState, a as GetObjectOptions, at as ParallelMessageQueue, b as Federation, bt as ActorHandleMapper, c as OutboxContext, ct as CircuitBreakerBeforeSendDecision, d as RequestContext, dt as CircuitBreakerKvState, et as InProcessMessageQueueOptions, f as RouteActivityOptions, ft as CircuitBreakerOptions, g as CollectionCallbackSetters, gt as normalizeCircuitBreakerOptions, h as ActorCallbackSetters, ht as NormalizedCircuitBreakerOptions, i as GetActorOptions, it as MessageQueueListenOptions, j as ObjectCallbackSetters, jt as InboxErrorHandler, k as InboxListenerSetters, kt as HashlinkMediaDispatcher, l as ParseUriResult, lt as CircuitBreakerCreateOptions, m as SendActivityOptionsForCollection, mt as CircuitBreakerStateChange, n as Context, nt as MessageQueueDepth, o as GetSignedKeyOptions, ot as CircuitBreaker, p as SendActivityOptions, pt as CircuitBreakerState, q as RetryContext, qt as SenderKeyPair, r as ForwardActivityOptions, rt as MessageQueueEnqueueOptions, s as InboxContext, st as CircuitBreakerActivityDrop, t as ActorKeyPair, tt as MessageQueue, u as PortableRequest, ut as CircuitBreakerFailurePolicy, v as CustomCollectionCallbackSetters, vt as ActorAliasMapper, w as FederationOptions, wt as CollectionCursor, x as FederationBenchmarkOptions, xt as ActorKeyPairsDispatcher, y as Federatable, yt as ActorDispatcher, z as Message, zt as OutboxListenerErrorHandler } from "./context-Bm6ldGvx.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-BhNbN8Ed.cjs";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.cjs";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-DnElMslb.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-DMdGFMEl.cjs";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-AVir5nVI.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-Byt5tvAS.cjs";
 import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-Cr79cQlc.cjs";
 export * from "@fedify/vocab-runtime";
 

package/dist/mod.d.ts

@@ -2,11 +2,11 @@
 import { a as InboundService, c as OutboundService, d as Software, f as Usage, i as parseNodeInfo, l as Protocol, n as ParseNodeInfoOptions, o as JsonValue, p as nodeInfoToJson, r as getNodeInfo, s as NodeInfo, t as GetNodeInfoOptions, u as Services } from "./client-D-XP_Ccb.js";
 import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-BrQgkJay.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "./owner-BSzr5-I8.js";
-import { $ as InProcessMessageQueue, A as MediaUploaderSetters, At as HashlinkMediaRequest, B as createFederationBuilder, Bt as OutboxPermanentFailureHandler, C as FederationFetchOptions, Ct as CollectionCounter, D as IdempotencyStrategy, Dt as CustomCollectionCursor, E as IdempotencyKeyCallback, Et as CustomCollectionCounter, F as FederationKvPrefixes, Ft as ObjectAuthorizePredicate, G as TaskRegistry, Gt as WebFingerLinksDispatcher, H as TaskDefinitionOptions, Ht as SharedInboxKeyDispatcher, I as FederationOrigin, It as ObjectDispatcher, J as RetryPolicy, Jt as PageItems, K as CreateExponentialBackoffPolicyOptions, Kt as SendActivityError, L as FederationQueueOptions, Lt as OutboxErrorHandler, M as OutboxListenerSetters, Mt as InboxListener, N as PortableInboxForwardingOptions, Nt as MediaUploaderCallback, O as InboxChallengePolicy, Ot as CustomCollectionDispatcher, P as Rfc6570Expression, Pt as NodeInfoDispatcher, Q as respondWithObjectIfAcceptable, R as createFederation, Rt as OutboxListener, S as FederationBuilder, St as AuthorizePredicate, T as FederationStartQueueOptions, Tt as CollectionDispatcher, U as TaskEnqueueOptions, Ut as UnverifiedActivityHandler, V as TaskDefinition, Vt as PortableActorIdMapper, W as TaskHandler, Wt as UnverifiedActivityReason, X as RespondWithObjectOptions, Xt as digest, Y as createExponentialBackoffPolicy, Yt as buildCollectionSynchronizationHeader, Z as respondWithObject, Zt as ActivityTransformer, _ as ConstructorWithTypeId, _t as parseCircuitBreakerKvState, a as GetObjectOptions, at as ParallelMessageQueue, b as Federation, bt as ActorHandleMapper, c as OutboxContext, ct as CircuitBreakerBeforeSendDecision, d as RequestContext, dt as CircuitBreakerKvState, et as InProcessMessageQueueOptions, f as RouteActivityOptions, ft as CircuitBreakerOptions, g as CollectionCallbackSetters, gt as normalizeCircuitBreakerOptions, h as ActorCallbackSetters, ht as NormalizedCircuitBreakerOptions, i as GetActorOptions, it as MessageQueueListenOptions, j as ObjectCallbackSetters, jt as InboxErrorHandler, k as InboxListenerSetters, kt as HashlinkMediaDispatcher, l as ParseUriResult, lt as CircuitBreakerCreateOptions, m as SendActivityOptionsForCollection, mt as CircuitBreakerStateChange, n as Context, nt as MessageQueueDepth, o as GetSignedKeyOptions, ot as CircuitBreaker, p as SendActivityOptions, pt as CircuitBreakerState, q as RetryContext, qt as SenderKeyPair, r as ForwardActivityOptions, rt as MessageQueueEnqueueOptions, s as InboxContext, st as CircuitBreakerActivityDrop, t as ActorKeyPair, tt as MessageQueue, u as PortableRequest, ut as CircuitBreakerFailurePolicy, v as CustomCollectionCallbackSetters, vt as ActorAliasMapper, w as FederationOptions, wt as CollectionCursor, x as FederationBenchmarkOptions, xt as ActorKeyPairsDispatcher, y as Federatable, yt as ActorDispatcher, z as Message, zt as OutboxListenerErrorHandler } from "./context-tOiJfBoD.js";
+import { $ as InProcessMessageQueue, A as MediaUploaderSetters, At as HashlinkMediaRequest, B as createFederationBuilder, Bt as OutboxPermanentFailureHandler, C as FederationFetchOptions, Ct as CollectionCounter, D as IdempotencyStrategy, Dt as CustomCollectionCursor, E as IdempotencyKeyCallback, Et as CustomCollectionCounter, F as FederationKvPrefixes, Ft as ObjectAuthorizePredicate, G as TaskRegistry, Gt as WebFingerLinksDispatcher, H as TaskDefinitionOptions, Ht as SharedInboxKeyDispatcher, I as FederationOrigin, It as ObjectDispatcher, J as RetryPolicy, Jt as PageItems, K as CreateExponentialBackoffPolicyOptions, Kt as SendActivityError, L as FederationQueueOptions, Lt as OutboxErrorHandler, M as OutboxListenerSetters, Mt as InboxListener, N as PortableInboxForwardingOptions, Nt as MediaUploaderCallback, O as InboxChallengePolicy, Ot as CustomCollectionDispatcher, P as Rfc6570Expression, Pt as NodeInfoDispatcher, Q as respondWithObjectIfAcceptable, R as createFederation, Rt as OutboxListener, S as FederationBuilder, St as AuthorizePredicate, T as FederationStartQueueOptions, Tt as CollectionDispatcher, U as TaskEnqueueOptions, Ut as UnverifiedActivityHandler, V as TaskDefinition, Vt as PortableActorIdMapper, W as TaskHandler, Wt as UnverifiedActivityReason, X as RespondWithObjectOptions, Xt as digest, Y as createExponentialBackoffPolicy, Yt as buildCollectionSynchronizationHeader, Z as respondWithObject, Zt as ActivityTransformer, _ as ConstructorWithTypeId, _t as parseCircuitBreakerKvState, a as GetObjectOptions, at as ParallelMessageQueue, b as Federation, bt as ActorHandleMapper, c as OutboxContext, ct as CircuitBreakerBeforeSendDecision, d as RequestContext, dt as CircuitBreakerKvState, et as InProcessMessageQueueOptions, f as RouteActivityOptions, ft as CircuitBreakerOptions, g as CollectionCallbackSetters, gt as normalizeCircuitBreakerOptions, h as ActorCallbackSetters, ht as NormalizedCircuitBreakerOptions, i as GetActorOptions, it as MessageQueueListenOptions, j as ObjectCallbackSetters, jt as InboxErrorHandler, k as InboxListenerSetters, kt as HashlinkMediaDispatcher, l as ParseUriResult, lt as CircuitBreakerCreateOptions, m as SendActivityOptionsForCollection, mt as CircuitBreakerStateChange, n as Context, nt as MessageQueueDepth, o as GetSignedKeyOptions, ot as CircuitBreaker, p as SendActivityOptions, pt as CircuitBreakerState, q as RetryContext, qt as SenderKeyPair, r as ForwardActivityOptions, rt as MessageQueueEnqueueOptions, s as InboxContext, st as CircuitBreakerActivityDrop, t as ActorKeyPair, tt as MessageQueue, u as PortableRequest, ut as CircuitBreakerFailurePolicy, v as CustomCollectionCallbackSetters, vt as ActorAliasMapper, w as FederationOptions, wt as CollectionCursor, x as FederationBenchmarkOptions, xt as ActorKeyPairsDispatcher, y as Federatable, yt as ActorDispatcher, z as Message, zt as OutboxListenerErrorHandler } from "./context-Ci5vuUr_.js";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-BhNbN8Ed.js";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.js";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-COWgSo2v.js";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-CTh7ijx5.js";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-eVOUPbQE.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-Co53r-VP.js";
 import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-Cwdt_CWU.js";
 export * from "@fedify/vocab-runtime";
 

package/dist/mod.js

@@ -3,15 +3,15 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./rolldown-runtime-BC-Eo5Mj.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-DAtXl_Kc.js";
 import "./compat/mod.js";
-import { B as generateCryptoKeyPair, I as exportJwk, N as verifyJsonLd, O as hasSignatureLike, P as verifySignature, R as fetchKey, S as attachSignature, T as detachSignature, V as importJwk, a as signRequest, ct as formatAcceptSignature, d as hasProofLike, dt as validateAcceptSignature, f as signObject, h as verifyPortableObjectProof, j as signJsonLd, lt as fulfillAcceptSignature, m as verifyObject, o as verifyRequest, s as verifyRequestDetailed, u as createProof, ut as parseAcceptSignature, v as verifyProof, w as createSignature, z as fetchKeyDetailed } from "./http-Ce6_Lf7k.js";
-import { a as respondWithObjectIfAcceptable, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as respondWithObject, l as CircuitBreaker, n as handleWebFinger, o as SendActivityError, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-DhIBngkj.js";
+import { B as generateCryptoKeyPair, I as exportJwk, N as verifyJsonLd, O as hasSignatureLike, P as verifySignature, R as fetchKey, S as attachSignature, T as detachSignature, V as importJwk, a as signRequest, ct as formatAcceptSignature, d as hasProofLike, dt as validateAcceptSignature, f as signObject, h as verifyPortableObjectProof, j as signJsonLd, lt as fulfillAcceptSignature, m as verifyObject, o as verifyRequest, s as verifyRequestDetailed, u as createProof, ut as parseAcceptSignature, v as verifyProof, w as createSignature, z as fetchKeyDetailed } from "./http-Rmbiu-5S.js";
+import { a as respondWithObjectIfAcceptable, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as respondWithObject, l as CircuitBreaker, n as handleWebFinger, o as SendActivityError, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-K9aLnf57.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-Cb3ytrlq.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DwzXzchj.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-DdXsKBg4.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-BweDce2I.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";
-import { t as verifyPortableObject } from "./sig-DN9pOglI.js";
+import "./sig/mod.js";
 import "./utils/mod.js";
 export * from "@fedify/vocab-runtime";
 //#endregion

package/dist/nodeinfo/handler.test.mjs

@@ -1,11 +1,11 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { r as createRequestContext } from "../context-CoNRxGYp.mjs";
+import { r as createRequestContext } from "../context-DfSVPcJ8.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { C as handleNodeInfo, o as createFederation, w as handleNodeInfoJrd } from "../middleware-BpwKvOpU.mjs";
+import { C as handleNodeInfo, o as createFederation, w as handleNodeInfoJrd } from "../middleware-BdhvduR9.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {

package/dist/{owner-9LiHmOv1.mjs → owner-CCfdL83M.mjs}

@@ -1,10 +1,10 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CCABdw7r.mjs";
+import { n as version, t as name } from "./deno-Be9xoxps.mjs";
 import { a as isCompatibleKeyId, l as isSamePublicKey$1, s as isPortableId, t as getCanonicalPortableId } from "./portable-key-id-T7lecIbt.mjs";
-import { l as verifyKeyOwnership, n as exportJwk, r as fetchActorDocument } from "./key-CkNxztNV.mjs";
-import { t as fetchPortableGatewayKey } from "./portable-key-9ck61lI0.mjs";
+import { l as verifyKeyOwnership, n as exportJwk, r as fetchActorDocument } from "./key-Cc1b6pW9.mjs";
+import { t as fetchPortableGatewayKey } from "./portable-key-C-fPq_Yf.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";