@fedify/fedify 2.4.0-dev.2122 → 2.4.0-dev.2129

package/dist/{http-BrQgkJay.d.ts → http-CjezPjFX.d.cts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { Actor, CryptographicKey, Multikey } from "@fedify/vocab";
-import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader } from "@fedify/vocab-runtime";
+import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 
 //#region src/sig/portable-key.d.ts
 /**
@@ -29,6 +29,28 @@ type PortableGatewayKeyResolution = {
   */
   readonly expires?: Temporal.Instant;
 };
+/**
+* The result of resolving a key of a portable actor at an `ap:` or
+* `ap+ef61:` key ID.
+* @internal
+*/
+type PortableActorKeyResolution = Exclude<PortableGatewayKeyResolution, {
+  readonly type: "legacy";
+}> | {
+  /**
+  * Whether the actor's document vouches for the key could not be
+  * determined, e.g., because no gateway could be reached.
+  */
+  readonly type: "unavailable";
+  readonly error: unknown;
+  /**
+  * Whether the failure can be cached as a failure to fetch the key, i.e.,
+  * every gateway failed to serve the actor's document at all.  A failure
+  * that is not cacheable comes with an error that has no HTTP status,
+  * since none of the statuses describes the lookup as a whole.
+  */
+  readonly cacheable: boolean;
+};
 //#endregion
 //#region src/sig/key.d.ts
 /**
@@ -119,17 +141,34 @@ interface FetchKeyOptions {
   */
   keyIdBoundByCaller?: boolean;
   /**
-  * Resolves a gateway key of an [FEP-ef61] portable actor, i.e., a key whose
-  * ID is a compatible identifier and dereferences to a portable actor's
-  * document.  Such a key is resolved only through this function, and is
-  * rejected if it is omitted, so that only HTTP Signature verification,
-  * which passes it, accepts gateway keys.  Object Integrity Proofs and
-  * Linked Data Signatures never do.
+  * Resolves keys of [FEP-ef61] portable actors, which only HTTP Signature
+  * verification passes, so that only it accepts them.  Object Integrity
+  * Proofs and Linked Data Signatures never do: such a key is rejected if
+  * this is omitted.
   *
   * [FEP-ef61]: https://w3id.org/fep/ef61
   * @internal
   */
-  portableGatewayKeyResolver?: (document: unknown, actor: Actor, keyId: URL) => Promise<PortableGatewayKeyResolution>;
+  portableKeyResolvers?: PortableKeyResolvers;
+}
+/**
+* Resolves keys of [FEP-ef61] portable actors for HTTP Signature
+* verification.  See {@link FetchKeyOptions.portableKeyResolvers}.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+interface PortableKeyResolvers {
+  /**
+  * Resolves a gateway key, i.e., a key whose ID is a compatible identifier
+  * and dereferences to a portable actor's document.
+  */
+  gatewayKey(document: unknown, actor: Actor, keyId: URL): Promise<PortableGatewayKeyResolution>;
+  /**
+  * Resolves a key of a portable actor itself, i.e., a key whose ID is an
+  * `ap:` or `ap+ef61:` URI.
+  */
+  actorKey(keyId: URL): Promise<PortableActorKeyResolution>;
 }
 /**
 * The result of {@link fetchKey}.
@@ -182,9 +221,11 @@ type FetchableKeyClass<T extends CryptographicKey | Multikey> = (new (...args: a
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
@@ -204,9 +245,11 @@ declare function fetchKey<T extends CryptographicKey | Multikey>(keyId: URL | st
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 *

package/dist/{key-PyYvun0F.mjs → key-DolJjJab.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BZrnW0Qz.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DCLoLvLz.mjs";
-import { a as isCompatibleKeyId, o as isPortableActorDocument, s as isPortableId } from "./portable-key-id-T7lecIbt.mjs";
+import { n as version, t as name } from "./deno-_o3lkDlG.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-CDaHfBXY.mjs";
+import { c as isPortableId, f as parseKeyIdString, o as isCompatibleKeyId, s as isPortableActorDocument, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
@@ -236,6 +236,17 @@ function bypassKeyCacheReads(keyCache) {
 	};
 	return bypassed;
 }
+/**
+* Parses a key ID given as a string.  Unlike `new URL()`, it accepts `ap:`
+* and `ap+ef61:` URIs, and refuses a portable or compatible key ID whose
+* identity URL parsing would change, e.g., by resolving dot segments.
+* @throws {TypeError} If the key ID is invalid.
+*/
+function parseKeyIdOrThrow(keyId) {
+	const parsed = parseKeyIdString(keyId);
+	if (parsed == null) throw new TypeError(`Invalid key ID: ${keyId}`);
+	return parsed;
+}
 async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 	tracerProvider ??= trace.getTracerProvider();
 	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
@@ -272,9 +283,11 @@ async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
@@ -287,7 +300,7 @@ async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 * @since 1.3.0
 */
 function fetchKey(keyId, cls, options = {}) {
-	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
+	keyId = typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId;
 	return withFetchKeySpan(keyId, options.tracerProvider, () => fetchKeyInternal(keyId, cls, options));
 }
 /**
@@ -297,9 +310,11 @@ function fetchKey(keyId, cls, options = {}) {
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 *
@@ -313,7 +328,7 @@ function fetchKey(keyId, cls, options = {}) {
 * @since 2.1.0
 */
 async function fetchKeyDetailed(keyId, cls, options = {}) {
-	const cacheKey = typeof keyId === "string" ? new URL(keyId) : keyId;
+	const cacheKey = typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId;
 	return await withFetchKeySpan(cacheKey, options.tracerProvider, async () => {
 		return await fetchKeyWithResult(cacheKey, cls, options, async (cacheKey, keyId, keyCache, logger) => {
 			const fetchError = await keyCache?.getFetchError?.(cacheKey);
@@ -452,7 +467,7 @@ async function resolveDidKey(cacheKey, cls, keyCache, logger) {
 		cached: false
 	};
 }
-async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableGatewayKeyResolver }, logger) {
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableKeyResolvers }, logger) {
 	let object;
 	try {
 		object = await Object$1.fromJsonLd(document, {
@@ -483,7 +498,7 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 	}
 	if (isCompatibleKeyId(cacheKey) && isPortableActorDocument(object)) {
 		const scopedCache = keyCache;
-		if (portableGatewayKeyResolver == null || cls !== CryptographicKey) {
+		if (portableKeyResolvers == null || cls !== CryptographicKey) {
 			logger.debug("Failed to verify; key {keyId} is a gateway key of the portable actor {actorId}, which is only accepted for HTTP Signatures.", {
 				keyId,
 				actorId: object.id?.href
@@ -494,7 +509,7 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 				cached: false
 			};
 		}
-		const resolution = await portableGatewayKeyResolver(document, object, cacheKey);
+		const resolution = await portableKeyResolvers.gatewayKey(document, object, cacheKey);
 		if (resolution.type !== "verified") {
 			logger.debug("Failed to verify; the portable actor {actorId} does not vouch for its gateway key {keyId}.", {
 				keyId,
@@ -654,6 +669,11 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 		]);
 		const keyId = cacheKey.href;
 		const keyCache = options.keyCache;
+		if (isPortableUri(cacheKey)) {
+			const result = await fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger);
+			outcome = result.outcome;
+			return result.result;
+		}
 		if (isCompatibleKeyId(cacheKey)) {
 			const result = await fetchCompatibleKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger);
 			outcome = result.outcome;
@@ -705,7 +725,7 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 */
 function getCompatibleKeyScope(cls, options) {
 	if (cls !== CryptographicKey) return "multikey";
-	return options.portableGatewayKeyResolver == null ? "cryptographicKey" : "httpSignature";
+	return options.portableKeyResolvers == null ? "cryptographicKey" : "httpSignature";
 }
 /**
 * Looks up a key at an [FEP-ef61] compatible identifier.  Such a key may be
@@ -759,8 +779,75 @@ async function fetchCompatibleKey(cacheKey, cls, options, onCachedUnavailable, o
 		outcome: { result: resolved.key != null ? "fetched" : "invalid" }
 	};
 }
+/**
+* Looks up a key of an [FEP-ef61] portable actor at an `ap:` or `ap+ef61:`
+* key ID.  Such a key is accepted only for HTTP Signatures, and is rejected
+* for any other purpose without being fetched.  Like keys at compatible
+* identifiers, what it resolves to is cached in the namespace of the lookup's
+* purpose, and a failure to fetch the actor's document from every gateway is
+* cached in the shared namespace.  A failure that is neither, e.g., one
+* gateway being unreachable while another served an invalid document, is not
+* cached at all.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+async function fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger) {
+	const keyId = cacheKey.href;
+	const resolvers = options.portableKeyResolvers;
+	if (resolvers == null || cls !== CryptographicKey) {
+		logger.debug("Failed to verify; key {keyId} is a key of a portable actor, which is only accepted for HTTP Signatures.", { keyId });
+		return {
+			result: {
+				key: null,
+				cached: false
+			},
+			outcome: { result: "invalid" }
+		};
+	}
+	const sharedCache = options.keyCache;
+	const scopedCache = sharedCache?.compatibleKeyScope?.("httpSignature");
+	const cached = await getCachedFetchKey(cacheKey, keyId, cls, scopedCache, logger);
+	if (cached != null) return {
+		result: cached,
+		outcome: { result: "hit" }
+	};
+	if (await sharedCache?.get(cacheKey) === null) {
+		logger.debug("Entry {keyId} found in cache, but it could not be fetched.", { keyId });
+		return {
+			result: await onCachedUnavailable(cacheKey, keyId, sharedCache, logger),
+			outcome: { result: "hit" }
+		};
+	}
+	logger.debug("Resolving key {keyId} to verify signature...", { keyId });
+	const resolution = await resolvers.actorKey(cacheKey);
+	if (resolution.type === "verified") {
+		await scopedCache?.set(cacheKey, resolution.key, { expires: resolution.expires });
+		return {
+			result: {
+				key: resolution.key,
+				cached: false
+			},
+			outcome: { result: "fetched" }
+		};
+	}
+	if (resolution.type === "rejected") {
+		await scopedCache?.set(cacheKey, null);
+		return {
+			result: {
+				key: null,
+				cached: false
+			},
+			outcome: { result: "invalid" }
+		};
+	}
+	await scopedCache?.delete(cacheKey);
+	return {
+		result: await onFetchError(resolution.error, cacheKey, keyId, resolution.cacheable ? sharedCache : void 0, logger),
+		outcome: resolution.cacheable ? classifyFetchError(resolution.error) : { result: "error" }
+	};
+}
 async function fetchKeyInternal(keyId, cls, options = {}) {
-	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
+	return await fetchKeyWithResult(typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
 		return {
 			key: null,
 			cached: true

package/dist/{kv-cache-CPqUxRL3.mjs → kv-cache-Bq2cah0c.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-DCLoLvLz.mjs";
+import { p as recordDocumentCache } from "./metrics-CDaHfBXY.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-C4mv2ZFQ.js → kv-cache-D7TiyMxv.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { H as validateCryptoKey, et as recordDocumentCache, t as doubleKnock } from "./http-BETASGl0.js";
+import { U as validateCryptoKey, t as doubleKnock, tt as recordDocumentCache } from "./http-C2M6wcs8.js";
 import { getLogger } from "@logtape/logtape";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";
@@ -24,21 +24,21 @@ const logger$1 = getLogger([
 function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, tracerProvider } = {}) {
 	validateCryptoKey(identity.privateKey);
 	async function load(url, options) {
-		await validateUrl(url);
+		await validateUrl(url, options);
 		return getRemoteDocument(url, await doubleKnock(createActivityPubRequest(url, { userAgent }), identity, {
 			maxRedirection,
 			specDeterminer,
 			log: curry(logRequest)(logger$1),
 			tracerProvider,
 			signal: options?.signal,
-			validateRedirect: validateUrl
-		}), load);
+			validateRedirect: (url) => validateUrl(url, options)
+		}), load, options);
 	}
-	async function validateUrl(url) {
+	async function validateUrl(url, options) {
 		if (!allowPrivateAddress) try {
 			await validatePublicUrl(url);
 		} catch (error) {
-			if (error instanceof UrlError) logger$1.error("Disallowed private URL: {url}", {
+			if (error instanceof UrlError) logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
 				url,
 				error
 			});

package/dist/{kv-cache-D2Bz6t_c.cjs → kv-cache-D9nRbG2Q.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-4bmgw-mA.cjs");
+const require_http = require("./http-B1J6E-bT.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");
@@ -23,21 +23,21 @@ const logger$1 = (0, _logtape_logtape.getLogger)([
 function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, tracerProvider } = {}) {
 	require_http.validateCryptoKey(identity.privateKey);
 	async function load(url, options) {
-		await validateUrl(url);
+		await validateUrl(url, options);
 		return (0, _fedify_vocab_runtime.getRemoteDocument)(url, await require_http.doubleKnock((0, _fedify_vocab_runtime.createActivityPubRequest)(url, { userAgent }), identity, {
 			maxRedirection,
 			specDeterminer,
 			log: (0, es_toolkit.curry)(_fedify_vocab_runtime.logRequest)(logger$1),
 			tracerProvider,
 			signal: options?.signal,
-			validateRedirect: validateUrl
-		}), load);
+			validateRedirect: (url) => validateUrl(url, options)
+		}), load, options);
 	}
-	async function validateUrl(url) {
+	async function validateUrl(url, options) {
 		if (!allowPrivateAddress) try {
 			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
 		} catch (error) {
-			if (error instanceof _fedify_vocab_runtime.UrlError) logger$1.error("Disallowed private URL: {url}", {
+			if (error instanceof _fedify_vocab_runtime.UrlError) logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
 				url,
 				error
 			});

package/dist/{ld-u4JOD4iO.mjs → ld-Dwc176V4.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BZrnW0Qz.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DCLoLvLz.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-PyYvun0F.mjs";
+import { n as version, t as name } from "./deno-_o3lkDlG.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CDaHfBXY.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-DolJjJab.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-DCLoLvLz.mjs → metrics-CDaHfBXY.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BZrnW0Qz.mjs";
+import { n as version, t as name } from "./deno-_o3lkDlG.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-B7bmtONC.mjs → middleware-CmB1FD8A.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-CgOqRkK-.mjs";
+import { n as FederationImpl } from "./middleware-DN3MdTDg.mjs";
 export { FederationImpl };

package/dist/{middleware-DWlAGlyP.js → middleware-CylX-pvI.js}

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as recordCollectionTotalItems, A as isInvalidUrlTypeError, C as compactJsonLd, D as hasSignature, E as getNormalizationContextLoader, F as wrapContextLoaderForJsonLd, G as getFederationMetrics, H as validateCryptoKey, I as exportJwk, J as isAbortError, K as getRemoteHost, M as verifyCompactJsonLd, O as hasSignatureLike, Q as recordCollectionRequest, T as detachSignature, V as importJwk, W as getDurationMs, X as recordCollectionDispatchDuration, Y as recordCircuitBreakerStateChange, Z as recordCollectionPageItems, _ as verifyPortableObjectProofWithRoot, _t as isPortableId, at as recordWebFingerHandle, b as InvalidContextReferenceError, bt as name, ct as formatAcceptSignature, d as hasProofLike, f as signObject, ft as getCanonicalPortableId, g as verifyPortableObjectProofPolicy, gt as isCompatibleKeyId, h as verifyPortableObjectProof, ht as hasPortableActor, i as selectRequestSignature, it as recordOutboxEnqueue, j as signJsonLd, k as isClearlyMalformedContextReference, l as InvalidPortableObjectIdError, m as verifyObject, mt as getPortableDid, n as listRequestSignatures, nt as recordInboxActivity, o as verifyRequest, ot as registerQueueDepthGauge, p as verifyMapLocalProof, pt as getGatewayKeyBase, q as instrumentDocumentLoader, r as parseRfc9421SignatureInput, rt as recordOutboxActivity, s as verifyRequestDetailed, st as preloadedOnlyDocumentLoader, t as doubleKnock, tt as recordFanoutRecipients, vt as isPortableUri, x as assertSafeJsonLd, xt as version, y as normalizeOutgoingActivityJsonLd } from "./http-BETASGl0.js";
+import { $ as recordCollectionRequest, A as isClearlyMalformedContextReference, Ct as version, D as getNormalizationContextLoader, E as detachSignature, G as getDurationMs, H as importJwk, I as wrapContextLoaderForJsonLd, J as instrumentDocumentLoader, K as getFederationMetrics, L as exportJwk, M as signJsonLd, N as verifyCompactJsonLd, O as hasSignature, Q as recordCollectionPageItems, S as assertSafeJsonLd, St as name, U as validateCryptoKey, X as recordCircuitBreakerStateChange, Y as isAbortError, Z as recordCollectionDispatchDuration, _ as verifyPortableObjectProofPolicy, _t as isCompatibleKeyId, at as recordOutboxEnqueue, b as normalizeOutgoingActivityJsonLd, bt as isPortableUri, ct as preloadedOnlyDocumentLoader, et as recordCollectionTotalItems, f as hasProofLike, g as verifyPortableObjectProof, gt as hasPortableActor, h as verifyObject, ht as getPortableDid, i as selectRequestSignature, it as recordOutboxActivity, j as isInvalidUrlTypeError, k as hasSignatureLike, lt as formatAcceptSignature, m as verifyMapLocalProof, mt as getGatewayKeyBase, n as listRequestSignatures, nt as recordFanoutRecipients, o as verifyRequest, ot as recordWebFingerHandle, p as signObject, pt as getCanonicalPortableId, q as getRemoteHost, r as parseRfc9421SignatureInput, rt as recordInboxActivity, s as verifyRequestDetailed, st as registerQueueDepthGauge, t as doubleKnock, u as InvalidPortableObjectIdError, v as verifyPortableObjectProofWithRoot, vt as isPortableId, w as compactJsonLd, x as InvalidContextReferenceError, yt as isPortableKeyId } from "./http-C2M6wcs8.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-wNinn7RK.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-C4mv2ZFQ.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-CgglAI9B.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-D7TiyMxv.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -3668,13 +3668,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$1.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$1),
+		kind: getCollectionMetricKind(name$2),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -3715,7 +3715,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$1, filterPredicate);
+						const items = filterCollectionItems(page.items, name$2, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -3755,7 +3755,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -3771,7 +3771,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$1, filterPredicate);
+					const items = filterCollectionItems(page.items, name$2, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -4506,7 +4506,8 @@ async function handleInboxInternal(request, parameters, span) {
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
-				tracerProvider
+				tracerProvider,
+				verifyPortableObject: ctx.verifyPortableObject
 			});
 		} catch (error) {
 			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
@@ -4664,7 +4665,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableGatewayKey(httpSigKey))) {
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableActorKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
@@ -4959,8 +4960,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$2;
+	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$1;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -5445,13 +5446,13 @@ const MIN_COMPONENTS = [
 	"@authority"
 ];
 /**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
+* Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
+* actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
+* URI, and it is owned by a portable actor, which only the portable actor's
+* signed document can establish.
 */
-function isPortableGatewayKey(key) {
-	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
+function isPortableActorKey(key) {
+	return key?.id != null && isPortableKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
 }
 /**
 * Checks whether an activity needs an Object Integrity Proof by its DID:
@@ -5800,7 +5801,7 @@ async function signOutgoingActivity(activity, candidates, options) {
 		hasProof = true;
 		break;
 	}
-	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isCompatibleKeyId(c.verificationMethod));
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isPortableKeyId(c.verificationMethod));
 	if (!hasProof && activity.id != null && isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
 	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
 		activity,
@@ -7114,11 +7115,16 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			return parsedActorIds;
 		};
-		const parseActivity = () => Activity.fromJsonLd(message.activity, {
-			contextLoader: this.contextLoaderFactory(loaderOptions),
-			documentLoader: rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions),
-			tracerProvider: this.tracerProvider
-		});
+		const parseActivity = () => {
+			const contextLoader = this.contextLoaderFactory(loaderOptions);
+			const documentLoader = rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions);
+			return Activity.fromJsonLd(message.activity, {
+				contextLoader,
+				documentLoader,
+				tracerProvider: this.tracerProvider,
+				verifyPortableObject: createPortableObjectVerifier(documentLoader, contextLoader, this)
+			});
+		};
 		const enqueueHeldOutboxMessage = async (delay, heldSince) => {
 			const { outboxQueue } = this;
 			if (outboxQueue == null) return;
@@ -7760,7 +7766,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const ldSignable = !hasPortableActor(activity);
 		for (const { keyId, privateKey } of keys) {
 			validateCryptoKey(privateKey, "private");
-			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isCompatibleKeyId(keyId)) rsaKey = {
+			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isPortableKeyId(keyId)) rsaKey = {
 				keyId,
 				privateKey
 			};
@@ -8594,12 +8600,28 @@ function getCollectionMetricRoute(routeName) {
 	}
 }
 const FANOUT_THRESHOLD = 5;
+/**
+* Creates the FEP-ef61 portable object verifier that a context applies to
+* portable objects it dereferences: `verifyPortableObject()` with the given
+* loaders and the federation's tracer provider as defaults.  Other options,
+* such as the document URL, gateways, and referrer, are passed through as
+* they are.
+*/
+function createPortableObjectVerifier(documentLoader, contextLoader, federation) {
+	return (document, options = {}) => verifyPortableObject(document, {
+		...options,
+		documentLoader: options.documentLoader ?? documentLoader,
+		contextLoader: options.contextLoader ?? contextLoader,
+		tracerProvider: options.tracerProvider ?? federation.tracerProvider
+	});
+}
 var ContextImpl = class ContextImpl {
 	url;
 	federation;
 	data;
 	documentLoader;
 	contextLoader;
+	verifyPortableObject;
 	invokedFromActorKeyPairsDispatcher;
 	#codec;
 	constructor({ url, federation, data, documentLoader, contextLoader, invokedFromActorKeyPairsDispatcher }) {
@@ -8608,6 +8630,7 @@ var ContextImpl = class ContextImpl {
 		this.data = data;
 		this.documentLoader = documentLoader;
 		this.contextLoader = contextLoader;
+		this.verifyPortableObject = createPortableObjectVerifier(documentLoader, contextLoader, federation);
 		this.invokedFromActorKeyPairsDispatcher = invokedFromActorKeyPairsDispatcher;
 	}
 	/**
@@ -8959,7 +8982,7 @@ var ContextImpl = class ContextImpl {
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			meterProvider: options.meterProvider ?? this.meterProvider,
-			verifyPortableObject: options.verifyPortableObject ?? verifyPortableObjectProof,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
@@ -8967,7 +8990,8 @@ var ContextImpl = class ContextImpl {
 		return traverseCollection(collection, {
 			...options,
 			documentLoader: options.documentLoader ?? this.documentLoader,
-			contextLoader: options.contextLoader ?? this.contextLoader
+			contextLoader: options.contextLoader ?? this.contextLoader,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject
 		});
 	}
 	lookupNodeInfo(url, options = {}) {