@fedify/fedify 2.4.0-dev.2122 → 2.4.0-dev.2127

package/dist/federation/portable-chain.test.mjs

@@ -0,0 +1,358 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { n as exportJwk } from "../key-Cc1b6pW9.mjs";
+import { o as verifyObject, s as verifyPortableObjectProof } from "../proof-CW8k0R1G.mjs";
+import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { n as FederationImpl } from "../middleware-BdhvduR9.mjs";
+import { Create, DataIntegrityProof, Note, OrderedCollection, Person, traverseCollection } from "@fedify/vocab";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+import { FetchError, encodeMultibase, exportDidKey } from "@fedify/vocab-runtime";
+import serialize from "json-canon";
+//#region src/federation/portable-chain.test.ts
+const did = await exportDidKey(ed25519PublicKey.publicKey);
+const keyId = `${did}#${did.slice(8)}`;
+const GATEWAY = "https://gw.example";
+const context = [
+	"https://www.w3.org/ns/activitystreams",
+	"https://w3id.org/security/data-integrity/v1",
+	"https://w3id.org/fep/ef61"
+];
+function compatible(path, gateway = GATEWAY) {
+	return `${gateway}/.well-known/apgateway/${did}${path}`;
+}
+async function sign(document, proofOptions = {}) {
+	const proofConfig = {
+		"@context": document["@context"],
+		...proofOptions,
+		type: "DataIntegrityProof",
+		cryptosuite: "eddsa-jcs-2022",
+		verificationMethod: keyId,
+		proofPurpose: "assertionMethod",
+		created: "2023-02-24T23:36:38Z"
+	};
+	const encoder = new TextEncoder();
+	const digest = /* @__PURE__ */ new Uint8Array(64);
+	digest.set(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(serialize(proofConfig)))), 0);
+	digest.set(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(serialize(document)))), 32);
+	const signature = await crypto.subtle.sign("Ed25519", ed25519PrivateKey, digest);
+	return {
+		...document,
+		proof: {
+			...proofConfig,
+			proofValue: new TextDecoder().decode(encodeMultibase("base58btc", new Uint8Array(signature)))
+		}
+	};
+}
+function note(path, content = "A portable note") {
+	return {
+		"@context": context,
+		id: compatible(path),
+		type: "Note",
+		attributedTo: compatible("/actor"),
+		content
+	};
+}
+function activity(object, id = compatible("/activities/1")) {
+	return {
+		"@context": context,
+		id,
+		type: "Create",
+		actor: compatible("/actor"),
+		object
+	};
+}
+function actor() {
+	return {
+		"@context": context,
+		id: compatible("/actor"),
+		type: "Person",
+		inbox: compatible("/actor/inbox"),
+		outbox: compatible("/actor/outbox"),
+		gateways: [GATEWAY]
+	};
+}
+function createLoader(responses) {
+	const fetched = [];
+	const loader = (url) => {
+		url = url.replace(/^ap\+ef61:/, "ap:");
+		fetched.push(url);
+		const document = responses[url];
+		if (document == null) {
+			if (!URL.canParse(url)) return Promise.reject(/* @__PURE__ */ new Error(`Not found: ${url}`));
+			if (!url.includes("/.well-known/apgateway/")) return mockDocumentLoader(url);
+			return Promise.reject(new FetchError(url, "HTTP 404", new Response(null, { status: 404 })));
+		}
+		return Promise.resolve({
+			contextUrl: null,
+			documentUrl: url,
+			document: structuredClone(document)
+		});
+	};
+	return Object.assign(loader, { fetched });
+}
+function createFederation(documentLoader, queue) {
+	return new FederationImpl({
+		kv: new MemoryKvStore(),
+		queue,
+		manuallyStartQueue: true,
+		contextLoaderFactory: () => mockDocumentLoader,
+		documentLoaderFactory: () => documentLoader
+	});
+}
+test("Context.verifyPortableObject", async (t) => {
+	const signed = await sign(note("/notes/1"));
+	const ctx = createFederation(createLoader({})).createContext(new URL("https://example.com/"));
+	await t.step("is an own property that survives spreading", () => {
+		assert(Object.hasOwn(ctx, "verifyPortableObject"));
+		assert({ ...ctx }.verifyPortableObject === ctx.verifyPortableObject);
+		assert(ctx.clone(void 0).verifyPortableObject != null);
+	});
+	await t.step("verifies portable objects with the context's loaders", async () => {
+		assertEquals((await ctx.verifyPortableObject(signed, {})).verified, true);
+		assertEquals((await ctx.verifyPortableObject(note("/notes/1"), {})).verified, false);
+		assertEquals((await ctx.verifyPortableObject({
+			...signed,
+			content: "Forged"
+		}, {})).verified, false);
+	});
+});
+test("accessors given a Context verify references of compatible-ID objects", async (t) => {
+	const signed = await sign(note("/notes/1"));
+	const create = () => Create.fromJsonLd(activity(compatible("/notes/1")), { contextLoader: mockDocumentLoader });
+	await t.step("a signed object at the reference", async () => {
+		const loader = createLoader({ [compatible("/notes/1")]: signed });
+		const ctx = createFederation(loader).createContext(new URL("https://example.com/"));
+		const object = await (await create()).getObject(ctx);
+		assertInstanceOf(object, Note);
+		assertEquals(object.content, "A portable note");
+		assertEquals(loader.fetched, [compatible("/notes/1")]);
+	});
+	await t.step("an unsigned object at the reference", async () => {
+		const ctx = createFederation(createLoader({ [compatible("/notes/1")]: note("/notes/1") })).createContext(new URL("https://example.com/"));
+		assertEquals(await (await create()).getObject(ctx), null);
+	});
+	await t.step("a forged object at the reference", async () => {
+		const ctx = createFederation(createLoader({ [compatible("/notes/1")]: {
+			...signed,
+			content: "Forged"
+		} })).createContext(new URL("https://example.com/"));
+		assertEquals(await (await create()).getObject(ctx), null);
+	});
+	await t.step("an ordinary object's compatible reference", async () => {
+		const loader = createLoader({ [compatible("/notes/1")]: note("/notes/1") });
+		const ctx = createFederation(loader).createContext(new URL("https://example.com/"));
+		const create = await Create.fromJsonLd(activity(compatible("/notes/1"), "https://example.com/activities/1"), { contextLoader: mockDocumentLoader });
+		assertEquals(await create.getObject(ctx), null);
+		assertInstanceOf(await create.getObject({
+			documentLoader: loader,
+			contextLoader: mockDocumentLoader
+		}), Note);
+	});
+});
+function createRecordingQueue() {
+	const queued = [];
+	return {
+		queued,
+		queue: {
+			enqueue(message) {
+				queued.push(message);
+				return Promise.resolve();
+			},
+			listen() {
+				return Promise.resolve();
+			}
+		}
+	};
+}
+test("inbox listeners dereference references of compatible-ID activities without options", async (t) => {
+	const signedNote = await sign(note("/notes/1"));
+	const signedCreate = await sign(activity(compatible("/notes/1")));
+	for (const queued of [false, true]) for (const [label, served] of [["signed", signedNote], ["unsigned", note("/notes/1")]]) await t.step(`${label} object${queued ? " through a queue" : ""}`, async () => {
+		const loader = createLoader({ [compatible("/notes/1")]: served });
+		const { queue, queued: messages } = createRecordingQueue();
+		const federation = createFederation(loader, queued ? queue : void 0);
+		const results = [];
+		federation.setActorDispatcher("/users/{identifier}", () => null);
+		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Create, async (_ctx, create) => {
+			const object = await create.getObject();
+			assert(object == null || object instanceof Note);
+			results.push(object);
+		});
+		assertEquals((await federation.fetch(new Request("https://example.com/inbox", {
+			method: "POST",
+			headers: { "Content-Type": "application/activity+json" },
+			body: JSON.stringify(signedCreate)
+		}), { contextData: void 0 })).status, 202);
+		if (queued) {
+			assertEquals(messages.length, 1);
+			assertEquals(messages[0].type, "inbox");
+			await federation.processQueuedTask(void 0, messages[0]);
+		}
+		assertEquals(results.length, 1);
+		if (label === "signed") {
+			assertInstanceOf(results[0], Note);
+			assertEquals(results[0].content, "A portable note");
+		} else assertEquals(results[0], null);
+		assertEquals(loader.fetched, [compatible("/notes/1")]);
+	});
+});
+test("verifyObject() does not leave its proof verifier to returned objects", async () => {
+	const proofUrl = `ap://${did}/proofs/1`;
+	const { proof, ...document } = await sign(activity(compatible("/notes/1")), { id: proofUrl });
+	const referenced = {
+		...document,
+		"https://w3id.org/security#proof": [{ "@graph": [proof] }, { "@graph": [{ "@id": proofUrl }] }]
+	};
+	const loader = createLoader({ [proofUrl]: proof });
+	const verifier = () => Promise.resolve({ verified: false });
+	for (const verifyPortableObject of [void 0, verifier]) {
+		const create = await verifyObject(Create, referenced, {
+			contextLoader: mockDocumentLoader,
+			documentLoader: loader,
+			verifyPortableObject
+		});
+		assertInstanceOf(create, Create);
+		assert(loader.fetched.includes(proofUrl));
+		const proofs = await Array.fromAsync(create.getProofs());
+		assertEquals(proofs.length, 2);
+		for (const p of proofs) {
+			assertInstanceOf(p, DataIntegrityProof);
+			assert(p._verifyPortableObject === verifyPortableObject);
+		}
+		assert(create._verifyPortableObject === verifyPortableObject);
+	}
+});
+test("Context.lookupObject() applies the gateway policy to unsecured collections", async (t) => {
+	const outbox = {
+		"@context": context,
+		id: compatible("/actor/outbox"),
+		type: "OrderedCollection",
+		attributedTo: compatible("/actor"),
+		orderedItems: [compatible("/notes/1")]
+	};
+	const signedActor = await sign(actor());
+	await t.step("from a listed gateway", async () => {
+		const ctx = createFederation(createLoader({
+			[compatible("/actor")]: signedActor,
+			[compatible("/actor/outbox")]: outbox,
+			[compatible("/notes/1")]: note("/notes/1")
+		})).createContext(new URL("https://example.com/"));
+		const collection = await ctx.lookupObject(compatible("/actor/outbox"));
+		assertInstanceOf(collection, OrderedCollection);
+		assertEquals(await Array.fromAsync(collection.getItems()), []);
+		assertEquals(await Array.fromAsync(traverseCollection(collection, ctx)), []);
+		assertEquals(await ctx.lookupObject(compatible("/actor/outbox"), { verifyPortableObject: verifyPortableObjectProof }), null);
+	});
+	await t.step("from an unlisted gateway", async () => {
+		const evil = "https://evil.example";
+		assertEquals(await createFederation(createLoader({
+			[compatible("/actor", evil)]: signedActor,
+			[compatible("/actor/outbox", evil)]: {
+				...outbox,
+				id: compatible("/actor/outbox", evil)
+			}
+		})).createContext(new URL("https://example.com/")).lookupObject(compatible("/actor/outbox", evil)), null);
+	});
+	await t.step("with signed items", async () => {
+		const collection = await createFederation(createLoader({
+			[compatible("/actor")]: signedActor,
+			[compatible("/actor/outbox")]: outbox,
+			[compatible("/notes/1")]: await sign(note("/notes/1"))
+		})).createContext(new URL("https://example.com/")).lookupObject(compatible("/actor/outbox"));
+		assertInstanceOf(collection, OrderedCollection);
+		const items = await Array.fromAsync(collection.getItems());
+		assertEquals(items.length, 1);
+		assertInstanceOf(items[0], Note);
+	});
+});
+test("traverseCollection() with a Context verifies pages and items of portable collections", async () => {
+	const loader = createLoader({
+		[compatible("/actor")]: await sign(actor()),
+		[compatible("/actor/outbox")]: {
+			"@context": context,
+			id: compatible("/actor/outbox"),
+			type: "OrderedCollection",
+			first: compatible("/actor/outbox/1")
+		},
+		[compatible("/actor/outbox/1")]: {
+			"@context": context,
+			id: compatible("/actor/outbox/1"),
+			type: "OrderedCollectionPage",
+			partOf: compatible("/actor/outbox"),
+			orderedItems: [compatible("/notes/1"), compatible("/notes/2")]
+		},
+		[compatible("/notes/1")]: await sign(note("/notes/1")),
+		[compatible("/notes/2")]: note("/notes/2", "Unsigned")
+	});
+	const ctx = createFederation(loader).createContext(new URL("https://example.com/"));
+	const outbox = await (await Person.fromJsonLd(actor(), { contextLoader: mockDocumentLoader })).getOutbox(ctx);
+	assertInstanceOf(outbox, OrderedCollection);
+	const items = await Array.fromAsync(traverseCollection(outbox, ctx));
+	assertEquals(items.length, 1);
+	assertInstanceOf(items[0], Note);
+	assertEquals(items[0].content, "A portable note");
+	let error;
+	try {
+		await items[0].getAttribution({ documentLoader: loader });
+	} catch (e) {
+		error = e;
+	}
+	assertInstanceOf(error, TypeError);
+	assertInstanceOf(await items[0].getAttribution(ctx), Person);
+});
+test("onOutboxError receives activities that verify portable objects by default", async () => {
+	const loader = createLoader({ [compatible("/notes/1")]: await sign(note("/notes/1")) });
+	const received = [];
+	const federation = new FederationImpl({
+		kv: new MemoryKvStore(),
+		queue: createRecordingQueue().queue,
+		manuallyStartQueue: true,
+		contextLoaderFactory: () => mockDocumentLoader,
+		documentLoaderFactory: () => loader,
+		authenticatedDocumentLoaderFactory: () => loader,
+		onOutboxError: async (_error, activity) => {
+			try {
+				received.push(await activity?.getObject());
+			} catch (error) {
+				received.push(error);
+			}
+		}
+	});
+	const message = {
+		type: "outbox",
+		id: crypto.randomUUID(),
+		baseUrl: "https://example.com",
+		keys: [{
+			keyId: rsaPublicKey2.id.href,
+			privateKey: await exportJwk(rsaPrivateKey2)
+		}],
+		activity: await sign(activity(compatible("/notes/1"))),
+		activityId: compatible("/activities/1"),
+		activityType: "https://www.w3.org/ns/activitystreams#Create",
+		inbox: "https://remote.example/inbox",
+		sharedInbox: false,
+		started: (/* @__PURE__ */ new Date()).toISOString(),
+		attempt: 0,
+		headers: {},
+		traceContext: {}
+	};
+	esm_default.spyGlobal();
+	esm_default.post("https://remote.example/inbox", 500);
+	try {
+		await federation.processQueuedTask(void 0, message);
+	} finally {
+		esm_default.hardReset();
+	}
+	assertEquals(received.length, 1);
+	assertInstanceOf(received[0], Note);
+	assertEquals(loader.fetched, [compatible("/notes/1")]);
+});
+//#endregion
+export {};

package/dist/federation/portable-gateway-keys.test.mjs

@@ -2,15 +2,15 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
-import { r as createRequestContext, t as createInboxContext } from "../context-CoNRxGYp.mjs";
+import { r as createRequestContext, t as createInboxContext } from "../context-DfSVPcJ8.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { p as signJsonLd } from "../ld-u4JOD4iO.mjs";
-import { l as signRequest } from "../http-B9BQDNIy.mjs";
+import { p as signJsonLd } from "../ld-DQNTIrAe.mjs";
+import { l as signRequest } from "../http-BFeK9sBg.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { f as handleInbox, n as FederationImpl, o as createFederation } from "../middleware-CgOqRkK-.mjs";
+import { f as handleInbox, n as FederationImpl, o as createFederation } from "../middleware-BdhvduR9.mjs";
 import { t as ActivityListenerSet } from "../activity-listener-C-BSbKI7.mjs";
 import { t as KvKeyCache } from "../keycache-BInaECGj.mjs";
 import { Create, CryptographicKey, Person } from "@fedify/vocab";

package/dist/federation/portable-inbox.test.mjs

@@ -8,11 +8,11 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { p as signJsonLd } from "../ld-u4JOD4iO.mjs";
-import { i as signObject } from "../proof-BCOg7Njv.mjs";
-import { f as verifyRequestDetailed, l as signRequest } from "../http-B9BQDNIy.mjs";
+import { p as signJsonLd } from "../ld-DQNTIrAe.mjs";
+import { i as signObject } from "../proof-CW8k0R1G.mjs";
+import { f as verifyRequestDetailed, l as signRequest } from "../http-BFeK9sBg.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { _ as coversDelivery, o as createFederation, v as forwardPortableInboxActivity, y as resolvePortableInboxForwardingOptions } from "../middleware-CgOqRkK-.mjs";
+import { _ as coversDelivery, o as createFederation, v as forwardPortableInboxActivity, y as resolvePortableInboxForwardingOptions } from "../middleware-BdhvduR9.mjs";
 import { Create, CryptographicKey, Follow, Note, Person, Tombstone } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { exportDidKey, formatIri, parseIri } from "@fedify/vocab-runtime";

package/dist/federation/portable.test.mjs

@@ -8,10 +8,10 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertStrictEquals } from "../assert_strict_equals-CYvBmkpC.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { i as signObject, s as verifyPortableObjectProof } from "../proof-BCOg7Njv.mjs";
-import { l as signRequest } from "../http-B9BQDNIy.mjs";
+import { i as signObject, s as verifyPortableObjectProof } from "../proof-CW8k0R1G.mjs";
+import { l as signRequest } from "../http-BFeK9sBg.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { b as PORTABLE_OBJECT_CONTENT_TYPE, o as createFederation } from "../middleware-CgOqRkK-.mjs";
+import { b as PORTABLE_OBJECT_CONTENT_TYPE, o as createFederation } from "../middleware-BdhvduR9.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { Collection, Create, Note, Object as Object$1, Person, Tombstone, lookupObject } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";

package/dist/federation/send.test.mjs

@@ -10,10 +10,10 @@ import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { d as verifyRequest } from "../http-B9BQDNIy.mjs";
+import { d as verifyRequest } from "../http-BFeK9sBg.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as doesActorOwnKey } from "../owner-CPFM-sqo.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-C8eOPat3.mjs";
+import { t as doesActorOwnKey } from "../owner-CCfdL83M.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send--FORaIc4.mjs";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";

package/dist/federation/tasks/enqueue.test.mjs

@@ -3,8 +3,8 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../../kv-DCHkaJ9-.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, t as MockQueue } from "../../tasks-dbCShlCb.mjs";
-import "../../testing-BWq1dCzx.mjs";
-import { o as createFederation } from "../../middleware-CgOqRkK-.mjs";
+import "../../testing-otQhu4aD.mjs";
+import { o as createFederation } from "../../middleware-BdhvduR9.mjs";
 import { n as ParallelMessageQueue } from "../../mq-Dm1Wmtm-.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { delay } from "es-toolkit";

package/dist/federation/tasks/tasks.test.mjs

@@ -3,9 +3,9 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../../kv-DCHkaJ9-.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, t as MockQueue } from "../../tasks-dbCShlCb.mjs";
-import "../../testing-BWq1dCzx.mjs";
-import { o as createFederation } from "../../middleware-CgOqRkK-.mjs";
-import { r as createFederationBuilder } from "../../builder-BCXywsZF.mjs";
+import "../../testing-otQhu4aD.mjs";
+import { o as createFederation } from "../../middleware-BdhvduR9.mjs";
+import { r as createFederationBuilder } from "../../builder-B2bgGYbP.mjs";
 import { t as TaskCodec } from "../../codec-C6rTrpIp.mjs";
 import { t as InProcessMessageQueue } from "../../mq-Dm1Wmtm-.mjs";
 import { W3CTraceContextPropagator } from "@opentelemetry/core";

package/dist/federation/temporal.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-vjHOhBpy.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-CffY_XOJ.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -1,12 +1,12 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { r as createRequestContext } from "../context-CoNRxGYp.mjs";
+import { r as createRequestContext } from "../context-DfSVPcJ8.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { o as createFederation, s as handleWebFinger } from "../middleware-CgOqRkK-.mjs";
+import { o as createFederation, s as handleWebFinger } from "../middleware-BdhvduR9.mjs";
 import { Image, Link, Person, Tombstone } from "@fedify/vocab";
 import { createTestMeterProvider, test } from "@fedify/fixture";
 import { parseIri } from "@fedify/vocab-runtime";

package/dist/{federation-Ml6NrgRV.cjs → federation-B6IHuS6n.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-4bmgw-mA.cjs");
+const require_http = require("./http-o8l4QeUY.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-DkA0Lz7v.cjs");
-const require_kv_cache = require("./kv-cache-D2Bz6t_c.cjs");
+const require_portable_collection = require("./portable-collection-DXogVs__.cjs");
+const require_kv_cache = require("./kv-cache-BUkgZAcX.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -4512,7 +4512,8 @@ async function handleInboxInternal(request, parameters, span) {
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
-				tracerProvider
+				tracerProvider,
+				verifyPortableObject: ctx.verifyPortableObject
 			});
 		} catch (error) {
 			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
@@ -4714,7 +4715,7 @@ async function handleInboxInternal(request, parameters, span) {
 			});
 		}
 	}
-	if (httpSigKey != null && !await require_owner.doesActorOwnKey(activity, httpSigKey, ctx)) {
+	if (httpSigKey != null && !await require_portable_collection.doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		require_http.getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : require_http.getRemoteHost(httpSigKey.id));
 		logger.error("The signer ({keyId}) and the actor ({actorId}) do not match.", {
@@ -7211,11 +7212,16 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			return parsedActorIds;
 		};
-		const parseActivity = () => _fedify_vocab.Activity.fromJsonLd(message.activity, {
-			contextLoader: this.contextLoaderFactory(loaderOptions),
-			documentLoader: rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions),
-			tracerProvider: this.tracerProvider
-		});
+		const parseActivity = () => {
+			const contextLoader = this.contextLoaderFactory(loaderOptions);
+			const documentLoader = rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions);
+			return _fedify_vocab.Activity.fromJsonLd(message.activity, {
+				contextLoader,
+				documentLoader,
+				tracerProvider: this.tracerProvider,
+				verifyPortableObject: createPortableObjectVerifier(documentLoader, contextLoader, this)
+			});
+		};
 		const enqueueHeldOutboxMessage = async (delay, heldSince) => {
 			const { outboxQueue } = this;
 			if (outboxQueue == null) return;
@@ -8691,12 +8697,28 @@ function getCollectionMetricRoute(routeName) {
 	}
 }
 const FANOUT_THRESHOLD = 5;
+/**
+* Creates the FEP-ef61 portable object verifier that a context applies to
+* portable objects it dereferences: `verifyPortableObject()` with the given
+* loaders and the federation's tracer provider as defaults.  Other options,
+* such as the document URL, gateways, and referrer, are passed through as
+* they are.
+*/
+function createPortableObjectVerifier(documentLoader, contextLoader, federation) {
+	return (document, options = {}) => require_portable_collection.verifyPortableObject(document, {
+		...options,
+		documentLoader: options.documentLoader ?? documentLoader,
+		contextLoader: options.contextLoader ?? contextLoader,
+		tracerProvider: options.tracerProvider ?? federation.tracerProvider
+	});
+}
 var ContextImpl = class ContextImpl {
 	url;
 	federation;
 	data;
 	documentLoader;
 	contextLoader;
+	verifyPortableObject;
 	invokedFromActorKeyPairsDispatcher;
 	#codec;
 	constructor({ url, federation, data, documentLoader, contextLoader, invokedFromActorKeyPairsDispatcher }) {
@@ -8705,6 +8727,7 @@ var ContextImpl = class ContextImpl {
 		this.data = data;
 		this.documentLoader = documentLoader;
 		this.contextLoader = contextLoader;
+		this.verifyPortableObject = createPortableObjectVerifier(documentLoader, contextLoader, federation);
 		this.invokedFromActorKeyPairsDispatcher = invokedFromActorKeyPairsDispatcher;
 	}
 	/**
@@ -9056,7 +9079,7 @@ var ContextImpl = class ContextImpl {
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			meterProvider: options.meterProvider ?? this.meterProvider,
-			verifyPortableObject: options.verifyPortableObject ?? require_http.verifyPortableObjectProof,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
@@ -9064,7 +9087,8 @@ var ContextImpl = class ContextImpl {
 		return (0, _fedify_vocab.traverseCollection)(collection, {
 			...options,
 			documentLoader: options.documentLoader ?? this.documentLoader,
-			contextLoader: options.contextLoader ?? this.contextLoader
+			contextLoader: options.contextLoader ?? this.contextLoader,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject
 		});
 	}
 	lookupNodeInfo(url, options = {}) {
@@ -9490,7 +9514,7 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 		const key = await this.getSignedKey(options);
 		if (key == null) return this.#signedKeyOwner = null;
 		try {
-			return this.#signedKeyOwner = await require_owner.getKeyOwner(key, {
+			return this.#signedKeyOwner = await require_portable_collection.getKeyOwner(key, {
 				contextLoader: options.contextLoader ?? this.contextLoader,
 				documentLoader: options.documentLoader ?? this.documentLoader,
 				tracerProvider: options.tracerProvider ?? this.tracerProvider

package/dist/{http-B9BQDNIy.mjs → http-BFeK9sBg.mjs}

@@ -1,11 +1,11 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BZrnW0Qz.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DCLoLvLz.mjs";
+import { n as version, t as name } from "./deno-Be9xoxps.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DDE9S63Q.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-PyYvun0F.mjs";
-import { n as verifyPortableGatewayKeyDocument } from "./portable-key-DyylakVV.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-Cc1b6pW9.mjs";
+import { n as verifyPortableGatewayKeyDocument } from "./portable-key-C-fPq_Yf.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{http-BETASGl0.js → http-Rmbiu-5S.js}

@@ -14,7 +14,7 @@ import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2122+bdc0ce8d";
+var version = "2.4.0-dev.2127+c41ce2eb";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;

package/dist/{http-4bmgw-mA.cjs → http-o8l4QeUY.cjs}

@@ -16,7 +16,7 @@ json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2122+bdc0ce8d";
+var version = "2.4.0-dev.2127+c41ce2eb";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;

package/dist/{key-PyYvun0F.mjs → key-Cc1b6pW9.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BZrnW0Qz.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DCLoLvLz.mjs";
+import { n as version, t as name } from "./deno-Be9xoxps.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DDE9S63Q.mjs";
 import { a as isCompatibleKeyId, o as isPortableActorDocument, s as isPortableId } from "./portable-key-id-T7lecIbt.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";