@fedify/fedify 2.4.0-dev.2127 → 2.4.0-dev.2129

package/dist/{federation-B6IHuS6n.cjs → federation-DRY8KrkB.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-o8l4QeUY.cjs");
+const require_http = require("./http-B1J6E-bT.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_portable_collection = require("./portable-collection-DXogVs__.cjs");
-const require_kv_cache = require("./kv-cache-BUkgZAcX.cjs");
+const require_portable_collection = require("./portable-collection-PTGD0q70.cjs");
+const require_kv_cache = require("./kv-cache-D9nRbG2Q.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -4671,7 +4671,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableGatewayKey(httpSigKey))) {
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableActorKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
@@ -5452,13 +5452,13 @@ const MIN_COMPONENTS = [
 	"@authority"
 ];
 /**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
+* Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
+* actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
+* URI, and it is owned by a portable actor, which only the portable actor's
+* signed document can establish.
 */
-function isPortableGatewayKey(key) {
-	return key?.id != null && require_http.isCompatibleKeyId(key.id) && key.ownerId != null && require_http.isPortableId(key.ownerId);
+function isPortableActorKey(key) {
+	return key?.id != null && require_http.isPortableKeyId(key.id) && key.ownerId != null && require_http.isPortableId(key.ownerId);
 }
 /**
 * Checks whether an activity needs an Object Integrity Proof by its DID:
@@ -5895,7 +5895,7 @@ async function signOutgoingActivity(activity, candidates, options) {
 		hasProof = true;
 		break;
 	}
-	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !require_http.isCompatibleKeyId(c.verificationMethod));
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !require_http.isPortableKeyId(c.verificationMethod));
 	if (!hasProof && activity.id != null && require_http.isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
 	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
 		activity,
@@ -7863,7 +7863,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const ldSignable = !require_http.hasPortableActor(activity);
 		for (const { keyId, privateKey } of keys) {
 			require_http.validateCryptoKey(privateKey, "private");
-			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !require_http.isCompatibleKeyId(keyId)) rsaKey = {
+			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !require_http.isPortableKeyId(keyId)) rsaKey = {
 				keyId,
 				privateKey
 			};

package/dist/{http-o8l4QeUY.cjs → http-B1J6E-bT.cjs}

@@ -16,10 +16,12 @@ json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2127+c41ce2eb";
+var version = "2.4.0-dev.2129+c0ddb433";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+const RAW_PORTABLE_URI_PATTERN = /^ap(?:\+ef61)?:\/\//i;
+const RAW_COMPATIBLE_ID_PREFIX_PATTERN = /^https?:\/\/[^/?#]*\/\.well-known\/apgateway\/(?=did(?::|%3A))/i;
 /**
 * Checks whether the URL is an `ap:` or `ap+ef61:` URI.
 * @internal
@@ -83,6 +85,20 @@ function isCompatibleKeyId(keyId) {
 	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
 }
 /**
+* Checks whether a key ID may name a key that is valid only for HTTP
+* Signatures: a gateway key at an [FEP-ef61] compatible identifier, or a key
+* of a portable actor at an `ap:` or `ap+ef61:` URI.  Neither ever makes or
+* verifies an Object Integrity Proof or a Linked Data Signature: a portable
+* object's proof is made by its DID, and a proof made with a gateway key
+* would claim that the gateway authored the object.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isPortableKeyId(keyId) {
+	return isPortableUri(keyId) || isCompatibleKeyId(keyId);
+}
+/**
 * Gets the canonical portable ID of an actor ID that is either an `ap:` or
 * `ap+ef61:` URI or a compatible identifier.
 * @returns The canonical portable ID, or `null` if the ID is neither, or is
@@ -101,6 +117,57 @@ function getCanonicalPortableId(id) {
 	}
 }
 /**
+* Gets the canonical portable ID of an `ap:` or `ap+ef61:` URI or
+* a compatible identifier as it is written, before any URL parsing.
+* Parsing an ID into a `URL` resolves dot segments in its path, which would
+* make it identify another portable object, e.g.,
+* `ap://did:key:z6Mk…/x/../actor` would become `ap://did:key:z6Mk…/actor`.
+* Such an ID has no canonical portable ID here.
+* @param raw The ID as it is written.
+* @returns The canonical portable ID, fragment included, or `null` if the ID
+*          is neither an `ap:` or `ap+ef61:` URI nor a compatible identifier,
+*          is malformed, or would identify another object once parsed.
+* @internal
+*/
+function getRawCanonicalPortableId(raw) {
+	let canonical;
+	let parsed;
+	try {
+		if (RAW_PORTABLE_URI_PATTERN.test(raw)) {
+			canonical = (0, _fedify_vocab_runtime.canonicalizePortableUri)(raw);
+			parsed = (0, _fedify_vocab_runtime.canonicalizePortableUri)((0, _fedify_vocab_runtime.formatIri)((0, _fedify_vocab_runtime.parseIri)(raw)));
+		} else {
+			const prefix = raw.match(RAW_COMPATIBLE_ID_PREFIX_PATTERN);
+			if (prefix == null || !URL.canParse(raw)) return null;
+			canonical = (0, _fedify_vocab_runtime.canonicalizePortableUri)("ap://" + raw.slice(prefix[0].length));
+			parsed = getCanonicalPortableId(new URL(raw));
+		}
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+	return canonical === parsed ? canonical : null;
+}
+/**
+* Parses a key ID, e.g., the `keyId` of an HTTP Signature, into a `URL`.
+* An `ap:` or `ap+ef61:` key ID is parsed into the internal `URL` form of
+* portable URIs.  A portable or compatible key ID that is malformed, or
+* whose identity URL parsing would change, e.g., by resolving dot segments in
+* its path, is refused, so that it can never be taken for, or looked up in
+* the key cache as, the key of another object.
+* @param raw The key ID as it is written.
+* @returns The parsed key ID, or `null` if it is invalid.
+* @internal
+*/
+function parseKeyIdString(raw) {
+	if (RAW_PORTABLE_URI_PATTERN.test(raw)) return getRawCanonicalPortableId(raw) == null ? null : (0, _fedify_vocab_runtime.parseIri)(raw);
+	if (!URL.canParse(raw)) return null;
+	const url = new URL(raw);
+	if (isPortableUri(url)) return null;
+	if (!RAW_COMPATIBLE_ID_PREFIX_PATTERN.test(raw)) return isCompatibleKeyId(url) ? null : url;
+	return getRawCanonicalPortableId(raw) == null ? null : url;
+}
+/**
 * Builds the base of the key IDs of a gateway's keys for a portable actor:
 * the actor's compatible identifier on the gateway.
 * @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
@@ -4908,6 +4975,17 @@ function bypassKeyCacheReads(keyCache) {
 	};
 	return bypassed;
 }
+/**
+* Parses a key ID given as a string.  Unlike `new URL()`, it accepts `ap:`
+* and `ap+ef61:` URIs, and refuses a portable or compatible key ID whose
+* identity URL parsing would change, e.g., by resolving dot segments.
+* @throws {TypeError} If the key ID is invalid.
+*/
+function parseKeyIdOrThrow(keyId) {
+	const parsed = parseKeyIdString(keyId);
+	if (parsed == null) throw new TypeError(`Invalid key ID: ${keyId}`);
+	return parsed;
+}
 async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 	tracerProvider ??= _opentelemetry_api.trace.getTracerProvider();
 	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
@@ -4944,9 +5022,11 @@ async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
@@ -4959,7 +5039,7 @@ async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 * @since 1.3.0
 */
 function fetchKey(keyId, cls, options = {}) {
-	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
+	keyId = typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId;
 	return withFetchKeySpan(keyId, options.tracerProvider, () => fetchKeyInternal(keyId, cls, options));
 }
 /**
@@ -4969,9 +5049,11 @@ function fetchKey(keyId, cls, options = {}) {
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 *
@@ -4985,7 +5067,7 @@ function fetchKey(keyId, cls, options = {}) {
 * @since 2.1.0
 */
 async function fetchKeyDetailed(keyId, cls, options = {}) {
-	const cacheKey = typeof keyId === "string" ? new URL(keyId) : keyId;
+	const cacheKey = typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId;
 	return await withFetchKeySpan(cacheKey, options.tracerProvider, async () => {
 		return await fetchKeyWithResult(cacheKey, cls, options, async (cacheKey, keyId, keyCache, logger) => {
 			const fetchError = await keyCache?.getFetchError?.(cacheKey);
@@ -5124,7 +5206,7 @@ async function resolveDidKey(cacheKey, cls, keyCache, logger) {
 		cached: false
 	};
 }
-async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableGatewayKeyResolver }, logger) {
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableKeyResolvers }, logger) {
 	let object;
 	try {
 		object = await _fedify_vocab.Object.fromJsonLd(document, {
@@ -5155,7 +5237,7 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 	}
 	if (isCompatibleKeyId(cacheKey) && isPortableActorDocument(object)) {
 		const scopedCache = keyCache;
-		if (portableGatewayKeyResolver == null || cls !== _fedify_vocab.CryptographicKey) {
+		if (portableKeyResolvers == null || cls !== _fedify_vocab.CryptographicKey) {
 			logger.debug("Failed to verify; key {keyId} is a gateway key of the portable actor {actorId}, which is only accepted for HTTP Signatures.", {
 				keyId,
 				actorId: object.id?.href
@@ -5166,7 +5248,7 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 				cached: false
 			};
 		}
-		const resolution = await portableGatewayKeyResolver(document, object, cacheKey);
+		const resolution = await portableKeyResolvers.gatewayKey(document, object, cacheKey);
 		if (resolution.type !== "verified") {
 			logger.debug("Failed to verify; the portable actor {actorId} does not vouch for its gateway key {keyId}.", {
 				keyId,
@@ -5326,6 +5408,11 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 		]);
 		const keyId = cacheKey.href;
 		const keyCache = options.keyCache;
+		if (isPortableUri(cacheKey)) {
+			const result = await fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger);
+			outcome = result.outcome;
+			return result.result;
+		}
 		if (isCompatibleKeyId(cacheKey)) {
 			const result = await fetchCompatibleKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger);
 			outcome = result.outcome;
@@ -5377,7 +5464,7 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 */
 function getCompatibleKeyScope(cls, options) {
 	if (cls !== _fedify_vocab.CryptographicKey) return "multikey";
-	return options.portableGatewayKeyResolver == null ? "cryptographicKey" : "httpSignature";
+	return options.portableKeyResolvers == null ? "cryptographicKey" : "httpSignature";
 }
 /**
 * Looks up a key at an [FEP-ef61] compatible identifier.  Such a key may be
@@ -5431,8 +5518,75 @@ async function fetchCompatibleKey(cacheKey, cls, options, onCachedUnavailable, o
 		outcome: { result: resolved.key != null ? "fetched" : "invalid" }
 	};
 }
+/**
+* Looks up a key of an [FEP-ef61] portable actor at an `ap:` or `ap+ef61:`
+* key ID.  Such a key is accepted only for HTTP Signatures, and is rejected
+* for any other purpose without being fetched.  Like keys at compatible
+* identifiers, what it resolves to is cached in the namespace of the lookup's
+* purpose, and a failure to fetch the actor's document from every gateway is
+* cached in the shared namespace.  A failure that is neither, e.g., one
+* gateway being unreachable while another served an invalid document, is not
+* cached at all.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+async function fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger) {
+	const keyId = cacheKey.href;
+	const resolvers = options.portableKeyResolvers;
+	if (resolvers == null || cls !== _fedify_vocab.CryptographicKey) {
+		logger.debug("Failed to verify; key {keyId} is a key of a portable actor, which is only accepted for HTTP Signatures.", { keyId });
+		return {
+			result: {
+				key: null,
+				cached: false
+			},
+			outcome: { result: "invalid" }
+		};
+	}
+	const sharedCache = options.keyCache;
+	const scopedCache = sharedCache?.compatibleKeyScope?.("httpSignature");
+	const cached = await getCachedFetchKey(cacheKey, keyId, cls, scopedCache, logger);
+	if (cached != null) return {
+		result: cached,
+		outcome: { result: "hit" }
+	};
+	if (await sharedCache?.get(cacheKey) === null) {
+		logger.debug("Entry {keyId} found in cache, but it could not be fetched.", { keyId });
+		return {
+			result: await onCachedUnavailable(cacheKey, keyId, sharedCache, logger),
+			outcome: { result: "hit" }
+		};
+	}
+	logger.debug("Resolving key {keyId} to verify signature...", { keyId });
+	const resolution = await resolvers.actorKey(cacheKey);
+	if (resolution.type === "verified") {
+		await scopedCache?.set(cacheKey, resolution.key, { expires: resolution.expires });
+		return {
+			result: {
+				key: resolution.key,
+				cached: false
+			},
+			outcome: { result: "fetched" }
+		};
+	}
+	if (resolution.type === "rejected") {
+		await scopedCache?.set(cacheKey, null);
+		return {
+			result: {
+				key: null,
+				cached: false
+			},
+			outcome: { result: "invalid" }
+		};
+	}
+	await scopedCache?.delete(cacheKey);
+	return {
+		result: await onFetchError(resolution.error, cacheKey, keyId, resolution.cacheable ? sharedCache : void 0, logger),
+		outcome: resolution.cacheable ? classifyFetchError(resolution.error) : { result: "error" }
+	};
+}
 async function fetchKeyInternal(keyId, cls, options = {}) {
-	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
+	return await fetchKeyWithResult(typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
 		return {
 			key: null,
 			cached: true
@@ -7601,6 +7755,14 @@ const SEC = "https://w3id.org/security#";
 *  -  no more than one entry of either property has that ID; and
 *  -  the key ID's origin is one of the actor's `gateways`.
 *
+* An entry has the key's ID if its ID is the key ID, or any compatible
+* identifier on the same gateway, or the `ap:` or `ap+ef61:` URI, with the
+* same canonical portable ID.  Some publishers, e.g., Mitra, list the keys
+* of portable actors under `ap:` URIs, but sign requests with compatible key
+* IDs on their own gateways.  IDs are compared as they are written in
+* the signed document, so an ID that URL parsing would turn into another,
+* e.g., by resolving dot segments, has no match.
+*
 * [FEP-8b32]: https://w3id.org/fep/8b32
 * [FEP-ef61]: https://w3id.org/fep/ef61
 * [FEP-521a]: https://w3id.org/fep/521a
@@ -7612,10 +7774,22 @@ const SEC = "https://w3id.org/security#";
 * @returns The verification result, which is never `legacy`.
 * @internal
 */
-async function verifyPortableGatewayKeyDocument(document, actor, keyId, options = {}) {
+function verifyPortableGatewayKeyDocument(document, actor, keyId, options = {}) {
+	return verifyPortableKeyDocument(document, actor, keyId, true, options);
+}
+/**
+* Verifies that the signed document of a portable actor vouches for the key
+* with the given ID, either a gateway key at a compatible key ID, or a key of
+* the actor itself at an `ap:` or `ap+ef61:` key ID.  See
+* {@link verifyPortableGatewayKeyDocument} for the rules; a key of the actor
+* itself names no gateway, so instead of the key ID's origin being one of
+* the actor's `gateways`, the actor only has to have a valid gateway, as
+* FEP-ef61 requires of every portable actor.
+*/
+async function verifyPortableKeyDocument(document, actor, keyId, isGatewayKey, options) {
 	const reject = (reason) => {
-		logger.debug("Failed to verify gateway key {keyId} of the portable actor {actorId}: {reason}", {
-			keyId: keyId.href,
+		logger.debug("Failed to verify key {keyId} of the portable actor {actorId}: {reason}", {
+			keyId: (0, _fedify_vocab_runtime.formatIri)(keyId),
 			actorId: actor.id?.href,
 			reason
 		});
@@ -7627,8 +7801,9 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 	const keyBase = new URL(keyId.href);
 	keyBase.hash = "";
 	const claimedActorId = getCanonicalPortableId(keyBase);
+	const claimedKeyId = getCanonicalPortableId(keyId);
 	const actorId = actor.id == null ? null : getCanonicalPortableId(actor.id);
-	if (claimedActorId == null || actorId == null) return reject("The key ID or the actor ID is not a valid portable ID.");
+	if (claimedActorId == null || claimedKeyId == null || actorId == null) return reject("The key ID or the actor ID is not a valid portable ID.");
 	if (claimedActorId !== actorId) return reject("The key ID is not a compatible identifier of the actor it dereferences to.");
 	let verification;
 	try {
@@ -7673,10 +7848,12 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 		if (!(error instanceof TypeError)) throw error;
 		return reject("The verified actor document is malformed.");
 	}
-	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
+	const rootId = root["@id"];
+	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId || typeof rootId !== "string" || getRawCanonicalPortableId(rootId) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
 	actor = verifiedActor;
-	const assertionNodes = findNodes(root[`${SEC}assertionMethod`], keyId);
-	const publicKeyNodes = findNodes(root[`${SEC}publicKey`], keyId);
+	const findKeyNodes = (values) => findNodes(values, claimedKeyId, isGatewayKey ? keyId.origin : null);
+	const assertionNodes = findKeyNodes(root[`${SEC}assertionMethod`]);
+	const publicKeyNodes = findKeyNodes(root[`${SEC}publicKey`]);
 	if (assertionNodes.length > 1 || publicKeyNodes.length > 1) return reject("The actor document has more than one key with the ID.");
 	let publicKey;
 	if (assertionNodes.length > 0) {
@@ -7706,7 +7883,9 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 		if (embedded.ownerId == null || getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The owner of the key is not the actor.");
 		publicKey = embedded.publicKey;
 	}
-	if (!actor.gateways.some((gateway) => (0, _fedify_vocab_runtime.isGatewayUrl)(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
+	if (isGatewayKey) {
+		if (!actor.gateways.some((gateway) => (0, _fedify_vocab_runtime.isGatewayUrl)(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
+	} else if (!actor.gateways.some(_fedify_vocab_runtime.isGatewayUrl)) return reject("The actor has no valid gateways.");
 	const key = new _fedify_vocab.CryptographicKey({
 		id: keyId,
 		owner: actor.id,
@@ -7761,15 +7940,170 @@ async function fetchPortableGatewayKey(keyId, options = {}) {
 		contextLoader
 	});
 }
-function findNodes(values, id) {
+/**
+* Resolves a key of a portable actor at an `ap:` or `ap+ef61:` key ID, e.g.,
+* `ap://did:key:z6Mk…/actor#main-key`.  Such a key ID names no gateway, so
+* the actor's document, i.e., the key ID without its fragment, is fetched
+* through the gateways in its `@gateway` location hints, one after another,
+* until one of them serves a document that vouches for the key.  Without
+* location hints, the document loader is asked for the `ap:` URI itself,
+* which only a custom document loader can resolve.  The hints are chosen by
+* whoever made the signature, but that does not matter: only a document with
+* a valid proof by the DID of the key ID vouches for the key.
+*
+* The key is taken as a key of the actor itself, not of a gateway, so it is
+* accepted by the rules of {@link verifyPortableGatewayKeyDocument}, except
+* that it is listed under the `ap:` or `ap+ef61:` URI with the same canonical
+* ID as the key ID, and that the actor only has to have a valid gateway.
+* The key ID must have a fragment; a key served as a standalone document is
+* not supported.
+*
+* If no gateway serves a document that vouches for the key, the result is
+* `rejected` only if every gateway served a document that definitely does not
+* vouch for it.  If every gateway failed to serve a document at all, the
+* result is a cacheable `unavailable`, with the error of the first gateway if
+* every gateway responded with the same HTTP status, so that the status
+* describes the whole lookup.  Otherwise, e.g., if one gateway was
+* unreachable and another served an invalid document, nothing tells what the
+* unreachable gateway would have served, so the result is an `unavailable`
+* that is not cacheable.
+*
+* @param keyId The key ID, which must be an `ap:` or `ap+ef61:` URI.
+* @param options Loaders and telemetry providers.
+* @returns The resolution, which is never `legacy`.
+* @internal
+*/
+async function resolvePortableActorKey(keyId, options = {}) {
+	const documentLoader = options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
+	const contextLoader = options.contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
+	let formattedKeyId = keyId.href;
+	const reject = (reason) => {
+		logger.debug("Failed to verify key {keyId} of a portable actor: {reason}", {
+			keyId: formattedKeyId,
+			reason
+		});
+		return {
+			type: "rejected",
+			reason
+		};
+	};
+	if (!isPortableUri(keyId) || getCanonicalPortableId(keyId) == null) return reject("The key ID is not a valid ap: or ap+ef61: URI.");
+	formattedKeyId = (0, _fedify_vocab_runtime.formatIri)(keyId);
+	if (keyId.hash === "" || keyId.hash === "#") return reject("The key ID has no fragment; only keys embedded in actor documents are supported.");
+	const actorUrl = new URL(keyId.href);
+	actorUrl.hash = "";
+	const requestUrls = [];
+	for (const gateway of (0, _fedify_vocab_runtime_internal_portable_dereference.getPortableGatewayCandidates)(actorUrl)) try {
+		requestUrls.push((0, _fedify_vocab_runtime.toCompatibleEf61Id)(actorUrl, gateway).href);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject(`The key ID cannot be fetched from gateways: ${error}`);
+	}
+	if (requestUrls.length < 1) requestUrls.push((0, _fedify_vocab_runtime.formatIri)(actorUrl));
+	const attempts = [];
+	for (const url of requestUrls) {
+		let remoteDocument;
+		try {
+			remoteDocument = await documentLoader(url);
+		} catch (error) {
+			logger.debug("Failed to fetch the actor of key {keyId} from {url}: {error}", {
+				keyId: formattedKeyId,
+				url,
+				error
+			});
+			attempts.push({
+				type: "retrievalFailed",
+				error
+			});
+			continue;
+		}
+		let resolution;
+		try {
+			const object = await _fedify_vocab.Object.fromJsonLd(remoteDocument.document, {
+				documentLoader,
+				contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+			resolution = isPortableActorDocument(object) ? await verifyPortableKeyDocument(remoteDocument.document, object, keyId, false, {
+				...options,
+				documentLoader,
+				contextLoader
+			}) : {
+				type: "rejected",
+				reason: "The document is not a portable actor."
+			};
+		} catch (error) {
+			if (error instanceof TypeError) resolution = {
+				type: "rejected",
+				reason: `The document is malformed: ${error.message}`
+			};
+			else {
+				logger.debug("Failed to process the actor of key {keyId} served from {url}: {error}", {
+					keyId: formattedKeyId,
+					url,
+					error
+				});
+				attempts.push({
+					type: "indeterminate",
+					error
+				});
+				continue;
+			}
+		}
+		if (resolution.type === "verified") return resolution;
+		const reason = resolution.type === "rejected" ? resolution.reason : "The document is not a portable actor.";
+		logger.debug("The actor document served from {url} does not vouch for key {keyId}: {reason}", {
+			keyId: formattedKeyId,
+			url,
+			reason
+		});
+		attempts.push({
+			type: "rejected",
+			reason
+		});
+	}
+	const rejections = attempts.flatMap((a) => a.type === "rejected" ? [a.reason] : []);
+	if (rejections.length === attempts.length) return reject(rejections.join(" "));
+	const errors = attempts.flatMap((a) => a.type === "rejected" ? [] : [a.error]);
+	const aggregate = errors.length === 1 ? errors[0] : new AggregateError(errors, `Failed to fetch the actor of key ${formattedKeyId} from any of its gateways: ${requestUrls.join(", ")}`);
+	if (attempts.every((a) => a.type === "retrievalFailed")) {
+		const statuses = errors.map((error) => error instanceof _fedify_vocab_runtime.FetchError ? error.response?.status : void 0);
+		return {
+			type: "unavailable",
+			error: statuses[0] != null && statuses.every((status) => status === statuses[0]) ? errors[0] : aggregate,
+			cacheable: true
+		};
+	}
+	return {
+		type: "unavailable",
+		error: new Error(`Could not determine whether the actor of key ${formattedKeyId} vouches for it.`, { cause: aggregate }),
+		cacheable: false
+	};
+}
+/**
+* Finds the nodes that stand for the key with the given canonical portable
+* ID.  A node whose ID is an `ap:` or `ap+ef61:` URI stands for the key
+* itself, e.g., Mitra lists the keys of portable actors that way while
+* signing requests with compatible key IDs.  A node whose ID is a compatible
+* identifier stands for a gateway's key, so it matches only a compatible key
+* ID on the same gateway; a key ID that names no gateway never selects
+* a gateway's key, even with the same fragment.
+* @param values The expanded values of a key property.
+* @param canonicalKeyId The canonical portable ID of the key ID.
+* @param gateway The origin of the gateway whose key the key ID names, or
+*                `null` if the key ID names no gateway.
+*/
+function findNodes(values, canonicalKeyId, gateway) {
 	if (!Array.isArray(values)) return [];
 	const nodes = [];
 	for (const value of values) {
 		if (value == null || typeof value !== "object" || Array.isArray(value)) continue;
 		const node = value;
 		const nodeId = node["@id"];
-		if (typeof nodeId !== "string" || !URL.canParse(nodeId)) continue;
-		if (new URL(nodeId).href === id.href) nodes.push(node);
+		if (typeof nodeId !== "string") continue;
+		if (getRawCanonicalPortableId(nodeId) !== canonicalKeyId) continue;
+		const parsed = (0, _fedify_vocab_runtime.parseIri)(nodeId);
+		if (isPortableUri(parsed) || parsed.origin === gateway) nodes.push(node);
 	}
 	return nodes;
 }
@@ -8148,13 +8482,18 @@ function keyFetchErrorResult(keyId, result) {
 		}
 	};
 }
+/**
+* Creates the resolvers of keys of FEP-ef61 portable actors, which HTTP
+* Signature verification alone passes to key lookups.
+*/
+function createPortableKeyResolvers(options) {
+	return {
+		gatewayKey: (document, actor, keyId) => verifyPortableGatewayKeyDocument(document, actor, keyId, options),
+		actorKey: (keyId) => resolvePortableActorKey(keyId, options)
+	};
+}
 function parseKeyId(value) {
-	if (value == null) return null;
-	try {
-		return new URL(value);
-	} catch {
-		return null;
-	}
+	return value == null ? null : parseKeyIdString(value);
 }
 function getKeyFetchErrorName(error) {
 	return error.name || error.constructor.name || "Error";
@@ -8412,7 +8751,7 @@ async function verifyRequestDraft(request, span, metricsContext, { documentLoade
 		keyCache,
 		tracerProvider,
 		meterProvider,
-		portableGatewayKeyResolver: (document, actor, keyId) => verifyPortableGatewayKeyDocument(document, actor, keyId, {
+		portableKeyResolvers: createPortableKeyResolvers({
 			documentLoader,
 			contextLoader,
 			keyCache,
@@ -8632,7 +8971,7 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 			keyCache,
 			tracerProvider,
 			meterProvider,
-			portableGatewayKeyResolver: (document, actor, gatewayKeyId) => verifyPortableGatewayKeyDocument(document, actor, gatewayKeyId, {
+			portableKeyResolvers: createPortableKeyResolvers({
 				documentLoader,
 				contextLoader,
 				keyCache,
@@ -9156,6 +9495,12 @@ Object.defineProperty(exports, "isPortableId", {
 		return isPortableId;
 	}
 });
+Object.defineProperty(exports, "isPortableKeyId", {
+	enumerable: true,
+	get: function() {
+		return isPortableKeyId;
+	}
+});
 Object.defineProperty(exports, "isPortableUri", {
 	enumerable: true,
 	get: function() {
@@ -9276,6 +9621,12 @@ Object.defineProperty(exports, "registerQueueDepthGauge", {
 		return registerQueueDepthGauge;
 	}
 });
+Object.defineProperty(exports, "resolvePortableActorKey", {
+	enumerable: true,
+	get: function() {
+		return resolvePortableActorKey;
+	}
+});
 Object.defineProperty(exports, "selectRequestSignature", {
 	enumerable: true,
 	get: function() {