@fedify/fedify 2.4.0-dev.2127 → 2.4.0-dev.2141

package/dist/sig/portable-key.test.mjs

@@ -2,12 +2,12 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
-import { i as fetchKey } from "../key-Cc1b6pW9.mjs";
-import { h as verifyJsonLd, p as signJsonLd } from "../ld-DQNTIrAe.mjs";
-import { n as createProof, u as verifyProof } from "../proof-CW8k0R1G.mjs";
-import { d as verifyRequest, f as verifyRequestDetailed, l as signRequest } from "../http-BFeK9sBg.mjs";
+import { i as fetchKey } from "../key-C0giKuki.mjs";
+import { h as verifyJsonLd, p as signJsonLd } from "../ld-CWDReGMZ.mjs";
+import { n as createProof, u as verifyProof } from "../proof-B5s-W6Sm.mjs";
+import { d as verifyRequest, f as verifyRequestDetailed, l as signRequest } from "../http-CEx2SZjf.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-CCfdL83M.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-CgoCOTUQ.mjs";
 import { t as KvKeyCache } from "../keycache-BInaECGj.mjs";
 import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
@@ -715,5 +715,479 @@ test("verifyRequest() binds gateway keys to the actor whose document is signed",
 		contextLoader: shiftingContextLoader
 	}), null);
 });
+test("verifyRequest() matches gateway keys listed under ap: URIs", async () => {
+	const portableKeyId = parseIri(`${actorId}#main-key`);
+	const cases = {
+		"both properties": await actorJson({ key: portableKeyId }),
+		"assertionMethod only": await actorJson({
+			key: portableKeyId,
+			publicKey: null
+		}),
+		"publicKey only": await actorJson({
+			key: portableKeyId,
+			assertionMethod: false
+		})
+	};
+	for (const [name, document] of Object.entries(cases)) {
+		const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(document) });
+		for (const spec of specs) {
+			const key = await verifyRequest(await signedRequest(spec), {
+				documentLoader,
+				contextLoader,
+				spec
+			});
+			strictEqual(key?.id?.href, keyId.href, `${name}, ${spec}`);
+			strictEqual(key?.ownerId?.href, parseIri(actorId).href, name);
+		}
+	}
+});
+test("verifyRequest() rejects ambiguous or foreign aliases of gateway keys", async () => {
+	const portableKeyId = `${actorId}#main-key`;
+	const base = await actorJson();
+	const assertionMethod = base.assertionMethod;
+	const publicKey = base.publicKey;
+	const cases = {
+		"an exact entry and an ap: alias in assertionMethod": {
+			...base,
+			assertionMethod: [assertionMethod, {
+				...assertionMethod,
+				id: portableKeyId
+			}]
+		},
+		"a reference and an embedded ap: alias in assertionMethod": {
+			...base,
+			assertionMethod: [keyId.href, {
+				...assertionMethod,
+				id: portableKeyId
+			}]
+		},
+		"an exact entry and an ap: alias in publicKey": {
+			...base,
+			publicKey: [publicKey, {
+				...publicKey,
+				id: portableKeyId
+			}]
+		},
+		"a key of another gateway": await actorJson({ key: new URL(`${compatibleId(gw2)}#main-key`) }),
+		"an ap: key ID with dot segments": {
+			...base,
+			assertionMethod: {
+				...assertionMethod,
+				id: portableKeyId.replace("/actor#", "/x/../actor#")
+			},
+			publicKey: {
+				...publicKey,
+				id: portableKeyId.replace("/actor#", "/x/../actor#")
+			}
+		},
+		"a compatible key ID with dot segments": {
+			...base,
+			assertionMethod: {
+				...assertionMethod,
+				id: keyId.href.replace("/actor#", "/x/../actor#")
+			},
+			publicKey: {
+				...publicKey,
+				id: keyId.href.replace("/actor#", "/x/../actor#")
+			}
+		}
+	};
+	for (const [name, document] of Object.entries(cases)) {
+		const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(document) });
+		strictEqual(await verifyRequest(await signedRequest(), {
+			documentLoader,
+			contextLoader
+		}), null, name);
+	}
+});
+test("verifyRequest() refuses key IDs whose identity URL parsing changes", async () => {
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await actorJson()) });
+	const request = await signedRequest("draft-cavage-http-signatures-12");
+	const dotted = keyId.href.replace("/actor#", "/x/../actor#");
+	const headers = new Headers(request.headers);
+	headers.set("Signature", headers.get("Signature").replace(keyId.href, dotted));
+	strictEqual(await verifyRequest(new Request(request, { headers }), {
+		documentLoader,
+		contextLoader
+	}), null);
+	strictEqual(documentLoader.fetched.length, 0);
+	const dottedPortable = `${actorId.replace("/actor", "/x/../actor")}#main-key`;
+	for (const id of [
+		dotted,
+		dottedPortable,
+		` ${dotted}`,
+		` ${dottedPortable}`,
+		` ${parseIri(dottedPortable).href}`,
+		dottedPortable.replace("ap+ef61:", "ap+	ef61:"),
+		dotted.replace("did:key:", "did:ke	y:"),
+		`${gw1}/.well-known/apgateway/${did}/../../../users/alice#main-key`,
+		` ap://not-a-did/actor#main-key`
+	]) {
+		let error;
+		try {
+			await fetchKey(id, CryptographicKey, {
+				documentLoader,
+				contextLoader
+			});
+		} catch (e) {
+			error = e;
+		}
+		ok(error instanceof TypeError, id);
+	}
+});
+const apKeyId = parseIri(`${actorId}#main-key`);
+function hinted(...gateways) {
+	const query = gateways.map((g) => `@gateway=${encodeURIComponent(g)}`).join("&");
+	return parseIri(`${actorId}${query === "" ? "" : `?${query}`}#main-key`);
+}
+async function apActorJson(options = {}) {
+	return await actorJson({
+		key: apKeyId,
+		...options
+	});
+}
+test("verifyRequest() accepts keys of portable actors at ap: key IDs", async () => {
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await apActorJson()) });
+	const hintedKeyId = hinted(gw1);
+	for (const spec of specs) {
+		const key = await verifyRequest(await signedRequest(spec, hintedKeyId), {
+			documentLoader,
+			contextLoader,
+			spec
+		});
+		ok(key != null, spec);
+		strictEqual(key.id?.href, hintedKeyId.href, spec);
+		strictEqual(key.ownerId?.href, parseIri(actorId).href, spec);
+	}
+	const raw = `ap://${did}/actor?@gateway=${encodeURIComponent(gw1)}#main-key`;
+	for (const written of [raw, raw.replace(/^ap:/, "ap+ef61:")]) {
+		const request = await signedRequest("draft-cavage-http-signatures-12", hintedKeyId);
+		const headers = new Headers(request.headers);
+		headers.set("Signature", headers.get("Signature").replace(hintedKeyId.href, written));
+		strictEqual((await verifyRequest(new Request(request, { headers }), {
+			documentLoader,
+			contextLoader
+		}))?.ownerId?.href, parseIri(actorId).href, written);
+	}
+	deepStrictEqual([...new Set(documentLoader.fetched)], [compatibleId(gw1)]);
+});
+test("verifyRequest() asks the document loader for ap: key IDs without hints", async () => {
+	const documentLoader = createLoader({ [actorId]: await sign(await apActorJson()) });
+	strictEqual((await verifyRequest(await signedRequest(void 0, apKeyId), {
+		documentLoader,
+		contextLoader
+	}))?.ownerId?.href, parseIri(actorId).href);
+	deepStrictEqual(documentLoader.fetched, [actorId]);
+	const result = await verifyRequestDetailed(await signedRequest(void 0, apKeyId), {
+		documentLoader: createLoader({}),
+		contextLoader
+	});
+	ok(!result.verified);
+	strictEqual(result.reason.type, "keyFetchError");
+});
+test("verifyRequest() rejects keys at ap: key IDs that portable actors do not vouch for", async () => {
+	const unsigned = await apActorJson();
+	const ordinaryActorId = "https://gw1.example/users/alice";
+	const cases = {
+		"an unsigned actor document": unsigned,
+		"an actor document signed by another DID": await sign(unsigned, otherKeyPair.privateKey, `${otherDid}#${otherDid.slice(8)}`),
+		"a key missing from both assertionMethod and publicKey": await sign(await apActorJson({
+			assertionMethod: false,
+			publicKey: null
+		})),
+		"a key referred to by URL": await sign({
+			...await apActorJson({
+				publicKey: null,
+				assertionMethod: false
+			}),
+			assertionMethod: [apKeyId.href]
+		}),
+		"a key only in publicKey without an owner": await sign(withoutPublicKeyOwner(await apActorJson({ assertionMethod: false }))),
+		"a publicKey entry with other key material": await sign(await apActorJson({ publicKey: rsaPublicKey3.publicKey })),
+		"a key only at a compatible identifier": await sign(await actorJson()),
+		"an actor without gateways": await sign(await apActorJson({ gateways: [] })),
+		"the document of another actor": await sign(await apActorJson({ id: `${actorId}/other` })),
+		"an ordinary actor": await actorJson({
+			id: ordinaryActorId,
+			key: apKeyId
+		}),
+		"a standalone key": {
+			"@context": "https://w3id.org/security/v1",
+			id: apKeyId.href,
+			type: "Key",
+			owner: actorId,
+			publicKeyPem: await exportSpki(gatewayPublicKey)
+		}
+	};
+	for (const [name, document] of Object.entries(cases)) {
+		const documentLoader = createLoader({ [compatibleId(gw1)]: document });
+		strictEqual(await verifyRequest(await signedRequest(void 0, hinted(gw1)), {
+			documentLoader,
+			contextLoader
+		}), null, name);
+	}
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await apActorJson()) });
+	strictEqual(await verifyRequest(await signedRequest(void 0, parseIri(`${actorId}?@gateway=${encodeURIComponent(gw1)}`)), {
+		documentLoader,
+		contextLoader
+	}), null);
+	strictEqual(documentLoader.fetched.length, 0);
+});
+test("verifyRequest() tries the gateways of ap: key IDs in order", async () => {
+	const signed = await sign(await apActorJson());
+	const cases = {
+		"an invalid document at the first gateway": {
+			[compatibleId(gw1)]: await apActorJson(),
+			[compatibleId(gw2)]: signed
+		},
+		"an unreachable first gateway": { [compatibleId(gw2)]: signed }
+	};
+	for (const [name, responses] of Object.entries(cases)) {
+		const documentLoader = createLoader(responses);
+		strictEqual((await verifyRequest(await signedRequest(void 0, hinted(gw1, gw2)), {
+			documentLoader,
+			contextLoader
+		}))?.ownerId?.href, parseIri(actorId).href, name);
+		deepStrictEqual(documentLoader.fetched, [compatibleId(gw1), compatibleId(gw2)], name);
+	}
+	const documentLoader = createLoader({
+		[compatibleId(gw1)]: signed,
+		[compatibleId(gw2)]: signed
+	});
+	ok(await verifyRequest(await signedRequest(void 0, hinted(gw1, gw2)), {
+		documentLoader,
+		contextLoader
+	}) != null);
+	deepStrictEqual(documentLoader.fetched, [compatibleId(gw1)]);
+	const gateways = Array.from({ length: 7 }, (_, i) => `https://gw${i + 10}.example`);
+	const many = createLoader({});
+	ok(!(await verifyRequestDetailed(await signedRequest(void 0, hinted(...gateways)), {
+		documentLoader: many,
+		contextLoader
+	})).verified);
+	deepStrictEqual(many.fetched, gateways.slice(0, 5).map((g) => compatibleId(g)));
+});
+function failingLoader(responses) {
+	const fetched = [];
+	const loader = (url) => {
+		fetched.push(url);
+		const response = responses[url.replace(/#.*$/, "")] ?? 404;
+		if (typeof response === "number") return Promise.reject(new FetchError(url, `HTTP ${response}`, new Response(null, { status: response })));
+		return Promise.resolve({
+			contextUrl: null,
+			documentUrl: url,
+			document: structuredClone(response)
+		});
+	};
+	return Object.assign(loader, { fetched });
+}
+test("verifyRequest() reports why keys at ap: key IDs could not be looked up", async () => {
+	const hintedKeyId = hinted(gw1, gw2);
+	const invalid = await apActorJson();
+	const cases = [
+		{
+			name: "every gateway serves an invalid document",
+			responses: {
+				[compatibleId(gw1)]: invalid,
+				[compatibleId(gw2)]: invalid
+			},
+			reason: "invalidSignature",
+			cached: true
+		},
+		{
+			name: "every gateway responds with 410 Gone",
+			responses: {
+				[compatibleId(gw1)]: 410,
+				[compatibleId(gw2)]: 410
+			},
+			reason: "keyFetchError",
+			status: 410,
+			cached: true
+		},
+		{
+			name: "the gateways respond with different statuses",
+			responses: {
+				[compatibleId(gw1)]: 404,
+				[compatibleId(gw2)]: 503
+			},
+			reason: "keyFetchError",
+			cached: true
+		},
+		{
+			name: "one gateway serves an invalid document, the other is gone",
+			responses: {
+				[compatibleId(gw1)]: invalid,
+				[compatibleId(gw2)]: 410
+			},
+			reason: "keyFetchError",
+			cached: false
+		}
+	];
+	for (const { name, responses, reason, status, cached } of cases) for (const spec of specs) {
+		const documentLoader = failingLoader(responses);
+		const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+		const options = {
+			documentLoader,
+			contextLoader,
+			keyCache,
+			spec
+		};
+		for (let i = 0; i < 2; i++) {
+			const result = await verifyRequestDetailed(await signedRequest(spec, hintedKeyId), options);
+			ok(!result.verified, `${name}, ${spec}`);
+			strictEqual(result.reason.type, reason, `${name}, ${spec}`);
+			if (result.reason.type === "keyFetchError") strictEqual("status" in result.reason.result ? result.reason.result.status : void 0, status, `${name}, ${spec}`);
+		}
+		strictEqual(documentLoader.fetched.length, cached ? 2 : 4, `${name}, ${spec}`);
+	}
+});
+test("verifyRequest() accepts keys at ap: key IDs only for HTTP Signatures", async () => {
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await apActorJson()) });
+	const hintedKeyId = hinted(gw1);
+	const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+	const options = {
+		documentLoader,
+		contextLoader,
+		keyCache
+	};
+	for (const cls of [CryptographicKey, Multikey]) strictEqual((cls === CryptographicKey ? await fetchKey(hintedKeyId, CryptographicKey, options) : await fetchKey(hintedKeyId, Multikey, options)).key, null);
+	strictEqual(documentLoader.fetched.length, 0);
+	for (let i = 0; i < 3; i++) {
+		const key = await verifyRequest(await signedRequest(void 0, hintedKeyId), options);
+		strictEqual(key?.id?.href, hintedKeyId.href);
+		strictEqual(key?.ownerId?.href, parseIri(actorId).href);
+	}
+	strictEqual(documentLoader.fetched.length, 1);
+	for (const cls of [CryptographicKey, Multikey]) strictEqual((cls === CryptographicKey ? await fetchKey(hintedKeyId, CryptographicKey, options) : await fetchKey(hintedKeyId, Multikey, options)).key, null);
+	const document = {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		type: "Create",
+		id: "https://gw1.example/activities/1",
+		actor: compatibleId(gw1)
+	};
+	const { signature } = await signJsonLd(document, rsaPrivateKey2, hintedKeyId, { contextLoader });
+	ok(!await verifyJsonLd({
+		...document,
+		signature
+	}, options));
+	strictEqual(documentLoader.fetched.length, 1);
+	const legacyCache = {
+		get: () => Promise.resolve(new CryptographicKey({
+			id: hintedKeyId,
+			owner: parseIri(actorId),
+			publicKey: gatewayPublicKey
+		})),
+		set: () => Promise.resolve()
+	};
+	const empty = createLoader({});
+	strictEqual(await verifyRequest(await signedRequest(void 0, hintedKeyId), {
+		documentLoader: empty,
+		contextLoader,
+		keyCache: legacyCache
+	}), null);
+	strictEqual(empty.fetched.length, 1);
+});
+test("verifyRequest() refreshes a cached key at an ap: key ID that fails to verify", async () => {
+	for (const spec of specs) {
+		const responses = { [compatibleId(gw1)]: await sign(await apActorJson()) };
+		const documentLoader = failingLoader(responses);
+		const hintedKeyId = hinted(gw1, gw2);
+		const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"]);
+		const options = {
+			documentLoader,
+			contextLoader,
+			keyCache,
+			spec
+		};
+		ok(await verifyRequest(await signedRequest(spec, hintedKeyId), options) != null);
+		strictEqual(documentLoader.fetched.length, 1, spec);
+		responses[compatibleId(gw1)] = await apActorJson();
+		responses[compatibleId(gw2)] = 503;
+		ok(!(await verifyRequestDetailed(await signRequest(new Request("https://recipient.example/inbox", {
+			method: "POST",
+			body: "{}",
+			headers: { "Content-Type": "application/activity+json" }
+		}), rsaPrivateKey3, hintedKeyId, { spec }), options)).verified, spec);
+		strictEqual(documentLoader.fetched.length, 3, spec);
+		const next = await verifyRequestDetailed(await signedRequest(spec, hintedKeyId), options);
+		ok(!next.verified, spec);
+		strictEqual(next.reason.type, "keyFetchError", spec);
+		strictEqual(documentLoader.fetched.length, 5, spec);
+	}
+});
+test("doesActorOwnKey() and getKeyOwner() resolve keys at ap: key IDs to portable actors", async () => {
+	const options = {
+		documentLoader: createLoader({ [compatibleId(gw1)]: await sign(await apActorJson()) }),
+		contextLoader
+	};
+	const hintedKeyId = hinted(gw1);
+	const key = new CryptographicKey({
+		id: hintedKeyId,
+		owner: parseIri(actorId),
+		publicKey: gatewayPublicKey
+	});
+	const activity = new Create({
+		id: parseIri(`${actorId.replace("/actor", "")}/activities/1`),
+		actor: parseIri(`ap://${did}/actor`)
+	});
+	ok(await doesActorOwnKey(activity, key, options));
+	strictEqual((await getKeyOwner(hintedKeyId, options))?.id?.href, parseIri(actorId).href);
+	strictEqual((await getKeyOwner(key, options))?.id?.href, parseIri(actorId).href);
+	ok(!await doesActorOwnKey(new Create({
+		id: parseIri(`ap+ef61://${otherDid}/activities/1`),
+		actor: parseIri(`ap+ef61://${otherDid}/actor`)
+	}), key, options));
+	const other = key.clone({ publicKey: rsaPublicKey3.publicKey });
+	ok(!await doesActorOwnKey(activity, other, options));
+	strictEqual(await getKeyOwner(other, options), null);
+	const unsigned = {
+		documentLoader: createLoader({ [compatibleId(gw1)]: await apActorJson() }),
+		contextLoader
+	};
+	ok(!await doesActorOwnKey(activity, key, unsigned));
+	strictEqual(await getKeyOwner(hintedKeyId, unsigned), null);
+});
+test("verifyRequest() does not trust a cached key at an ap: key ID for longer than its proof", async () => {
+	let now = Temporal.Now.instant();
+	const keyCache = new KvKeyCache(new MemoryKvStore(), ["pk"], { now: () => now });
+	const expires = now.add({ minutes: 30 });
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await apActorJson(), ed25519PrivateKey, didKeyId, { expires: expires.toString() }) });
+	const options = {
+		documentLoader,
+		contextLoader,
+		keyCache
+	};
+	const hintedKeyId = hinted(gw1);
+	ok(await verifyRequest(await signedRequest(void 0, hintedKeyId), options) != null);
+	now = expires.subtract({ seconds: 1 });
+	ok(await verifyRequest(await signedRequest(void 0, hintedKeyId), options) != null);
+	strictEqual(documentLoader.fetched.length, 1);
+	now = expires;
+	ok(await verifyRequest(await signedRequest(void 0, hintedKeyId), options) != null);
+	strictEqual(documentLoader.fetched.length, 2);
+});
+test("verifyRequest() does not cache keys at ap: key IDs it could not process", async () => {
+	let failures = 1;
+	const flakyContextLoader = (url, options) => {
+		if (failures > 0) {
+			failures--;
+			return Promise.reject(/* @__PURE__ */ new Error(`Temporarily failed to load ${url}`));
+		}
+		return contextLoader(url, options);
+	};
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await apActorJson()) });
+	const options = {
+		documentLoader,
+		contextLoader: flakyContextLoader,
+		keyCache: new KvKeyCache(new MemoryKvStore(), ["pk"])
+	};
+	const hintedKeyId = hinted(gw1);
+	const result = await verifyRequestDetailed(await signedRequest(void 0, hintedKeyId), options);
+	ok(!result.verified);
+	strictEqual(result.reason.type, "keyFetchError");
+	if (result.reason.type === "keyFetchError") ok(!("status" in result.reason.result));
+	strictEqual((await verifyRequest(await signedRequest(void 0, hintedKeyId), options))?.ownerId?.href, parseIri(actorId).href);
+	strictEqual(documentLoader.fetched.length, 2);
+});
 //#endregion
 export {};

package/dist/sig/proof.test.mjs

@@ -10,10 +10,10 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { i as signObject, n as createProof, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, u as verifyProof } from "../proof-CW8k0R1G.mjs";
-import { d as verifyRequest } from "../http-BFeK9sBg.mjs";
+import { i as signObject, n as createProof, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, u as verifyProof } from "../proof-B5s-W6Sm.mjs";
+import { d as verifyRequest } from "../http-CEx2SZjf.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-Dtuyb0ps.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-B5BIo7e9.mjs";
 import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place, Translation } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";
@@ -1655,6 +1655,48 @@ test("verifyObject() hydrates pending proof references", async () => {
 	assertEquals(proofFetches, 1);
 	assertInstanceOf(verified, Note);
 });
+test("verifyObject() does not pass its proof verifier on to cached proofs", async () => {
+	const did = await exportDidKey(ed25519PublicKey.publicKey);
+	const method = did.substring(8);
+	const keyId = new URL(`${did}#${method}`);
+	const proofUrl = `ap://did:key:${method}/proofs/1`;
+	const signed = await signPortableJsonLd({
+		"@context": portableContext,
+		id: `ap://did:key:${method}/objects/1`,
+		type: "Note",
+		attributedTo: `ap://did:key:${method}/actor`,
+		content: "Portable note with a referenced proof"
+	}, {
+		verificationMethod: keyId,
+		proofOptions: { id: proofUrl }
+	});
+	const rawProof = signed.proof;
+	const referencedJsonLd = { ...signed };
+	delete referencedJsonLd.proof;
+	referencedJsonLd["https://w3id.org/security#proof"] = [{ "@graph": [rawProof] }, { "@graph": [{ "@id": proofUrl }] }];
+	const rootVerifier = async () => ({ verified: false });
+	for (const verifyPortableObject of [void 0, rootVerifier]) {
+		let proofFetches = 0;
+		const verified = await verifyObject(Note, referencedJsonLd, {
+			documentLoader(url) {
+				proofFetches++;
+				return Promise.resolve({
+					contextUrl: null,
+					document: structuredClone(rawProof),
+					documentUrl: url
+				});
+			},
+			contextLoader: mockDocumentLoader,
+			...verifyPortableObject == null ? {} : { verifyPortableObject }
+		});
+		assertInstanceOf(verified, Note);
+		assertEquals(proofFetches, 1);
+		const proofs = await Array.fromAsync(verified.getProofs());
+		assertEquals(proofs.length, 2);
+		assertEquals(proofFetches, 1);
+		for (const proof of proofs) assert(proof._verifyPortableObject === verifyPortableObject);
+	}
+});
 test("verifyObject() hydrates portable proof references with gateway hints", async () => {
 	const did = await exportDidKey(ed25519PublicKey.publicKey);
 	const method = did.substring(8);

package/dist/{temporal-CffY_XOJ.mjs → temporal-BkCPJ_uC.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-DQNTIrAe.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CWDReGMZ.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/kv.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
-import { o as createFederation } from "../middleware-BdhvduR9.mjs";
+import { o as createFederation } from "../middleware-CAWRGSwH.mjs";
 //#region src/testing/kv.test.ts
 test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
 	const kv = new ManualClockKvStore();

package/dist/testing/mod.d.mts

@@ -2891,8 +2891,9 @@ interface Context<TContextData> {
    * property accessors, `lookupObject()`, and `traverseCollection()`, passing
    * a context as their options applies the policy, e.g.,
    * `await create.getObject(ctx)`.  Objects parsed with a context as options,
-   * such as activities that inboxes receive, also use it by default for
-   * their property accessors.  It never verifies an object by itself being
+   * such as activities that inboxes receive, and objects that accessors
+   * fetch with a context as options also use it by default for their
+   * property accessors.  It never verifies an object by itself being
    * there: it only applies to objects that are dereferenced.
    *
    * It is optional only so that custom implementations of this interface

package/dist/utils/docloader.test.mjs

@@ -5,9 +5,9 @@ import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { d as verifyRequest } from "../http-BFeK9sBg.mjs";
+import { d as verifyRequest } from "../http-CEx2SZjf.mjs";
 import { i as rsaPrivateKey2 } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-Dtuyb0ps.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-B5BIo7e9.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";

package/dist/utils/kv-cache.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-tLKBfxHc.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-AWTrxTq3.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { preloadedContexts } from "@fedify/vocab-runtime";

package/dist/utils/mod.cjs

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-BUkgZAcX.cjs");
+const require_kv_cache = require("../kv-cache-BcsvaCCL.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.d.cts

@@ -1,3 +1,3 @@
 /// <reference lib="esnext.temporal" />
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-Cr79cQlc.cjs";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-D4g9ffEn.cjs";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.d.ts

@@ -1,3 +1,3 @@
 /// <reference lib="esnext.temporal" />
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-Cwdt_CWU.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-CZetqT5h.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-BweDce2I.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-D_E-2K3i.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "2.4.0-dev.2127+c41ce2eb",
+  "version": "2.4.0-dev.2141+881cc858",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",
@@ -151,10 +151,10 @@
     "structured-field-values": "^2.0.4",
     "temporal-polyfill": "^1.0.1",
     "urlpattern-polyfill": "^10.1.0",
-    "@fedify/vocab-runtime": "2.4.0-dev.2127+c41ce2eb",
-    "@fedify/vocab": "2.4.0-dev.2127+c41ce2eb",
-    "@fedify/uri-template": "2.4.0-dev.2127+c41ce2eb",
-    "@fedify/webfinger": "2.4.0-dev.2127+c41ce2eb"
+    "@fedify/uri-template": "2.4.0-dev.2141+881cc858",
+    "@fedify/vocab": "2.4.0-dev.2141+881cc858",
+    "@fedify/vocab-runtime": "2.4.0-dev.2141+881cc858",
+    "@fedify/webfinger": "2.4.0-dev.2141+881cc858"
   },
   "devDependencies": {
     "@std/assert": "npm:@jsr/std__assert@^0.226.0",
@@ -167,7 +167,7 @@
     "typescript": "^6.0.0",
     "wrangler": "^4.17.0",
     "@fedify/fixture": "2.0.0",
-    "@fedify/vocab-tools": "^2.4.0-dev.2127+c41ce2eb"
+    "@fedify/vocab-tools": "^2.4.0-dev.2141+881cc858"
   },
   "scripts": {
     "build:self": "tsdown",