@fedify/fedify 2.4.0-dev.2127 → 2.4.0-dev.2129

package/dist/{http-BrQgkJay.d.ts → http-CjezPjFX.d.cts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { Actor, CryptographicKey, Multikey } from "@fedify/vocab";
-import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader } from "@fedify/vocab-runtime";
+import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 
 //#region src/sig/portable-key.d.ts
 /**
@@ -29,6 +29,28 @@ type PortableGatewayKeyResolution = {
   */
   readonly expires?: Temporal.Instant;
 };
+/**
+* The result of resolving a key of a portable actor at an `ap:` or
+* `ap+ef61:` key ID.
+* @internal
+*/
+type PortableActorKeyResolution = Exclude<PortableGatewayKeyResolution, {
+  readonly type: "legacy";
+}> | {
+  /**
+  * Whether the actor's document vouches for the key could not be
+  * determined, e.g., because no gateway could be reached.
+  */
+  readonly type: "unavailable";
+  readonly error: unknown;
+  /**
+  * Whether the failure can be cached as a failure to fetch the key, i.e.,
+  * every gateway failed to serve the actor's document at all.  A failure
+  * that is not cacheable comes with an error that has no HTTP status,
+  * since none of the statuses describes the lookup as a whole.
+  */
+  readonly cacheable: boolean;
+};
 //#endregion
 //#region src/sig/key.d.ts
 /**
@@ -119,17 +141,34 @@ interface FetchKeyOptions {
   */
   keyIdBoundByCaller?: boolean;
   /**
-  * Resolves a gateway key of an [FEP-ef61] portable actor, i.e., a key whose
-  * ID is a compatible identifier and dereferences to a portable actor's
-  * document.  Such a key is resolved only through this function, and is
-  * rejected if it is omitted, so that only HTTP Signature verification,
-  * which passes it, accepts gateway keys.  Object Integrity Proofs and
-  * Linked Data Signatures never do.
+  * Resolves keys of [FEP-ef61] portable actors, which only HTTP Signature
+  * verification passes, so that only it accepts them.  Object Integrity
+  * Proofs and Linked Data Signatures never do: such a key is rejected if
+  * this is omitted.
   *
   * [FEP-ef61]: https://w3id.org/fep/ef61
   * @internal
   */
-  portableGatewayKeyResolver?: (document: unknown, actor: Actor, keyId: URL) => Promise<PortableGatewayKeyResolution>;
+  portableKeyResolvers?: PortableKeyResolvers;
+}
+/**
+* Resolves keys of [FEP-ef61] portable actors for HTTP Signature
+* verification.  See {@link FetchKeyOptions.portableKeyResolvers}.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+interface PortableKeyResolvers {
+  /**
+  * Resolves a gateway key, i.e., a key whose ID is a compatible identifier
+  * and dereferences to a portable actor's document.
+  */
+  gatewayKey(document: unknown, actor: Actor, keyId: URL): Promise<PortableGatewayKeyResolution>;
+  /**
+  * Resolves a key of a portable actor itself, i.e., a key whose ID is an
+  * `ap:` or `ap+ef61:` URI.
+  */
+  actorKey(keyId: URL): Promise<PortableActorKeyResolution>;
 }
 /**
 * The result of {@link fetchKey}.
@@ -182,9 +221,11 @@ type FetchableKeyClass<T extends CryptographicKey | Multikey> = (new (...args: a
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
@@ -204,9 +245,11 @@ declare function fetchKey<T extends CryptographicKey | Multikey>(keyId: URL | st
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 *

package/dist/{key-Cc1b6pW9.mjs → key-DolJjJab.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Be9xoxps.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DDE9S63Q.mjs";
-import { a as isCompatibleKeyId, o as isPortableActorDocument, s as isPortableId } from "./portable-key-id-T7lecIbt.mjs";
+import { n as version, t as name } from "./deno-_o3lkDlG.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-CDaHfBXY.mjs";
+import { c as isPortableId, f as parseKeyIdString, o as isCompatibleKeyId, s as isPortableActorDocument, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
@@ -236,6 +236,17 @@ function bypassKeyCacheReads(keyCache) {
 	};
 	return bypassed;
 }
+/**
+* Parses a key ID given as a string.  Unlike `new URL()`, it accepts `ap:`
+* and `ap+ef61:` URIs, and refuses a portable or compatible key ID whose
+* identity URL parsing would change, e.g., by resolving dot segments.
+* @throws {TypeError} If the key ID is invalid.
+*/
+function parseKeyIdOrThrow(keyId) {
+	const parsed = parseKeyIdString(keyId);
+	if (parsed == null) throw new TypeError(`Invalid key ID: ${keyId}`);
+	return parsed;
+}
 async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 	tracerProvider ??= trace.getTracerProvider();
 	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
@@ -272,9 +283,11 @@ async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
@@ -287,7 +300,7 @@ async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 * @since 1.3.0
 */
 function fetchKey(keyId, cls, options = {}) {
-	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
+	keyId = typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId;
 	return withFetchKeySpan(keyId, options.tracerProvider, () => fetchKeyInternal(keyId, cls, options));
 }
 /**
@@ -297,9 +310,11 @@ function fetchKey(keyId, cls, options = {}) {
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 *
@@ -313,7 +328,7 @@ function fetchKey(keyId, cls, options = {}) {
 * @since 2.1.0
 */
 async function fetchKeyDetailed(keyId, cls, options = {}) {
-	const cacheKey = typeof keyId === "string" ? new URL(keyId) : keyId;
+	const cacheKey = typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId;
 	return await withFetchKeySpan(cacheKey, options.tracerProvider, async () => {
 		return await fetchKeyWithResult(cacheKey, cls, options, async (cacheKey, keyId, keyCache, logger) => {
 			const fetchError = await keyCache?.getFetchError?.(cacheKey);
@@ -452,7 +467,7 @@ async function resolveDidKey(cacheKey, cls, keyCache, logger) {
 		cached: false
 	};
 }
-async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableGatewayKeyResolver }, logger) {
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableKeyResolvers }, logger) {
 	let object;
 	try {
 		object = await Object$1.fromJsonLd(document, {
@@ -483,7 +498,7 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 	}
 	if (isCompatibleKeyId(cacheKey) && isPortableActorDocument(object)) {
 		const scopedCache = keyCache;
-		if (portableGatewayKeyResolver == null || cls !== CryptographicKey) {
+		if (portableKeyResolvers == null || cls !== CryptographicKey) {
 			logger.debug("Failed to verify; key {keyId} is a gateway key of the portable actor {actorId}, which is only accepted for HTTP Signatures.", {
 				keyId,
 				actorId: object.id?.href
@@ -494,7 +509,7 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 				cached: false
 			};
 		}
-		const resolution = await portableGatewayKeyResolver(document, object, cacheKey);
+		const resolution = await portableKeyResolvers.gatewayKey(document, object, cacheKey);
 		if (resolution.type !== "verified") {
 			logger.debug("Failed to verify; the portable actor {actorId} does not vouch for its gateway key {keyId}.", {
 				keyId,
@@ -654,6 +669,11 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 		]);
 		const keyId = cacheKey.href;
 		const keyCache = options.keyCache;
+		if (isPortableUri(cacheKey)) {
+			const result = await fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger);
+			outcome = result.outcome;
+			return result.result;
+		}
 		if (isCompatibleKeyId(cacheKey)) {
 			const result = await fetchCompatibleKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger);
 			outcome = result.outcome;
@@ -705,7 +725,7 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 */
 function getCompatibleKeyScope(cls, options) {
 	if (cls !== CryptographicKey) return "multikey";
-	return options.portableGatewayKeyResolver == null ? "cryptographicKey" : "httpSignature";
+	return options.portableKeyResolvers == null ? "cryptographicKey" : "httpSignature";
 }
 /**
 * Looks up a key at an [FEP-ef61] compatible identifier.  Such a key may be
@@ -759,8 +779,75 @@ async function fetchCompatibleKey(cacheKey, cls, options, onCachedUnavailable, o
 		outcome: { result: resolved.key != null ? "fetched" : "invalid" }
 	};
 }
+/**
+* Looks up a key of an [FEP-ef61] portable actor at an `ap:` or `ap+ef61:`
+* key ID.  Such a key is accepted only for HTTP Signatures, and is rejected
+* for any other purpose without being fetched.  Like keys at compatible
+* identifiers, what it resolves to is cached in the namespace of the lookup's
+* purpose, and a failure to fetch the actor's document from every gateway is
+* cached in the shared namespace.  A failure that is neither, e.g., one
+* gateway being unreachable while another served an invalid document, is not
+* cached at all.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+async function fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger) {
+	const keyId = cacheKey.href;
+	const resolvers = options.portableKeyResolvers;
+	if (resolvers == null || cls !== CryptographicKey) {
+		logger.debug("Failed to verify; key {keyId} is a key of a portable actor, which is only accepted for HTTP Signatures.", { keyId });
+		return {
+			result: {
+				key: null,
+				cached: false
+			},
+			outcome: { result: "invalid" }
+		};
+	}
+	const sharedCache = options.keyCache;
+	const scopedCache = sharedCache?.compatibleKeyScope?.("httpSignature");
+	const cached = await getCachedFetchKey(cacheKey, keyId, cls, scopedCache, logger);
+	if (cached != null) return {
+		result: cached,
+		outcome: { result: "hit" }
+	};
+	if (await sharedCache?.get(cacheKey) === null) {
+		logger.debug("Entry {keyId} found in cache, but it could not be fetched.", { keyId });
+		return {
+			result: await onCachedUnavailable(cacheKey, keyId, sharedCache, logger),
+			outcome: { result: "hit" }
+		};
+	}
+	logger.debug("Resolving key {keyId} to verify signature...", { keyId });
+	const resolution = await resolvers.actorKey(cacheKey);
+	if (resolution.type === "verified") {
+		await scopedCache?.set(cacheKey, resolution.key, { expires: resolution.expires });
+		return {
+			result: {
+				key: resolution.key,
+				cached: false
+			},
+			outcome: { result: "fetched" }
+		};
+	}
+	if (resolution.type === "rejected") {
+		await scopedCache?.set(cacheKey, null);
+		return {
+			result: {
+				key: null,
+				cached: false
+			},
+			outcome: { result: "invalid" }
+		};
+	}
+	await scopedCache?.delete(cacheKey);
+	return {
+		result: await onFetchError(resolution.error, cacheKey, keyId, resolution.cacheable ? sharedCache : void 0, logger),
+		outcome: resolution.cacheable ? classifyFetchError(resolution.error) : { result: "error" }
+	};
+}
 async function fetchKeyInternal(keyId, cls, options = {}) {
-	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
+	return await fetchKeyWithResult(typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
 		return {
 			key: null,
 			cached: true

package/dist/{kv-cache-tLKBfxHc.mjs → kv-cache-Bq2cah0c.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-DDE9S63Q.mjs";
+import { p as recordDocumentCache } from "./metrics-CDaHfBXY.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-BweDce2I.js → kv-cache-D7TiyMxv.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { H as validateCryptoKey, et as recordDocumentCache, t as doubleKnock } from "./http-Rmbiu-5S.js";
+import { U as validateCryptoKey, t as doubleKnock, tt as recordDocumentCache } from "./http-C2M6wcs8.js";
 import { getLogger } from "@logtape/logtape";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{kv-cache-BUkgZAcX.cjs → kv-cache-D9nRbG2Q.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-o8l4QeUY.cjs");
+const require_http = require("./http-B1J6E-bT.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{ld-DQNTIrAe.mjs → ld-Dwc176V4.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Be9xoxps.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DDE9S63Q.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-Cc1b6pW9.mjs";
+import { n as version, t as name } from "./deno-_o3lkDlG.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CDaHfBXY.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-DolJjJab.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-DDE9S63Q.mjs → metrics-CDaHfBXY.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Be9xoxps.mjs";
+import { n as version, t as name } from "./deno-_o3lkDlG.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-CsQorLC_.mjs → middleware-CmB1FD8A.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-BdhvduR9.mjs";
+import { n as FederationImpl } from "./middleware-DN3MdTDg.mjs";
 export { FederationImpl };

package/dist/{middleware-K9aLnf57.js → middleware-CylX-pvI.js}

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as recordCollectionTotalItems, A as isInvalidUrlTypeError, C as compactJsonLd, D as hasSignature, E as getNormalizationContextLoader, F as wrapContextLoaderForJsonLd, G as getFederationMetrics, H as validateCryptoKey, I as exportJwk, J as isAbortError, K as getRemoteHost, M as verifyCompactJsonLd, O as hasSignatureLike, Q as recordCollectionRequest, T as detachSignature, V as importJwk, W as getDurationMs, X as recordCollectionDispatchDuration, Y as recordCircuitBreakerStateChange, Z as recordCollectionPageItems, _ as verifyPortableObjectProofWithRoot, _t as isPortableId, at as recordWebFingerHandle, b as InvalidContextReferenceError, bt as name, ct as formatAcceptSignature, d as hasProofLike, f as signObject, ft as getCanonicalPortableId, g as verifyPortableObjectProofPolicy, gt as isCompatibleKeyId, h as verifyPortableObjectProof, ht as hasPortableActor, i as selectRequestSignature, it as recordOutboxEnqueue, j as signJsonLd, k as isClearlyMalformedContextReference, l as InvalidPortableObjectIdError, m as verifyObject, mt as getPortableDid, n as listRequestSignatures, nt as recordInboxActivity, o as verifyRequest, ot as registerQueueDepthGauge, p as verifyMapLocalProof, pt as getGatewayKeyBase, q as instrumentDocumentLoader, r as parseRfc9421SignatureInput, rt as recordOutboxActivity, s as verifyRequestDetailed, st as preloadedOnlyDocumentLoader, t as doubleKnock, tt as recordFanoutRecipients, vt as isPortableUri, x as assertSafeJsonLd, xt as version, y as normalizeOutgoingActivityJsonLd } from "./http-Rmbiu-5S.js";
+import { $ as recordCollectionRequest, A as isClearlyMalformedContextReference, Ct as version, D as getNormalizationContextLoader, E as detachSignature, G as getDurationMs, H as importJwk, I as wrapContextLoaderForJsonLd, J as instrumentDocumentLoader, K as getFederationMetrics, L as exportJwk, M as signJsonLd, N as verifyCompactJsonLd, O as hasSignature, Q as recordCollectionPageItems, S as assertSafeJsonLd, St as name, U as validateCryptoKey, X as recordCircuitBreakerStateChange, Y as isAbortError, Z as recordCollectionDispatchDuration, _ as verifyPortableObjectProofPolicy, _t as isCompatibleKeyId, at as recordOutboxEnqueue, b as normalizeOutgoingActivityJsonLd, bt as isPortableUri, ct as preloadedOnlyDocumentLoader, et as recordCollectionTotalItems, f as hasProofLike, g as verifyPortableObjectProof, gt as hasPortableActor, h as verifyObject, ht as getPortableDid, i as selectRequestSignature, it as recordOutboxActivity, j as isInvalidUrlTypeError, k as hasSignatureLike, lt as formatAcceptSignature, m as verifyMapLocalProof, mt as getGatewayKeyBase, n as listRequestSignatures, nt as recordFanoutRecipients, o as verifyRequest, ot as recordWebFingerHandle, p as signObject, pt as getCanonicalPortableId, q as getRemoteHost, r as parseRfc9421SignatureInput, rt as recordInboxActivity, s as verifyRequestDetailed, st as registerQueueDepthGauge, t as doubleKnock, u as InvalidPortableObjectIdError, v as verifyPortableObjectProofWithRoot, vt as isPortableId, w as compactJsonLd, x as InvalidContextReferenceError, yt as isPortableKeyId } from "./http-C2M6wcs8.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-DdXsKBg4.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-BweDce2I.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-CgglAI9B.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-D7TiyMxv.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -4665,7 +4665,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableGatewayKey(httpSigKey))) {
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableActorKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
@@ -5446,13 +5446,13 @@ const MIN_COMPONENTS = [
 	"@authority"
 ];
 /**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
+* Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
+* actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
+* URI, and it is owned by a portable actor, which only the portable actor's
+* signed document can establish.
 */
-function isPortableGatewayKey(key) {
-	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
+function isPortableActorKey(key) {
+	return key?.id != null && isPortableKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
 }
 /**
 * Checks whether an activity needs an Object Integrity Proof by its DID:
@@ -5801,7 +5801,7 @@ async function signOutgoingActivity(activity, candidates, options) {
 		hasProof = true;
 		break;
 	}
-	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isCompatibleKeyId(c.verificationMethod));
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isPortableKeyId(c.verificationMethod));
 	if (!hasProof && activity.id != null && isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
 	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
 		activity,
@@ -7766,7 +7766,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const ldSignable = !hasPortableActor(activity);
 		for (const { keyId, privateKey } of keys) {
 			validateCryptoKey(privateKey, "private");
-			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isCompatibleKeyId(keyId)) rsaKey = {
+			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isPortableKeyId(keyId)) rsaKey = {
 				keyId,
 				privateKey
 			};

package/dist/{middleware-BdhvduR9.mjs → middleware-DN3MdTDg.mjs}

@@ -1,29 +1,29 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Be9xoxps.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DDE9S63Q.mjs";
+import { n as version, t as name } from "./deno-_o3lkDlG.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-CDaHfBXY.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
-import { a as isCompatibleKeyId, c as isPortableUri, i as hasPortableActor, n as getGatewayKeyBase, r as getPortableDid, s as isPortableId, t as getCanonicalPortableId } from "./portable-key-id-T7lecIbt.mjs";
-import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-Cc1b6pW9.mjs";
+import { a as hasPortableActor, c as isPortableId, l as isPortableKeyId, n as getGatewayKeyBase, o as isCompatibleKeyId, r as getPortableDid, t as getCanonicalPortableId, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
+import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-DolJjJab.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-DQNTIrAe.mjs";
-import { i as signObject, l as verifyPortableObjectProofWithRoot, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, t as InvalidPortableObjectIdError } from "./proof-CW8k0R1G.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-BFeK9sBg.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-Dtuyb0ps.mjs";
-import { n as kvCache } from "./kv-cache-tLKBfxHc.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-Dwc176V4.mjs";
+import { i as signObject, l as verifyPortableObjectProofWithRoot, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, t as InvalidPortableObjectIdError } from "./proof-B4_0E-KU.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-BpOiZE09.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-BbS0rO-Y.mjs";
+import { n as kvCache } from "./kv-cache-Bq2cah0c.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CCfdL83M.mjs";
-import { t as verifyPortableObject } from "./portable-collection-WXaHkNqC.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send--FORaIc4.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-B2bgGYbP.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BNHhwjNu.mjs";
+import { t as verifyPortableObject } from "./portable-collection-CRpTUHCY.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-Dpu5qbP5.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-C0bxZDL0.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-SVlHSzV7.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-D9Kljk_7.mjs";
 import { t as KvKeyCache } from "./keycache-BInaECGj.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CffY_XOJ.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-78JVR3GK.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -2309,7 +2309,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableGatewayKey(httpSigKey))) {
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableActorKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
@@ -3090,13 +3090,13 @@ const MIN_COMPONENTS = [
 	"@authority"
 ];
 /**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
+* Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
+* actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
+* URI, and it is owned by a portable actor, which only the portable actor's
+* signed document can establish.
 */
-function isPortableGatewayKey(key) {
-	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
+function isPortableActorKey(key) {
+	return key?.id != null && isPortableKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
 }
 /**
 * Checks whether an activity needs an Object Integrity Proof by its DID:
@@ -3215,7 +3215,7 @@ async function signOutgoingActivity(activity, candidates, options) {
 		hasProof = true;
 		break;
 	}
-	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isCompatibleKeyId(c.verificationMethod));
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isPortableKeyId(c.verificationMethod));
 	if (!hasProof && activity.id != null && isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
 	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
 		activity,
@@ -5001,7 +5001,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const ldSignable = !hasPortableActor(activity);
 		for (const { keyId, privateKey } of keys) {
 			validateCryptoKey(privateKey, "private");
-			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isCompatibleKeyId(keyId)) rsaKey = {
+			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isPortableKeyId(keyId)) rsaKey = {
 				keyId,
 				privateKey
 			};

package/dist/{mod-Co53r-VP.d.ts → mod-Bz9tFXI2.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { S as KeyCache } from "./http-BrQgkJay.js";
+import { S as KeyCache } from "./http-C-x_OLSp.js";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader, PortableObjectVerifier, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";

package/dist/{mod-Cwdt_CWU.d.ts → mod-CZetqT5h.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { n as HttpMessageSignaturesSpecDeterminer } from "./http-BrQgkJay.js";
+import { n as HttpMessageSignaturesSpecDeterminer } from "./http-C-x_OLSp.js";
 import { n as KvStore, t as KvKey } from "./kv-BhNbN8Ed.js";
 import { t as DocumentFetchKind } from "./metrics-DoRtI0qU.js";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";

package/dist/{mod-Cr79cQlc.d.cts → mod-D4g9ffEn.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { n as HttpMessageSignaturesSpecDeterminer } from "./http-D76Py0M4.cjs";
+import { n as HttpMessageSignaturesSpecDeterminer } from "./http-CjezPjFX.cjs";
 import { n as KvStore, t as KvKey } from "./kv-BhNbN8Ed.cjs";
 import { t as DocumentFetchKind } from "./metrics-DVKYY6K1.cjs";
 import { DocumentLoader, DocumentLoaderFactoryOptions } from "@fedify/vocab-runtime";

package/dist/{mod-AVir5nVI.d.cts → mod-DGOIxEfb.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-Bm6ldGvx.cjs";
+import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-Dvec_D_h.cjs";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 

package/dist/{mod-Byt5tvAS.d.cts → mod-S--JxYjo.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { S as KeyCache } from "./http-D76Py0M4.cjs";
+import { S as KeyCache } from "./http-CjezPjFX.cjs";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { DocumentLoader, PortableObjectVerifier, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";

package/dist/{mod-eVOUPbQE.d.ts → mod-owwElvpw.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-Ci5vuUr_.js";
+import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-Cz1w5Krc.js";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 

package/dist/mod.cjs

@@ -3,11 +3,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-o8l4QeUY.cjs");
-const require_federation = require("./federation-B6IHuS6n.cjs");
+const require_http = require("./http-B1J6E-bT.cjs");
+const require_federation = require("./federation-DRY8KrkB.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_portable_collection = require("./portable-collection-DXogVs__.cjs");
-const require_kv_cache = require("./kv-cache-BUkgZAcX.cjs");
+const require_portable_collection = require("./portable-collection-PTGD0q70.cjs");
+const require_kv_cache = require("./kv-cache-D9nRbG2Q.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
 require("./sig/mod.cjs");