@fedify/fedify 2.4.0-dev.2122 → 2.4.0-dev.2129

package/dist/{middleware-CgOqRkK-.mjs → middleware-DN3MdTDg.mjs}

@@ -1,28 +1,29 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BZrnW0Qz.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DCLoLvLz.mjs";
+import { n as version, t as name } from "./deno-_o3lkDlG.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-CDaHfBXY.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
-import { a as isCompatibleKeyId, c as isPortableUri, i as hasPortableActor, n as getGatewayKeyBase, r as getPortableDid, s as isPortableId, t as getCanonicalPortableId } from "./portable-key-id-T7lecIbt.mjs";
-import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-PyYvun0F.mjs";
+import { a as hasPortableActor, c as isPortableId, l as isPortableKeyId, n as getGatewayKeyBase, o as isCompatibleKeyId, r as getPortableDid, t as getCanonicalPortableId, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
+import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-DolJjJab.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-u4JOD4iO.mjs";
-import { i as signObject, l as verifyPortableObjectProofWithRoot, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, t as InvalidPortableObjectIdError } from "./proof-BCOg7Njv.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-B9BQDNIy.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-3BHaS20Z.mjs";
-import { n as kvCache } from "./kv-cache-CPqUxRL3.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-Dwc176V4.mjs";
+import { i as signObject, l as verifyPortableObjectProofWithRoot, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, t as InvalidPortableObjectIdError } from "./proof-B4_0E-KU.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-BpOiZE09.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-BbS0rO-Y.mjs";
+import { n as kvCache } from "./kv-cache-Bq2cah0c.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CPFM-sqo.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-C8eOPat3.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-BCXywsZF.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BNHhwjNu.mjs";
+import { t as verifyPortableObject } from "./portable-collection-CRpTUHCY.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-Dpu5qbP5.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-C0bxZDL0.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-Fxd45Oy5.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-D9Kljk_7.mjs";
 import { t as KvKeyCache } from "./keycache-BInaECGj.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-vjHOhBpy.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-78JVR3GK.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -1311,13 +1312,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$1.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$1),
+		kind: getCollectionMetricKind(name$2),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -1358,7 +1359,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$1, filterPredicate);
+						const items = filterCollectionItems(page.items, name$2, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -1398,7 +1399,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -1414,7 +1415,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$1, filterPredicate);
+					const items = filterCollectionItems(page.items, name$2, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -2149,7 +2150,8 @@ async function handleInboxInternal(request, parameters, span) {
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
-				tracerProvider
+				tracerProvider,
+				verifyPortableObject: ctx.verifyPortableObject
 			});
 		} catch (error) {
 			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
@@ -2307,7 +2309,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableGatewayKey(httpSigKey))) {
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableActorKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
@@ -2602,8 +2604,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$2;
+	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$1;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -3088,13 +3090,13 @@ const MIN_COMPONENTS = [
 	"@authority"
 ];
 /**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
+* Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
+* actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
+* URI, and it is owned by a portable actor, which only the portable actor's
+* signed document can establish.
 */
-function isPortableGatewayKey(key) {
-	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
+function isPortableActorKey(key) {
+	return key?.id != null && isPortableKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
 }
 /**
 * Checks whether an activity needs an Object Integrity Proof by its DID:
@@ -3213,7 +3215,7 @@ async function signOutgoingActivity(activity, candidates, options) {
 		hasProof = true;
 		break;
 	}
-	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isCompatibleKeyId(c.verificationMethod));
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isPortableKeyId(c.verificationMethod));
 	if (!hasProof && activity.id != null && isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
 	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
 		activity,
@@ -4348,11 +4350,16 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			return parsedActorIds;
 		};
-		const parseActivity = () => Activity.fromJsonLd(message.activity, {
-			contextLoader: this.contextLoaderFactory(loaderOptions),
-			documentLoader: rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions),
-			tracerProvider: this.tracerProvider
-		});
+		const parseActivity = () => {
+			const contextLoader = this.contextLoaderFactory(loaderOptions);
+			const documentLoader = rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions);
+			return Activity.fromJsonLd(message.activity, {
+				contextLoader,
+				documentLoader,
+				tracerProvider: this.tracerProvider,
+				verifyPortableObject: createPortableObjectVerifier(documentLoader, contextLoader, this)
+			});
+		};
 		const enqueueHeldOutboxMessage = async (delay, heldSince) => {
 			const { outboxQueue } = this;
 			if (outboxQueue == null) return;
@@ -4994,7 +5001,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const ldSignable = !hasPortableActor(activity);
 		for (const { keyId, privateKey } of keys) {
 			validateCryptoKey(privateKey, "private");
-			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isCompatibleKeyId(keyId)) rsaKey = {
+			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isPortableKeyId(keyId)) rsaKey = {
 				keyId,
 				privateKey
 			};
@@ -5828,12 +5835,28 @@ function getCollectionMetricRoute(routeName) {
 	}
 }
 const FANOUT_THRESHOLD = 5;
+/**
+* Creates the FEP-ef61 portable object verifier that a context applies to
+* portable objects it dereferences: `verifyPortableObject()` with the given
+* loaders and the federation's tracer provider as defaults.  Other options,
+* such as the document URL, gateways, and referrer, are passed through as
+* they are.
+*/
+function createPortableObjectVerifier(documentLoader, contextLoader, federation) {
+	return (document, options = {}) => verifyPortableObject(document, {
+		...options,
+		documentLoader: options.documentLoader ?? documentLoader,
+		contextLoader: options.contextLoader ?? contextLoader,
+		tracerProvider: options.tracerProvider ?? federation.tracerProvider
+	});
+}
 var ContextImpl = class ContextImpl {
 	url;
 	federation;
 	data;
 	documentLoader;
 	contextLoader;
+	verifyPortableObject;
 	invokedFromActorKeyPairsDispatcher;
 	#codec;
 	constructor({ url, federation, data, documentLoader, contextLoader, invokedFromActorKeyPairsDispatcher }) {
@@ -5842,6 +5865,7 @@ var ContextImpl = class ContextImpl {
 		this.data = data;
 		this.documentLoader = documentLoader;
 		this.contextLoader = contextLoader;
+		this.verifyPortableObject = createPortableObjectVerifier(documentLoader, contextLoader, federation);
 		this.invokedFromActorKeyPairsDispatcher = invokedFromActorKeyPairsDispatcher;
 	}
 	/**
@@ -6193,7 +6217,7 @@ var ContextImpl = class ContextImpl {
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			meterProvider: options.meterProvider ?? this.meterProvider,
-			verifyPortableObject: options.verifyPortableObject ?? verifyPortableObjectProof,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
@@ -6201,7 +6225,8 @@ var ContextImpl = class ContextImpl {
 		return traverseCollection(collection, {
 			...options,
 			documentLoader: options.documentLoader ?? this.documentLoader,
-			contextLoader: options.contextLoader ?? this.contextLoader
+			contextLoader: options.contextLoader ?? this.contextLoader,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject
 		});
 	}
 	lookupNodeInfo(url, options = {}) {

package/dist/{mod-CTh7ijx5.d.ts → mod-Bz9tFXI2.d.ts}

@@ -1,8 +1,8 @@
 /// <reference lib="esnext.temporal" />
-import { S as KeyCache } from "./http-BrQgkJay.js";
+import { S as KeyCache } from "./http-C-x_OLSp.js";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
-import { DocumentLoader, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
+import { DocumentLoader, PortableObjectVerifier, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
 
 //#region src/sig/ld.d.ts
 /**
@@ -376,7 +376,18 @@ declare function verifyPortableObjectProof(jsonLd: unknown, options?: VerifyPort
 * Options for {@link verifyObject}.
 * @since 0.10.0
 */
-interface VerifyObjectOptions extends VerifyProofOptions {}
+interface VerifyObjectOptions extends VerifyProofOptions {
+  /**
+  * The default [FEP-ef61] portable object verifier for the property
+  * accessors of the returned object and the objects obtained from it, e.g.,
+  * `Context.verifyPortableObject`.  It is not used to verify the given
+  * object itself.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  * @since 2.4.0
+  */
+  verifyPortableObject?: PortableObjectVerifier;
+}
 /**
 * Verifies the given object.  It will verify all the proofs in the object,
 * and succeed only if all the proofs are valid and all attributions and

package/dist/{mod-Cwdt_CWU.d.ts → mod-CZetqT5h.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { n as HttpMessageSignaturesSpecDeterminer } from "./http-BrQgkJay.js";
+import { n as HttpMessageSignaturesSpecDeterminer } from "./http-C-x_OLSp.js";
 import { n as KvStore, t as KvKey } from "./kv-BhNbN8Ed.js";
 import { t as DocumentFetchKind } from "./metrics-DoRtI0qU.js";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";

package/dist/{mod-Cr79cQlc.d.cts → mod-D4g9ffEn.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { n as HttpMessageSignaturesSpecDeterminer } from "./http-D76Py0M4.cjs";
+import { n as HttpMessageSignaturesSpecDeterminer } from "./http-CjezPjFX.cjs";
 import { n as KvStore, t as KvKey } from "./kv-BhNbN8Ed.cjs";
 import { t as DocumentFetchKind } from "./metrics-DVKYY6K1.cjs";
 import { DocumentLoader, DocumentLoaderFactoryOptions } from "@fedify/vocab-runtime";

package/dist/{mod-DnElMslb.d.cts → mod-DGOIxEfb.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-SMNOiiY6.cjs";
+import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-Dvec_D_h.cjs";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 

package/dist/{mod-DMdGFMEl.d.cts → mod-S--JxYjo.d.cts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
-import { S as KeyCache } from "./http-D76Py0M4.cjs";
+import { S as KeyCache } from "./http-CjezPjFX.cjs";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
-import { DocumentLoader, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
+import { DocumentLoader, PortableObjectVerifier, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 
 //#region src/sig/ld.d.ts
@@ -376,7 +376,18 @@ declare function verifyPortableObjectProof(jsonLd: unknown, options?: VerifyPort
 * Options for {@link verifyObject}.
 * @since 0.10.0
 */
-interface VerifyObjectOptions extends VerifyProofOptions {}
+interface VerifyObjectOptions extends VerifyProofOptions {
+  /**
+  * The default [FEP-ef61] portable object verifier for the property
+  * accessors of the returned object and the objects obtained from it, e.g.,
+  * `Context.verifyPortableObject`.  It is not used to verify the given
+  * object itself.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  * @since 2.4.0
+  */
+  verifyPortableObject?: PortableObjectVerifier;
+}
 /**
 * Verifies the given object.  It will verify all the proofs in the object,
 * and succeed only if all the proofs are valid and all attributions and

package/dist/{mod-COWgSo2v.d.ts → mod-owwElvpw.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-tOiJfBoD.js";
+import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-Cz1w5Krc.js";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 

package/dist/mod.cjs

@@ -3,14 +3,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-4bmgw-mA.cjs");
-const require_federation = require("./federation-Ml6NrgRV.cjs");
+const require_http = require("./http-B1J6E-bT.cjs");
+const require_federation = require("./federation-DRY8KrkB.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-DkA0Lz7v.cjs");
-const require_kv_cache = require("./kv-cache-D2Bz6t_c.cjs");
+const require_portable_collection = require("./portable-collection-PTGD0q70.cjs");
+const require_kv_cache = require("./kv-cache-D9nRbG2Q.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
-const require_sig = require("./sig-Cb9VSeiF.cjs");
+require("./sig/mod.cjs");
 require("./utils/mod.cjs");
 //#endregion
 exports.CircuitBreaker = require_federation.CircuitBreaker;
@@ -31,7 +31,7 @@ exports.createProof = require_http.createProof;
 exports.createSignature = require_http.createSignature;
 exports.detachSignature = require_http.detachSignature;
 exports.digest = require_federation.digest;
-exports.doesActorOwnKey = require_owner.doesActorOwnKey;
+exports.doesActorOwnKey = require_portable_collection.doesActorOwnKey;
 exports.exportJwk = require_http.exportJwk;
 exports.fetchKey = require_http.fetchKey;
 exports.fetchKeyDetailed = require_http.fetchKeyDetailed;
@@ -40,7 +40,7 @@ exports.fulfillAcceptSignature = require_http.fulfillAcceptSignature;
 exports.generateCryptoKeyPair = require_http.generateCryptoKeyPair;
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.getDefaultActivityTransformers = require_transformers.getDefaultActivityTransformers;
-exports.getKeyOwner = require_owner.getKeyOwner;
+exports.getKeyOwner = require_portable_collection.getKeyOwner;
 exports.getNodeInfo = require_types.getNodeInfo;
 exports.handleWebFinger = require_federation.handleWebFinger;
 exports.hasProofLike = require_http.hasProofLike;
@@ -60,7 +60,7 @@ exports.signRequest = require_http.signRequest;
 exports.validateAcceptSignature = require_http.validateAcceptSignature;
 exports.verifyJsonLd = require_http.verifyJsonLd;
 exports.verifyObject = require_http.verifyObject;
-exports.verifyPortableObject = require_sig.verifyPortableObject;
+exports.verifyPortableObject = require_portable_collection.verifyPortableObject;
 exports.verifyPortableObjectProof = require_http.verifyPortableObjectProof;
 exports.verifyProof = require_http.verifyProof;
 exports.verifyRequest = require_http.verifyRequest;

package/dist/mod.d.cts

@@ -1,13 +1,13 @@
 /// <reference lib="esnext.temporal" />
 import { a as InboundService, c as OutboundService, d as Software, f as Usage, i as parseNodeInfo, l as Protocol, n as ParseNodeInfoOptions, o as JsonValue, p as nodeInfoToJson, r as getNodeInfo, s as NodeInfo, t as GetNodeInfoOptions, u as Services } from "./client-D-XP_Ccb.cjs";
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-D76Py0M4.cjs";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-CjezPjFX.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "./owner-BF0L9cMt.cjs";
-import { $ as InProcessMessageQueue, A as MediaUploaderSetters, At as HashlinkMediaRequest, B as createFederationBuilder, Bt as OutboxPermanentFailureHandler, C as FederationFetchOptions, Ct as CollectionCounter, D as IdempotencyStrategy, Dt as CustomCollectionCursor, E as IdempotencyKeyCallback, Et as CustomCollectionCounter, F as FederationKvPrefixes, Ft as ObjectAuthorizePredicate, G as TaskRegistry, Gt as WebFingerLinksDispatcher, H as TaskDefinitionOptions, Ht as SharedInboxKeyDispatcher, I as FederationOrigin, It as ObjectDispatcher, J as RetryPolicy, Jt as PageItems, K as CreateExponentialBackoffPolicyOptions, Kt as SendActivityError, L as FederationQueueOptions, Lt as OutboxErrorHandler, M as OutboxListenerSetters, Mt as InboxListener, N as PortableInboxForwardingOptions, Nt as MediaUploaderCallback, O as InboxChallengePolicy, Ot as CustomCollectionDispatcher, P as Rfc6570Expression, Pt as NodeInfoDispatcher, Q as respondWithObjectIfAcceptable, R as createFederation, Rt as OutboxListener, S as FederationBuilder, St as AuthorizePredicate, T as FederationStartQueueOptions, Tt as CollectionDispatcher, U as TaskEnqueueOptions, Ut as UnverifiedActivityHandler, V as TaskDefinition, Vt as PortableActorIdMapper, W as TaskHandler, Wt as UnverifiedActivityReason, X as RespondWithObjectOptions, Xt as digest, Y as createExponentialBackoffPolicy, Yt as buildCollectionSynchronizationHeader, Z as respondWithObject, Zt as ActivityTransformer, _ as ConstructorWithTypeId, _t as parseCircuitBreakerKvState, a as GetObjectOptions, at as ParallelMessageQueue, b as Federation, bt as ActorHandleMapper, c as OutboxContext, ct as CircuitBreakerBeforeSendDecision, d as RequestContext, dt as CircuitBreakerKvState, et as InProcessMessageQueueOptions, f as RouteActivityOptions, ft as CircuitBreakerOptions, g as CollectionCallbackSetters, gt as normalizeCircuitBreakerOptions, h as ActorCallbackSetters, ht as NormalizedCircuitBreakerOptions, i as GetActorOptions, it as MessageQueueListenOptions, j as ObjectCallbackSetters, jt as InboxErrorHandler, k as InboxListenerSetters, kt as HashlinkMediaDispatcher, l as ParseUriResult, lt as CircuitBreakerCreateOptions, m as SendActivityOptionsForCollection, mt as CircuitBreakerStateChange, n as Context, nt as MessageQueueDepth, o as GetSignedKeyOptions, ot as CircuitBreaker, p as SendActivityOptions, pt as CircuitBreakerState, q as RetryContext, qt as SenderKeyPair, r as ForwardActivityOptions, rt as MessageQueueEnqueueOptions, s as InboxContext, st as CircuitBreakerActivityDrop, t as ActorKeyPair, tt as MessageQueue, u as PortableRequest, ut as CircuitBreakerFailurePolicy, v as CustomCollectionCallbackSetters, vt as ActorAliasMapper, w as FederationOptions, wt as CollectionCursor, x as FederationBenchmarkOptions, xt as ActorKeyPairsDispatcher, y as Federatable, yt as ActorDispatcher, z as Message, zt as OutboxListenerErrorHandler } from "./context-SMNOiiY6.cjs";
+import { $ as InProcessMessageQueue, A as MediaUploaderSetters, At as HashlinkMediaRequest, B as createFederationBuilder, Bt as OutboxPermanentFailureHandler, C as FederationFetchOptions, Ct as CollectionCounter, D as IdempotencyStrategy, Dt as CustomCollectionCursor, E as IdempotencyKeyCallback, Et as CustomCollectionCounter, F as FederationKvPrefixes, Ft as ObjectAuthorizePredicate, G as TaskRegistry, Gt as WebFingerLinksDispatcher, H as TaskDefinitionOptions, Ht as SharedInboxKeyDispatcher, I as FederationOrigin, It as ObjectDispatcher, J as RetryPolicy, Jt as PageItems, K as CreateExponentialBackoffPolicyOptions, Kt as SendActivityError, L as FederationQueueOptions, Lt as OutboxErrorHandler, M as OutboxListenerSetters, Mt as InboxListener, N as PortableInboxForwardingOptions, Nt as MediaUploaderCallback, O as InboxChallengePolicy, Ot as CustomCollectionDispatcher, P as Rfc6570Expression, Pt as NodeInfoDispatcher, Q as respondWithObjectIfAcceptable, R as createFederation, Rt as OutboxListener, S as FederationBuilder, St as AuthorizePredicate, T as FederationStartQueueOptions, Tt as CollectionDispatcher, U as TaskEnqueueOptions, Ut as UnverifiedActivityHandler, V as TaskDefinition, Vt as PortableActorIdMapper, W as TaskHandler, Wt as UnverifiedActivityReason, X as RespondWithObjectOptions, Xt as digest, Y as createExponentialBackoffPolicy, Yt as buildCollectionSynchronizationHeader, Z as respondWithObject, Zt as ActivityTransformer, _ as ConstructorWithTypeId, _t as parseCircuitBreakerKvState, a as GetObjectOptions, at as ParallelMessageQueue, b as Federation, bt as ActorHandleMapper, c as OutboxContext, ct as CircuitBreakerBeforeSendDecision, d as RequestContext, dt as CircuitBreakerKvState, et as InProcessMessageQueueOptions, f as RouteActivityOptions, ft as CircuitBreakerOptions, g as CollectionCallbackSetters, gt as normalizeCircuitBreakerOptions, h as ActorCallbackSetters, ht as NormalizedCircuitBreakerOptions, i as GetActorOptions, it as MessageQueueListenOptions, j as ObjectCallbackSetters, jt as InboxErrorHandler, k as InboxListenerSetters, kt as HashlinkMediaDispatcher, l as ParseUriResult, lt as CircuitBreakerCreateOptions, m as SendActivityOptionsForCollection, mt as CircuitBreakerStateChange, n as Context, nt as MessageQueueDepth, o as GetSignedKeyOptions, ot as CircuitBreaker, p as SendActivityOptions, pt as CircuitBreakerState, q as RetryContext, qt as SenderKeyPair, r as ForwardActivityOptions, rt as MessageQueueEnqueueOptions, s as InboxContext, st as CircuitBreakerActivityDrop, t as ActorKeyPair, tt as MessageQueue, u as PortableRequest, ut as CircuitBreakerFailurePolicy, v as CustomCollectionCallbackSetters, vt as ActorAliasMapper, w as FederationOptions, wt as CollectionCursor, x as FederationBenchmarkOptions, xt as ActorKeyPairsDispatcher, y as Federatable, yt as ActorDispatcher, z as Message, zt as OutboxListenerErrorHandler } from "./context-Dvec_D_h.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-BhNbN8Ed.cjs";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.cjs";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-DnElMslb.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-DMdGFMEl.cjs";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-Cr79cQlc.cjs";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-DGOIxEfb.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-S--JxYjo.cjs";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-D4g9ffEn.cjs";
 export * from "@fedify/vocab-runtime";
 
 //#region src/mod.d.ts

package/dist/mod.d.ts

@@ -1,13 +1,13 @@
 /// <reference lib="esnext.temporal" />
 import { a as InboundService, c as OutboundService, d as Software, f as Usage, i as parseNodeInfo, l as Protocol, n as ParseNodeInfoOptions, o as JsonValue, p as nodeInfoToJson, r as getNodeInfo, s as NodeInfo, t as GetNodeInfoOptions, u as Services } from "./client-D-XP_Ccb.js";
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-BrQgkJay.js";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-C-x_OLSp.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "./owner-BSzr5-I8.js";
-import { $ as InProcessMessageQueue, A as MediaUploaderSetters, At as HashlinkMediaRequest, B as createFederationBuilder, Bt as OutboxPermanentFailureHandler, C as FederationFetchOptions, Ct as CollectionCounter, D as IdempotencyStrategy, Dt as CustomCollectionCursor, E as IdempotencyKeyCallback, Et as CustomCollectionCounter, F as FederationKvPrefixes, Ft as ObjectAuthorizePredicate, G as TaskRegistry, Gt as WebFingerLinksDispatcher, H as TaskDefinitionOptions, Ht as SharedInboxKeyDispatcher, I as FederationOrigin, It as ObjectDispatcher, J as RetryPolicy, Jt as PageItems, K as CreateExponentialBackoffPolicyOptions, Kt as SendActivityError, L as FederationQueueOptions, Lt as OutboxErrorHandler, M as OutboxListenerSetters, Mt as InboxListener, N as PortableInboxForwardingOptions, Nt as MediaUploaderCallback, O as InboxChallengePolicy, Ot as CustomCollectionDispatcher, P as Rfc6570Expression, Pt as NodeInfoDispatcher, Q as respondWithObjectIfAcceptable, R as createFederation, Rt as OutboxListener, S as FederationBuilder, St as AuthorizePredicate, T as FederationStartQueueOptions, Tt as CollectionDispatcher, U as TaskEnqueueOptions, Ut as UnverifiedActivityHandler, V as TaskDefinition, Vt as PortableActorIdMapper, W as TaskHandler, Wt as UnverifiedActivityReason, X as RespondWithObjectOptions, Xt as digest, Y as createExponentialBackoffPolicy, Yt as buildCollectionSynchronizationHeader, Z as respondWithObject, Zt as ActivityTransformer, _ as ConstructorWithTypeId, _t as parseCircuitBreakerKvState, a as GetObjectOptions, at as ParallelMessageQueue, b as Federation, bt as ActorHandleMapper, c as OutboxContext, ct as CircuitBreakerBeforeSendDecision, d as RequestContext, dt as CircuitBreakerKvState, et as InProcessMessageQueueOptions, f as RouteActivityOptions, ft as CircuitBreakerOptions, g as CollectionCallbackSetters, gt as normalizeCircuitBreakerOptions, h as ActorCallbackSetters, ht as NormalizedCircuitBreakerOptions, i as GetActorOptions, it as MessageQueueListenOptions, j as ObjectCallbackSetters, jt as InboxErrorHandler, k as InboxListenerSetters, kt as HashlinkMediaDispatcher, l as ParseUriResult, lt as CircuitBreakerCreateOptions, m as SendActivityOptionsForCollection, mt as CircuitBreakerStateChange, n as Context, nt as MessageQueueDepth, o as GetSignedKeyOptions, ot as CircuitBreaker, p as SendActivityOptions, pt as CircuitBreakerState, q as RetryContext, qt as SenderKeyPair, r as ForwardActivityOptions, rt as MessageQueueEnqueueOptions, s as InboxContext, st as CircuitBreakerActivityDrop, t as ActorKeyPair, tt as MessageQueue, u as PortableRequest, ut as CircuitBreakerFailurePolicy, v as CustomCollectionCallbackSetters, vt as ActorAliasMapper, w as FederationOptions, wt as CollectionCursor, x as FederationBenchmarkOptions, xt as ActorKeyPairsDispatcher, y as Federatable, yt as ActorDispatcher, z as Message, zt as OutboxListenerErrorHandler } from "./context-tOiJfBoD.js";
+import { $ as InProcessMessageQueue, A as MediaUploaderSetters, At as HashlinkMediaRequest, B as createFederationBuilder, Bt as OutboxPermanentFailureHandler, C as FederationFetchOptions, Ct as CollectionCounter, D as IdempotencyStrategy, Dt as CustomCollectionCursor, E as IdempotencyKeyCallback, Et as CustomCollectionCounter, F as FederationKvPrefixes, Ft as ObjectAuthorizePredicate, G as TaskRegistry, Gt as WebFingerLinksDispatcher, H as TaskDefinitionOptions, Ht as SharedInboxKeyDispatcher, I as FederationOrigin, It as ObjectDispatcher, J as RetryPolicy, Jt as PageItems, K as CreateExponentialBackoffPolicyOptions, Kt as SendActivityError, L as FederationQueueOptions, Lt as OutboxErrorHandler, M as OutboxListenerSetters, Mt as InboxListener, N as PortableInboxForwardingOptions, Nt as MediaUploaderCallback, O as InboxChallengePolicy, Ot as CustomCollectionDispatcher, P as Rfc6570Expression, Pt as NodeInfoDispatcher, Q as respondWithObjectIfAcceptable, R as createFederation, Rt as OutboxListener, S as FederationBuilder, St as AuthorizePredicate, T as FederationStartQueueOptions, Tt as CollectionDispatcher, U as TaskEnqueueOptions, Ut as UnverifiedActivityHandler, V as TaskDefinition, Vt as PortableActorIdMapper, W as TaskHandler, Wt as UnverifiedActivityReason, X as RespondWithObjectOptions, Xt as digest, Y as createExponentialBackoffPolicy, Yt as buildCollectionSynchronizationHeader, Z as respondWithObject, Zt as ActivityTransformer, _ as ConstructorWithTypeId, _t as parseCircuitBreakerKvState, a as GetObjectOptions, at as ParallelMessageQueue, b as Federation, bt as ActorHandleMapper, c as OutboxContext, ct as CircuitBreakerBeforeSendDecision, d as RequestContext, dt as CircuitBreakerKvState, et as InProcessMessageQueueOptions, f as RouteActivityOptions, ft as CircuitBreakerOptions, g as CollectionCallbackSetters, gt as normalizeCircuitBreakerOptions, h as ActorCallbackSetters, ht as NormalizedCircuitBreakerOptions, i as GetActorOptions, it as MessageQueueListenOptions, j as ObjectCallbackSetters, jt as InboxErrorHandler, k as InboxListenerSetters, kt as HashlinkMediaDispatcher, l as ParseUriResult, lt as CircuitBreakerCreateOptions, m as SendActivityOptionsForCollection, mt as CircuitBreakerStateChange, n as Context, nt as MessageQueueDepth, o as GetSignedKeyOptions, ot as CircuitBreaker, p as SendActivityOptions, pt as CircuitBreakerState, q as RetryContext, qt as SenderKeyPair, r as ForwardActivityOptions, rt as MessageQueueEnqueueOptions, s as InboxContext, st as CircuitBreakerActivityDrop, t as ActorKeyPair, tt as MessageQueue, u as PortableRequest, ut as CircuitBreakerFailurePolicy, v as CustomCollectionCallbackSetters, vt as ActorAliasMapper, w as FederationOptions, wt as CollectionCursor, x as FederationBenchmarkOptions, xt as ActorKeyPairsDispatcher, y as Federatable, yt as ActorDispatcher, z as Message, zt as OutboxListenerErrorHandler } from "./context-Cz1w5Krc.js";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-BhNbN8Ed.js";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.js";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-COWgSo2v.js";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-CTh7ijx5.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-Cwdt_CWU.js";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-owwElvpw.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-Bz9tFXI2.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-CZetqT5h.js";
 export * from "@fedify/vocab-runtime";
 
 //#region src/mod.d.ts

package/dist/mod.js

@@ -3,15 +3,15 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./rolldown-runtime-BC-Eo5Mj.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-DAtXl_Kc.js";
 import "./compat/mod.js";
-import { B as generateCryptoKeyPair, I as exportJwk, N as verifyJsonLd, O as hasSignatureLike, P as verifySignature, R as fetchKey, S as attachSignature, T as detachSignature, V as importJwk, a as signRequest, ct as formatAcceptSignature, d as hasProofLike, dt as validateAcceptSignature, f as signObject, h as verifyPortableObjectProof, j as signJsonLd, lt as fulfillAcceptSignature, m as verifyObject, o as verifyRequest, s as verifyRequestDetailed, u as createProof, ut as parseAcceptSignature, v as verifyProof, w as createSignature, z as fetchKeyDetailed } from "./http-BETASGl0.js";
-import { a as respondWithObjectIfAcceptable, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as respondWithObject, l as CircuitBreaker, n as handleWebFinger, o as SendActivityError, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-DWlAGlyP.js";
+import { B as fetchKeyDetailed, C as attachSignature, E as detachSignature, F as verifySignature, H as importJwk, L as exportJwk, M as signJsonLd, P as verifyJsonLd, T as createSignature, V as generateCryptoKeyPair, a as signRequest, d as createProof, dt as parseAcceptSignature, f as hasProofLike, ft as validateAcceptSignature, g as verifyPortableObjectProof, h as verifyObject, k as hasSignatureLike, lt as formatAcceptSignature, o as verifyRequest, p as signObject, s as verifyRequestDetailed, ut as fulfillAcceptSignature, y as verifyProof, z as fetchKey } from "./http-C2M6wcs8.js";
+import { a as respondWithObjectIfAcceptable, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as respondWithObject, l as CircuitBreaker, n as handleWebFinger, o as SendActivityError, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-CylX-pvI.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-wNinn7RK.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-C4mv2ZFQ.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-CgglAI9B.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-D7TiyMxv.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";
-import { t as verifyPortableObject } from "./sig-C1xOA4ml.js";
+import "./sig/mod.js";
 import "./utils/mod.js";
 export * from "@fedify/vocab-runtime";
 //#endregion

package/dist/nodeinfo/handler.test.mjs

@@ -1,11 +1,11 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { r as createRequestContext } from "../context-CoNRxGYp.mjs";
+import { r as createRequestContext } from "../context-DfSVPcJ8.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { C as handleNodeInfo, o as createFederation, w as handleNodeInfoJrd } from "../middleware-CgOqRkK-.mjs";
+import { C as handleNodeInfo, o as createFederation, w as handleNodeInfoJrd } from "../middleware-DN3MdTDg.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {

package/dist/{owner-CPFM-sqo.mjs → owner-BNHhwjNu.mjs}

@@ -1,10 +1,10 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BZrnW0Qz.mjs";
-import { a as isCompatibleKeyId, l as isSamePublicKey$1, s as isPortableId, t as getCanonicalPortableId } from "./portable-key-id-T7lecIbt.mjs";
-import { l as verifyKeyOwnership, n as exportJwk, r as fetchActorDocument } from "./key-PyYvun0F.mjs";
-import { t as fetchPortableGatewayKey } from "./portable-key-DyylakVV.mjs";
+import { n as version, t as name } from "./deno-_o3lkDlG.mjs";
+import { c as isPortableId, d as isSamePublicKey$1, o as isCompatibleKeyId, t as getCanonicalPortableId, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
+import { l as verifyKeyOwnership, n as exportJwk, r as fetchActorDocument } from "./key-DolJjJab.mjs";
+import { n as resolvePortableActorKey, t as fetchPortableGatewayKey } from "./portable-key-DqX2emHQ.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
@@ -44,6 +44,14 @@ async function doesActorOwnKey(activity, key, options) {
 				span.setAttribute("activitypub.key_ownership.method", "none");
 				return false;
 			}
+			if (key.id != null && isPortableUri(key.id)) {
+				const owner = await getPortableActorKeyOwner(key, options);
+				const ownerId = owner?.id == null ? null : getCanonicalPortableId(owner.id);
+				const verified = ownerId != null && ownerId === getCanonicalPortableId(actorId);
+				span.setAttribute("activitypub.key_ownership.verified", verified);
+				span.setAttribute("activitypub.key_ownership.method", "portable_actor_key");
+				return verified;
+			}
 			if (key.id != null && isCompatibleKeyId(key.id)) {
 				const owner = await getPortableGatewayKeyOwner(key, options);
 				if (owner !== void 0) {
@@ -143,6 +151,7 @@ async function getKeyOwner(keyId, options) {
 		tracerProvider
 	};
 	const id = keyId instanceof CryptographicKey ? keyId.id : keyId;
+	if (id != null && isPortableUri(id)) return await getPortableActorKeyOwner(keyId, fetchOptions);
 	if (id != null && isCompatibleKeyId(id)) {
 		const owner = await getPortableGatewayKeyOwner(keyId, fetchOptions);
 		if (owner !== void 0) return owner;
@@ -215,5 +224,29 @@ async function getPortableGatewayKeyOwner(key, options) {
 	}
 	return resolution.actor;
 }
+/**
+* Resolves the owner of a key of an [FEP-ef61] portable actor at an `ap:` or
+* `ap+ef61:` key ID.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param key The key, or its ID, which must be an `ap:` or `ap+ef61:` URI.
+* @param options Options for fetching the key.
+* @returns The portable actor if its signed document vouches for the key,
+*          and the given key, if any, has the same key material, or `null`
+*          if not.
+*/
+async function getPortableActorKeyOwner(key, options) {
+	const keyId = key instanceof CryptographicKey ? key.id : key;
+	if (keyId == null) return null;
+	const resolution = await resolvePortableActorKey(keyId, options);
+	if (resolution.type !== "verified") return null;
+	if (key instanceof CryptographicKey) {
+		if (key.publicKey == null || !await isSamePublicKey$1(key.publicKey, resolution.key.publicKey)) {
+			logger.debug("The key {keyId} does not have the same key material as the key its portable actor vouches for.", { keyId: keyId.href });
+			return null;
+		}
+	}
+	return resolution.actor;
+}
 //#endregion
 export { getKeyOwner as n, doesActorOwnKey as t };

package/dist/{sig-C1xOA4ml.js → portable-collection-CRpTUHCY.mjs}

@@ -1,7 +1,8 @@
-import { Temporal } from "temporal-polyfill";
-import { URLPattern } from "urlpattern-polyfill";
-import { _ as verifyPortableObjectProofWithRoot, bt as name, h as verifyPortableObjectProof, xt as version } from "./http-BETASGl0.js";
-import "./owner-wNinn7RK.js";
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { n as version, t as name } from "./deno-_o3lkDlG.mjs";
+import { l as verifyPortableObjectProofWithRoot, s as verifyPortableObjectProof } from "./proof-B4_0E-KU.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CollectionPage, Object as Object$1, isActor } from "@fedify/vocab";
 import { trace } from "@opentelemetry/api";