@fedify/fedify 2.4.0-dev.2127 → 2.4.0-dev.2129

package/dist/{http-Rmbiu-5S.js → http-C2M6wcs8.js}

@@ -4,7 +4,7 @@ import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, PUBLIC_COLLECTION, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, metrics, trace } from "@opentelemetry/api";
 import { FetchError, canonicalizePortableUri, encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDidKeyVerificationMethod, parseIri, preloadedContexts, toCompatibleEf61Id } from "@fedify/vocab-runtime";
-import { isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
+import { getPortableGatewayCandidates, isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { encodeHex } from "byte-encodings/hex";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import { Item, decodeDict, encodeDict, encodeItem } from "structured-field-values";
@@ -14,10 +14,12 @@ import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2127+c41ce2eb";
+var version = "2.4.0-dev.2129+c0ddb433";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+const RAW_PORTABLE_URI_PATTERN = /^ap(?:\+ef61)?:\/\//i;
+const RAW_COMPATIBLE_ID_PREFIX_PATTERN = /^https?:\/\/[^/?#]*\/\.well-known\/apgateway\/(?=did(?::|%3A))/i;
 /**
 * Checks whether the URL is an `ap:` or `ap+ef61:` URI.
 * @internal
@@ -81,6 +83,20 @@ function isCompatibleKeyId(keyId) {
 	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
 }
 /**
+* Checks whether a key ID may name a key that is valid only for HTTP
+* Signatures: a gateway key at an [FEP-ef61] compatible identifier, or a key
+* of a portable actor at an `ap:` or `ap+ef61:` URI.  Neither ever makes or
+* verifies an Object Integrity Proof or a Linked Data Signature: a portable
+* object's proof is made by its DID, and a proof made with a gateway key
+* would claim that the gateway authored the object.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isPortableKeyId(keyId) {
+	return isPortableUri(keyId) || isCompatibleKeyId(keyId);
+}
+/**
 * Gets the canonical portable ID of an actor ID that is either an `ap:` or
 * `ap+ef61:` URI or a compatible identifier.
 * @returns The canonical portable ID, or `null` if the ID is neither, or is
@@ -99,6 +115,57 @@ function getCanonicalPortableId(id) {
 	}
 }
 /**
+* Gets the canonical portable ID of an `ap:` or `ap+ef61:` URI or
+* a compatible identifier as it is written, before any URL parsing.
+* Parsing an ID into a `URL` resolves dot segments in its path, which would
+* make it identify another portable object, e.g.,
+* `ap://did:key:z6Mk…/x/../actor` would become `ap://did:key:z6Mk…/actor`.
+* Such an ID has no canonical portable ID here.
+* @param raw The ID as it is written.
+* @returns The canonical portable ID, fragment included, or `null` if the ID
+*          is neither an `ap:` or `ap+ef61:` URI nor a compatible identifier,
+*          is malformed, or would identify another object once parsed.
+* @internal
+*/
+function getRawCanonicalPortableId(raw) {
+	let canonical;
+	let parsed;
+	try {
+		if (RAW_PORTABLE_URI_PATTERN.test(raw)) {
+			canonical = canonicalizePortableUri(raw);
+			parsed = canonicalizePortableUri(formatIri(parseIri(raw)));
+		} else {
+			const prefix = raw.match(RAW_COMPATIBLE_ID_PREFIX_PATTERN);
+			if (prefix == null || !URL.canParse(raw)) return null;
+			canonical = canonicalizePortableUri("ap://" + raw.slice(prefix[0].length));
+			parsed = getCanonicalPortableId(new URL(raw));
+		}
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+	return canonical === parsed ? canonical : null;
+}
+/**
+* Parses a key ID, e.g., the `keyId` of an HTTP Signature, into a `URL`.
+* An `ap:` or `ap+ef61:` key ID is parsed into the internal `URL` form of
+* portable URIs.  A portable or compatible key ID that is malformed, or
+* whose identity URL parsing would change, e.g., by resolving dot segments in
+* its path, is refused, so that it can never be taken for, or looked up in
+* the key cache as, the key of another object.
+* @param raw The key ID as it is written.
+* @returns The parsed key ID, or `null` if it is invalid.
+* @internal
+*/
+function parseKeyIdString(raw) {
+	if (RAW_PORTABLE_URI_PATTERN.test(raw)) return getRawCanonicalPortableId(raw) == null ? null : parseIri(raw);
+	if (!URL.canParse(raw)) return null;
+	const url = new URL(raw);
+	if (isPortableUri(url)) return null;
+	if (!RAW_COMPATIBLE_ID_PREFIX_PATTERN.test(raw)) return isCompatibleKeyId(url) ? null : url;
+	return getRawCanonicalPortableId(raw) == null ? null : url;
+}
+/**
 * Builds the base of the key IDs of a gateway's keys for a portable actor:
 * the actor's compatible identifier on the gateway.
 * @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
@@ -1342,6 +1409,17 @@ function bypassKeyCacheReads(keyCache) {
 	};
 	return bypassed;
 }
+/**
+* Parses a key ID given as a string.  Unlike `new URL()`, it accepts `ap:`
+* and `ap+ef61:` URIs, and refuses a portable or compatible key ID whose
+* identity URL parsing would change, e.g., by resolving dot segments.
+* @throws {TypeError} If the key ID is invalid.
+*/
+function parseKeyIdOrThrow(keyId) {
+	const parsed = parseKeyIdString(keyId);
+	if (parsed == null) throw new TypeError(`Invalid key ID: ${keyId}`);
+	return parsed;
+}
 async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 	tracerProvider ??= trace.getTracerProvider();
 	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
@@ -1378,9 +1456,11 @@ async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
@@ -1393,7 +1473,7 @@ async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 * @since 1.3.0
 */
 function fetchKey(keyId, cls, options = {}) {
-	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
+	keyId = typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId;
 	return withFetchKeySpan(keyId, options.tracerProvider, () => fetchKeyInternal(keyId, cls, options));
 }
 /**
@@ -1403,9 +1483,11 @@ function fetchKey(keyId, cls, options = {}) {
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 *
@@ -1419,7 +1501,7 @@ function fetchKey(keyId, cls, options = {}) {
 * @since 2.1.0
 */
 async function fetchKeyDetailed(keyId, cls, options = {}) {
-	const cacheKey = typeof keyId === "string" ? new URL(keyId) : keyId;
+	const cacheKey = typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId;
 	return await withFetchKeySpan(cacheKey, options.tracerProvider, async () => {
 		return await fetchKeyWithResult(cacheKey, cls, options, async (cacheKey, keyId, keyCache, logger) => {
 			const fetchError = await keyCache?.getFetchError?.(cacheKey);
@@ -1558,7 +1640,7 @@ async function resolveDidKey(cacheKey, cls, keyCache, logger) {
 		cached: false
 	};
 }
-async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableGatewayKeyResolver }, logger) {
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableKeyResolvers }, logger) {
 	let object;
 	try {
 		object = await Object$1.fromJsonLd(document, {
@@ -1589,7 +1671,7 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 	}
 	if (isCompatibleKeyId(cacheKey) && isPortableActorDocument(object)) {
 		const scopedCache = keyCache;
-		if (portableGatewayKeyResolver == null || cls !== CryptographicKey) {
+		if (portableKeyResolvers == null || cls !== CryptographicKey) {
 			logger.debug("Failed to verify; key {keyId} is a gateway key of the portable actor {actorId}, which is only accepted for HTTP Signatures.", {
 				keyId,
 				actorId: object.id?.href
@@ -1600,7 +1682,7 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 				cached: false
 			};
 		}
-		const resolution = await portableGatewayKeyResolver(document, object, cacheKey);
+		const resolution = await portableKeyResolvers.gatewayKey(document, object, cacheKey);
 		if (resolution.type !== "verified") {
 			logger.debug("Failed to verify; the portable actor {actorId} does not vouch for its gateway key {keyId}.", {
 				keyId,
@@ -1760,6 +1842,11 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 		]);
 		const keyId = cacheKey.href;
 		const keyCache = options.keyCache;
+		if (isPortableUri(cacheKey)) {
+			const result = await fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger);
+			outcome = result.outcome;
+			return result.result;
+		}
 		if (isCompatibleKeyId(cacheKey)) {
 			const result = await fetchCompatibleKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger);
 			outcome = result.outcome;
@@ -1811,7 +1898,7 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 */
 function getCompatibleKeyScope(cls, options) {
 	if (cls !== CryptographicKey) return "multikey";
-	return options.portableGatewayKeyResolver == null ? "cryptographicKey" : "httpSignature";
+	return options.portableKeyResolvers == null ? "cryptographicKey" : "httpSignature";
 }
 /**
 * Looks up a key at an [FEP-ef61] compatible identifier.  Such a key may be
@@ -1865,8 +1952,75 @@ async function fetchCompatibleKey(cacheKey, cls, options, onCachedUnavailable, o
 		outcome: { result: resolved.key != null ? "fetched" : "invalid" }
 	};
 }
+/**
+* Looks up a key of an [FEP-ef61] portable actor at an `ap:` or `ap+ef61:`
+* key ID.  Such a key is accepted only for HTTP Signatures, and is rejected
+* for any other purpose without being fetched.  Like keys at compatible
+* identifiers, what it resolves to is cached in the namespace of the lookup's
+* purpose, and a failure to fetch the actor's document from every gateway is
+* cached in the shared namespace.  A failure that is neither, e.g., one
+* gateway being unreachable while another served an invalid document, is not
+* cached at all.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+async function fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger) {
+	const keyId = cacheKey.href;
+	const resolvers = options.portableKeyResolvers;
+	if (resolvers == null || cls !== CryptographicKey) {
+		logger.debug("Failed to verify; key {keyId} is a key of a portable actor, which is only accepted for HTTP Signatures.", { keyId });
+		return {
+			result: {
+				key: null,
+				cached: false
+			},
+			outcome: { result: "invalid" }
+		};
+	}
+	const sharedCache = options.keyCache;
+	const scopedCache = sharedCache?.compatibleKeyScope?.("httpSignature");
+	const cached = await getCachedFetchKey(cacheKey, keyId, cls, scopedCache, logger);
+	if (cached != null) return {
+		result: cached,
+		outcome: { result: "hit" }
+	};
+	if (await sharedCache?.get(cacheKey) === null) {
+		logger.debug("Entry {keyId} found in cache, but it could not be fetched.", { keyId });
+		return {
+			result: await onCachedUnavailable(cacheKey, keyId, sharedCache, logger),
+			outcome: { result: "hit" }
+		};
+	}
+	logger.debug("Resolving key {keyId} to verify signature...", { keyId });
+	const resolution = await resolvers.actorKey(cacheKey);
+	if (resolution.type === "verified") {
+		await scopedCache?.set(cacheKey, resolution.key, { expires: resolution.expires });
+		return {
+			result: {
+				key: resolution.key,
+				cached: false
+			},
+			outcome: { result: "fetched" }
+		};
+	}
+	if (resolution.type === "rejected") {
+		await scopedCache?.set(cacheKey, null);
+		return {
+			result: {
+				key: null,
+				cached: false
+			},
+			outcome: { result: "invalid" }
+		};
+	}
+	await scopedCache?.delete(cacheKey);
+	return {
+		result: await onFetchError(resolution.error, cacheKey, keyId, resolution.cacheable ? sharedCache : void 0, logger),
+		outcome: resolution.cacheable ? classifyFetchError(resolution.error) : { result: "error" }
+	};
+}
 async function fetchKeyInternal(keyId, cls, options = {}) {
-	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
+	return await fetchKeyWithResult(typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
 		return {
 			key: null,
 			cached: true
@@ -4034,6 +4188,14 @@ const SEC = "https://w3id.org/security#";
 *  -  no more than one entry of either property has that ID; and
 *  -  the key ID's origin is one of the actor's `gateways`.
 *
+* An entry has the key's ID if its ID is the key ID, or any compatible
+* identifier on the same gateway, or the `ap:` or `ap+ef61:` URI, with the
+* same canonical portable ID.  Some publishers, e.g., Mitra, list the keys
+* of portable actors under `ap:` URIs, but sign requests with compatible key
+* IDs on their own gateways.  IDs are compared as they are written in
+* the signed document, so an ID that URL parsing would turn into another,
+* e.g., by resolving dot segments, has no match.
+*
 * [FEP-8b32]: https://w3id.org/fep/8b32
 * [FEP-ef61]: https://w3id.org/fep/ef61
 * [FEP-521a]: https://w3id.org/fep/521a
@@ -4045,10 +4207,22 @@ const SEC = "https://w3id.org/security#";
 * @returns The verification result, which is never `legacy`.
 * @internal
 */
-async function verifyPortableGatewayKeyDocument(document, actor, keyId, options = {}) {
+function verifyPortableGatewayKeyDocument(document, actor, keyId, options = {}) {
+	return verifyPortableKeyDocument(document, actor, keyId, true, options);
+}
+/**
+* Verifies that the signed document of a portable actor vouches for the key
+* with the given ID, either a gateway key at a compatible key ID, or a key of
+* the actor itself at an `ap:` or `ap+ef61:` key ID.  See
+* {@link verifyPortableGatewayKeyDocument} for the rules; a key of the actor
+* itself names no gateway, so instead of the key ID's origin being one of
+* the actor's `gateways`, the actor only has to have a valid gateway, as
+* FEP-ef61 requires of every portable actor.
+*/
+async function verifyPortableKeyDocument(document, actor, keyId, isGatewayKey, options) {
 	const reject = (reason) => {
-		logger.debug("Failed to verify gateway key {keyId} of the portable actor {actorId}: {reason}", {
-			keyId: keyId.href,
+		logger.debug("Failed to verify key {keyId} of the portable actor {actorId}: {reason}", {
+			keyId: formatIri(keyId),
 			actorId: actor.id?.href,
 			reason
 		});
@@ -4060,8 +4234,9 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 	const keyBase = new URL(keyId.href);
 	keyBase.hash = "";
 	const claimedActorId = getCanonicalPortableId(keyBase);
+	const claimedKeyId = getCanonicalPortableId(keyId);
 	const actorId = actor.id == null ? null : getCanonicalPortableId(actor.id);
-	if (claimedActorId == null || actorId == null) return reject("The key ID or the actor ID is not a valid portable ID.");
+	if (claimedActorId == null || claimedKeyId == null || actorId == null) return reject("The key ID or the actor ID is not a valid portable ID.");
 	if (claimedActorId !== actorId) return reject("The key ID is not a compatible identifier of the actor it dereferences to.");
 	let verification;
 	try {
@@ -4106,10 +4281,12 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 		if (!(error instanceof TypeError)) throw error;
 		return reject("The verified actor document is malformed.");
 	}
-	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
+	const rootId = root["@id"];
+	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId || typeof rootId !== "string" || getRawCanonicalPortableId(rootId) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
 	actor = verifiedActor;
-	const assertionNodes = findNodes(root[`${SEC}assertionMethod`], keyId);
-	const publicKeyNodes = findNodes(root[`${SEC}publicKey`], keyId);
+	const findKeyNodes = (values) => findNodes(values, claimedKeyId, isGatewayKey ? keyId.origin : null);
+	const assertionNodes = findKeyNodes(root[`${SEC}assertionMethod`]);
+	const publicKeyNodes = findKeyNodes(root[`${SEC}publicKey`]);
 	if (assertionNodes.length > 1 || publicKeyNodes.length > 1) return reject("The actor document has more than one key with the ID.");
 	let publicKey;
 	if (assertionNodes.length > 0) {
@@ -4139,7 +4316,9 @@ async function verifyPortableGatewayKeyDocument(document, actor, keyId, options
 		if (embedded.ownerId == null || getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The owner of the key is not the actor.");
 		publicKey = embedded.publicKey;
 	}
-	if (!actor.gateways.some((gateway) => isGatewayUrl(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
+	if (isGatewayKey) {
+		if (!actor.gateways.some((gateway) => isGatewayUrl(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
+	} else if (!actor.gateways.some(isGatewayUrl)) return reject("The actor has no valid gateways.");
 	const key = new CryptographicKey({
 		id: keyId,
 		owner: actor.id,
@@ -4194,15 +4373,170 @@ async function fetchPortableGatewayKey(keyId, options = {}) {
 		contextLoader
 	});
 }
-function findNodes(values, id) {
+/**
+* Resolves a key of a portable actor at an `ap:` or `ap+ef61:` key ID, e.g.,
+* `ap://did:key:z6Mk…/actor#main-key`.  Such a key ID names no gateway, so
+* the actor's document, i.e., the key ID without its fragment, is fetched
+* through the gateways in its `@gateway` location hints, one after another,
+* until one of them serves a document that vouches for the key.  Without
+* location hints, the document loader is asked for the `ap:` URI itself,
+* which only a custom document loader can resolve.  The hints are chosen by
+* whoever made the signature, but that does not matter: only a document with
+* a valid proof by the DID of the key ID vouches for the key.
+*
+* The key is taken as a key of the actor itself, not of a gateway, so it is
+* accepted by the rules of {@link verifyPortableGatewayKeyDocument}, except
+* that it is listed under the `ap:` or `ap+ef61:` URI with the same canonical
+* ID as the key ID, and that the actor only has to have a valid gateway.
+* The key ID must have a fragment; a key served as a standalone document is
+* not supported.
+*
+* If no gateway serves a document that vouches for the key, the result is
+* `rejected` only if every gateway served a document that definitely does not
+* vouch for it.  If every gateway failed to serve a document at all, the
+* result is a cacheable `unavailable`, with the error of the first gateway if
+* every gateway responded with the same HTTP status, so that the status
+* describes the whole lookup.  Otherwise, e.g., if one gateway was
+* unreachable and another served an invalid document, nothing tells what the
+* unreachable gateway would have served, so the result is an `unavailable`
+* that is not cacheable.
+*
+* @param keyId The key ID, which must be an `ap:` or `ap+ef61:` URI.
+* @param options Loaders and telemetry providers.
+* @returns The resolution, which is never `legacy`.
+* @internal
+*/
+async function resolvePortableActorKey(keyId, options = {}) {
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	let formattedKeyId = keyId.href;
+	const reject = (reason) => {
+		logger.debug("Failed to verify key {keyId} of a portable actor: {reason}", {
+			keyId: formattedKeyId,
+			reason
+		});
+		return {
+			type: "rejected",
+			reason
+		};
+	};
+	if (!isPortableUri(keyId) || getCanonicalPortableId(keyId) == null) return reject("The key ID is not a valid ap: or ap+ef61: URI.");
+	formattedKeyId = formatIri(keyId);
+	if (keyId.hash === "" || keyId.hash === "#") return reject("The key ID has no fragment; only keys embedded in actor documents are supported.");
+	const actorUrl = new URL(keyId.href);
+	actorUrl.hash = "";
+	const requestUrls = [];
+	for (const gateway of getPortableGatewayCandidates(actorUrl)) try {
+		requestUrls.push(toCompatibleEf61Id(actorUrl, gateway).href);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject(`The key ID cannot be fetched from gateways: ${error}`);
+	}
+	if (requestUrls.length < 1) requestUrls.push(formatIri(actorUrl));
+	const attempts = [];
+	for (const url of requestUrls) {
+		let remoteDocument;
+		try {
+			remoteDocument = await documentLoader(url);
+		} catch (error) {
+			logger.debug("Failed to fetch the actor of key {keyId} from {url}: {error}", {
+				keyId: formattedKeyId,
+				url,
+				error
+			});
+			attempts.push({
+				type: "retrievalFailed",
+				error
+			});
+			continue;
+		}
+		let resolution;
+		try {
+			const object = await Object$1.fromJsonLd(remoteDocument.document, {
+				documentLoader,
+				contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+			resolution = isPortableActorDocument(object) ? await verifyPortableKeyDocument(remoteDocument.document, object, keyId, false, {
+				...options,
+				documentLoader,
+				contextLoader
+			}) : {
+				type: "rejected",
+				reason: "The document is not a portable actor."
+			};
+		} catch (error) {
+			if (error instanceof TypeError) resolution = {
+				type: "rejected",
+				reason: `The document is malformed: ${error.message}`
+			};
+			else {
+				logger.debug("Failed to process the actor of key {keyId} served from {url}: {error}", {
+					keyId: formattedKeyId,
+					url,
+					error
+				});
+				attempts.push({
+					type: "indeterminate",
+					error
+				});
+				continue;
+			}
+		}
+		if (resolution.type === "verified") return resolution;
+		const reason = resolution.type === "rejected" ? resolution.reason : "The document is not a portable actor.";
+		logger.debug("The actor document served from {url} does not vouch for key {keyId}: {reason}", {
+			keyId: formattedKeyId,
+			url,
+			reason
+		});
+		attempts.push({
+			type: "rejected",
+			reason
+		});
+	}
+	const rejections = attempts.flatMap((a) => a.type === "rejected" ? [a.reason] : []);
+	if (rejections.length === attempts.length) return reject(rejections.join(" "));
+	const errors = attempts.flatMap((a) => a.type === "rejected" ? [] : [a.error]);
+	const aggregate = errors.length === 1 ? errors[0] : new AggregateError(errors, `Failed to fetch the actor of key ${formattedKeyId} from any of its gateways: ${requestUrls.join(", ")}`);
+	if (attempts.every((a) => a.type === "retrievalFailed")) {
+		const statuses = errors.map((error) => error instanceof FetchError ? error.response?.status : void 0);
+		return {
+			type: "unavailable",
+			error: statuses[0] != null && statuses.every((status) => status === statuses[0]) ? errors[0] : aggregate,
+			cacheable: true
+		};
+	}
+	return {
+		type: "unavailable",
+		error: new Error(`Could not determine whether the actor of key ${formattedKeyId} vouches for it.`, { cause: aggregate }),
+		cacheable: false
+	};
+}
+/**
+* Finds the nodes that stand for the key with the given canonical portable
+* ID.  A node whose ID is an `ap:` or `ap+ef61:` URI stands for the key
+* itself, e.g., Mitra lists the keys of portable actors that way while
+* signing requests with compatible key IDs.  A node whose ID is a compatible
+* identifier stands for a gateway's key, so it matches only a compatible key
+* ID on the same gateway; a key ID that names no gateway never selects
+* a gateway's key, even with the same fragment.
+* @param values The expanded values of a key property.
+* @param canonicalKeyId The canonical portable ID of the key ID.
+* @param gateway The origin of the gateway whose key the key ID names, or
+*                `null` if the key ID names no gateway.
+*/
+function findNodes(values, canonicalKeyId, gateway) {
 	if (!Array.isArray(values)) return [];
 	const nodes = [];
 	for (const value of values) {
 		if (value == null || typeof value !== "object" || Array.isArray(value)) continue;
 		const node = value;
 		const nodeId = node["@id"];
-		if (typeof nodeId !== "string" || !URL.canParse(nodeId)) continue;
-		if (new URL(nodeId).href === id.href) nodes.push(node);
+		if (typeof nodeId !== "string") continue;
+		if (getRawCanonicalPortableId(nodeId) !== canonicalKeyId) continue;
+		const parsed = parseIri(nodeId);
+		if (isPortableUri(parsed) || parsed.origin === gateway) nodes.push(node);
 	}
 	return nodes;
 }
@@ -4580,13 +4914,18 @@ function keyFetchErrorResult(keyId, result) {
 		}
 	};
 }
+/**
+* Creates the resolvers of keys of FEP-ef61 portable actors, which HTTP
+* Signature verification alone passes to key lookups.
+*/
+function createPortableKeyResolvers(options) {
+	return {
+		gatewayKey: (document, actor, keyId) => verifyPortableGatewayKeyDocument(document, actor, keyId, options),
+		actorKey: (keyId) => resolvePortableActorKey(keyId, options)
+	};
+}
 function parseKeyId(value) {
-	if (value == null) return null;
-	try {
-		return new URL(value);
-	} catch {
-		return null;
-	}
+	return value == null ? null : parseKeyIdString(value);
 }
 function getKeyFetchErrorName(error) {
 	return error.name || error.constructor.name || "Error";
@@ -4844,7 +5183,7 @@ async function verifyRequestDraft(request, span, metricsContext, { documentLoade
 		keyCache,
 		tracerProvider,
 		meterProvider,
-		portableGatewayKeyResolver: (document, actor, keyId) => verifyPortableGatewayKeyDocument(document, actor, keyId, {
+		portableKeyResolvers: createPortableKeyResolvers({
 			documentLoader,
 			contextLoader,
 			keyCache,
@@ -5064,7 +5403,7 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 			keyCache,
 			tracerProvider,
 			meterProvider,
-			portableGatewayKeyResolver: (document, actor, gatewayKeyId) => verifyPortableGatewayKeyDocument(document, actor, gatewayKeyId, {
+			portableKeyResolvers: createPortableKeyResolvers({
 				documentLoader,
 				contextLoader,
 				keyCache,
@@ -5372,4 +5711,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { recordCollectionTotalItems as $, isInvalidUrlTypeError as A, generateCryptoKeyPair as B, compactJsonLd as C, hasSignature as D, getNormalizationContextLoader as E, wrapContextLoaderForJsonLd as F, getFederationMetrics as G, validateCryptoKey as H, exportJwk as I, isAbortError$1 as J, getRemoteHost as K, fetchActorDocument as L, verifyCompactJsonLd as M, verifyJsonLd as N, hasSignatureLike as O, verifySignature as P, recordCollectionRequest as Q, fetchKey as R, attachSignature as S, detachSignature as T, verifyKeyOwnership as U, importJwk as V, getDurationMs as W, recordCollectionDispatchDuration as X, recordCircuitBreakerStateChange as Y, recordCollectionPageItems as Z, verifyPortableObjectProofWithRoot as _, isPortableId as _t, signRequest as a, recordWebFingerHandle as at, InvalidContextReferenceError as b, name as bt, fetchPortableGatewayKey as c, formatAcceptSignature as ct, hasProofLike as d, validateAcceptSignature as dt, recordDocumentCache as et, signObject as f, getCanonicalPortableId as ft, verifyPortableObjectProofPolicy as g, isCompatibleKeyId as gt, verifyPortableObjectProof as h, hasPortableActor as ht, selectRequestSignature as i, recordOutboxEnqueue as it, signJsonLd as j, isClearlyMalformedContextReference as k, InvalidPortableObjectIdError as l, fulfillAcceptSignature as lt, verifyObject as m, getPortableDid as mt, listRequestSignatures as n, recordInboxActivity as nt, verifyRequest as o, registerQueueDepthGauge as ot, verifyMapLocalProof as p, getGatewayKeyBase as pt, instrumentDocumentLoader as q, parseRfc9421SignatureInput as r, recordOutboxActivity as rt, verifyRequestDetailed as s, preloadedOnlyDocumentLoader as st, doubleKnock as t, recordFanoutRecipients as tt, createProof as u, parseAcceptSignature as ut, verifyProof as v, isPortableUri as vt, createSignature as w, assertSafeJsonLd as x, version as xt, normalizeOutgoingActivityJsonLd as y, isSamePublicKey as yt, fetchKeyDetailed as z };
+export { recordCollectionRequest as $, isClearlyMalformedContextReference as A, fetchKeyDetailed as B, attachSignature as C, version as Ct, getNormalizationContextLoader as D, detachSignature as E, verifySignature as F, getDurationMs as G, importJwk as H, wrapContextLoaderForJsonLd as I, instrumentDocumentLoader as J, getFederationMetrics as K, exportJwk as L, signJsonLd as M, verifyCompactJsonLd as N, hasSignature as O, verifyJsonLd as P, recordCollectionPageItems as Q, fetchActorDocument as R, assertSafeJsonLd as S, name as St, createSignature as T, validateCryptoKey as U, generateCryptoKeyPair as V, verifyKeyOwnership as W, recordCircuitBreakerStateChange as X, isAbortError$1 as Y, recordCollectionDispatchDuration as Z, verifyPortableObjectProofPolicy as _, isCompatibleKeyId as _t, signRequest as a, recordOutboxEnqueue as at, normalizeOutgoingActivityJsonLd as b, isPortableUri as bt, fetchPortableGatewayKey as c, preloadedOnlyDocumentLoader as ct, createProof as d, parseAcceptSignature as dt, recordCollectionTotalItems as et, hasProofLike as f, validateAcceptSignature as ft, verifyPortableObjectProof as g, hasPortableActor as gt, verifyObject as h, getPortableDid as ht, selectRequestSignature as i, recordOutboxActivity as it, isInvalidUrlTypeError as j, hasSignatureLike as k, resolvePortableActorKey as l, formatAcceptSignature as lt, verifyMapLocalProof as m, getGatewayKeyBase as mt, listRequestSignatures as n, recordFanoutRecipients as nt, verifyRequest as o, recordWebFingerHandle as ot, signObject as p, getCanonicalPortableId as pt, getRemoteHost as q, parseRfc9421SignatureInput as r, recordInboxActivity as rt, verifyRequestDetailed as s, registerQueueDepthGauge as st, doubleKnock as t, recordDocumentCache as tt, InvalidPortableObjectIdError as u, fulfillAcceptSignature as ut, verifyPortableObjectProofWithRoot as v, isPortableId as vt, compactJsonLd as w, InvalidContextReferenceError as x, isSamePublicKey as xt, verifyProof as y, isPortableKeyId as yt, fetchKey as z };