@fedify/fedify 2.4.0-dev.2115 → 2.4.0-dev.2127

package/dist/testing/mod.mjs

@@ -2,8 +2,8 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { r as testDefinitions } from "../dist-BQvArojP.mjs";
-import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-CoNRxGYp.mjs";
+import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-DfSVPcJ8.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, r as envelopeSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
-import "../testing-BWq1dCzx.mjs";
+import "../testing-otQhu4aD.mjs";
 export { ManualClockKvStore, MockQueue, baseOptions, createInboxContext, createOutboxContext, createRequestContext, envelopeSchema, makeSchema, numberSchema, stringSchema, testDefinitions };

package/dist/{testing-BWq1dCzx.mjs → testing-otQhu4aD.mjs}

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import "./dist-BQvArojP.mjs";
-import "./context-CoNRxGYp.mjs";
+import "./context-DfSVPcJ8.mjs";
 import "./kv-DBRWVx3Q.mjs";
 import "./tasks-dbCShlCb.mjs";
 export {};

package/dist/utils/docloader.test.mjs

@@ -5,9 +5,10 @@ import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { d as verifyRequest } from "../http-BcLnr2do.mjs";
+import { d as verifyRequest } from "../http-BFeK9sBg.mjs";
 import { i as rsaPrivateKey2 } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-Bby5g2iu.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-Dtuyb0ps.mjs";
+import { configure, reset } from "@logtape/logtape";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";
 //#region src/utils/docloader.test.ts
@@ -160,5 +161,83 @@ test("getAuthenticatedDocumentLoader() bounds JSON after redirects", async () =>
 		esm_default.hardReset();
 	}
 });
+test("authenticated document loader suppresses HTTP failure logs", async () => {
+	const records = [];
+	const url = "https://example.com/missing-authenticated-document";
+	const loader = getAuthenticatedDocumentLoader({
+		keyId: new URL("https://example.com/key2"),
+		privateKey: rsaPrivateKey2
+	}, { allowPrivateAddress: true });
+	await reset();
+	await configure({
+		sinks: { capture: (record) => records.push(record) },
+		loggers: [{
+			category: ["fedify"],
+			lowestLevel: "debug",
+			sinks: ["capture"]
+		}]
+	});
+	esm_default.mockGlobal();
+	esm_default.get(url, { status: 404 });
+	try {
+		for (const suppressError of [
+			true,
+			false,
+			void 0
+		]) {
+			records.length = 0;
+			assertEquals((await assertRejects(() => loader(url, { suppressError }), FetchError)).response?.status, 404);
+			const failures = records.filter((record) => record.rawMessage === "Failed to fetch document: {status} {url} {headers}");
+			assertEquals(failures.length, 1);
+			assertEquals(failures[0].level, suppressError ? "warning" : "error");
+			if (suppressError) assertEquals(records.filter((record) => record.level === "error"), []);
+		}
+	} finally {
+		esm_default.hardReset();
+		await reset();
+	}
+});
+test("authenticated document loader suppresses private URL logs", async () => {
+	const records = [];
+	const loader = getAuthenticatedDocumentLoader({
+		keyId: new URL("https://example.com/key2"),
+		privateKey: rsaPrivateKey2
+	});
+	await reset();
+	await configure({
+		sinks: { capture: (record) => {
+			records.push(record);
+		} },
+		loggers: [{
+			category: ["fedify"],
+			lowestLevel: "debug",
+			sinks: ["capture"]
+		}]
+	});
+	esm_default.spyGlobal();
+	let requests = 0;
+	esm_default.get("https://example.com/private-redirect", () => {
+		requests++;
+		return Response.redirect("http://127.0.0.1/private", 302);
+	});
+	try {
+		for (const url of ["http://127.0.0.1/private", "https://example.com/private-redirect"]) for (const suppressError of [
+			true,
+			false,
+			void 0
+		]) {
+			records.length = 0;
+			requests = 0;
+			await assertRejects(() => loader(url, { suppressError }), UrlError);
+			const failures = records.filter((r) => r.rawMessage === "Disallowed private URL: {url}");
+			assertEquals(failures.length, 1);
+			assertEquals(failures[0].level, suppressError ? "warning" : "error");
+			assertEquals(requests, url.startsWith("http://127") ? 0 : 1);
+		}
+	} finally {
+		esm_default.hardReset();
+		await reset();
+	}
+});
 //#endregion
 export {};

package/dist/utils/kv-cache.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-iFaRIcIL.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-tLKBfxHc.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { preloadedContexts } from "@fedify/vocab-runtime";

package/dist/utils/mod.cjs

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-Dqp_E-1g.cjs");
+const require_kv_cache = require("../kv-cache-BUkgZAcX.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-DwzXzchj.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-BweDce2I.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "2.4.0-dev.2115+e2feaf2b",
+  "version": "2.4.0-dev.2127+c41ce2eb",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",
@@ -151,10 +151,10 @@
     "structured-field-values": "^2.0.4",
     "temporal-polyfill": "^1.0.1",
     "urlpattern-polyfill": "^10.1.0",
-    "@fedify/uri-template": "2.4.0-dev.2115+e2feaf2b",
-    "@fedify/vocab": "2.4.0-dev.2115+e2feaf2b",
-    "@fedify/vocab-runtime": "2.4.0-dev.2115+e2feaf2b",
-    "@fedify/webfinger": "2.4.0-dev.2115+e2feaf2b"
+    "@fedify/vocab-runtime": "2.4.0-dev.2127+c41ce2eb",
+    "@fedify/vocab": "2.4.0-dev.2127+c41ce2eb",
+    "@fedify/uri-template": "2.4.0-dev.2127+c41ce2eb",
+    "@fedify/webfinger": "2.4.0-dev.2127+c41ce2eb"
   },
   "devDependencies": {
     "@std/assert": "npm:@jsr/std__assert@^0.226.0",
@@ -167,7 +167,7 @@
     "typescript": "^6.0.0",
     "wrangler": "^4.17.0",
     "@fedify/fixture": "2.0.0",
-    "@fedify/vocab-tools": "^2.4.0-dev.2115+e2feaf2b"
+    "@fedify/vocab-tools": "^2.4.0-dev.2127+c41ce2eb"
   },
   "scripts": {
     "build:self": "tsdown",

package/dist/owner-BtoMCv6Z.cjs

@@ -1,225 +0,0 @@
-const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-B4mQvNcv.cjs");
-let _logtape_logtape = require("@logtape/logtape");
-let _fedify_vocab = require("@fedify/vocab");
-let _opentelemetry_api = require("@opentelemetry/api");
-let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
-//#region src/sig/owner.ts
-const logger = (0, _logtape_logtape.getLogger)([
-	"fedify",
-	"sig",
-	"owner"
-]);
-/**
-* Checks if the actor of the given activity owns the specified key.
-*
-* Ownership is never taken from what the activity or the key say about
-* themselves, as both are written by whoever sent the activity.  It is
-* established from a document that the owner itself serves: either the key's
-* claimed owner links back to the key, or the actor the activity claims lists
-* the key as its own.
-*
-* @param activity The activity to check.
-* @param key The public key to check.
-* @param options Options for checking the key ownership.
-* @returns Whether the actor is the owner of the key.
-*/
-async function doesActorOwnKey(activity, key, options) {
-	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(require_http.name, require_http.version).startActiveSpan("activitypub.verify_key_ownership", {
-		kind: _opentelemetry_api.SpanKind.INTERNAL,
-		attributes: {
-			"activitypub.actor.id": activity.actorId?.href ?? "",
-			"activitypub.key.id": key.id?.href ?? ""
-		}
-	}, async (span) => {
-		try {
-			const actorId = activity.actorId;
-			if (actorId == null) {
-				span.setAttribute("activitypub.key_ownership.verified", false);
-				span.setAttribute("activitypub.key_ownership.method", "none");
-				return false;
-			}
-			if (key.id != null && require_http.isCompatibleKeyId(key.id)) {
-				const owner = await getPortableGatewayKeyOwner(key, options);
-				if (owner !== void 0) {
-					const ownerId = owner?.id == null ? null : require_http.getCanonicalPortableId(owner.id);
-					const verified = ownerId != null && ownerId === require_http.getCanonicalPortableId(actorId);
-					span.setAttribute("activitypub.key_ownership.verified", verified);
-					span.setAttribute("activitypub.key_ownership.method", "portable_gateway_key");
-					return verified;
-				}
-			}
-			if (key.ownerId != null) {
-				const owner = await require_http.verifyKeyOwnership(key, options);
-				if (owner?.id != null && owner.id.href === actorId.href) {
-					span.setAttribute("activitypub.key_ownership.verified", true);
-					span.setAttribute("activitypub.key_ownership.method", "key_owner");
-					return true;
-				}
-			}
-			const actor = await require_http.fetchActorDocument(actorId, options);
-			if (actor != null && await doesActorListKey(actor, key, options)) {
-				span.setAttribute("activitypub.key_ownership.verified", true);
-				span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
-				return true;
-			}
-			logger.debug("The actor {actorId} does not own key {keyId}: neither the owner the key claims nor the actor's own document links the two to each other.", {
-				actorId: actorId.href,
-				keyId: key.id?.href
-			});
-			span.setAttribute("activitypub.key_ownership.verified", false);
-			span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
-			return false;
-		} catch (error) {
-			span.recordException(error);
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
-		}
-	});
-}
-/**
-* Determines whether the given actor's own document lists the given key among
-* its public keys.
-*
-* Keys are matched by id, which is what an actor document links to.  A key
-* document may leave its id implicit, though, and then there is no id for the
-* actor to link to; the key material itself is the only thing the two can
-* have in common, so that is what gets compared.
-*/
-async function doesActorListKey(actor, key, options) {
-	if (key.id != null) {
-		for (const publicKeyId of actor.publicKeyIds) if (publicKeyId.href === key.id.href) return true;
-		return false;
-	}
-	if (key.publicKey == null) return false;
-	const publicKeys = actor.getPublicKeys({
-		...options,
-		suppressError: true
-	});
-	for await (const publicKey of publicKeys) {
-		if (publicKey.publicKey == null) continue;
-		if (await isSamePublicKey(publicKey.publicKey, key.publicKey)) return true;
-	}
-	return false;
-}
-/**
-* Compares two public keys by their key material, ignoring the metadata that
-* surrounds it.
-*/
-async function isSamePublicKey(a, b) {
-	const [x, y] = await Promise.all([require_http.exportJwk(a), require_http.exportJwk(b)]);
-	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
-}
-/**
-* Gets the actor that owns the specified key.  Returns `null` if the key has no
-* known owner.
-*
-* The owner is only returned when the key and the owner link to each other:
-* a document that merely claims to own a key is not enough, as the claim and
-* the key can come from the same host.
-*
-* @param keyId The ID of the key to check, or the key itself.
-* @param options Options for getting the key owner.
-* @returns The actor that owns the key, or `null` if the key has no known
-*          owner.
-* @since 0.7.0
-*/
-async function getKeyOwner(keyId, options) {
-	const tracerProvider = options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
-	const documentLoader = options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
-	const fetchOptions = {
-		documentLoader,
-		contextLoader: options.contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)(),
-		tracerProvider
-	};
-	const id = keyId instanceof _fedify_vocab.CryptographicKey ? keyId.id : keyId;
-	if (id != null && require_http.isCompatibleKeyId(id)) {
-		const owner = await getPortableGatewayKeyOwner(keyId, fetchOptions);
-		if (owner !== void 0) return owner;
-	}
-	if (keyId instanceof _fedify_vocab.CryptographicKey) return await require_http.verifyKeyOwnership(keyId, fetchOptions);
-	let keyDoc;
-	let documentUrl = keyId;
-	try {
-		const remoteDocument = await documentLoader(keyId.href);
-		keyDoc = remoteDocument.document;
-		documentUrl = new URL(remoteDocument.documentUrl ?? "", keyId);
-	} catch (_) {
-		return null;
-	}
-	let object;
-	try {
-		object = await _fedify_vocab.Object.fromJsonLd(keyDoc, {
-			...fetchOptions,
-			baseUrl: documentUrl
-		});
-	} catch (e) {
-		if (!(e instanceof TypeError)) throw e;
-		try {
-			object = await _fedify_vocab.CryptographicKey.fromJsonLd(keyDoc, fetchOptions);
-		} catch (e) {
-			if (e instanceof TypeError) return null;
-			throw e;
-		}
-	}
-	if (object instanceof _fedify_vocab.CryptographicKey) {
-		if (object.id != null && object.id.href !== keyId.href) return null;
-		return await require_http.verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
-	}
-	if (!(0, _fedify_vocab.isActor)(object)) return null;
-	if (object.id == null || require_http.isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
-		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
-			documentUrl: documentUrl.href,
-			actorId: object.id?.href,
-			keyId: keyId.href
-		});
-		return null;
-	}
-	for (const kid of object.publicKeyIds) if (kid.href === keyId.href) return object;
-	return null;
-}
-/**
-* Resolves the owner of a key at a compatible identifier, if the key turns
-* out to be a gateway key of an [FEP-ef61] portable actor.
-*
-* [FEP-ef61]: https://w3id.org/fep/ef61
-* @param key The key, or its ID, which must be a compatible identifier.
-* @param options Options for fetching the key.
-* @returns `undefined` if the key is not a gateway key, i.e., the document at
-*          the key ID is not a portable actor, so the usual checks apply.
-*          Otherwise, the portable actor if its signed document vouches for
-*          the key, and the given key, if any, has the same key material, or
-*          `null` if not.
-*/
-async function getPortableGatewayKeyOwner(key, options) {
-	const keyId = key instanceof _fedify_vocab.CryptographicKey ? key.id : key;
-	if (keyId == null) return void 0;
-	const resolution = await require_http.fetchPortableGatewayKey(keyId, options);
-	if (resolution.type === "legacy") return void 0;
-	if (resolution.type === "rejected") return null;
-	if (key instanceof _fedify_vocab.CryptographicKey) {
-		if (key.publicKey == null || !await require_http.isSamePublicKey(key.publicKey, resolution.key.publicKey)) {
-			logger.debug("The key {keyId} does not have the same key material as the gateway key its portable actor vouches for.", { keyId: keyId.href });
-			return null;
-		}
-	}
-	return resolution.actor;
-}
-//#endregion
-Object.defineProperty(exports, "doesActorOwnKey", {
-	enumerable: true,
-	get: function() {
-		return doesActorOwnKey;
-	}
-});
-Object.defineProperty(exports, "getKeyOwner", {
-	enumerable: true,
-	get: function() {
-		return getKeyOwner;
-	}
-});

package/dist/owner-Cb3ytrlq.js

@@ -1,215 +0,0 @@
-import { Temporal } from "temporal-polyfill";
-import { URLPattern } from "urlpattern-polyfill";
-import { I as exportJwk, L as fetchActorDocument, U as verifyKeyOwnership, _t as isPortableId, bt as name, c as fetchPortableGatewayKey, ft as getCanonicalPortableId, gt as isCompatibleKeyId, xt as version, yt as isSamePublicKey$1 } from "./http-Ce6_Lf7k.js";
-import { getLogger } from "@logtape/logtape";
-import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
-import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
-import { getDocumentLoader } from "@fedify/vocab-runtime";
-//#region src/sig/owner.ts
-const logger = getLogger([
-	"fedify",
-	"sig",
-	"owner"
-]);
-/**
-* Checks if the actor of the given activity owns the specified key.
-*
-* Ownership is never taken from what the activity or the key say about
-* themselves, as both are written by whoever sent the activity.  It is
-* established from a document that the owner itself serves: either the key's
-* claimed owner links back to the key, or the actor the activity claims lists
-* the key as its own.
-*
-* @param activity The activity to check.
-* @param key The public key to check.
-* @param options Options for checking the key ownership.
-* @returns Whether the actor is the owner of the key.
-*/
-async function doesActorOwnKey(activity, key, options) {
-	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("activitypub.verify_key_ownership", {
-		kind: SpanKind.INTERNAL,
-		attributes: {
-			"activitypub.actor.id": activity.actorId?.href ?? "",
-			"activitypub.key.id": key.id?.href ?? ""
-		}
-	}, async (span) => {
-		try {
-			const actorId = activity.actorId;
-			if (actorId == null) {
-				span.setAttribute("activitypub.key_ownership.verified", false);
-				span.setAttribute("activitypub.key_ownership.method", "none");
-				return false;
-			}
-			if (key.id != null && isCompatibleKeyId(key.id)) {
-				const owner = await getPortableGatewayKeyOwner(key, options);
-				if (owner !== void 0) {
-					const ownerId = owner?.id == null ? null : getCanonicalPortableId(owner.id);
-					const verified = ownerId != null && ownerId === getCanonicalPortableId(actorId);
-					span.setAttribute("activitypub.key_ownership.verified", verified);
-					span.setAttribute("activitypub.key_ownership.method", "portable_gateway_key");
-					return verified;
-				}
-			}
-			if (key.ownerId != null) {
-				const owner = await verifyKeyOwnership(key, options);
-				if (owner?.id != null && owner.id.href === actorId.href) {
-					span.setAttribute("activitypub.key_ownership.verified", true);
-					span.setAttribute("activitypub.key_ownership.method", "key_owner");
-					return true;
-				}
-			}
-			const actor = await fetchActorDocument(actorId, options);
-			if (actor != null && await doesActorListKey(actor, key, options)) {
-				span.setAttribute("activitypub.key_ownership.verified", true);
-				span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
-				return true;
-			}
-			logger.debug("The actor {actorId} does not own key {keyId}: neither the owner the key claims nor the actor's own document links the two to each other.", {
-				actorId: actorId.href,
-				keyId: key.id?.href
-			});
-			span.setAttribute("activitypub.key_ownership.verified", false);
-			span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
-			return false;
-		} catch (error) {
-			span.recordException(error);
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
-		}
-	});
-}
-/**
-* Determines whether the given actor's own document lists the given key among
-* its public keys.
-*
-* Keys are matched by id, which is what an actor document links to.  A key
-* document may leave its id implicit, though, and then there is no id for the
-* actor to link to; the key material itself is the only thing the two can
-* have in common, so that is what gets compared.
-*/
-async function doesActorListKey(actor, key, options) {
-	if (key.id != null) {
-		for (const publicKeyId of actor.publicKeyIds) if (publicKeyId.href === key.id.href) return true;
-		return false;
-	}
-	if (key.publicKey == null) return false;
-	const publicKeys = actor.getPublicKeys({
-		...options,
-		suppressError: true
-	});
-	for await (const publicKey of publicKeys) {
-		if (publicKey.publicKey == null) continue;
-		if (await isSamePublicKey(publicKey.publicKey, key.publicKey)) return true;
-	}
-	return false;
-}
-/**
-* Compares two public keys by their key material, ignoring the metadata that
-* surrounds it.
-*/
-async function isSamePublicKey(a, b) {
-	const [x, y] = await Promise.all([exportJwk(a), exportJwk(b)]);
-	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
-}
-/**
-* Gets the actor that owns the specified key.  Returns `null` if the key has no
-* known owner.
-*
-* The owner is only returned when the key and the owner link to each other:
-* a document that merely claims to own a key is not enough, as the claim and
-* the key can come from the same host.
-*
-* @param keyId The ID of the key to check, or the key itself.
-* @param options Options for getting the key owner.
-* @returns The actor that owns the key, or `null` if the key has no known
-*          owner.
-* @since 0.7.0
-*/
-async function getKeyOwner(keyId, options) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const documentLoader = options.documentLoader ?? getDocumentLoader();
-	const fetchOptions = {
-		documentLoader,
-		contextLoader: options.contextLoader ?? getDocumentLoader(),
-		tracerProvider
-	};
-	const id = keyId instanceof CryptographicKey ? keyId.id : keyId;
-	if (id != null && isCompatibleKeyId(id)) {
-		const owner = await getPortableGatewayKeyOwner(keyId, fetchOptions);
-		if (owner !== void 0) return owner;
-	}
-	if (keyId instanceof CryptographicKey) return await verifyKeyOwnership(keyId, fetchOptions);
-	let keyDoc;
-	let documentUrl = keyId;
-	try {
-		const remoteDocument = await documentLoader(keyId.href);
-		keyDoc = remoteDocument.document;
-		documentUrl = new URL(remoteDocument.documentUrl ?? "", keyId);
-	} catch (_) {
-		return null;
-	}
-	let object;
-	try {
-		object = await Object$1.fromJsonLd(keyDoc, {
-			...fetchOptions,
-			baseUrl: documentUrl
-		});
-	} catch (e) {
-		if (!(e instanceof TypeError)) throw e;
-		try {
-			object = await CryptographicKey.fromJsonLd(keyDoc, fetchOptions);
-		} catch (e) {
-			if (e instanceof TypeError) return null;
-			throw e;
-		}
-	}
-	if (object instanceof CryptographicKey) {
-		if (object.id != null && object.id.href !== keyId.href) return null;
-		return await verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
-	}
-	if (!isActor(object)) return null;
-	if (object.id == null || isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
-		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
-			documentUrl: documentUrl.href,
-			actorId: object.id?.href,
-			keyId: keyId.href
-		});
-		return null;
-	}
-	for (const kid of object.publicKeyIds) if (kid.href === keyId.href) return object;
-	return null;
-}
-/**
-* Resolves the owner of a key at a compatible identifier, if the key turns
-* out to be a gateway key of an [FEP-ef61] portable actor.
-*
-* [FEP-ef61]: https://w3id.org/fep/ef61
-* @param key The key, or its ID, which must be a compatible identifier.
-* @param options Options for fetching the key.
-* @returns `undefined` if the key is not a gateway key, i.e., the document at
-*          the key ID is not a portable actor, so the usual checks apply.
-*          Otherwise, the portable actor if its signed document vouches for
-*          the key, and the given key, if any, has the same key material, or
-*          `null` if not.
-*/
-async function getPortableGatewayKeyOwner(key, options) {
-	const keyId = key instanceof CryptographicKey ? key.id : key;
-	if (keyId == null) return void 0;
-	const resolution = await fetchPortableGatewayKey(keyId, options);
-	if (resolution.type === "legacy") return void 0;
-	if (resolution.type === "rejected") return null;
-	if (key instanceof CryptographicKey) {
-		if (key.publicKey == null || !await isSamePublicKey$1(key.publicKey, resolution.key.publicKey)) {
-			logger.debug("The key {keyId} does not have the same key material as the gateway key its portable actor vouches for.", { keyId: keyId.href });
-			return null;
-		}
-	}
-	return resolution.actor;
-}
-//#endregion
-export { getKeyOwner as n, doesActorOwnKey as t };