@fedify/fedify 2.4.0-dev.2127 → 2.4.0-dev.2141

package/dist/{key-Cc1b6pW9.mjs → key-C0giKuki.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Be9xoxps.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DDE9S63Q.mjs";
-import { a as isCompatibleKeyId, o as isPortableActorDocument, s as isPortableId } from "./portable-key-id-T7lecIbt.mjs";
+import { n as version, t as name } from "./deno-BXI_BLNy.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DxlVXwn5.mjs";
+import { c as isPortableId, f as parseKeyIdString, o as isCompatibleKeyId, s as isPortableActorDocument, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
@@ -236,6 +236,17 @@ function bypassKeyCacheReads(keyCache) {
 	};
 	return bypassed;
 }
+/**
+* Parses a key ID given as a string.  Unlike `new URL()`, it accepts `ap:`
+* and `ap+ef61:` URIs, and refuses a portable or compatible key ID whose
+* identity URL parsing would change, e.g., by resolving dot segments.
+* @throws {TypeError} If the key ID is invalid.
+*/
+function parseKeyIdOrThrow(keyId) {
+	const parsed = parseKeyIdString(keyId);
+	if (parsed == null) throw new TypeError(`Invalid key ID: ${keyId}`);
+	return parsed;
+}
 async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 	tracerProvider ??= trace.getTracerProvider();
 	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
@@ -272,9 +283,11 @@ async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 * @template T The type of the key to fetch.  Either {@link CryptographicKey}
@@ -287,7 +300,7 @@ async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 * @since 1.3.0
 */
 function fetchKey(keyId, cls, options = {}) {
-	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
+	keyId = typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId;
 	return withFetchKeySpan(keyId, options.tracerProvider, () => fetchKeyInternal(keyId, cls, options));
 }
 /**
@@ -297,9 +310,11 @@ function fetchKey(keyId, cls, options = {}) {
 * Gateway keys of [FEP-ef61] portable actors, i.e., keys whose IDs are
 * compatible identifiers that dereference to portable actor documents, are
 * not resolved by this function, as they only authenticate HTTP requests;
-* use `verifyRequest()` or `getKeyOwner()` for them instead.  Keys whose IDs
-* are compatible identifiers are never read from or written to the key
-* cache under their IDs, except for failures to fetch them.
+* use `verifyRequest()` or `getKeyOwner()` for them instead.  Nor are keys
+* of portable actors whose IDs are `ap:` or `ap+ef61:` URIs, for the same
+* reason.  Keys whose IDs are compatible identifiers or `ap:` or `ap+ef61:`
+* URIs are never read from or written to the key cache under their IDs,
+* except for failures to fetch them.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 *
@@ -313,7 +328,7 @@ function fetchKey(keyId, cls, options = {}) {
 * @since 2.1.0
 */
 async function fetchKeyDetailed(keyId, cls, options = {}) {
-	const cacheKey = typeof keyId === "string" ? new URL(keyId) : keyId;
+	const cacheKey = typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId;
 	return await withFetchKeySpan(cacheKey, options.tracerProvider, async () => {
 		return await fetchKeyWithResult(cacheKey, cls, options, async (cacheKey, keyId, keyCache, logger) => {
 			const fetchError = await keyCache?.getFetchError?.(cacheKey);
@@ -452,7 +467,7 @@ async function resolveDidKey(cacheKey, cls, keyCache, logger) {
 		cached: false
 	};
 }
-async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableGatewayKeyResolver }, logger) {
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller, portableKeyResolvers }, logger) {
 	let object;
 	try {
 		object = await Object$1.fromJsonLd(document, {
@@ -483,7 +498,7 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 	}
 	if (isCompatibleKeyId(cacheKey) && isPortableActorDocument(object)) {
 		const scopedCache = keyCache;
-		if (portableGatewayKeyResolver == null || cls !== CryptographicKey) {
+		if (portableKeyResolvers == null || cls !== CryptographicKey) {
 			logger.debug("Failed to verify; key {keyId} is a gateway key of the portable actor {actorId}, which is only accepted for HTTP Signatures.", {
 				keyId,
 				actorId: object.id?.href
@@ -494,7 +509,7 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 				cached: false
 			};
 		}
-		const resolution = await portableGatewayKeyResolver(document, object, cacheKey);
+		const resolution = await portableKeyResolvers.gatewayKey(document, object, cacheKey);
 		if (resolution.type !== "verified") {
 			logger.debug("Failed to verify; the portable actor {actorId} does not vouch for its gateway key {keyId}.", {
 				keyId,
@@ -654,6 +669,11 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 		]);
 		const keyId = cacheKey.href;
 		const keyCache = options.keyCache;
+		if (isPortableUri(cacheKey)) {
+			const result = await fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger);
+			outcome = result.outcome;
+			return result.result;
+		}
 		if (isCompatibleKeyId(cacheKey)) {
 			const result = await fetchCompatibleKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger);
 			outcome = result.outcome;
@@ -705,7 +725,7 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 */
 function getCompatibleKeyScope(cls, options) {
 	if (cls !== CryptographicKey) return "multikey";
-	return options.portableGatewayKeyResolver == null ? "cryptographicKey" : "httpSignature";
+	return options.portableKeyResolvers == null ? "cryptographicKey" : "httpSignature";
 }
 /**
 * Looks up a key at an [FEP-ef61] compatible identifier.  Such a key may be
@@ -759,8 +779,75 @@ async function fetchCompatibleKey(cacheKey, cls, options, onCachedUnavailable, o
 		outcome: { result: resolved.key != null ? "fetched" : "invalid" }
 	};
 }
+/**
+* Looks up a key of an [FEP-ef61] portable actor at an `ap:` or `ap+ef61:`
+* key ID.  Such a key is accepted only for HTTP Signatures, and is rejected
+* for any other purpose without being fetched.  Like keys at compatible
+* identifiers, what it resolves to is cached in the namespace of the lookup's
+* purpose, and a failure to fetch the actor's document from every gateway is
+* cached in the shared namespace.  A failure that is neither, e.g., one
+* gateway being unreachable while another served an invalid document, is not
+* cached at all.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+async function fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable, onFetchError, logger) {
+	const keyId = cacheKey.href;
+	const resolvers = options.portableKeyResolvers;
+	if (resolvers == null || cls !== CryptographicKey) {
+		logger.debug("Failed to verify; key {keyId} is a key of a portable actor, which is only accepted for HTTP Signatures.", { keyId });
+		return {
+			result: {
+				key: null,
+				cached: false
+			},
+			outcome: { result: "invalid" }
+		};
+	}
+	const sharedCache = options.keyCache;
+	const scopedCache = sharedCache?.compatibleKeyScope?.("httpSignature");
+	const cached = await getCachedFetchKey(cacheKey, keyId, cls, scopedCache, logger);
+	if (cached != null) return {
+		result: cached,
+		outcome: { result: "hit" }
+	};
+	if (await sharedCache?.get(cacheKey) === null) {
+		logger.debug("Entry {keyId} found in cache, but it could not be fetched.", { keyId });
+		return {
+			result: await onCachedUnavailable(cacheKey, keyId, sharedCache, logger),
+			outcome: { result: "hit" }
+		};
+	}
+	logger.debug("Resolving key {keyId} to verify signature...", { keyId });
+	const resolution = await resolvers.actorKey(cacheKey);
+	if (resolution.type === "verified") {
+		await scopedCache?.set(cacheKey, resolution.key, { expires: resolution.expires });
+		return {
+			result: {
+				key: resolution.key,
+				cached: false
+			},
+			outcome: { result: "fetched" }
+		};
+	}
+	if (resolution.type === "rejected") {
+		await scopedCache?.set(cacheKey, null);
+		return {
+			result: {
+				key: null,
+				cached: false
+			},
+			outcome: { result: "invalid" }
+		};
+	}
+	await scopedCache?.delete(cacheKey);
+	return {
+		result: await onFetchError(resolution.error, cacheKey, keyId, resolution.cacheable ? sharedCache : void 0, logger),
+		outcome: resolution.cacheable ? classifyFetchError(resolution.error) : { result: "error" }
+	};
+}
 async function fetchKeyInternal(keyId, cls, options = {}) {
-	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
+	return await fetchKeyWithResult(typeof keyId === "string" ? parseKeyIdOrThrow(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
 		return {
 			key: null,
 			cached: true

package/dist/{kv-cache-tLKBfxHc.mjs → kv-cache-AWTrxTq3.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-DDE9S63Q.mjs";
+import { p as recordDocumentCache } from "./metrics-DxlVXwn5.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-BUkgZAcX.cjs → kv-cache-BcsvaCCL.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-o8l4QeUY.cjs");
+const require_http = require("./http-DSYQQn23.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{kv-cache-BweDce2I.js → kv-cache-D_E-2K3i.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { H as validateCryptoKey, et as recordDocumentCache, t as doubleKnock } from "./http-Rmbiu-5S.js";
+import { U as validateCryptoKey, t as doubleKnock, tt as recordDocumentCache } from "./http-D4KW2GTi.js";
 import { getLogger } from "@logtape/logtape";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{ld-DQNTIrAe.mjs → ld-CWDReGMZ.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Be9xoxps.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DDE9S63Q.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-Cc1b6pW9.mjs";
+import { n as version, t as name } from "./deno-BXI_BLNy.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DxlVXwn5.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-C0giKuki.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-DDE9S63Q.mjs → metrics-DxlVXwn5.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Be9xoxps.mjs";
+import { n as version, t as name } from "./deno-BXI_BLNy.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-K9aLnf57.js → middleware-1mv9QR16.js}

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as recordCollectionTotalItems, A as isInvalidUrlTypeError, C as compactJsonLd, D as hasSignature, E as getNormalizationContextLoader, F as wrapContextLoaderForJsonLd, G as getFederationMetrics, H as validateCryptoKey, I as exportJwk, J as isAbortError, K as getRemoteHost, M as verifyCompactJsonLd, O as hasSignatureLike, Q as recordCollectionRequest, T as detachSignature, V as importJwk, W as getDurationMs, X as recordCollectionDispatchDuration, Y as recordCircuitBreakerStateChange, Z as recordCollectionPageItems, _ as verifyPortableObjectProofWithRoot, _t as isPortableId, at as recordWebFingerHandle, b as InvalidContextReferenceError, bt as name, ct as formatAcceptSignature, d as hasProofLike, f as signObject, ft as getCanonicalPortableId, g as verifyPortableObjectProofPolicy, gt as isCompatibleKeyId, h as verifyPortableObjectProof, ht as hasPortableActor, i as selectRequestSignature, it as recordOutboxEnqueue, j as signJsonLd, k as isClearlyMalformedContextReference, l as InvalidPortableObjectIdError, m as verifyObject, mt as getPortableDid, n as listRequestSignatures, nt as recordInboxActivity, o as verifyRequest, ot as registerQueueDepthGauge, p as verifyMapLocalProof, pt as getGatewayKeyBase, q as instrumentDocumentLoader, r as parseRfc9421SignatureInput, rt as recordOutboxActivity, s as verifyRequestDetailed, st as preloadedOnlyDocumentLoader, t as doubleKnock, tt as recordFanoutRecipients, vt as isPortableUri, x as assertSafeJsonLd, xt as version, y as normalizeOutgoingActivityJsonLd } from "./http-Rmbiu-5S.js";
+import { $ as recordCollectionRequest, A as isClearlyMalformedContextReference, Ct as name, D as getNormalizationContextLoader, E as detachSignature, G as getDurationMs, H as importJwk, I as wrapContextLoaderForJsonLd, J as instrumentDocumentLoader, K as getFederationMetrics, L as exportJwk, M as signJsonLd, N as verifyCompactJsonLd, O as hasSignature, Q as recordCollectionPageItems, S as assertSafeJsonLd, U as validateCryptoKey, X as recordCircuitBreakerStateChange, Y as isAbortError, Z as recordCollectionDispatchDuration, _ as verifyPortableObjectProofPolicy, _t as hasPortableActor, at as recordOutboxEnqueue, b as normalizeOutgoingActivityJsonLd, bt as isPortableKeyId, ct as preloadedOnlyDocumentLoader, et as recordCollectionTotalItems, f as hasProofLike, g as verifyPortableObjectProof, gt as getRawCanonicalPortableId, h as verifyObject, ht as getPortableDid, i as selectRequestSignature, it as recordOutboxActivity, j as isInvalidUrlTypeError, k as hasSignatureLike, lt as formatAcceptSignature, m as verifyMapLocalProof, mt as getGatewayKeyBase, n as listRequestSignatures, nt as recordFanoutRecipients, o as verifyRequest, ot as recordWebFingerHandle, p as signObject, pt as getCanonicalPortableId, q as getRemoteHost, r as parseRfc9421SignatureInput, rt as recordInboxActivity, s as verifyRequestDetailed, st as registerQueueDepthGauge, t as doubleKnock, u as InvalidPortableObjectIdError, v as verifyPortableObjectProofWithRoot, vt as isCompatibleKeyId, w as compactJsonLd, wt as version, x as InvalidContextReferenceError, xt as isPortableUri, yt as isPortableId } from "./http-D4KW2GTi.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-DdXsKBg4.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-BweDce2I.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-CG9P_i0E.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-D_E-2K3i.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -1963,9 +1963,9 @@ const KEY_PROPERTIES = /* @__PURE__ */ new Set([
 *
 * The projection must expand to the parent's verified ID with the key as the
 * single value of `publicKey` or `assertionMethod`, and the key must be
-* nothing but a `CryptographicKey` or `Multikey` whose ID is a compatible
-* identifier of the parent plus a fragment, and whose owner or controller,
-* if any, is the parent.
+* nothing but a `CryptographicKey` or `Multikey` whose ID is the parent's
+* `ap:` or `ap+ef61:` URI, or its compatible identifier, plus a fragment,
+* and whose owner or controller, if any, is the parent.
 */
 async function isEmbeddedPortableKey(parent, member, key, parentId) {
 	const parentPortableId = getCanonicalPortableIdOf(parentId);
@@ -2023,21 +2023,16 @@ function getCanonicalPortableIdOf(id) {
 	}
 }
 /**
-* Checks whether an ID is a compatible identifier of the given portable
-* object plus a fragment.
+* Checks whether an ID is the given portable object's `ap:` or `ap+ef61:`
+* URI, or its compatible identifier, plus a non-empty fragment.  The ID is
+* compared as it is written, so an ID that URL parsing would turn into
+* the portable object's, e.g., through dot segments, is not one of its keys.
 */
 function isKeyIdOf(id, portableId) {
-	let url;
-	try {
-		if (fromCompatibleEf61Id(id) == null) return false;
-		url = new URL(id);
-	} catch (error) {
-		if (error instanceof TypeError) return false;
-		throw error;
-	}
-	if (url.hash.length < 2) return false;
-	url.hash = "";
-	return getCanonicalPortableId(url) === portableId;
+	const canonical = getRawCanonicalPortableId(id);
+	if (canonical == null) return false;
+	const hash = canonical.indexOf("#");
+	return hash >= 0 && hash < canonical.length - 1 && canonical.slice(0, hash) === portableId;
 }
 /**
 * Checks whether a `@context` value defines no keyword aliases and no scoped
@@ -4665,7 +4660,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableGatewayKey(httpSigKey))) {
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableActorKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
@@ -5446,13 +5441,13 @@ const MIN_COMPONENTS = [
 	"@authority"
 ];
 /**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
+* Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
+* actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
+* URI, and it is owned by a portable actor, which only the portable actor's
+* signed document can establish.
 */
-function isPortableGatewayKey(key) {
-	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
+function isPortableActorKey(key) {
+	return key?.id != null && isPortableKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
 }
 /**
 * Checks whether an activity needs an Object Integrity Proof by its DID:
@@ -5801,7 +5796,7 @@ async function signOutgoingActivity(activity, candidates, options) {
 		hasProof = true;
 		break;
 	}
-	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isCompatibleKeyId(c.verificationMethod));
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isPortableKeyId(c.verificationMethod));
 	if (!hasProof && activity.id != null && isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
 	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
 		activity,
@@ -7766,7 +7761,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const ldSignable = !hasPortableActor(activity);
 		for (const { keyId, privateKey } of keys) {
 			validateCryptoKey(privateKey, "private");
-			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isCompatibleKeyId(keyId)) rsaKey = {
+			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isPortableKeyId(keyId)) rsaKey = {
 				keyId,
 				privateKey
 			};

package/dist/{middleware-CsQorLC_.mjs → middleware-B7stx5gy.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-BdhvduR9.mjs";
+import { n as FederationImpl } from "./middleware-CAWRGSwH.mjs";
 export { FederationImpl };

package/dist/{middleware-BdhvduR9.mjs → middleware-CAWRGSwH.mjs}

@@ -1,29 +1,29 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Be9xoxps.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DDE9S63Q.mjs";
+import { n as version, t as name } from "./deno-BXI_BLNy.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DxlVXwn5.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
-import { a as isCompatibleKeyId, c as isPortableUri, i as hasPortableActor, n as getGatewayKeyBase, r as getPortableDid, s as isPortableId, t as getCanonicalPortableId } from "./portable-key-id-T7lecIbt.mjs";
-import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-Cc1b6pW9.mjs";
+import { a as hasPortableActor, c as isPortableId, l as isPortableKeyId, n as getGatewayKeyBase, o as isCompatibleKeyId, r as getPortableDid, t as getCanonicalPortableId, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
+import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-C0giKuki.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-DQNTIrAe.mjs";
-import { i as signObject, l as verifyPortableObjectProofWithRoot, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, t as InvalidPortableObjectIdError } from "./proof-CW8k0R1G.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-BFeK9sBg.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-Dtuyb0ps.mjs";
-import { n as kvCache } from "./kv-cache-tLKBfxHc.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-CWDReGMZ.mjs";
+import { i as signObject, l as verifyPortableObjectProofWithRoot, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, t as InvalidPortableObjectIdError } from "./proof-B5s-W6Sm.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-CEx2SZjf.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-B5BIo7e9.mjs";
+import { n as kvCache } from "./kv-cache-AWTrxTq3.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CCfdL83M.mjs";
-import { t as verifyPortableObject } from "./portable-collection-WXaHkNqC.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send--FORaIc4.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-B2bgGYbP.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CgoCOTUQ.mjs";
+import { t as verifyPortableObject } from "./portable-collection-0_5DyXMt.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-BAJvkdNL.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-BI7H61zO.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-SVlHSzV7.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-D0H4LLvQ.mjs";
 import { t as KvKeyCache } from "./keycache-BInaECGj.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CffY_XOJ.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-BkCPJ_uC.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -2309,7 +2309,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableGatewayKey(httpSigKey))) {
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableActorKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
@@ -3090,13 +3090,13 @@ const MIN_COMPONENTS = [
 	"@authority"
 ];
 /**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
+* Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
+* actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
+* URI, and it is owned by a portable actor, which only the portable actor's
+* signed document can establish.
 */
-function isPortableGatewayKey(key) {
-	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
+function isPortableActorKey(key) {
+	return key?.id != null && isPortableKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
 }
 /**
 * Checks whether an activity needs an Object Integrity Proof by its DID:
@@ -3215,7 +3215,7 @@ async function signOutgoingActivity(activity, candidates, options) {
 		hasProof = true;
 		break;
 	}
-	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isCompatibleKeyId(c.verificationMethod));
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isPortableKeyId(c.verificationMethod));
 	if (!hasProof && activity.id != null && isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
 	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
 		activity,
@@ -5001,7 +5001,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const ldSignable = !hasPortableActor(activity);
 		for (const { keyId, privateKey } of keys) {
 			validateCryptoKey(privateKey, "private");
-			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isCompatibleKeyId(keyId)) rsaKey = {
+			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isPortableKeyId(keyId)) rsaKey = {
 				keyId,
 				privateKey
 			};

package/dist/{mod-AVir5nVI.d.cts → mod-B7SfEqIP.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-Bm6ldGvx.cjs";
+import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-CrDDVrbF.cjs";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 

package/dist/{mod-Co53r-VP.d.ts → mod-Bz9tFXI2.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { S as KeyCache } from "./http-BrQgkJay.js";
+import { S as KeyCache } from "./http-C-x_OLSp.js";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader, PortableObjectVerifier, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";

package/dist/{mod-eVOUPbQE.d.ts → mod-C06GoL5Z.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-Ci5vuUr_.js";
+import { Gt as WebFingerLinksDispatcher, bt as ActorHandleMapper, d as RequestContext, vt as ActorAliasMapper, yt as ActorDispatcher } from "./context-B2C8nuN3.js";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 

package/dist/{mod-Cwdt_CWU.d.ts → mod-CZetqT5h.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { n as HttpMessageSignaturesSpecDeterminer } from "./http-BrQgkJay.js";
+import { n as HttpMessageSignaturesSpecDeterminer } from "./http-C-x_OLSp.js";
 import { n as KvStore, t as KvKey } from "./kv-BhNbN8Ed.js";
 import { t as DocumentFetchKind } from "./metrics-DoRtI0qU.js";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";

package/dist/{mod-Cr79cQlc.d.cts → mod-D4g9ffEn.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { n as HttpMessageSignaturesSpecDeterminer } from "./http-D76Py0M4.cjs";
+import { n as HttpMessageSignaturesSpecDeterminer } from "./http-CjezPjFX.cjs";
 import { n as KvStore, t as KvKey } from "./kv-BhNbN8Ed.cjs";
 import { t as DocumentFetchKind } from "./metrics-DVKYY6K1.cjs";
 import { DocumentLoader, DocumentLoaderFactoryOptions } from "@fedify/vocab-runtime";

package/dist/{mod-Byt5tvAS.d.cts → mod-S--JxYjo.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { S as KeyCache } from "./http-D76Py0M4.cjs";
+import { S as KeyCache } from "./http-CjezPjFX.cjs";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { DocumentLoader, PortableObjectVerifier, PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";

package/dist/mod.cjs

@@ -3,11 +3,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-o8l4QeUY.cjs");
-const require_federation = require("./federation-B6IHuS6n.cjs");
+const require_http = require("./http-DSYQQn23.cjs");
+const require_federation = require("./federation-DqDOPjWo.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_portable_collection = require("./portable-collection-DXogVs__.cjs");
-const require_kv_cache = require("./kv-cache-BUkgZAcX.cjs");
+const require_portable_collection = require("./portable-collection-BD8fE3j3.cjs");
+const require_kv_cache = require("./kv-cache-BcsvaCCL.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
 require("./sig/mod.cjs");

package/dist/mod.d.cts

@@ -1,13 +1,13 @@
 /// <reference lib="esnext.temporal" />
 import { a as InboundService, c as OutboundService, d as Software, f as Usage, i as parseNodeInfo, l as Protocol, n as ParseNodeInfoOptions, o as JsonValue, p as nodeInfoToJson, r as getNodeInfo, s as NodeInfo, t as GetNodeInfoOptions, u as Services } from "./client-D-XP_Ccb.cjs";
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-D76Py0M4.cjs";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-CjezPjFX.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "./owner-BF0L9cMt.cjs";
-import { $ as InProcessMessageQueue, A as MediaUploaderSetters, At as HashlinkMediaRequest, B as createFederationBuilder, Bt as OutboxPermanentFailureHandler, C as FederationFetchOptions, Ct as CollectionCounter, D as IdempotencyStrategy, Dt as CustomCollectionCursor, E as IdempotencyKeyCallback, Et as CustomCollectionCounter, F as FederationKvPrefixes, Ft as ObjectAuthorizePredicate, G as TaskRegistry, Gt as WebFingerLinksDispatcher, H as TaskDefinitionOptions, Ht as SharedInboxKeyDispatcher, I as FederationOrigin, It as ObjectDispatcher, J as RetryPolicy, Jt as PageItems, K as CreateExponentialBackoffPolicyOptions, Kt as SendActivityError, L as FederationQueueOptions, Lt as OutboxErrorHandler, M as OutboxListenerSetters, Mt as InboxListener, N as PortableInboxForwardingOptions, Nt as MediaUploaderCallback, O as InboxChallengePolicy, Ot as CustomCollectionDispatcher, P as Rfc6570Expression, Pt as NodeInfoDispatcher, Q as respondWithObjectIfAcceptable, R as createFederation, Rt as OutboxListener, S as FederationBuilder, St as AuthorizePredicate, T as FederationStartQueueOptions, Tt as CollectionDispatcher, U as TaskEnqueueOptions, Ut as UnverifiedActivityHandler, V as TaskDefinition, Vt as PortableActorIdMapper, W as TaskHandler, Wt as UnverifiedActivityReason, X as RespondWithObjectOptions, Xt as digest, Y as createExponentialBackoffPolicy, Yt as buildCollectionSynchronizationHeader, Z as respondWithObject, Zt as ActivityTransformer, _ as ConstructorWithTypeId, _t as parseCircuitBreakerKvState, a as GetObjectOptions, at as ParallelMessageQueue, b as Federation, bt as ActorHandleMapper, c as OutboxContext, ct as CircuitBreakerBeforeSendDecision, d as RequestContext, dt as CircuitBreakerKvState, et as InProcessMessageQueueOptions, f as RouteActivityOptions, ft as CircuitBreakerOptions, g as CollectionCallbackSetters, gt as normalizeCircuitBreakerOptions, h as ActorCallbackSetters, ht as NormalizedCircuitBreakerOptions, i as GetActorOptions, it as MessageQueueListenOptions, j as ObjectCallbackSetters, jt as InboxErrorHandler, k as InboxListenerSetters, kt as HashlinkMediaDispatcher, l as ParseUriResult, lt as CircuitBreakerCreateOptions, m as SendActivityOptionsForCollection, mt as CircuitBreakerStateChange, n as Context, nt as MessageQueueDepth, o as GetSignedKeyOptions, ot as CircuitBreaker, p as SendActivityOptions, pt as CircuitBreakerState, q as RetryContext, qt as SenderKeyPair, r as ForwardActivityOptions, rt as MessageQueueEnqueueOptions, s as InboxContext, st as CircuitBreakerActivityDrop, t as ActorKeyPair, tt as MessageQueue, u as PortableRequest, ut as CircuitBreakerFailurePolicy, v as CustomCollectionCallbackSetters, vt as ActorAliasMapper, w as FederationOptions, wt as CollectionCursor, x as FederationBenchmarkOptions, xt as ActorKeyPairsDispatcher, y as Federatable, yt as ActorDispatcher, z as Message, zt as OutboxListenerErrorHandler } from "./context-Bm6ldGvx.cjs";
+import { $ as InProcessMessageQueue, A as MediaUploaderSetters, At as HashlinkMediaRequest, B as createFederationBuilder, Bt as OutboxPermanentFailureHandler, C as FederationFetchOptions, Ct as CollectionCounter, D as IdempotencyStrategy, Dt as CustomCollectionCursor, E as IdempotencyKeyCallback, Et as CustomCollectionCounter, F as FederationKvPrefixes, Ft as ObjectAuthorizePredicate, G as TaskRegistry, Gt as WebFingerLinksDispatcher, H as TaskDefinitionOptions, Ht as SharedInboxKeyDispatcher, I as FederationOrigin, It as ObjectDispatcher, J as RetryPolicy, Jt as PageItems, K as CreateExponentialBackoffPolicyOptions, Kt as SendActivityError, L as FederationQueueOptions, Lt as OutboxErrorHandler, M as OutboxListenerSetters, Mt as InboxListener, N as PortableInboxForwardingOptions, Nt as MediaUploaderCallback, O as InboxChallengePolicy, Ot as CustomCollectionDispatcher, P as Rfc6570Expression, Pt as NodeInfoDispatcher, Q as respondWithObjectIfAcceptable, R as createFederation, Rt as OutboxListener, S as FederationBuilder, St as AuthorizePredicate, T as FederationStartQueueOptions, Tt as CollectionDispatcher, U as TaskEnqueueOptions, Ut as UnverifiedActivityHandler, V as TaskDefinition, Vt as PortableActorIdMapper, W as TaskHandler, Wt as UnverifiedActivityReason, X as RespondWithObjectOptions, Xt as digest, Y as createExponentialBackoffPolicy, Yt as buildCollectionSynchronizationHeader, Z as respondWithObject, Zt as ActivityTransformer, _ as ConstructorWithTypeId, _t as parseCircuitBreakerKvState, a as GetObjectOptions, at as ParallelMessageQueue, b as Federation, bt as ActorHandleMapper, c as OutboxContext, ct as CircuitBreakerBeforeSendDecision, d as RequestContext, dt as CircuitBreakerKvState, et as InProcessMessageQueueOptions, f as RouteActivityOptions, ft as CircuitBreakerOptions, g as CollectionCallbackSetters, gt as normalizeCircuitBreakerOptions, h as ActorCallbackSetters, ht as NormalizedCircuitBreakerOptions, i as GetActorOptions, it as MessageQueueListenOptions, j as ObjectCallbackSetters, jt as InboxErrorHandler, k as InboxListenerSetters, kt as HashlinkMediaDispatcher, l as ParseUriResult, lt as CircuitBreakerCreateOptions, m as SendActivityOptionsForCollection, mt as CircuitBreakerStateChange, n as Context, nt as MessageQueueDepth, o as GetSignedKeyOptions, ot as CircuitBreaker, p as SendActivityOptions, pt as CircuitBreakerState, q as RetryContext, qt as SenderKeyPair, r as ForwardActivityOptions, rt as MessageQueueEnqueueOptions, s as InboxContext, st as CircuitBreakerActivityDrop, t as ActorKeyPair, tt as MessageQueue, u as PortableRequest, ut as CircuitBreakerFailurePolicy, v as CustomCollectionCallbackSetters, vt as ActorAliasMapper, w as FederationOptions, wt as CollectionCursor, x as FederationBenchmarkOptions, xt as ActorKeyPairsDispatcher, y as Federatable, yt as ActorDispatcher, z as Message, zt as OutboxListenerErrorHandler } from "./context-CrDDVrbF.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-BhNbN8Ed.cjs";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.cjs";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-AVir5nVI.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-Byt5tvAS.cjs";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-Cr79cQlc.cjs";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-B7SfEqIP.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-S--JxYjo.cjs";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-D4g9ffEn.cjs";
 export * from "@fedify/vocab-runtime";
 
 //#region src/mod.d.ts

package/dist/mod.d.ts

@@ -1,13 +1,13 @@
 /// <reference lib="esnext.temporal" />
 import { a as InboundService, c as OutboundService, d as Software, f as Usage, i as parseNodeInfo, l as Protocol, n as ParseNodeInfoOptions, o as JsonValue, p as nodeInfoToJson, r as getNodeInfo, s as NodeInfo, t as GetNodeInfoOptions, u as Services } from "./client-D-XP_Ccb.js";
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-BrQgkJay.js";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-C-x_OLSp.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "./owner-BSzr5-I8.js";
-import { $ as InProcessMessageQueue, A as MediaUploaderSetters, At as HashlinkMediaRequest, B as createFederationBuilder, Bt as OutboxPermanentFailureHandler, C as FederationFetchOptions, Ct as CollectionCounter, D as IdempotencyStrategy, Dt as CustomCollectionCursor, E as IdempotencyKeyCallback, Et as CustomCollectionCounter, F as FederationKvPrefixes, Ft as ObjectAuthorizePredicate, G as TaskRegistry, Gt as WebFingerLinksDispatcher, H as TaskDefinitionOptions, Ht as SharedInboxKeyDispatcher, I as FederationOrigin, It as ObjectDispatcher, J as RetryPolicy, Jt as PageItems, K as CreateExponentialBackoffPolicyOptions, Kt as SendActivityError, L as FederationQueueOptions, Lt as OutboxErrorHandler, M as OutboxListenerSetters, Mt as InboxListener, N as PortableInboxForwardingOptions, Nt as MediaUploaderCallback, O as InboxChallengePolicy, Ot as CustomCollectionDispatcher, P as Rfc6570Expression, Pt as NodeInfoDispatcher, Q as respondWithObjectIfAcceptable, R as createFederation, Rt as OutboxListener, S as FederationBuilder, St as AuthorizePredicate, T as FederationStartQueueOptions, Tt as CollectionDispatcher, U as TaskEnqueueOptions, Ut as UnverifiedActivityHandler, V as TaskDefinition, Vt as PortableActorIdMapper, W as TaskHandler, Wt as UnverifiedActivityReason, X as RespondWithObjectOptions, Xt as digest, Y as createExponentialBackoffPolicy, Yt as buildCollectionSynchronizationHeader, Z as respondWithObject, Zt as ActivityTransformer, _ as ConstructorWithTypeId, _t as parseCircuitBreakerKvState, a as GetObjectOptions, at as ParallelMessageQueue, b as Federation, bt as ActorHandleMapper, c as OutboxContext, ct as CircuitBreakerBeforeSendDecision, d as RequestContext, dt as CircuitBreakerKvState, et as InProcessMessageQueueOptions, f as RouteActivityOptions, ft as CircuitBreakerOptions, g as CollectionCallbackSetters, gt as normalizeCircuitBreakerOptions, h as ActorCallbackSetters, ht as NormalizedCircuitBreakerOptions, i as GetActorOptions, it as MessageQueueListenOptions, j as ObjectCallbackSetters, jt as InboxErrorHandler, k as InboxListenerSetters, kt as HashlinkMediaDispatcher, l as ParseUriResult, lt as CircuitBreakerCreateOptions, m as SendActivityOptionsForCollection, mt as CircuitBreakerStateChange, n as Context, nt as MessageQueueDepth, o as GetSignedKeyOptions, ot as CircuitBreaker, p as SendActivityOptions, pt as CircuitBreakerState, q as RetryContext, qt as SenderKeyPair, r as ForwardActivityOptions, rt as MessageQueueEnqueueOptions, s as InboxContext, st as CircuitBreakerActivityDrop, t as ActorKeyPair, tt as MessageQueue, u as PortableRequest, ut as CircuitBreakerFailurePolicy, v as CustomCollectionCallbackSetters, vt as ActorAliasMapper, w as FederationOptions, wt as CollectionCursor, x as FederationBenchmarkOptions, xt as ActorKeyPairsDispatcher, y as Federatable, yt as ActorDispatcher, z as Message, zt as OutboxListenerErrorHandler } from "./context-Ci5vuUr_.js";
+import { $ as InProcessMessageQueue, A as MediaUploaderSetters, At as HashlinkMediaRequest, B as createFederationBuilder, Bt as OutboxPermanentFailureHandler, C as FederationFetchOptions, Ct as CollectionCounter, D as IdempotencyStrategy, Dt as CustomCollectionCursor, E as IdempotencyKeyCallback, Et as CustomCollectionCounter, F as FederationKvPrefixes, Ft as ObjectAuthorizePredicate, G as TaskRegistry, Gt as WebFingerLinksDispatcher, H as TaskDefinitionOptions, Ht as SharedInboxKeyDispatcher, I as FederationOrigin, It as ObjectDispatcher, J as RetryPolicy, Jt as PageItems, K as CreateExponentialBackoffPolicyOptions, Kt as SendActivityError, L as FederationQueueOptions, Lt as OutboxErrorHandler, M as OutboxListenerSetters, Mt as InboxListener, N as PortableInboxForwardingOptions, Nt as MediaUploaderCallback, O as InboxChallengePolicy, Ot as CustomCollectionDispatcher, P as Rfc6570Expression, Pt as NodeInfoDispatcher, Q as respondWithObjectIfAcceptable, R as createFederation, Rt as OutboxListener, S as FederationBuilder, St as AuthorizePredicate, T as FederationStartQueueOptions, Tt as CollectionDispatcher, U as TaskEnqueueOptions, Ut as UnverifiedActivityHandler, V as TaskDefinition, Vt as PortableActorIdMapper, W as TaskHandler, Wt as UnverifiedActivityReason, X as RespondWithObjectOptions, Xt as digest, Y as createExponentialBackoffPolicy, Yt as buildCollectionSynchronizationHeader, Z as respondWithObject, Zt as ActivityTransformer, _ as ConstructorWithTypeId, _t as parseCircuitBreakerKvState, a as GetObjectOptions, at as ParallelMessageQueue, b as Federation, bt as ActorHandleMapper, c as OutboxContext, ct as CircuitBreakerBeforeSendDecision, d as RequestContext, dt as CircuitBreakerKvState, et as InProcessMessageQueueOptions, f as RouteActivityOptions, ft as CircuitBreakerOptions, g as CollectionCallbackSetters, gt as normalizeCircuitBreakerOptions, h as ActorCallbackSetters, ht as NormalizedCircuitBreakerOptions, i as GetActorOptions, it as MessageQueueListenOptions, j as ObjectCallbackSetters, jt as InboxErrorHandler, k as InboxListenerSetters, kt as HashlinkMediaDispatcher, l as ParseUriResult, lt as CircuitBreakerCreateOptions, m as SendActivityOptionsForCollection, mt as CircuitBreakerStateChange, n as Context, nt as MessageQueueDepth, o as GetSignedKeyOptions, ot as CircuitBreaker, p as SendActivityOptions, pt as CircuitBreakerState, q as RetryContext, qt as SenderKeyPair, r as ForwardActivityOptions, rt as MessageQueueEnqueueOptions, s as InboxContext, st as CircuitBreakerActivityDrop, t as ActorKeyPair, tt as MessageQueue, u as PortableRequest, ut as CircuitBreakerFailurePolicy, v as CustomCollectionCallbackSetters, vt as ActorAliasMapper, w as FederationOptions, wt as CollectionCursor, x as FederationBenchmarkOptions, xt as ActorKeyPairsDispatcher, y as Federatable, yt as ActorDispatcher, z as Message, zt as OutboxListenerErrorHandler } from "./context-B2C8nuN3.js";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-BhNbN8Ed.js";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.js";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-eVOUPbQE.js";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-Co53r-VP.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-Cwdt_CWU.js";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-C06GoL5Z.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "./mod-Bz9tFXI2.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-CZetqT5h.js";
 export * from "@fedify/vocab-runtime";
 
 //#region src/mod.d.ts