@fedify/fedify 2.4.0-dev.2122 → 2.4.0-dev.2129

package/dist/{federation-Ml6NrgRV.cjs → federation-DRY8KrkB.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-4bmgw-mA.cjs");
+const require_http = require("./http-B1J6E-bT.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-DkA0Lz7v.cjs");
-const require_kv_cache = require("./kv-cache-D2Bz6t_c.cjs");
+const require_portable_collection = require("./portable-collection-PTGD0q70.cjs");
+const require_kv_cache = require("./kv-cache-D9nRbG2Q.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -4512,7 +4512,8 @@ async function handleInboxInternal(request, parameters, span) {
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
-				tracerProvider
+				tracerProvider,
+				verifyPortableObject: ctx.verifyPortableObject
 			});
 		} catch (error) {
 			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
@@ -4670,7 +4671,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableGatewayKey(httpSigKey))) {
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableActorKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
@@ -4714,7 +4715,7 @@ async function handleInboxInternal(request, parameters, span) {
 			});
 		}
 	}
-	if (httpSigKey != null && !await require_owner.doesActorOwnKey(activity, httpSigKey, ctx)) {
+	if (httpSigKey != null && !await require_portable_collection.doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		require_http.getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : require_http.getRemoteHost(httpSigKey.id));
 		logger.error("The signer ({keyId}) and the actor ({actorId}) do not match.", {
@@ -5451,13 +5452,13 @@ const MIN_COMPONENTS = [
 	"@authority"
 ];
 /**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
+* Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
+* actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
+* URI, and it is owned by a portable actor, which only the portable actor's
+* signed document can establish.
 */
-function isPortableGatewayKey(key) {
-	return key?.id != null && require_http.isCompatibleKeyId(key.id) && key.ownerId != null && require_http.isPortableId(key.ownerId);
+function isPortableActorKey(key) {
+	return key?.id != null && require_http.isPortableKeyId(key.id) && key.ownerId != null && require_http.isPortableId(key.ownerId);
 }
 /**
 * Checks whether an activity needs an Object Integrity Proof by its DID:
@@ -5894,7 +5895,7 @@ async function signOutgoingActivity(activity, candidates, options) {
 		hasProof = true;
 		break;
 	}
-	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !require_http.isCompatibleKeyId(c.verificationMethod));
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !require_http.isPortableKeyId(c.verificationMethod));
 	if (!hasProof && activity.id != null && require_http.isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
 	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
 		activity,
@@ -7211,11 +7212,16 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			return parsedActorIds;
 		};
-		const parseActivity = () => _fedify_vocab.Activity.fromJsonLd(message.activity, {
-			contextLoader: this.contextLoaderFactory(loaderOptions),
-			documentLoader: rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions),
-			tracerProvider: this.tracerProvider
-		});
+		const parseActivity = () => {
+			const contextLoader = this.contextLoaderFactory(loaderOptions);
+			const documentLoader = rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions);
+			return _fedify_vocab.Activity.fromJsonLd(message.activity, {
+				contextLoader,
+				documentLoader,
+				tracerProvider: this.tracerProvider,
+				verifyPortableObject: createPortableObjectVerifier(documentLoader, contextLoader, this)
+			});
+		};
 		const enqueueHeldOutboxMessage = async (delay, heldSince) => {
 			const { outboxQueue } = this;
 			if (outboxQueue == null) return;
@@ -7857,7 +7863,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const ldSignable = !require_http.hasPortableActor(activity);
 		for (const { keyId, privateKey } of keys) {
 			require_http.validateCryptoKey(privateKey, "private");
-			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !require_http.isCompatibleKeyId(keyId)) rsaKey = {
+			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !require_http.isPortableKeyId(keyId)) rsaKey = {
 				keyId,
 				privateKey
 			};
@@ -8691,12 +8697,28 @@ function getCollectionMetricRoute(routeName) {
 	}
 }
 const FANOUT_THRESHOLD = 5;
+/**
+* Creates the FEP-ef61 portable object verifier that a context applies to
+* portable objects it dereferences: `verifyPortableObject()` with the given
+* loaders and the federation's tracer provider as defaults.  Other options,
+* such as the document URL, gateways, and referrer, are passed through as
+* they are.
+*/
+function createPortableObjectVerifier(documentLoader, contextLoader, federation) {
+	return (document, options = {}) => require_portable_collection.verifyPortableObject(document, {
+		...options,
+		documentLoader: options.documentLoader ?? documentLoader,
+		contextLoader: options.contextLoader ?? contextLoader,
+		tracerProvider: options.tracerProvider ?? federation.tracerProvider
+	});
+}
 var ContextImpl = class ContextImpl {
 	url;
 	federation;
 	data;
 	documentLoader;
 	contextLoader;
+	verifyPortableObject;
 	invokedFromActorKeyPairsDispatcher;
 	#codec;
 	constructor({ url, federation, data, documentLoader, contextLoader, invokedFromActorKeyPairsDispatcher }) {
@@ -8705,6 +8727,7 @@ var ContextImpl = class ContextImpl {
 		this.data = data;
 		this.documentLoader = documentLoader;
 		this.contextLoader = contextLoader;
+		this.verifyPortableObject = createPortableObjectVerifier(documentLoader, contextLoader, federation);
 		this.invokedFromActorKeyPairsDispatcher = invokedFromActorKeyPairsDispatcher;
 	}
 	/**
@@ -9056,7 +9079,7 @@ var ContextImpl = class ContextImpl {
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			meterProvider: options.meterProvider ?? this.meterProvider,
-			verifyPortableObject: options.verifyPortableObject ?? require_http.verifyPortableObjectProof,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
@@ -9064,7 +9087,8 @@ var ContextImpl = class ContextImpl {
 		return (0, _fedify_vocab.traverseCollection)(collection, {
 			...options,
 			documentLoader: options.documentLoader ?? this.documentLoader,
-			contextLoader: options.contextLoader ?? this.contextLoader
+			contextLoader: options.contextLoader ?? this.contextLoader,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject
 		});
 	}
 	lookupNodeInfo(url, options = {}) {
@@ -9490,7 +9514,7 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 		const key = await this.getSignedKey(options);
 		if (key == null) return this.#signedKeyOwner = null;
 		try {
-			return this.#signedKeyOwner = await require_owner.getKeyOwner(key, {
+			return this.#signedKeyOwner = await require_portable_collection.getKeyOwner(key, {
 				contextLoader: options.contextLoader ?? this.contextLoader,
 				documentLoader: options.documentLoader ?? this.documentLoader,
 				tracerProvider: options.tracerProvider ?? this.tracerProvider