@fedify/fedify 2.4.0-dev.2127 → 2.4.0-dev.2141

package/dist/{portable-key-id-T7lecIbt.mjs → portable-key-id-Bg259c4Z.mjs}

@@ -2,10 +2,12 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { isActor } from "@fedify/vocab";
-import { canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getFe34Origin, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getFe34Origin, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+const RAW_PORTABLE_URI_PATTERN = /^ap(?:\+ef61)?:\/\//i;
+const RAW_COMPATIBLE_ID_PREFIX_PATTERN = /^https?:\/\/[^/?#]*\/\.well-known\/apgateway\/(?=did(?::|%3A))/i;
 /**
 * Checks whether the URL is an `ap:` or `ap+ef61:` URI.
 * @internal
@@ -69,6 +71,20 @@ function isCompatibleKeyId(keyId) {
 	return (keyId.protocol === "http:" || keyId.protocol === "https:") && COMPATIBLE_KEY_ID_PATH_PATTERN.test(keyId.pathname);
 }
 /**
+* Checks whether a key ID may name a key that is valid only for HTTP
+* Signatures: a gateway key at an [FEP-ef61] compatible identifier, or a key
+* of a portable actor at an `ap:` or `ap+ef61:` URI.  Neither ever makes or
+* verifies an Object Integrity Proof or a Linked Data Signature: a portable
+* object's proof is made by its DID, and a proof made with a gateway key
+* would claim that the gateway authored the object.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+function isPortableKeyId(keyId) {
+	return isPortableUri(keyId) || isCompatibleKeyId(keyId);
+}
+/**
 * Gets the canonical portable ID of an actor ID that is either an `ap:` or
 * `ap+ef61:` URI or a compatible identifier.
 * @returns The canonical portable ID, or `null` if the ID is neither, or is
@@ -87,6 +103,57 @@ function getCanonicalPortableId(id) {
 	}
 }
 /**
+* Gets the canonical portable ID of an `ap:` or `ap+ef61:` URI or
+* a compatible identifier as it is written, before any URL parsing.
+* Parsing an ID into a `URL` resolves dot segments in its path, which would
+* make it identify another portable object, e.g.,
+* `ap://did:key:z6Mk…/x/../actor` would become `ap://did:key:z6Mk…/actor`.
+* Such an ID has no canonical portable ID here.
+* @param raw The ID as it is written.
+* @returns The canonical portable ID, fragment included, or `null` if the ID
+*          is neither an `ap:` or `ap+ef61:` URI nor a compatible identifier,
+*          is malformed, or would identify another object once parsed.
+* @internal
+*/
+function getRawCanonicalPortableId(raw) {
+	let canonical;
+	let parsed;
+	try {
+		if (RAW_PORTABLE_URI_PATTERN.test(raw)) {
+			canonical = canonicalizePortableUri(raw);
+			parsed = canonicalizePortableUri(formatIri(parseIri(raw)));
+		} else {
+			const prefix = raw.match(RAW_COMPATIBLE_ID_PREFIX_PATTERN);
+			if (prefix == null || !URL.canParse(raw)) return null;
+			canonical = canonicalizePortableUri("ap://" + raw.slice(prefix[0].length));
+			parsed = getCanonicalPortableId(new URL(raw));
+		}
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+	return canonical === parsed ? canonical : null;
+}
+/**
+* Parses a key ID, e.g., the `keyId` of an HTTP Signature, into a `URL`.
+* An `ap:` or `ap+ef61:` key ID is parsed into the internal `URL` form of
+* portable URIs.  A portable or compatible key ID that is malformed, or
+* whose identity URL parsing would change, e.g., by resolving dot segments in
+* its path, is refused, so that it can never be taken for, or looked up in
+* the key cache as, the key of another object.
+* @param raw The key ID as it is written.
+* @returns The parsed key ID, or `null` if it is invalid.
+* @internal
+*/
+function parseKeyIdString(raw) {
+	if (RAW_PORTABLE_URI_PATTERN.test(raw)) return getRawCanonicalPortableId(raw) == null ? null : parseIri(raw);
+	if (!URL.canParse(raw)) return null;
+	const url = new URL(raw);
+	if (isPortableUri(url)) return null;
+	if (!RAW_COMPATIBLE_ID_PREFIX_PATTERN.test(raw)) return isCompatibleKeyId(url) ? null : url;
+	return getRawCanonicalPortableId(raw) == null ? null : url;
+}
+/**
 * Builds the base of the key IDs of a gateway's keys for a portable actor:
 * the actor's compatible identifier on the gateway.
 * @param actorId The portable actor's ID, either an `ap:` or `ap+ef61:` URI
@@ -134,4 +201,4 @@ async function isSamePublicKey(a, b) {
 	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
 }
 //#endregion
-export { isCompatibleKeyId as a, isPortableUri as c, hasPortableActor as i, isSamePublicKey as l, getGatewayKeyBase as n, isPortableActorDocument as o, getPortableDid as r, isPortableId as s, getCanonicalPortableId as t };
+export { hasPortableActor as a, isPortableId as c, isSamePublicKey as d, parseKeyIdString as f, getRawCanonicalPortableId as i, isPortableKeyId as l, getGatewayKeyBase as n, isCompatibleKeyId as o, getPortableDid as r, isPortableActorDocument as s, getCanonicalPortableId as t, isPortableUri as u };

package/dist/{proof-CW8k0R1G.mjs → proof-B5s-W6Sm.mjs}

@@ -1,13 +1,13 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Be9xoxps.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DDE9S63Q.mjs";
-import { r as getPortableDid, s as isPortableId } from "./portable-key-id-T7lecIbt.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-Cc1b6pW9.mjs";
+import { n as version, t as name } from "./deno-BXI_BLNy.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DxlVXwn5.mjs";
+import { c as isPortableId, r as getPortableDid } from "./portable-key-id-Bg259c4Z.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-C0giKuki.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { c as getNormalizationContextLoader } from "./ld-DQNTIrAe.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CWDReGMZ.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -1092,7 +1092,8 @@ async function verifyObject(cls, jsonLd, options = {}) {
 		...options,
 		documentLoader: proofDocumentLoader,
 		gateways: [],
-		verifyPortableObject: acceptPortableProofDocument
+		verifyPortableObject: acceptPortableProofDocument,
+		inheritPortableObjectVerifier: false
 	})) {
 		const rawProofCandidate = takeRawProofCandidate(rawProofCandidatePool, proof);
 		if (rawProofCandidate == null) return null;

package/dist/{send--FORaIc4.mjs → send-BAJvkdNL.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Be9xoxps.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-DDE9S63Q.mjs";
-import { n as doubleKnock } from "./http-BFeK9sBg.mjs";
+import { n as version, t as name } from "./deno-BXI_BLNy.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-DxlVXwn5.mjs";
+import { n as doubleKnock } from "./http-CEx2SZjf.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/sig/compound-proof-discovery.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-SVlHSzV7.mjs";
+import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-D0H4LLvQ.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-discovery.test.ts

package/dist/sig/compound-proof-producer.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-SVlHSzV7.mjs";
+import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-D0H4LLvQ.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-producer.test.ts
 const portableId = "ap+ef61://did:key:z6MkAlice/objects/1";

package/dist/sig/compound-proof-verification.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as verifyMapLocalProof, c as verifyPortableObjectProofPolicy } from "../proof-CW8k0R1G.mjs";
+import { a as verifyMapLocalProof, c as verifyPortableObjectProofPolicy } from "../proof-B5s-W6Sm.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-SVlHSzV7.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-D0H4LLvQ.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { CryptographicKey, Multikey, Person } from "@fedify/vocab";
@@ -618,5 +618,199 @@ test("verifyCompoundPortableObjectProofs() exempts only keys of the parent itsel
 		assert(result.portableObjects.some((o) => o.path !== "" && !o.verified), name);
 	}
 });
+/**
+* Rewrites the IDs of a {@link compatibleActor}'s keys as they are written,
+* e.g., as `ap:` URIs, which the serializer would canonicalize otherwise.
+*/
+function withKeyIds(actor, keyBase, { id = actor.id, owner = id } = {}) {
+	const [multikey] = actor.assertionMethod;
+	return {
+		...actor,
+		id,
+		publicKey: {
+			...asRecord(actor.publicKey),
+			id: `${keyBase}#main-key`,
+			owner
+		},
+		assertionMethod: [{
+			...multikey,
+			id: `${keyBase}#ed25519-key`,
+			controller: owner
+		}]
+	};
+}
+const apActorId = `ap://${compatibleDid}/actor`;
+test("verifyCompoundPortableObjectProofs() exempts keys at ap: URIs embedded in portable actors", async () => {
+	const actor = await compatibleActor();
+	const encodedDid = encodeURIComponent(compatibleDid);
+	const cases = {
+		"ap: keys of an ap: actor": [apActorId, apActorId],
+		"ap: keys of a compatible-ID actor": [compatibleActorId, apActorId],
+		"ap+ef61: keys": [apActorId, `ap+ef61://${compatibleDid}/actor`],
+		"keys with percent-encoded DIDs": [apActorId, `ap://${encodedDid}/actor`],
+		"ap+ef61: keys of a percent-encoded actor": [`ap+ef61://${encodedDid}/actor`, `ap+ef61://${encodedDid}/actor`],
+		"keys with an uppercase scheme": [apActorId, `AP://${compatibleDid}/actor`],
+		"keys with location hints": [apActorId, `${apActorId}?@gateway=https%3A%2F%2Fgw.example`]
+	};
+	for (const [name, [id, keyBase]] of Object.entries(cases)) {
+		const result = await verifyCompoundPortableObjectProofs(await signCompatible(withKeyIds(actor, keyBase, { id })), limits, options);
+		assert(result.status === "ok", name);
+		assert(result.verified, name);
+		assertEquals(result.portableObjects.map((o) => o.path), [""], name);
+	}
+	const apActor = withKeyIds(actor, apActorId, { id: apActorId });
+	const atIdKeys = (key) => {
+		const { id, ...rest } = asRecord(key);
+		return {
+			...rest,
+			"@id": id
+		};
+	};
+	const withAtIds = await verifyCompoundPortableObjectProofs(await signCompatible({
+		...apActor,
+		publicKey: atIdKeys(apActor.publicKey),
+		assertionMethod: apActor.assertionMethod.map(atIdKeys)
+	}), limits, options);
+	assert(withAtIds.status === "ok");
+	assert(withAtIds.verified);
+	assertEquals(withAtIds.portableObjects.map((o) => o.path), [""]);
+	const withApTerm = await verifyCompoundPortableObjectProofs(await signCompatible({
+		...withKeyIds(actor, apActorId, { id: apActorId }),
+		"@context": [...actor["@context"], { ap: "https://ap.example/" }]
+	}), limits, options);
+	assert(withApTerm.status === "ok");
+	assert(withApTerm.verified);
+	assertEquals(withApTerm.portableObjects.map((o) => o.path), [""]);
+	const result = await verifyCompoundPortableObjectProofs(await signCompatible({
+		"@context": [...compatibleContext],
+		id: `ap://${compatibleDid}/activities/1`,
+		type: "Update",
+		actor: apActorId,
+		object: await signCompatible(withKeyIds(actor, apActorId, { id: apActorId }))
+	}), limits, options);
+	assert(result.status === "ok");
+	assert(result.verified);
+	assertEquals(result.portableObjects.map((o) => o.path), ["/object", ""]);
+});
+test("verifyCompoundPortableObjectProofs() exempts only ap: keys of the parent itself", async () => {
+	const actor = withKeyIds(await compatibleActor(), apActorId, { id: apActorId });
+	const publicKey = asRecord(actor.publicKey);
+	const otherDid = "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK";
+	const keyIds = {
+		"a key of another actor": `ap://${compatibleDid}/other#main-key`,
+		"a key of another DID": `ap://${otherDid}/actor#main-key`,
+		"a key without a fragment": apActorId,
+		"a key with an empty fragment": `${apActorId}#`,
+		"a key with dot segments": `ap://${compatibleDid}/x/../actor#main-key`,
+		"a key with encoded dot segments": `ap://${compatibleDid}/x/%2E%2E/actor#main-key`,
+		"a key with an encoded slash": `${apActorId}%2F#main-key`,
+		"a key with an encoded fragment delimiter": `${apActorId}%23main-key`,
+		"a compatible key with dot segments": `https://gw.example/.well-known/apgateway/${compatibleDid}/x/../actor#main-key`
+	};
+	const cases = {};
+	for (const [name, id] of Object.entries(keyIds)) cases[name] = {
+		...actor,
+		publicKey: {
+			...publicKey,
+			id
+		}
+	};
+	Object.assign(cases, {
+		"a key owned by another actor": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				owner: `ap://${otherDid}/actor`
+			}
+		},
+		"a key controlled by another actor": {
+			...actor,
+			assertionMethod: actor.assertionMethod.map((key) => ({
+				...key,
+				controller: `ap://${otherDid}/actor`
+			}))
+		},
+		"a key with extra content": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				name: "Extra"
+			}
+		},
+		"a key with a scoped context": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				"@context": { CryptographicKey: {
+					"@id": "https://w3id.org/security#Key",
+					"@context": {}
+				} }
+			}
+		}
+	});
+	for (const [name, document] of Object.entries(cases)) {
+		const result = await verifyCompoundPortableObjectProofs(await signCompatible(document), limits, options);
+		assert(result.status === "ok", name);
+		assertEquals(result.verified, false, name);
+		assert(result.portableObjects.find((o) => o.path === "")?.verified, name);
+		assert(result.portableObjects.some((o) => o.path !== "" && !o.verified), name);
+	}
+	const conflicting = await verifyCompoundPortableObjectProofs(await signCompatible({
+		...actor,
+		publicKey: {
+			...publicKey,
+			"@id": `ap://${compatibleDid}/other#main-key`
+		}
+	}), limits, options);
+	assert(conflicting.status === "ok");
+	assertEquals(conflicting.verified, false);
+});
+test("verifyCompoundPortableObjectProofs() exempts ap: keys only of verified actors", async () => {
+	const actor = withKeyIds(await compatibleActor(), apActorId, { id: apActorId });
+	const signed = await signCompatible(actor);
+	const unverified = {
+		"": true,
+		"/object": false,
+		"/object/publicKey": false,
+		"/object/assertionMethod/0": false
+	};
+	const cases = {
+		"an unsigned actor": [actor, unverified],
+		"a tampered actor": [{
+			...signed,
+			name: "Tampered"
+		}, unverified],
+		"an actor with a key with an invalid proof": [await signCompatible({
+			...actor,
+			publicKey: {
+				...asRecord(actor.publicKey),
+				"@context": [...compatibleContext],
+				proof: asRecord(signed.proof)
+			}
+		}), {
+			"": true,
+			"/object": true,
+			"/object/publicKey": false
+		}]
+	};
+	for (const [name, [object, expected]] of Object.entries(cases)) {
+		const result = await verifyCompoundPortableObjectProofs(await signCompatible({
+			"@context": [...compatibleContext],
+			id: `ap://${compatibleDid}/activities/1`,
+			type: "Update",
+			actor: apActorId,
+			object
+		}), limits, options);
+		assert(result.status === "ok", name);
+		assertEquals(result.verified, false, name);
+		assertEquals(Object.fromEntries(result.portableObjects.map((o) => [o.path, o.verified])), expected, name);
+	}
+});
+test("verifyCompoundPortableObjectProofs() leaves keys at DID URLs alone", async () => {
+	const result = await verifyCompoundPortableObjectProofs(await signCompatible(withKeyIds(await compatibleActor(), compatibleDid, { id: apActorId })), limits, options);
+	assert(result.status === "ok");
+	assert(result.verified);
+	assertEquals(result.portableObjects.map((o) => o.path), [""]);
+});
 //#endregion
 export {};

package/dist/sig/compound-proof.test.mjs

@@ -6,9 +6,9 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { i as signObject, u as verifyProof } from "../proof-CW8k0R1G.mjs";
+import { i as signObject, u as verifyProof } from "../proof-B5s-W6Sm.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { o as verifyCompoundProofDocuments } from "../compound-proof-SVlHSzV7.mjs";
+import { o as verifyCompoundProofDocuments } from "../compound-proof-D0H4LLvQ.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";

package/dist/sig/http.test.mjs

@@ -11,8 +11,8 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as exportJwk } from "../key-Cc1b6pW9.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-BFeK9sBg.mjs";
+import { n as exportJwk } from "../key-C0giKuki.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-CEx2SZjf.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";

package/dist/sig/key.test.mjs

@@ -6,7 +6,7 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-Cc1b6pW9.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-C0giKuki.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/ld.test.mjs

@@ -8,8 +8,8 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { o as generateCryptoKeyPair } from "../key-Cc1b6pW9.mjs";
-import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-DQNTIrAe.mjs";
+import { o as generateCryptoKeyPair } from "../key-C0giKuki.mjs";
+import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-CWDReGMZ.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/mod.cjs

@@ -1,7 +1,7 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-o8l4QeUY.cjs");
-const require_portable_collection = require("../portable-collection-DXogVs__.cjs");
+const require_http = require("../http-DSYQQn23.cjs");
+const require_portable_collection = require("../portable-collection-BD8fE3j3.cjs");
 exports.attachSignature = require_http.attachSignature;
 exports.createProof = require_http.createProof;
 exports.createSignature = require_http.createSignature;

package/dist/sig/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-D76Py0M4.cjs";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-CjezPjFX.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BF0L9cMt.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-Byt5tvAS.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-S--JxYjo.cjs";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-BrQgkJay.js";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-C-x_OLSp.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BSzr5-I8.js";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-Co53r-VP.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-Bz9tFXI2.js";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.js

@@ -1,5 +1,5 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { B as generateCryptoKeyPair, I as exportJwk, N as verifyJsonLd, O as hasSignatureLike, P as verifySignature, R as fetchKey, S as attachSignature, T as detachSignature, V as importJwk, a as signRequest, ct as formatAcceptSignature, d as hasProofLike, dt as validateAcceptSignature, f as signObject, h as verifyPortableObjectProof, j as signJsonLd, lt as fulfillAcceptSignature, m as verifyObject, o as verifyRequest, s as verifyRequestDetailed, u as createProof, ut as parseAcceptSignature, v as verifyProof, w as createSignature, z as fetchKeyDetailed } from "../http-Rmbiu-5S.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-DdXsKBg4.js";
+import { B as fetchKeyDetailed, C as attachSignature, E as detachSignature, F as verifySignature, H as importJwk, L as exportJwk, M as signJsonLd, P as verifyJsonLd, T as createSignature, V as generateCryptoKeyPair, a as signRequest, d as createProof, dt as parseAcceptSignature, f as hasProofLike, ft as validateAcceptSignature, g as verifyPortableObjectProof, h as verifyObject, k as hasSignatureLike, lt as formatAcceptSignature, o as verifyRequest, p as signObject, s as verifyRequestDetailed, ut as fulfillAcceptSignature, y as verifyProof, z as fetchKey } from "../http-D4KW2GTi.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-CG9P_i0E.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-CCfdL83M.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-CgoCOTUQ.mjs";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/owner.test.ts

package/dist/sig/portable-collection.test.mjs

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { t as verifyPortableObject } from "../portable-collection-WXaHkNqC.mjs";
+import { t as verifyPortableObject } from "../portable-collection-0_5DyXMt.mjs";
 import { Collection, CollectionPage, Note, OrderedCollection, Person, traverseCollection } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 import { FetchError, encodeMultibase, exportDidKey, preloadedContexts } from "@fedify/vocab-runtime";