@fedify/fedify 2.4.0-dev.2127 → 2.4.0-dev.2129

package/dist/portable-key-DqX2emHQ.mjs

@@ -0,0 +1,395 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { d as isSamePublicKey, i as getRawCanonicalPortableId, s as isPortableActorDocument, t as getCanonicalPortableId, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
+import { l as verifyPortableObjectProofWithRoot } from "./proof-B4_0E-KU.mjs";
+import { getLogger } from "@logtape/logtape";
+import { CryptographicKey, Multikey, Object as Object$1 } from "@fedify/vocab";
+import { FetchError, formatIri, getDocumentLoader, isGatewayUrl, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { getPortableGatewayCandidates } from "@fedify/vocab-runtime/internal/portable-dereference";
+//#region src/sig/portable-key.ts
+const logger = getLogger([
+	"fedify",
+	"sig",
+	"key"
+]);
+const SEC = "https://w3id.org/security#";
+/**
+* Verifies that the signed document of a portable actor vouches for
+* the gateway key with the given ID.
+*
+* A gateway key is accepted only if:
+*
+*  -  the document is an actor whose portable ID, i.e., its `ap:` ID or
+*     the canonical portable ID of its compatible identifier, is the one
+*     the key ID is the compatible identifier of;
+*  -  the document has a valid [FEP-8b32] Object Integrity Proof made by
+*     the DID of its ID, i.e., it satisfies the [FEP-ef61] proof policy;
+*  -  the document embeds a `Multikey` with that ID in its `assertionMethod`,
+*     whose `controller` is the actor, as [FEP-521a] requires, and a key
+*     embedded in its `publicKey` with the same ID agrees with it; or, if
+*     no `assertionMethod` entry has that ID, the document embeds
+*     a `CryptographicKey` with that ID in its `publicKey`, whose `owner` is
+*     the actor, as some publishers, e.g., tootik, list their RSA keys only
+*     there;
+*  -  no more than one entry of either property has that ID; and
+*  -  the key ID's origin is one of the actor's `gateways`.
+*
+* An entry has the key's ID if its ID is the key ID, or any compatible
+* identifier on the same gateway, or the `ap:` or `ap+ef61:` URI, with the
+* same canonical portable ID.  Some publishers, e.g., Mitra, list the keys
+* of portable actors under `ap:` URIs, but sign requests with compatible key
+* IDs on their own gateways.  IDs are compared as they are written in
+* the signed document, so an ID that URL parsing would turn into another,
+* e.g., by resolving dot segments, has no match.
+*
+* [FEP-8b32]: https://w3id.org/fep/8b32
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* [FEP-521a]: https://w3id.org/fep/521a
+*
+* @param document The raw JSON-LD document served at the key ID.
+* @param actor The parsed document, which must be a portable actor.
+* @param keyId The key ID, which must be a compatible key ID.
+* @param options Loaders and telemetry providers.
+* @returns The verification result, which is never `legacy`.
+* @internal
+*/
+function verifyPortableGatewayKeyDocument(document, actor, keyId, options = {}) {
+	return verifyPortableKeyDocument(document, actor, keyId, true, options);
+}
+/**
+* Verifies that the signed document of a portable actor vouches for the key
+* with the given ID, either a gateway key at a compatible key ID, or a key of
+* the actor itself at an `ap:` or `ap+ef61:` key ID.  See
+* {@link verifyPortableGatewayKeyDocument} for the rules; a key of the actor
+* itself names no gateway, so instead of the key ID's origin being one of
+* the actor's `gateways`, the actor only has to have a valid gateway, as
+* FEP-ef61 requires of every portable actor.
+*/
+async function verifyPortableKeyDocument(document, actor, keyId, isGatewayKey, options) {
+	const reject = (reason) => {
+		logger.debug("Failed to verify key {keyId} of the portable actor {actorId}: {reason}", {
+			keyId: formatIri(keyId),
+			actorId: actor.id?.href,
+			reason
+		});
+		return {
+			type: "rejected",
+			reason
+		};
+	};
+	const keyBase = new URL(keyId.href);
+	keyBase.hash = "";
+	const claimedActorId = getCanonicalPortableId(keyBase);
+	const claimedKeyId = getCanonicalPortableId(keyId);
+	const actorId = actor.id == null ? null : getCanonicalPortableId(actor.id);
+	if (claimedActorId == null || claimedKeyId == null || actorId == null) return reject("The key ID or the actor ID is not a valid portable ID.");
+	if (claimedActorId !== actorId) return reject("The key ID is not a compatible identifier of the actor it dereferences to.");
+	let verification;
+	try {
+		verification = await verifyPortableObjectProofWithRoot(document, {
+			documentLoader: options.documentLoader,
+			contextLoader: options.contextLoader,
+			keyCache: options.keyCache,
+			tracerProvider: options.tracerProvider,
+			meterProvider: options.meterProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject(`The actor document is malformed: ${error.message}`);
+	}
+	const { result, root, expires } = verification;
+	if (!result.verified) return reject("The actor document does not satisfy the FEP-ef61 proof policy: " + result.reason.type);
+	if (root == null) return reject("The actor document could not be expanded.");
+	const refuse = (url) => Promise.reject(/* @__PURE__ */ new Error(`Refusing to fetch ${url}.`));
+	const parseEmbeddedPublicKey = async (node) => {
+		if (isReference(node)) return null;
+		let key;
+		try {
+			key = await CryptographicKey.fromJsonLd(node, {
+				documentLoader: refuse,
+				contextLoader: options.contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			return null;
+		}
+		return key.publicKey == null ? null : key;
+	};
+	let verifiedActor;
+	try {
+		verifiedActor = await Object$1.fromJsonLd(root, {
+			documentLoader: refuse,
+			contextLoader: options.contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject("The verified actor document is malformed.");
+	}
+	const rootId = root["@id"];
+	if (!isPortableActorDocument(verifiedActor) || getCanonicalPortableId(verifiedActor.id) !== claimedActorId || typeof rootId !== "string" || getRawCanonicalPortableId(rootId) !== claimedActorId) return reject("The key ID is not a compatible identifier of the actor whose document is signed.");
+	actor = verifiedActor;
+	const findKeyNodes = (values) => findNodes(values, claimedKeyId, isGatewayKey ? keyId.origin : null);
+	const assertionNodes = findKeyNodes(root[`${SEC}assertionMethod`]);
+	const publicKeyNodes = findKeyNodes(root[`${SEC}publicKey`]);
+	if (assertionNodes.length > 1 || publicKeyNodes.length > 1) return reject("The actor document has more than one key with the ID.");
+	let publicKey;
+	if (assertionNodes.length > 0) {
+		if (isReference(assertionNodes[0])) return reject("The actor document does not embed the key in its assertionMethod.");
+		let multikey;
+		try {
+			multikey = await Multikey.fromJsonLd(assertionNodes[0], {
+				documentLoader: refuse,
+				contextLoader: options.contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			return reject("The key in the assertionMethod is malformed.");
+		}
+		if (multikey.publicKey == null) return reject("The key in the assertionMethod has no public key.");
+		if (multikey.controllerId == null || getCanonicalPortableId(multikey.controllerId) !== actorId) return reject("The controller of the key is not the actor.");
+		publicKey = multikey.publicKey;
+		if (publicKeyNodes.length > 0 && !isReference(publicKeyNodes[0])) {
+			const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
+			if (embedded == null || !await isSamePublicKey(embedded.publicKey, publicKey) || embedded.ownerId != null && getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The key in the publicKey does not agree with the one in the assertionMethod.");
+		}
+	} else {
+		if (publicKeyNodes.length < 1) return reject("The actor document embeds the key in neither its assertionMethod nor its publicKey.");
+		const embedded = await parseEmbeddedPublicKey(publicKeyNodes[0]);
+		if (embedded == null) return reject("The key in the publicKey is not embedded or malformed.");
+		if (embedded.ownerId == null || getCanonicalPortableId(embedded.ownerId) !== actorId) return reject("The owner of the key is not the actor.");
+		publicKey = embedded.publicKey;
+	}
+	if (isGatewayKey) {
+		if (!actor.gateways.some((gateway) => isGatewayUrl(gateway) && gateway.origin === keyId.origin)) return reject(`The gateway ${keyId.origin} is not listed in the actor's gateways.`);
+	} else if (!actor.gateways.some(isGatewayUrl)) return reject("The actor has no valid gateways.");
+	const key = new CryptographicKey({
+		id: keyId,
+		owner: actor.id,
+		publicKey
+	});
+	return {
+		type: "verified",
+		actor,
+		key,
+		...expires == null ? {} : { expires }
+	};
+}
+/**
+* Fetches the document at a compatible key ID, and resolves the key as
+* a gateway key if the document is a portable actor.
+*
+* @param keyId The key ID, which must be a compatible key ID.
+* @param options Loaders and telemetry providers.
+* @returns `legacy` if the document cannot be fetched or is not a portable
+*          actor, which leaves the key to the usual resolution; otherwise,
+*          the result of {@link verifyPortableGatewayKeyDocument}.
+* @internal
+*/
+async function fetchPortableGatewayKey(keyId, options = {}) {
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	let remoteDocument;
+	try {
+		remoteDocument = await documentLoader(keyId.href);
+	} catch (error) {
+		logger.debug("Failed to fetch key {keyId}: {error}", {
+			keyId: keyId.href,
+			error
+		});
+		return { type: "legacy" };
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(remoteDocument.document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return { type: "legacy" };
+	}
+	if (!isPortableActorDocument(object)) return { type: "legacy" };
+	return await verifyPortableGatewayKeyDocument(remoteDocument.document, object, keyId, {
+		...options,
+		documentLoader,
+		contextLoader
+	});
+}
+/**
+* Resolves a key of a portable actor at an `ap:` or `ap+ef61:` key ID, e.g.,
+* `ap://did:key:z6Mk…/actor#main-key`.  Such a key ID names no gateway, so
+* the actor's document, i.e., the key ID without its fragment, is fetched
+* through the gateways in its `@gateway` location hints, one after another,
+* until one of them serves a document that vouches for the key.  Without
+* location hints, the document loader is asked for the `ap:` URI itself,
+* which only a custom document loader can resolve.  The hints are chosen by
+* whoever made the signature, but that does not matter: only a document with
+* a valid proof by the DID of the key ID vouches for the key.
+*
+* The key is taken as a key of the actor itself, not of a gateway, so it is
+* accepted by the rules of {@link verifyPortableGatewayKeyDocument}, except
+* that it is listed under the `ap:` or `ap+ef61:` URI with the same canonical
+* ID as the key ID, and that the actor only has to have a valid gateway.
+* The key ID must have a fragment; a key served as a standalone document is
+* not supported.
+*
+* If no gateway serves a document that vouches for the key, the result is
+* `rejected` only if every gateway served a document that definitely does not
+* vouch for it.  If every gateway failed to serve a document at all, the
+* result is a cacheable `unavailable`, with the error of the first gateway if
+* every gateway responded with the same HTTP status, so that the status
+* describes the whole lookup.  Otherwise, e.g., if one gateway was
+* unreachable and another served an invalid document, nothing tells what the
+* unreachable gateway would have served, so the result is an `unavailable`
+* that is not cacheable.
+*
+* @param keyId The key ID, which must be an `ap:` or `ap+ef61:` URI.
+* @param options Loaders and telemetry providers.
+* @returns The resolution, which is never `legacy`.
+* @internal
+*/
+async function resolvePortableActorKey(keyId, options = {}) {
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	let formattedKeyId = keyId.href;
+	const reject = (reason) => {
+		logger.debug("Failed to verify key {keyId} of a portable actor: {reason}", {
+			keyId: formattedKeyId,
+			reason
+		});
+		return {
+			type: "rejected",
+			reason
+		};
+	};
+	if (!isPortableUri(keyId) || getCanonicalPortableId(keyId) == null) return reject("The key ID is not a valid ap: or ap+ef61: URI.");
+	formattedKeyId = formatIri(keyId);
+	if (keyId.hash === "" || keyId.hash === "#") return reject("The key ID has no fragment; only keys embedded in actor documents are supported.");
+	const actorUrl = new URL(keyId.href);
+	actorUrl.hash = "";
+	const requestUrls = [];
+	for (const gateway of getPortableGatewayCandidates(actorUrl)) try {
+		requestUrls.push(toCompatibleEf61Id(actorUrl, gateway).href);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return reject(`The key ID cannot be fetched from gateways: ${error}`);
+	}
+	if (requestUrls.length < 1) requestUrls.push(formatIri(actorUrl));
+	const attempts = [];
+	for (const url of requestUrls) {
+		let remoteDocument;
+		try {
+			remoteDocument = await documentLoader(url);
+		} catch (error) {
+			logger.debug("Failed to fetch the actor of key {keyId} from {url}: {error}", {
+				keyId: formattedKeyId,
+				url,
+				error
+			});
+			attempts.push({
+				type: "retrievalFailed",
+				error
+			});
+			continue;
+		}
+		let resolution;
+		try {
+			const object = await Object$1.fromJsonLd(remoteDocument.document, {
+				documentLoader,
+				contextLoader,
+				tracerProvider: options.tracerProvider
+			});
+			resolution = isPortableActorDocument(object) ? await verifyPortableKeyDocument(remoteDocument.document, object, keyId, false, {
+				...options,
+				documentLoader,
+				contextLoader
+			}) : {
+				type: "rejected",
+				reason: "The document is not a portable actor."
+			};
+		} catch (error) {
+			if (error instanceof TypeError) resolution = {
+				type: "rejected",
+				reason: `The document is malformed: ${error.message}`
+			};
+			else {
+				logger.debug("Failed to process the actor of key {keyId} served from {url}: {error}", {
+					keyId: formattedKeyId,
+					url,
+					error
+				});
+				attempts.push({
+					type: "indeterminate",
+					error
+				});
+				continue;
+			}
+		}
+		if (resolution.type === "verified") return resolution;
+		const reason = resolution.type === "rejected" ? resolution.reason : "The document is not a portable actor.";
+		logger.debug("The actor document served from {url} does not vouch for key {keyId}: {reason}", {
+			keyId: formattedKeyId,
+			url,
+			reason
+		});
+		attempts.push({
+			type: "rejected",
+			reason
+		});
+	}
+	const rejections = attempts.flatMap((a) => a.type === "rejected" ? [a.reason] : []);
+	if (rejections.length === attempts.length) return reject(rejections.join(" "));
+	const errors = attempts.flatMap((a) => a.type === "rejected" ? [] : [a.error]);
+	const aggregate = errors.length === 1 ? errors[0] : new AggregateError(errors, `Failed to fetch the actor of key ${formattedKeyId} from any of its gateways: ${requestUrls.join(", ")}`);
+	if (attempts.every((a) => a.type === "retrievalFailed")) {
+		const statuses = errors.map((error) => error instanceof FetchError ? error.response?.status : void 0);
+		return {
+			type: "unavailable",
+			error: statuses[0] != null && statuses.every((status) => status === statuses[0]) ? errors[0] : aggregate,
+			cacheable: true
+		};
+	}
+	return {
+		type: "unavailable",
+		error: new Error(`Could not determine whether the actor of key ${formattedKeyId} vouches for it.`, { cause: aggregate }),
+		cacheable: false
+	};
+}
+/**
+* Finds the nodes that stand for the key with the given canonical portable
+* ID.  A node whose ID is an `ap:` or `ap+ef61:` URI stands for the key
+* itself, e.g., Mitra lists the keys of portable actors that way while
+* signing requests with compatible key IDs.  A node whose ID is a compatible
+* identifier stands for a gateway's key, so it matches only a compatible key
+* ID on the same gateway; a key ID that names no gateway never selects
+* a gateway's key, even with the same fragment.
+* @param values The expanded values of a key property.
+* @param canonicalKeyId The canonical portable ID of the key ID.
+* @param gateway The origin of the gateway whose key the key ID names, or
+*                `null` if the key ID names no gateway.
+*/
+function findNodes(values, canonicalKeyId, gateway) {
+	if (!Array.isArray(values)) return [];
+	const nodes = [];
+	for (const value of values) {
+		if (value == null || typeof value !== "object" || Array.isArray(value)) continue;
+		const node = value;
+		const nodeId = node["@id"];
+		if (typeof nodeId !== "string") continue;
+		if (getRawCanonicalPortableId(nodeId) !== canonicalKeyId) continue;
+		const parsed = parseIri(nodeId);
+		if (isPortableUri(parsed) || parsed.origin === gateway) nodes.push(node);
+	}
+	return nodes;
+}
+/** A node with nothing but an `@id` is a reference, not an embedded key. */
+function isReference(node) {
+	return Object.keys(node).every((key) => key === "@id");
+}
+//#endregion
+export { resolvePortableActorKey as n, verifyPortableGatewayKeyDocument as r, fetchPortableGatewayKey as t };

package/dist/{portable-key-id-T7lecIbt.mjs → portable-key-id-Bg259c4Z.mjs}

@@ -2,10 +2,12 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { isActor } from "@fedify/vocab";
-import { canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getFe34Origin, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getFe34Origin, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+const RAW_PORTABLE_URI_PATTERN = /^ap(?:\+ef61)?:\/\//i;
+const RAW_COMPATIBLE_ID_PREFIX_PATTERN = /^https?:\/\/[^/?#]*\/\.well-known\/apgateway\/(?=did(?::|%3A))/i;
 /**
 * Checks whether the URL is an `ap:` or `ap+ef61:` URI.
 * @internal
@@ -69,6 +71,20 @@ function isCompatibleKeyId(keyId) {
 	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
 }
 /**
+* Checks whether a key ID may name a key that is valid only for HTTP
+* Signatures: a gateway key at an [FEP-ef61] compatible identifier, or a key
+* of a portable actor at an `ap:` or `ap+ef61:` URI.  Neither ever makes or
+* verifies an Object Integrity Proof or a Linked Data Signature: a portable
+* object's proof is made by its DID, and a proof made with a gateway key
+* would claim that the gateway authored the object.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isPortableKeyId(keyId) {
+	return isPortableUri(keyId) || isCompatibleKeyId(keyId);
+}
+/**
 * Gets the canonical portable ID of an actor ID that is either an `ap:` or
 * `ap+ef61:` URI or a compatible identifier.
 * @returns The canonical portable ID, or `null` if the ID is neither, or is
@@ -87,6 +103,57 @@ function getCanonicalPortableId(id) {
 	}
 }
 /**
+* Gets the canonical portable ID of an `ap:` or `ap+ef61:` URI or
+* a compatible identifier as it is written, before any URL parsing.
+* Parsing an ID into a `URL` resolves dot segments in its path, which would
+* make it identify another portable object, e.g.,
+* `ap://did:key:z6Mk…/x/../actor` would become `ap://did:key:z6Mk…/actor`.
+* Such an ID has no canonical portable ID here.
+* @param raw The ID as it is written.
+* @returns The canonical portable ID, fragment included, or `null` if the ID
+*          is neither an `ap:` or `ap+ef61:` URI nor a compatible identifier,
+*          is malformed, or would identify another object once parsed.
+* @internal
+*/
+function getRawCanonicalPortableId(raw) {
+	let canonical;
+	let parsed;
+	try {
+		if (RAW_PORTABLE_URI_PATTERN.test(raw)) {
+			canonical = canonicalizePortableUri(raw);
+			parsed = canonicalizePortableUri(formatIri(parseIri(raw)));
+		} else {
+			const prefix = raw.match(RAW_COMPATIBLE_ID_PREFIX_PATTERN);
+			if (prefix == null || !URL.canParse(raw)) return null;
+			canonical = canonicalizePortableUri("ap://" + raw.slice(prefix[0].length));
+			parsed = getCanonicalPortableId(new URL(raw));
+		}
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+	return canonical === parsed ? canonical : null;
+}
+/**
+* Parses a key ID, e.g., the `keyId` of an HTTP Signature, into a `URL`.
+* An `ap:` or `ap+ef61:` key ID is parsed into the internal `URL` form of
+* portable URIs.  A portable or compatible key ID that is malformed, or
+* whose identity URL parsing would change, e.g., by resolving dot segments in
+* its path, is refused, so that it can never be taken for, or looked up in
+* the key cache as, the key of another object.
+* @param raw The key ID as it is written.
+* @returns The parsed key ID, or `null` if it is invalid.
+* @internal
+*/
+function parseKeyIdString(raw) {
+	if (RAW_PORTABLE_URI_PATTERN.test(raw)) return getRawCanonicalPortableId(raw) == null ? null : parseIri(raw);
+	if (!URL.canParse(raw)) return null;
+	const url = new URL(raw);
+	if (isPortableUri(url)) return null;
+	if (!RAW_COMPATIBLE_ID_PREFIX_PATTERN.test(raw)) return isCompatibleKeyId(url) ? null : url;
+	return getRawCanonicalPortableId(raw) == null ? null : url;
+}
+/**
 * Builds the base of the key IDs of a gateway's keys for a portable actor:
 * the actor's compatible identifier on the gateway.
 * @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
@@ -134,4 +201,4 @@ async function isSamePublicKey(a, b) {
 	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
 }
 //#endregion
-export { isCompatibleKeyId as a, isPortableUri as c, hasPortableActor as i, isSamePublicKey as l, getGatewayKeyBase as n, isPortableActorDocument as o, getPortableDid as r, isPortableId as s, getCanonicalPortableId as t };
+export { hasPortableActor as a, isPortableId as c, isSamePublicKey as d, parseKeyIdString as f, getRawCanonicalPortableId as i, isPortableKeyId as l, getGatewayKeyBase as n, isCompatibleKeyId as o, getPortableDid as r, isPortableActorDocument as s, getCanonicalPortableId as t, isPortableUri as u };

package/dist/{proof-CW8k0R1G.mjs → proof-B4_0E-KU.mjs}

@@ -1,13 +1,13 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Be9xoxps.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DDE9S63Q.mjs";
-import { r as getPortableDid, s as isPortableId } from "./portable-key-id-T7lecIbt.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-Cc1b6pW9.mjs";
+import { n as version, t as name } from "./deno-_o3lkDlG.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CDaHfBXY.mjs";
+import { c as isPortableId, r as getPortableDid } from "./portable-key-id-Bg259c4Z.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-DolJjJab.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { c as getNormalizationContextLoader } from "./ld-DQNTIrAe.mjs";
+import { c as getNormalizationContextLoader } from "./ld-Dwc176V4.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{send--FORaIc4.mjs → send-Dpu5qbP5.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Be9xoxps.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-DDE9S63Q.mjs";
-import { n as doubleKnock } from "./http-BFeK9sBg.mjs";
+import { n as version, t as name } from "./deno-_o3lkDlG.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-CDaHfBXY.mjs";
+import { n as doubleKnock } from "./http-BpOiZE09.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/sig/compound-proof-discovery.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-SVlHSzV7.mjs";
+import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-D9Kljk_7.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-discovery.test.ts

package/dist/sig/compound-proof-producer.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-SVlHSzV7.mjs";
+import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-D9Kljk_7.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-producer.test.ts
 const portableId = "ap+ef61://did:key:z6MkAlice/objects/1";

package/dist/sig/compound-proof-verification.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as verifyMapLocalProof, c as verifyPortableObjectProofPolicy } from "../proof-CW8k0R1G.mjs";
+import { a as verifyMapLocalProof, c as verifyPortableObjectProofPolicy } from "../proof-B4_0E-KU.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-SVlHSzV7.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-D9Kljk_7.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { CryptographicKey, Multikey, Person } from "@fedify/vocab";

package/dist/sig/compound-proof.test.mjs

@@ -6,9 +6,9 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { i as signObject, u as verifyProof } from "../proof-CW8k0R1G.mjs";
+import { i as signObject, u as verifyProof } from "../proof-B4_0E-KU.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { o as verifyCompoundProofDocuments } from "../compound-proof-SVlHSzV7.mjs";
+import { o as verifyCompoundProofDocuments } from "../compound-proof-D9Kljk_7.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";

package/dist/sig/http.test.mjs

@@ -11,8 +11,8 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as exportJwk } from "../key-Cc1b6pW9.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-BFeK9sBg.mjs";
+import { n as exportJwk } from "../key-DolJjJab.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-BpOiZE09.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";

package/dist/sig/key.test.mjs

@@ -6,7 +6,7 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-Cc1b6pW9.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-DolJjJab.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/ld.test.mjs

@@ -8,8 +8,8 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { o as generateCryptoKeyPair } from "../key-Cc1b6pW9.mjs";
-import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-DQNTIrAe.mjs";
+import { o as generateCryptoKeyPair } from "../key-DolJjJab.mjs";
+import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-Dwc176V4.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/mod.cjs

@@ -1,7 +1,7 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-o8l4QeUY.cjs");
-const require_portable_collection = require("../portable-collection-DXogVs__.cjs");
+const require_http = require("../http-B1J6E-bT.cjs");
+const require_portable_collection = require("../portable-collection-PTGD0q70.cjs");
 exports.attachSignature = require_http.attachSignature;
 exports.createProof = require_http.createProof;
 exports.createSignature = require_http.createSignature;

package/dist/sig/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-D76Py0M4.cjs";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-CjezPjFX.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BF0L9cMt.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-Byt5tvAS.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-S--JxYjo.cjs";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };