@fedify/fedify 2.4.0-dev.2122 → 2.4.0-dev.2129

package/dist/portable-collection-CgglAI9B.js

@@ -0,0 +1,656 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";
+import { Ct as version, L as exportJwk, R as fetchActorDocument, St as name, W as verifyKeyOwnership, _t as isCompatibleKeyId, bt as isPortableUri, c as fetchPortableGatewayKey, g as verifyPortableObjectProof, l as resolvePortableActorKey, pt as getCanonicalPortableId, v as verifyPortableObjectProofWithRoot, vt as isPortableId, xt as isSamePublicKey$1 } from "./http-C2M6wcs8.js";
+import { getLogger } from "@logtape/logtape";
+import { CollectionPage, CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
+import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+import { canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseIri } from "@fedify/vocab-runtime";
+import { dereferencePortableIri, getPortableGatewayCandidates } from "@fedify/vocab-runtime/internal/portable-dereference";
+//#region src/sig/owner.ts
+const logger$1 = getLogger([
+	"fedify",
+	"sig",
+	"owner"
+]);
+/**
+* Checks if the actor of the given activity owns the specified key.
+*
+* Ownership is never taken from what the activity or the key say about
+* themselves, as both are written by whoever sent the activity.  It is
+* established from a document that the owner itself serves: either the key's
+* claimed owner links back to the key, or the actor the activity claims lists
+* the key as its own.
+*
+* @param activity The activity to check.
+* @param key The public key to check.
+* @param options Options for checking the key ownership.
+* @returns Whether the actor is the owner of the key.
+*/
+async function doesActorOwnKey(activity, key, options) {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("activitypub.verify_key_ownership", {
+		kind: SpanKind.INTERNAL,
+		attributes: {
+			"activitypub.actor.id": activity.actorId?.href ?? "",
+			"activitypub.key.id": key.id?.href ?? ""
+		}
+	}, async (span) => {
+		try {
+			const actorId = activity.actorId;
+			if (actorId == null) {
+				span.setAttribute("activitypub.key_ownership.verified", false);
+				span.setAttribute("activitypub.key_ownership.method", "none");
+				return false;
+			}
+			if (key.id != null && isPortableUri(key.id)) {
+				const owner = await getPortableActorKeyOwner(key, options);
+				const ownerId = owner?.id == null ? null : getCanonicalPortableId(owner.id);
+				const verified = ownerId != null && ownerId === getCanonicalPortableId(actorId);
+				span.setAttribute("activitypub.key_ownership.verified", verified);
+				span.setAttribute("activitypub.key_ownership.method", "portable_actor_key");
+				return verified;
+			}
+			if (key.id != null && isCompatibleKeyId(key.id)) {
+				const owner = await getPortableGatewayKeyOwner(key, options);
+				if (owner !== void 0) {
+					const ownerId = owner?.id == null ? null : getCanonicalPortableId(owner.id);
+					const verified = ownerId != null && ownerId === getCanonicalPortableId(actorId);
+					span.setAttribute("activitypub.key_ownership.verified", verified);
+					span.setAttribute("activitypub.key_ownership.method", "portable_gateway_key");
+					return verified;
+				}
+			}
+			if (key.ownerId != null) {
+				const owner = await verifyKeyOwnership(key, options);
+				if (owner?.id != null && owner.id.href === actorId.href) {
+					span.setAttribute("activitypub.key_ownership.verified", true);
+					span.setAttribute("activitypub.key_ownership.method", "key_owner");
+					return true;
+				}
+			}
+			const actor = await fetchActorDocument(actorId, options);
+			if (actor != null && await doesActorListKey(actor, key, options)) {
+				span.setAttribute("activitypub.key_ownership.verified", true);
+				span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
+				return true;
+			}
+			logger$1.debug("The actor {actorId} does not own key {keyId}: neither the owner the key claims nor the actor's own document links the two to each other.", {
+				actorId: actorId.href,
+				keyId: key.id?.href
+			});
+			span.setAttribute("activitypub.key_ownership.verified", false);
+			span.setAttribute("activitypub.key_ownership.method", "actor_fetch");
+			return false;
+		} catch (error) {
+			span.recordException(error);
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
+/**
+* Determines whether the given actor's own document lists the given key among
+* its public keys.
+*
+* Keys are matched by id, which is what an actor document links to.  A key
+* document may leave its id implicit, though, and then there is no id for the
+* actor to link to; the key material itself is the only thing the two can
+* have in common, so that is what gets compared.
+*/
+async function doesActorListKey(actor, key, options) {
+	if (key.id != null) {
+		for (const publicKeyId of actor.publicKeyIds) if (publicKeyId.href === key.id.href) return true;
+		return false;
+	}
+	if (key.publicKey == null) return false;
+	const publicKeys = actor.getPublicKeys({
+		...options,
+		suppressError: true
+	});
+	for await (const publicKey of publicKeys) {
+		if (publicKey.publicKey == null) continue;
+		if (await isSamePublicKey(publicKey.publicKey, key.publicKey)) return true;
+	}
+	return false;
+}
+/**
+* Compares two public keys by their key material, ignoring the metadata that
+* surrounds it.
+*/
+async function isSamePublicKey(a, b) {
+	const [x, y] = await Promise.all([exportJwk(a), exportJwk(b)]);
+	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
+}
+/**
+* Gets the actor that owns the specified key.  Returns `null` if the key has no
+* known owner.
+*
+* The owner is only returned when the key and the owner link to each other:
+* a document that merely claims to own a key is not enough, as the claim and
+* the key can come from the same host.
+*
+* @param keyId The ID of the key to check, or the key itself.
+* @param options Options for getting the key owner.
+* @returns The actor that owns the key, or `null` if the key has no known
+*          owner.
+* @since 0.7.0
+*/
+async function getKeyOwner(keyId, options) {
+	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const fetchOptions = {
+		documentLoader,
+		contextLoader: options.contextLoader ?? getDocumentLoader(),
+		tracerProvider
+	};
+	const id = keyId instanceof CryptographicKey ? keyId.id : keyId;
+	if (id != null && isPortableUri(id)) return await getPortableActorKeyOwner(keyId, fetchOptions);
+	if (id != null && isCompatibleKeyId(id)) {
+		const owner = await getPortableGatewayKeyOwner(keyId, fetchOptions);
+		if (owner !== void 0) return owner;
+	}
+	if (keyId instanceof CryptographicKey) return await verifyKeyOwnership(keyId, fetchOptions);
+	let keyDoc;
+	let documentUrl = keyId;
+	try {
+		const remoteDocument = await documentLoader(keyId.href);
+		keyDoc = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", keyId);
+	} catch (_) {
+		return null;
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(keyDoc, {
+			...fetchOptions,
+			baseUrl: documentUrl
+		});
+	} catch (e) {
+		if (!(e instanceof TypeError)) throw e;
+		try {
+			object = await CryptographicKey.fromJsonLd(keyDoc, fetchOptions);
+		} catch (e) {
+			if (e instanceof TypeError) return null;
+			throw e;
+		}
+	}
+	if (object instanceof CryptographicKey) {
+		if (object.id != null && object.id.href !== keyId.href) return null;
+		return await verifyKeyOwnership(object.id == null ? object.clone({ id: keyId }) : object, fetchOptions);
+	}
+	if (!isActor(object)) return null;
+	if (object.id == null || isPortableId(object.id) || object.id.origin !== documentUrl.origin) {
+		logger$1.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as the owner of key {keyId}.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href,
+			keyId: keyId.href
+		});
+		return null;
+	}
+	for (const kid of object.publicKeyIds) if (kid.href === keyId.href) return object;
+	return null;
+}
+/**
+* Resolves the owner of a key at a compatible identifier, if the key turns
+* out to be a gateway key of an [FEP-ef61] portable actor.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param key The key, or its ID, which must be a compatible identifier.
+* @param options Options for fetching the key.
+* @returns `undefined` if the key is not a gateway key, i.e., the document at
+*          the key ID is not a portable actor, so the usual checks apply.
+*          Otherwise, the portable actor if its signed document vouches for
+*          the key, and the given key, if any, has the same key material, or
+*          `null` if not.
+*/
+async function getPortableGatewayKeyOwner(key, options) {
+	const keyId = key instanceof CryptographicKey ? key.id : key;
+	if (keyId == null) return void 0;
+	const resolution = await fetchPortableGatewayKey(keyId, options);
+	if (resolution.type === "legacy") return void 0;
+	if (resolution.type === "rejected") return null;
+	if (key instanceof CryptographicKey) {
+		if (key.publicKey == null || !await isSamePublicKey$1(key.publicKey, resolution.key.publicKey)) {
+			logger$1.debug("The key {keyId} does not have the same key material as the gateway key its portable actor vouches for.", { keyId: keyId.href });
+			return null;
+		}
+	}
+	return resolution.actor;
+}
+/**
+* Resolves the owner of a key of an [FEP-ef61] portable actor at an `ap:` or
+* `ap+ef61:` key ID.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param key The key, or its ID, which must be an `ap:` or `ap+ef61:` URI.
+* @param options Options for fetching the key.
+* @returns The portable actor if its signed document vouches for the key,
+*          and the given key, if any, has the same key material, or `null`
+*          if not.
+*/
+async function getPortableActorKeyOwner(key, options) {
+	const keyId = key instanceof CryptographicKey ? key.id : key;
+	if (keyId == null) return null;
+	const resolution = await resolvePortableActorKey(keyId, options);
+	if (resolution.type !== "verified") return null;
+	if (key instanceof CryptographicKey) {
+		if (key.publicKey == null || !await isSamePublicKey$1(key.publicKey, resolution.key.publicKey)) {
+			logger$1.debug("The key {keyId} does not have the same key material as the key its portable actor vouches for.", { keyId: keyId.href });
+			return null;
+		}
+	}
+	return resolution.actor;
+}
+//#endregion
+//#region src/sig/portable-collection.ts
+const logger = getLogger([
+	"fedify",
+	"sig",
+	"proof"
+]);
+const AS_NAMESPACE = "https://www.w3.org/ns/activitystreams#";
+const AS_ATTRIBUTED_TO = `${AS_NAMESPACE}attributedTo`;
+const AS_PART_OF = `${AS_NAMESPACE}partOf`;
+/**
+* The properties through which a collection refers to its pages, and a page
+* to other pages of the same collection.
+*/
+const PAGING_PROPERTIES = new Set([
+	"first",
+	"last",
+	"current",
+	"next",
+	"prev"
+].map((p) => AS_NAMESPACE + p));
+/**
+* The properties through which an actor refers to its own collections.
+*/
+const ACTOR_COLLECTION_PROPERTIES = /* @__PURE__ */ new Set([
+	"http://www.w3.org/ns/ldp#inbox",
+	`${AS_NAMESPACE}outbox`,
+	`${AS_NAMESPACE}followers`,
+	`${AS_NAMESPACE}following`,
+	`${AS_NAMESPACE}liked`
+]);
+const contextStates = /* @__PURE__ */ new WeakMap();
+function createContext(state) {
+	const token = Object.freeze(Object.create(null));
+	contextStates.set(token, state);
+	return token;
+}
+function getContextState(context) {
+	if (context == null || typeof context !== "object") return void 0;
+	return contextStates.get(context);
+}
+function canonicalize(id) {
+	try {
+		const portable = fromCompatibleEf61Id(id);
+		if (portable != null) return canonicalizePortableUri(formatIri(portable));
+		return canonicalizePortableUri(typeof id === "string" ? id : formatIri(id));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+function toUrl(canonicalId) {
+	return parseIri(canonicalId);
+}
+function canonicalizeAll(ids) {
+	const result = [];
+	for (const id of ids) {
+		const canonical = canonicalize(id);
+		if (canonical == null) return null;
+		result.push(canonical);
+	}
+	return result;
+}
+function getExpandedIds(node, property) {
+	const values = node[property];
+	if (values == null) return [];
+	if (!Array.isArray(values)) return null;
+	const ids = [];
+	for (const value of values) {
+		if (value == null || typeof value !== "object" || Array.isArray(value) || typeof value["@id"] !== "string") return null;
+		ids.push(value["@id"]);
+	}
+	return ids;
+}
+function parseAll(ids) {
+	const result = [];
+	for (const id of ids) try {
+		result.push(parseIri(id));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+	return result;
+}
+function describeRoot(root) {
+	const rawId = root["@id"];
+	if (typeof rawId !== "string") return null;
+	const id = canonicalize(rawId);
+	if (id == null) return null;
+	const partOf = getExpandedIds(root, AS_PART_OF);
+	const attributedTo = getExpandedIds(root, AS_ATTRIBUTED_TO);
+	return {
+		id,
+		url: toUrl(id),
+		origin: getFe34Origin(id),
+		partOf: partOf == null ? null : canonicalizeAll(partOf),
+		attributedTo: attributedTo == null ? null : canonicalizeAll(attributedTo),
+		attributedToUrls: attributedTo == null ? null : parseAll(attributedTo)
+	};
+}
+function describeObject(object) {
+	if (!(object instanceof Object$1) || object.id == null) return null;
+	const id = canonicalize(object.id);
+	if (id == null) return null;
+	const partOfId = object instanceof CollectionPage ? object.partOfId : null;
+	return {
+		id,
+		url: toUrl(id),
+		origin: getFe34Origin(id),
+		partOf: canonicalizeAll(partOfId == null ? [] : [partOfId]),
+		attributedTo: canonicalizeAll(object.attributionIds),
+		attributedToUrls: object.attributionIds
+	};
+}
+function fail(reason) {
+	return {
+		verified: false,
+		reason
+	};
+}
+/**
+* Walks the referrer chain of a collection or page to find the root
+* collection and its owner candidate, checking every page on the way.
+*/
+function resolveChain(node, referrer) {
+	const pages = [];
+	let top = node;
+	let link = referrer;
+	let state;
+	while (link != null && PAGING_PROPERTIES.has(link.property)) {
+		pages.push(top);
+		state = getContextState(link.collectionContext);
+		if (state != null) break;
+		const parent = describeObject(link.object);
+		if (parent == null || link.truncated) return fail({ type: "unknownCollectionOwner" });
+		top = parent;
+		link = link.referrer;
+	}
+	let rootId;
+	let rootOrigin;
+	let candidate;
+	if (state != null) {
+		rootId = state.rootId;
+		rootOrigin = state.rootOrigin;
+		const ownerCandidate = state.owner == null ? state.ownerCandidate : { id: canonicalize(state.owner.id) };
+		if (ownerCandidate == null) return fail({ type: "unknownCollectionOwner" });
+		candidate = ownerCandidate;
+	} else {
+		rootId = top.id;
+		rootOrigin = top.origin;
+		const attributedTo = top.attributedTo;
+		if (attributedTo == null) return fail({ type: "unknownCollectionOwner" });
+		if (link != null && ACTOR_COLLECTION_PROPERTIES.has(link.property)) {
+			const id = link.id == null ? null : canonicalize(link.id);
+			if (id == null) return fail({ type: "unknownCollectionOwner" });
+			candidate = {
+				id,
+				object: link.object,
+				acceptance: link.acceptance
+			};
+		} else if (attributedTo.length === 1) candidate = {
+			id: attributedTo[0],
+			url: top.attributedToUrls?.[0]
+		};
+		else if (attributedTo.length > 1) return fail({
+			type: "conflictingCollectionOwners",
+			candidates: attributedTo.map(toUrl)
+		});
+		else return fail({ type: "unknownCollectionOwner" });
+		const conflict = attributedTo.find((id) => id !== candidate.id);
+		if (conflict != null) return fail({
+			type: "conflictingCollectionOwners",
+			candidates: [toUrl(candidate.id), toUrl(conflict)]
+		});
+	}
+	if (getFe34Origin(candidate.id) !== rootOrigin) return fail({ type: "unknownCollectionOwner" });
+	for (const page of pages) {
+		if (page.origin !== rootOrigin) return fail({
+			type: "collectionPageMismatch",
+			pageId: page.url,
+			collectionId: toUrl(rootId),
+			partOf: null
+		});
+		if (page.partOf == null) return fail({ type: "unknownCollectionOwner" });
+		const partOf = page.partOf.find((id) => id !== rootId);
+		if (partOf != null) return fail({
+			type: "collectionPageMismatch",
+			pageId: page.url,
+			collectionId: toUrl(rootId),
+			partOf: toUrl(partOf)
+		});
+		if (page.attributedTo == null) return fail({ type: "unknownCollectionOwner" });
+		const conflict = page.attributedTo.find((id) => id !== candidate.id);
+		if (conflict != null) return fail({
+			type: "conflictingCollectionOwners",
+			candidates: [toUrl(candidate.id), toUrl(conflict)]
+		});
+	}
+	return {
+		rootId,
+		rootOrigin,
+		owner: state?.owner ?? null,
+		candidate
+	};
+}
+function getActorCollectionIds(actor) {
+	const ids = [];
+	for (const id of [
+		actor.inboxId,
+		actor.outboxId,
+		actor.followersId,
+		actor.followingId,
+		actor.likedId
+	]) {
+		if (id == null) continue;
+		const canonical = canonicalize(id);
+		if (canonical != null) ids.push(canonical);
+	}
+	return ids;
+}
+async function fetchOwner(candidate, options) {
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+	const tracer = tracerProvider.getTracer(name, version);
+	let inferredGateways;
+	try {
+		const portable = fromCompatibleEf61Id(candidate);
+		if (portable != null) {
+			inferredGateways = [new URL(candidate.origin)];
+			candidate = portable;
+		}
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.debug("The owner {owner} of a portable collection is a malformed compatible identifier.", { owner: candidate.href });
+		return null;
+	}
+	const gateways = options.gateways ?? (inferredGateways != null || getPortableGatewayCandidates(candidate).length > 0 ? void 0 : options.gatewayHints);
+	if (options.gateways != null) inferredGateways = void 0;
+	const span = tracer.startSpan("activitypub.lookup_object");
+	try {
+		const object = await dereferencePortableIri(candidate, {
+			documentLoader,
+			contextLoader,
+			tracerProvider,
+			gateways,
+			...inferredGateways == null ? {} : { inferredGateways },
+			verifyPortableObject: (document, verifierOptions) => verifyPortableObjectProof(document, {
+				...options,
+				...verifierOptions
+			}),
+			suppressError: true,
+			span,
+			parse: (document, parseOptions) => Object$1.fromJsonLd(document, {
+				documentLoader,
+				contextLoader: parseOptions.contextLoader,
+				tracerProvider,
+				baseUrl: parseOptions.baseUrl
+			})
+		});
+		return isActor(object) ? object : null;
+	} catch (error) {
+		logger.debug("Failed to fetch the owner {owner} of a portable collection: {error}", {
+			owner: formatIri(candidate),
+			error
+		});
+		return null;
+	} finally {
+		span.end();
+	}
+}
+async function resolveOwner(chain, options) {
+	if (chain.owner != null) return chain.owner;
+	const { candidate } = chain;
+	const candidateUrl = toUrl(candidate.id);
+	let actor = null;
+	if (candidate.acceptance === "verified" && isActor(candidate.object) && candidate.object.id != null && canonicalize(candidate.object.id) === candidate.id) actor = candidate.object;
+	else actor = await fetchOwner(candidate.url ?? (candidate.object instanceof Object$1 && candidate.object.id != null ? candidate.object.id : candidateUrl), options);
+	if (actor == null || actor.id == null) return fail({
+		type: "collectionOwnerUnavailable",
+		owner: candidateUrl
+	});
+	const gateways = actor.gateways;
+	if (gateways.length < 1) return fail({
+		type: "collectionOwnerUnavailable",
+		owner: candidateUrl
+	});
+	if (!getActorCollectionIds(actor).includes(chain.rootId)) return fail({
+		type: "collectionNotListedByOwner",
+		owner: candidateUrl,
+		collectionId: toUrl(chain.rootId)
+	});
+	return {
+		id: candidateUrl,
+		gateways
+	};
+}
+function getSourceGateway(node, documentUrl) {
+	if (documentUrl == null || documentUrl.protocol !== "http:" && documentUrl.protocol !== "https:") return null;
+	let portableId;
+	try {
+		portableId = fromCompatibleEf61Id(documentUrl);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+	if (portableId == null || canonicalize(portableId) !== node.id) return null;
+	return new URL(documentUrl.origin);
+}
+/**
+* Applies the [FEP-ef61] trust policy to a portable object fetched through
+* a gateway.
+*
+* Portable actors, activities, objects, and collections with proofs are
+* verified by {@link verifyPortableObjectProof}.  A portable collection or
+* collection page without a proof is accepted only if all of the following
+* hold:
+*
+*  -  It was retrieved from a gateway: its final URL (`documentUrl`) is
+*     a compatible identifier for the same portable collection.
+*  -  Its owner is determined unambiguously: the actor whose `inbox`,
+*     `outbox`, `followers`, `following`, or `liked` property referred to
+*     the collection, or the single actor in its `attributedTo`.  A page
+*     inherits the owner of the collection it was reached from through
+*     `first`, `last`, `current`, `next`, or `prev`, and must not name
+*     another collection in `partOf`.
+*  -  The owner's actor document is verified by its proof and lists the
+*     collection as its `inbox`, `outbox`, `followers`, `following`, or
+*     `liked`.
+*  -  The gateway that served the collection is in the owner's `gateways`.
+*
+* Where the document came from and which object referred to it are passed
+* by property accessors when this function is used as their
+* `verifyPortableObject` option.  Objects embedded in an unsecured
+* collection accepted this way are not trusted: accessors dereference and
+* verify them one by one.
+*
+* Note that acceptance through the gateway policy does not verify anything
+* cryptographically; it only means that the owner trusts the gateway.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param jsonLd The JSON-LD document to verify.
+* @param options Additional options.  See also
+*                {@link VerifyPortableObjectOptions}.
+* @returns The detailed result.
+* @throws {TypeError} If the input is not a single JSON-LD object or has a
+*                     malformed portable ID.
+* @since 2.4.0
+*/
+async function verifyPortableObject(jsonLd, options = {}) {
+	const { result, root, objectType } = await verifyPortableObjectProofWithRoot(jsonLd, options);
+	if (result.verified) {
+		const node = objectType === "collection" && root != null ? describeRoot(root) : null;
+		const chain = node == null ? null : resolveChain(node, options.referrer);
+		if (chain == null || !("rootId" in chain)) return {
+			verified: true,
+			method: "proof",
+			keys: result.keys
+		};
+		return {
+			verified: true,
+			method: "proof",
+			keys: result.keys,
+			collectionContext: createContext({
+				rootId: chain.rootId,
+				rootOrigin: chain.rootOrigin,
+				owner: chain.owner,
+				ownerCandidate: chain.candidate
+			})
+		};
+	}
+	if (result.reason.type !== "unsecuredCollection") return {
+		verified: false,
+		reason: result.reason
+	};
+	const node = root == null ? null : describeRoot(root);
+	if (node == null) return fail({ type: "unknownCollectionOwner" });
+	const gateway = getSourceGateway(node, options.documentUrl);
+	if (gateway == null) return fail({
+		type: "unknownCollectionSource",
+		documentUrl: options.documentUrl ?? null
+	});
+	const chain = resolveChain(node, options.referrer);
+	if (!("rootId" in chain)) return chain;
+	const owner = await resolveOwner(chain, options);
+	if (!("gateways" in owner)) return owner;
+	if (!owner.gateways.some((g) => g.origin === gateway.origin)) return fail({
+		type: "untrustedGateway",
+		owner: owner.id,
+		gateway,
+		gateways: owner.gateways
+	});
+	return {
+		verified: true,
+		method: "gateway",
+		unsecured: true,
+		owner: owner.id,
+		gateway,
+		collectionContext: createContext({
+			rootId: chain.rootId,
+			rootOrigin: chain.rootOrigin,
+			owner,
+			ownerCandidate: null
+		})
+	};
+}
+//#endregion
+export { doesActorOwnKey as n, getKeyOwner as r, verifyPortableObject as t };