@fedify/fedify 2.4.0-dev.2122 → 2.4.0-dev.2129

package/dist/{sig-Cb9VSeiF.cjs → portable-collection-PTGD0q70.cjs}

@@ -1,11 +1,250 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-4bmgw-mA.cjs");
-require("./owner-DkA0Lz7v.cjs");
+const require_http = require("./http-B1J6E-bT.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let _fedify_vocab_runtime_internal_portable_dereference = require("@fedify/vocab-runtime/internal/portable-dereference");
+//#region src/sig/owner.ts
+const logger$1 = (0, _logtape_logtape.getLogger)([
+	"fedify",
+	"sig",
+	"owner"
+]);
+/**
+* Checks if the actor of the given activity owns the specified key.
+*
+* Ownership is never taken from what the activity or the key say about
+* themselves, as both are written by whoever sent the activity.  It is
+* established from a document that the owner itself serves: either the key's
+* claimed owner links back to the key, or the actor the activity claims lists
+* the key as its own.
+*
+* @param activity The activity to check.
+* @param key The public key to check.
+* @param options Options for checking the key ownership.
+* @returns Whether the actor is the owner of the key.
+*/
+async function doesActorOwnKey(activity, key, options) {
+	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(require_http.name, require_http.version).startActiveSpan("activitypub.verify_key_ownership", {
+		kind: _opentelemetry_api.SpanKind.INTERNAL,
+		attributes: {
+			"activitypub.actor.id": activity.actorId?.href ?? "",
+			"activitypub.key.id": key.id?.href ?? ""
+		}
+	}, async (span) => {
+		try {
+			const actorId = activity.actorId;
+			if (actorId == null) {
+				span.setAttribute("activitypub.key_ownership.verified", false);
+				span.setAttribute("activitypub.key_ownership.method", "none");
+				return false;
+			}
+			if (key.id != null && require_http.isPortableUri(key.id)) {
+				const owner = await getPortableActorKeyOwner(key, options);
+				const ownerId = owner?.id == null ? null : require_http.getCanonicalPortableId(owner.id);
+				const verified = ownerId != null && ownerId === require_http.getCanonicalPortableId(actorId);
+				span.setAttribute("activitypub.key_ownership.verified", verified);
+				span.setAttribute("activitypub.key_ownership.method", "portable_actor_key");
+				return verified;
+			}
+			if (key.id != null && require_http.isCompatibleKeyId(key.id)) {
+				const owner = await getPortableGatewayKeyOwner(key, options);
+				if (owner !== void 0) {
+					const ownerId = owner?.id == null ? null : require_http.getCanonicalPortableId(owner.id);
+					const verified = ownerId != null && ownerId === require_http.getCanonicalPortableId(actorId);
+					span.setAttribute("activitypub.key_ownership.verified", verified);
+					span.setAttribute("activitypub.key_ownership.method", "portable_gateway_key");
+					return verified;
+				}
+			}
+			if (key.ownerId != null) {
+				const owner = await require_http.verifyKeyOwnership(key, options);
+				if (owner?.id != null && owner.id.href === actorId.href) {
+					span.setAttribute("activitypub.key_ownership.verified", true);
+					span.setAttribute("activitypub.key_ownership.method", "key_owner");
+					return true;
+				}
+			}
+			const actor = await require_http.fetchActorDocument(actorId, options);
+			if (actor != null && await doesActorListKey(actor, key, options)) {
+				span.setAttribute("activitypub.key_ownership.verified", true);
+				span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
+				return true;
+			}
+			logger$1.debug("The actor {actorId} does not own key {keyId}: neither the owner the key claims nor the actor's own document links the two to each other.", {
+				actorId: actorId.href,
+				keyId: key.id?.href
+			});
+			span.setAttribute("activitypub.key_ownership.verified", false);
+			span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
+			return false;
+		} catch (error) {
+			span.recordException(error);
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
+/**
+* Determines whether the given actor's own document lists the given key among
+* its public keys.
+*
+* Keys are matched by id, which is what an actor document links to.  A key
+* document may leave its id implicit, though, and then there is no id for the
+* actor to link to; the key material itself is the only thing the two can
+* have in common, so that is what gets compared.
+*/
+async function doesActorListKey(actor, key, options) {
+	if (key.id != null) {
+		for (const publicKeyId of actor.publicKeyIds) if (publicKeyId.href === key.id.href) return true;
+		return false;
+	}
+	if (key.publicKey == null) return false;
+	const publicKeys = actor.getPublicKeys({
+		...options,
+		suppressError: true
+	});
+	for await (const publicKey of publicKeys) {
+		if (publicKey.publicKey == null) continue;
+		if (await isSamePublicKey(publicKey.publicKey, key.publicKey)) return true;
+	}
+	return false;
+}
+/**
+* Compares two public keys by their key material, ignoring the metadata that
+* surrounds it.
+*/
+async function isSamePublicKey(a, b) {
+	const [x, y] = await Promise.all([require_http.exportJwk(a), require_http.exportJwk(b)]);
+	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
+}
+/**
+* Gets the actor that owns the specified key.  Returns `null` if the key has no
+* known owner.
+*
+* The owner is only returned when the key and the owner link to each other:
+* a document that merely claims to own a key is not enough, as the claim and
+* the key can come from the same host.
+*
+* @param keyId The ID of the key to check, or the key itself.
+* @param options Options for getting the key owner.
+* @returns The actor that owns the key, or `null` if the key has no known
+*          owner.
+* @since 0.7.0
+*/
+async function getKeyOwner(keyId, options) {
+	const tracerProvider = options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
+	const documentLoader = options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
+	const fetchOptions = {
+		documentLoader,
+		contextLoader: options.contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)(),
+		tracerProvider
+	};
+	const id = keyId instanceof _fedify_vocab.CryptographicKey ? keyId.id : keyId;
+	if (id != null && require_http.isPortableUri(id)) return await getPortableActorKeyOwner(keyId, fetchOptions);
+	if (id != null && require_http.isCompatibleKeyId(id)) {
+		const owner = await getPortableGatewayKeyOwner(keyId, fetchOptions);
+		if (owner !== void 0) return owner;
+	}
+	if (keyId instanceof _fedify_vocab.CryptographicKey) return await require_http.verifyKeyOwnership(keyId, fetchOptions);
+	let keyDoc;
+	let documentUrl = keyId;
+	try {
+		const remoteDocument = await documentLoader(keyId.href);
+		keyDoc = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", keyId);
+	} catch (_) {
+		return null;
+	}
+	let object;
+	try {
+		object = await _fedify_vocab.Object.fromJsonLd(keyDoc, {
+			...fetchOptions,
+			baseUrl: documentUrl
+		});
+	} catch (e) {
+		if (!(e instanceof TypeError)) throw e;
+		try {
+			object = await _fedify_vocab.CryptographicKey.fromJsonLd(keyDoc, fetchOptions);
+		} catch (e) {
+			if (e instanceof TypeError) return null;
+			throw e;
+		}
+	}
+	if (object instanceof _fedify_vocab.CryptographicKey) {
+		if (object.id != null && object.id.href !== keyId.href) return null;
+		return await require_http.verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
+	}
+	if (!(0, _fedify_vocab.isActor)(object)) return null;
+	if (object.id == null || require_http.isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
+		logger$1.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href,
+			keyId: keyId.href
+		});
+		return null;
+	}
+	for (const kid of object.publicKeyIds) if (kid.href === keyId.href) return object;
+	return null;
+}
+/**
+* Resolves the owner of a key at a compatible identifier, if the key turns
+* out to be a gateway key of an [FEP-ef61] portable actor.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param key The key, or its ID, which must be a compatible identifier.
+* @param options Options for fetching the key.
+* @returns `undefined` if the key is not a gateway key, i.e., the document at
+*          the key ID is not a portable actor, so the usual checks apply.
+*          Otherwise, the portable actor if its signed document vouches for
+*          the key, and the given key, if any, has the same key material, or
+*          `null` if not.
+*/
+async function getPortableGatewayKeyOwner(key, options) {
+	const keyId = key instanceof _fedify_vocab.CryptographicKey ? key.id : key;
+	if (keyId == null) return void 0;
+	const resolution = await require_http.fetchPortableGatewayKey(keyId, options);
+	if (resolution.type === "legacy") return void 0;
+	if (resolution.type === "rejected") return null;
+	if (key instanceof _fedify_vocab.CryptographicKey) {
+		if (key.publicKey == null || !await require_http.isSamePublicKey(key.publicKey, resolution.key.publicKey)) {
+			logger$1.debug("The key {keyId} does not have the same key material as the gateway key its portable actor vouches for.", { keyId: keyId.href });
+			return null;
+		}
+	}
+	return resolution.actor;
+}
+/**
+* Resolves the owner of a key of an [FEP-ef61] portable actor at an `ap:` or
+* `ap+ef61:` key ID.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param key The key, or its ID, which must be an `ap:` or `ap+ef61:` URI.
+* @param options Options for fetching the key.
+* @returns The portable actor if its signed document vouches for the key,
+*          and the given key, if any, has the same key material, or `null`
+*          if not.
+*/
+async function getPortableActorKeyOwner(key, options) {
+	const keyId = key instanceof _fedify_vocab.CryptographicKey ? key.id : key;
+	if (keyId == null) return null;
+	const resolution = await require_http.resolvePortableActorKey(keyId, options);
+	if (resolution.type !== "verified") return null;
+	if (key instanceof _fedify_vocab.CryptographicKey) {
+		if (key.publicKey == null || !await require_http.isSamePublicKey(key.publicKey, resolution.key.publicKey)) {
+			logger$1.debug("The key {keyId} does not have the same key material as the key its portable actor vouches for.", { keyId: keyId.href });
+			return null;
+		}
+	}
+	return resolution.actor;
+}
+//#endregion
 //#region src/sig/portable-collection.ts
 const logger = (0, _logtape_logtape.getLogger)([
 	"fedify",
@@ -413,6 +652,18 @@ async function verifyPortableObject(jsonLd, options = {}) {
 	};
 }
 //#endregion
+Object.defineProperty(exports, "doesActorOwnKey", {
+	enumerable: true,
+	get: function() {
+		return doesActorOwnKey;
+	}
+});
+Object.defineProperty(exports, "getKeyOwner", {
+	enumerable: true,
+	get: function() {
+		return getKeyOwner;
+	}
+});
 Object.defineProperty(exports, "verifyPortableObject", {
 	enumerable: true,
 	get: function() {

package/dist/portable-key-DqX2emHQ.mjs

@@ -0,0 +1,395 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { d as isSamePublicKey, i as getRawCanonicalPortableId, s as isPortableActorDocument, t as getCanonicalPortableId, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
+import { l as verifyPortableObjectProofWithRoot } from "./proof-B4_0E-KU.mjs";
+import { getLogger } from "@logtape/logtape";
+import { CryptographicKey, Multikey, Object as Object$1 } from "@fedify/vocab";
+import { FetchError, formatIri, getDocumentLoader, isGatewayUrl, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { getPortableGatewayCandidates } from "@fedify/vocab-runtime/internal/portable-dereference";
+//#region src/sig/portable-key.ts
+const logger = getLogger([
+	"fedify",
+	"sig",
+	"key"
+]);
+const SEC = "https://w3id.org/security#";
+/**
+* Verifies that the signed document of a portable actor vouches for
+* the gateway key with the given ID.
+*
+* A gateway key is accepted only if:
+*
+*  -  the document is an actor whose portable ID, i.e., its `ap:` ID or
+*     the canonical portable ID of its compatible identifier, is the one
+*     the key ID is the compatible identifier of;
+*  -  the document has a valid [FEP-8b32] Object Integrity Proof made by
+*     the DID of its ID, i.e., it satisfies the [FEP-ef61] proof policy;
+*  -  the document embeds a `Multikey` with that ID in its `assertionMethod`,
+*     whose `controller` is the actor, as [FEP-521a] requires, and a key
+*     embedded in its `publicKey` with the same ID agrees with it; or, if
+*     no `assertionMethod` entry has that ID, the document embeds
+*     a `CryptographicKey` with that ID in its `publicKey`, whose `owner` is
+*     the actor, as some publishers, e.g., tootik, list their RSA keys only
+*     there;
+*  -  no more than one entry of either property has that ID; and
+*  -  the key ID's origin is one of the actor's `gateways`.
+*
+* An entry has the key's ID if its ID is the key ID, or any compatible
+* identifier on the same gateway, or the `ap:` or `ap+ef61:` URI, with the
+* same canonical portable ID.  Some publishers, e.g., Mitra, list the keys
+* of portable actors under `ap:` URIs, but sign requests with compatible key
+* IDs on their own gateways.  IDs are compared as they are written in
+* the signed document, so an ID that URL parsing would turn into another,
+* e.g., by resolving dot segments, has no match.
+*
+* [FEP-8b32]: https://w3id.org/fep/8b32
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* [FEP-521a]: https://w3id.org/fep/521a
+*
+* @param document The raw JSON-LD document served at the key ID.
+* @param actor The parsed document, which must be a portable actor.
+* @param keyId The key ID, which must be a compatible key ID.
+* @param options Loaders and telemetry providers.
+* @returns The verification result, which is never `legacy`.
+* @internal
+*/
+function verifyPortableGatewayKeyDocument(document, actor, keyId, options = {}) {
+	return verifyPortableKeyDocument(document, actor, keyId, true, options);
+}
+/**
+* Verifies that the signed document of a portable actor vouches for the key
+* with the given ID, either a gateway key at a compatible key ID, or a key of
+* the actor itself at an `ap:` or `ap+ef61:` key ID.  See
+* {@link verifyPortableGatewayKeyDocument} for the rules; a key of the actor
+* itself names no gateway, so instead of the key ID's origin being one of
+* the actor's `gateways`, the actor only has to have a valid gateway, as
+* FEP-ef61 requires of every portable actor.
+*/
+async function verifyPortableKeyDocument(document, actor, keyId, isGatewayKey, options) {
+	const reject = (reason) => {
+		logger.debug("Failed to verify key {keyId} of the portable actor {actorId}: {reason}", {
+			keyId: formatIri(keyId),
+			actorId: actor.id?.href,
+			reason
+		});
+		return {
+			type: "rejected",
+			reason
+		};
+	};
+	const keyBase = new URL(keyId.href);
+	keyBase.hash = "";
+	const claimedActorId = getCanonicalPortableId(keyBase);
+	const claimedKeyId = getCanonicalPortableId(keyId);
+	const actorId = actor.id == null ? null : getCanonicalPortableId(actor.id);
+	if (claimedActorId == null || claimedKeyId == null || actorId == null) return reject("The key ID or the actor ID is not a valid portable ID.");
+	if (claimedActorId !== actorId) return reject("The key ID is not a compatible identifier of the actor it dereferences to.");
+	let verification;
+	try {
+		verification = await verifyPortableObjectProofWithRoot(document, {
+			documentLoader: options.documentLoader,
+			contextLoader: options.contextLoader,
+			keyCache: options.keyCache,
+			tracerProvider: options.tracerProvider,
+			meterProvider: options.meterProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject(`The actor document is malformed: ${error.message}`);
+	}
+	const { result, root, expires } = verification;
+	if (!result.verified) return reject("The actor document does not satisfy the FEP-ef61 proof policy: " + result.reason.type);
+	if (root == null) return reject("The actor document could not be expanded.");
+	const refuse = (url) => Promise.reject(/* @__PURE__ */ new Error(`Refusing to fetch ${url}.`));
+	const parseEmbeddedPublicKey = async (node) => {
+		if (isReference(node)) return null;
+		let key;
+		try {
+			key = await CryptographicKey.fromJsonLd(node, {
+				documentLoader: refuse,
+				contextLoader: options.contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			return null;
+		}
+		return key.publicKey == null ? null : key;
+	};
+	let verifiedActor;
+	try {
+		verifiedActor = await Object$1.fromJsonLd(root, {
+			documentLoader: refuse,
+			contextLoader: options.contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject("The verified actor document is malformed.");
+	}
+	const rootId = root["@id"];
+	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId || typeof rootId !== "string" || getRawCanonicalPortableId(rootId) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
+	actor = verifiedActor;
+	const findKeyNodes = (values) => findNodes(values, claimedKeyId, isGatewayKey ? keyId.origin : null);
+	const assertionNodes = findKeyNodes(root[`${SEC}assertionMethod`]);
+	const publicKeyNodes = findKeyNodes(root[`${SEC}publicKey`]);
+	if (assertionNodes.length > 1 || publicKeyNodes.length > 1) return reject("The actor document has more than one key with the ID.");
+	let publicKey;
+	if (assertionNodes.length > 0) {
+		if (isReference(assertionNodes[0])) return reject("The actor document does not embed the key in its assertionMethod.");
+		let multikey;
+		try {
+			multikey = await Multikey.fromJsonLd(assertionNodes[0], {
+				documentLoader: refuse,
+				contextLoader: options.contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			return reject("The key in the assertionMethod is malformed.");
+		}
+		if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
+		if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
+		publicKey = multikey.publicKey;
+		if (publicKeyNodes.length > 0 && !isReference(publicKeyNodes[0])) {
+			const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
+			if (embedded == null || !await isSamePublicKey(embedded.publicKey, publicKey) || embedded.ownerId != null && getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
+		}
+	} else {
+		if (publicKeyNodes.length < 1) return reject("The actor document embeds the key in neither its assertionMethod nor its publicKey.");
+		const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
+		if (embedded == null) return reject("The key in the publicKey is not embedded or malformed.");
+		if (embedded.ownerId == null || getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The owner of the key is not the actor.");
+		publicKey = embedded.publicKey;
+	}
+	if (isGatewayKey) {
+		if (!actor.gateways.some((gateway) => isGatewayUrl(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
+	} else if (!actor.gateways.some(isGatewayUrl)) return reject("The actor has no valid gateways.");
+	const key = new CryptographicKey({
+		id: keyId,
+		owner: actor.id,
+		publicKey
+	});
+	return {
+		type: "verified",
+		actor,
+		key,
+		...expires == null ? {} : { expires }
+	};
+}
+/**
+* Fetches the document at a compatible key ID, and resolves the key as
+* a gateway key if the document is a portable actor.
+*
+* @param keyId The key ID, which must be a compatible key ID.
+* @param options Loaders and telemetry providers.
+* @returns `legacy` if the document cannot be fetched or is not a portable
+*          actor, which leaves the key to the usual resolution; otherwise,
+*          the result of {@link verifyPortableGatewayKeyDocument}.
+* @internal
+*/
+async function fetchPortableGatewayKey(keyId, options = {}) {
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	let remoteDocument;
+	try {
+		remoteDocument = await documentLoader(keyId.href);
+	} catch (error) {
+		logger.debug("Failed to fetch key {keyId}: {error}", {
+			keyId: keyId.href,
+			error
+		});
+		return { type: "legacy" };
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(remoteDocument.document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return { type: "legacy" };
+	}
+	if (!isPortableActorDocument(object)) return { type: "legacy" };
+	return await verifyPortableGatewayKeyDocument(remoteDocument.document, object, keyId, {
+		...options,
+		documentLoader,
+		contextLoader
+	});
+}
+/**
+* Resolves a key of a portable actor at an `ap:` or `ap+ef61:` key ID, e.g.,
+* `ap://did:key:z6Mk…/actor#main-key`.  Such a key ID names no gateway, so
+* the actor's document, i.e., the key ID without its fragment, is fetched
+* through the gateways in its `@gateway` location hints, one after another,
+* until one of them serves a document that vouches for the key.  Without
+* location hints, the document loader is asked for the `ap:` URI itself,
+* which only a custom document loader can resolve.  The hints are chosen by
+* whoever made the signature, but that does not matter: only a document with
+* a valid proof by the DID of the key ID vouches for the key.
+*
+* The key is taken as a key of the actor itself, not of a gateway, so it is
+* accepted by the rules of {@link verifyPortableGatewayKeyDocument}, except
+* that it is listed under the `ap:` or `ap+ef61:` URI with the same canonical
+* ID as the key ID, and that the actor only has to have a valid gateway.
+* The key ID must have a fragment; a key served as a standalone document is
+* not supported.
+*
+* If no gateway serves a document that vouches for the key, the result is
+* `rejected` only if every gateway served a document that definitely does not
+* vouch for it.  If every gateway failed to serve a document at all, the
+* result is a cacheable `unavailable`, with the error of the first gateway if
+* every gateway responded with the same HTTP status, so that the status
+* describes the whole lookup.  Otherwise, e.g., if one gateway was
+* unreachable and another served an invalid document, nothing tells what the
+* unreachable gateway would have served, so the result is an `unavailable`
+* that is not cacheable.
+*
+* @param keyId The key ID, which must be an `ap:` or `ap+ef61:` URI.
+* @param options Loaders and telemetry providers.
+* @returns The resolution, which is never `legacy`.
+* @internal
+*/
+async function resolvePortableActorKey(keyId, options = {}) {
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	let formattedKeyId = keyId.href;
+	const reject = (reason) => {
+		logger.debug("Failed to verify key {keyId} of a portable actor: {reason}", {
+			keyId: formattedKeyId,
+			reason
+		});
+		return {
+			type: "rejected",
+			reason
+		};
+	};
+	if (!isPortableUri(keyId) || getCanonicalPortableId(keyId) == null) return reject("The key ID is not a valid ap: or ap+ef61: URI.");
+	formattedKeyId = formatIri(keyId);
+	if (keyId.hash === "" || keyId.hash === "#") return reject("The key ID has no fragment; only keys embedded in actor documents are supported.");
+	const actorUrl = new URL(keyId.href);
+	actorUrl.hash = "";
+	const requestUrls = [];
+	for (const gateway of getPortableGatewayCandidates(actorUrl)) try {
+		requestUrls.push(toCompatibleEf61Id(actorUrl, gateway).href);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject(`The key ID cannot be fetched from gateways: ${error}`);
+	}
+	if (requestUrls.length < 1) requestUrls.push(formatIri(actorUrl));
+	const attempts = [];
+	for (const url of requestUrls) {
+		let remoteDocument;
+		try {
+			remoteDocument = await documentLoader(url);
+		} catch (error) {
+			logger.debug("Failed to fetch the actor of key {keyId} from {url}: {error}", {
+				keyId: formattedKeyId,
+				url,
+				error
+			});
+			attempts.push({
+				type: "retrievalFailed",
+				error
+			});
+			continue;
+		}
+		let resolution;
+		try {
+			const object = await Object$1.fromJsonLd(remoteDocument.document, {
+				documentLoader,
+				contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+			resolution = isPortableActorDocument(object) ? await verifyPortableKeyDocument(remoteDocument.document, object, keyId, false, {
+				...options,
+				documentLoader,
+				contextLoader
+			}) : {
+				type: "rejected",
+				reason: "The document is not a portable actor."
+			};
+		} catch (error) {
+			if (error instanceof TypeError) resolution = {
+				type: "rejected",
+				reason: `The document is malformed: ${error.message}`
+			};
+			else {
+				logger.debug("Failed to process the actor of key {keyId} served from {url}: {error}", {
+					keyId: formattedKeyId,
+					url,
+					error
+				});
+				attempts.push({
+					type: "indeterminate",
+					error
+				});
+				continue;
+			}
+		}
+		if (resolution.type === "verified") return resolution;
+		const reason = resolution.type === "rejected" ? resolution.reason : "The document is not a portable actor.";
+		logger.debug("The actor document served from {url} does not vouch for key {keyId}: {reason}", {
+			keyId: formattedKeyId,
+			url,
+			reason
+		});
+		attempts.push({
+			type: "rejected",
+			reason
+		});
+	}
+	const rejections = attempts.flatMap((a) => a.type === "rejected" ? [a.reason] : []);
+	if (rejections.length === attempts.length) return reject(rejections.join(" "));
+	const errors = attempts.flatMap((a) => a.type === "rejected" ? [] : [a.error]);
+	const aggregate = errors.length === 1 ? errors[0] : new AggregateError(errors, `Failed to fetch the actor of key ${formattedKeyId} from any of its gateways: ${requestUrls.join(", ")}`);
+	if (attempts.every((a) => a.type === "retrievalFailed")) {
+		const statuses = errors.map((error) => error instanceof FetchError ? error.response?.status : void 0);
+		return {
+			type: "unavailable",
+			error: statuses[0] != null && statuses.every((status) => status === statuses[0]) ? errors[0] : aggregate,
+			cacheable: true
+		};
+	}
+	return {
+		type: "unavailable",
+		error: new Error(`Could not determine whether the actor of key ${formattedKeyId} vouches for it.`, { cause: aggregate }),
+		cacheable: false
+	};
+}
+/**
+* Finds the nodes that stand for the key with the given canonical portable
+* ID.  A node whose ID is an `ap:` or `ap+ef61:` URI stands for the key
+* itself, e.g., Mitra lists the keys of portable actors that way while
+* signing requests with compatible key IDs.  A node whose ID is a compatible
+* identifier stands for a gateway's key, so it matches only a compatible key
+* ID on the same gateway; a key ID that names no gateway never selects
+* a gateway's key, even with the same fragment.
+* @param values The expanded values of a key property.
+* @param canonicalKeyId The canonical portable ID of the key ID.
+* @param gateway The origin of the gateway whose key the key ID names, or
+*                `null` if the key ID names no gateway.
+*/
+function findNodes(values, canonicalKeyId, gateway) {
+	if (!Array.isArray(values)) return [];
+	const nodes = [];
+	for (const value of values) {
+		if (value == null || typeof value !== "object" || Array.isArray(value)) continue;
+		const node = value;
+		const nodeId = node["@id"];
+		if (typeof nodeId !== "string") continue;
+		if (getRawCanonicalPortableId(nodeId) !== canonicalKeyId) continue;
+		const parsed = parseIri(nodeId);
+		if (isPortableUri(parsed) || parsed.origin === gateway) nodes.push(node);
+	}
+	return nodes;
+}
+/** A node with nothing but an `@id` is a reference, not an embedded key. */
+function isReference(node) {
+	return Object.keys(node).every((key) => key === "@id");
+}
+//#endregion
+export { resolvePortableActorKey as n, verifyPortableGatewayKeyDocument as r, fetchPortableGatewayKey as t };