@fedify/fedify 2.4.0-dev.2129 → 2.4.0-dev.2141

package/dist/sig/compound-proof-verification.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as verifyMapLocalProof, c as verifyPortableObjectProofPolicy } from "../proof-B4_0E-KU.mjs";
+import { a as verifyMapLocalProof, c as verifyPortableObjectProofPolicy } from "../proof-B5s-W6Sm.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-D9Kljk_7.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-D0H4LLvQ.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { CryptographicKey, Multikey, Person } from "@fedify/vocab";
@@ -618,5 +618,199 @@ test("verifyCompoundPortableObjectProofs() exempts only keys of the parent itsel
 		assert(result.portableObjects.some((o) => o.path !== "" && !o.verified), name);
 	}
 });
+/**
+* Rewrites the IDs of a {@link compatibleActor}'s keys as they are written,
+* e.g., as `ap:` URIs, which the serializer would canonicalize otherwise.
+*/
+function withKeyIds(actor, keyBase, { id = actor.id, owner = id } = {}) {
+	const [multikey] = actor.assertionMethod;
+	return {
+		...actor,
+		id,
+		publicKey: {
+			...asRecord(actor.publicKey),
+			id: `${keyBase}#main-key`,
+			owner
+		},
+		assertionMethod: [{
+			...multikey,
+			id: `${keyBase}#ed25519-key`,
+			controller: owner
+		}]
+	};
+}
+const apActorId = `ap://${compatibleDid}/actor`;
+test("verifyCompoundPortableObjectProofs() exempts keys at ap: URIs embedded in portable actors", async () => {
+	const actor = await compatibleActor();
+	const encodedDid = encodeURIComponent(compatibleDid);
+	const cases = {
+		"ap: keys of an ap: actor": [apActorId, apActorId],
+		"ap: keys of a compatible-ID actor": [compatibleActorId, apActorId],
+		"ap+ef61: keys": [apActorId, `ap+ef61://${compatibleDid}/actor`],
+		"keys with percent-encoded DIDs": [apActorId, `ap://${encodedDid}/actor`],
+		"ap+ef61: keys of a percent-encoded actor": [`ap+ef61://${encodedDid}/actor`, `ap+ef61://${encodedDid}/actor`],
+		"keys with an uppercase scheme": [apActorId, `AP://${compatibleDid}/actor`],
+		"keys with location hints": [apActorId, `${apActorId}?@gateway=https%3A%2F%2Fgw.example`]
+	};
+	for (const [name, [id, keyBase]] of Object.entries(cases)) {
+		const result = await verifyCompoundPortableObjectProofs(await signCompatible(withKeyIds(actor, keyBase, { id })), limits, options);
+		assert(result.status === "ok", name);
+		assert(result.verified, name);
+		assertEquals(result.portableObjects.map((o) => o.path), [""], name);
+	}
+	const apActor = withKeyIds(actor, apActorId, { id: apActorId });
+	const atIdKeys = (key) => {
+		const { id, ...rest } = asRecord(key);
+		return {
+			...rest,
+			"@id": id
+		};
+	};
+	const withAtIds = await verifyCompoundPortableObjectProofs(await signCompatible({
+		...apActor,
+		publicKey: atIdKeys(apActor.publicKey),
+		assertionMethod: apActor.assertionMethod.map(atIdKeys)
+	}), limits, options);
+	assert(withAtIds.status === "ok");
+	assert(withAtIds.verified);
+	assertEquals(withAtIds.portableObjects.map((o) => o.path), [""]);
+	const withApTerm = await verifyCompoundPortableObjectProofs(await signCompatible({
+		...withKeyIds(actor, apActorId, { id: apActorId }),
+		"@context": [...actor["@context"], { ap: "https://ap.example/" }]
+	}), limits, options);
+	assert(withApTerm.status === "ok");
+	assert(withApTerm.verified);
+	assertEquals(withApTerm.portableObjects.map((o) => o.path), [""]);
+	const result = await verifyCompoundPortableObjectProofs(await signCompatible({
+		"@context": [...compatibleContext],
+		id: `ap://${compatibleDid}/activities/1`,
+		type: "Update",
+		actor: apActorId,
+		object: await signCompatible(withKeyIds(actor, apActorId, { id: apActorId }))
+	}), limits, options);
+	assert(result.status === "ok");
+	assert(result.verified);
+	assertEquals(result.portableObjects.map((o) => o.path), ["/object", ""]);
+});
+test("verifyCompoundPortableObjectProofs() exempts only ap: keys of the parent itself", async () => {
+	const actor = withKeyIds(await compatibleActor(), apActorId, { id: apActorId });
+	const publicKey = asRecord(actor.publicKey);
+	const otherDid = "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK";
+	const keyIds = {
+		"a key of another actor": `ap://${compatibleDid}/other#main-key`,
+		"a key of another DID": `ap://${otherDid}/actor#main-key`,
+		"a key without a fragment": apActorId,
+		"a key with an empty fragment": `${apActorId}#`,
+		"a key with dot segments": `ap://${compatibleDid}/x/../actor#main-key`,
+		"a key with encoded dot segments": `ap://${compatibleDid}/x/%2E%2E/actor#main-key`,
+		"a key with an encoded slash": `${apActorId}%2F#main-key`,
+		"a key with an encoded fragment delimiter": `${apActorId}%23main-key`,
+		"a compatible key with dot segments": `https://gw.example/.well-known/apgateway/${compatibleDid}/x/../actor#main-key`
+	};
+	const cases = {};
+	for (const [name, id] of Object.entries(keyIds)) cases[name] = {
+		...actor,
+		publicKey: {
+			...publicKey,
+			id
+		}
+	};
+	Object.assign(cases, {
+		"a key owned by another actor": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				owner: `ap://${otherDid}/actor`
+			}
+		},
+		"a key controlled by another actor": {
+			...actor,
+			assertionMethod: actor.assertionMethod.map((key) => ({
+				...key,
+				controller: `ap://${otherDid}/actor`
+			}))
+		},
+		"a key with extra content": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				name: "Extra"
+			}
+		},
+		"a key with a scoped context": {
+			...actor,
+			publicKey: {
+				...publicKey,
+				"@context": { CryptographicKey: {
+					"@id": "https://w3id.org/security#Key",
+					"@context": {}
+				} }
+			}
+		}
+	});
+	for (const [name, document] of Object.entries(cases)) {
+		const result = await verifyCompoundPortableObjectProofs(await signCompatible(document), limits, options);
+		assert(result.status === "ok", name);
+		assertEquals(result.verified, false, name);
+		assert(result.portableObjects.find((o) => o.path === "")?.verified, name);
+		assert(result.portableObjects.some((o) => o.path !== "" && !o.verified), name);
+	}
+	const conflicting = await verifyCompoundPortableObjectProofs(await signCompatible({
+		...actor,
+		publicKey: {
+			...publicKey,
+			"@id": `ap://${compatibleDid}/other#main-key`
+		}
+	}), limits, options);
+	assert(conflicting.status === "ok");
+	assertEquals(conflicting.verified, false);
+});
+test("verifyCompoundPortableObjectProofs() exempts ap: keys only of verified actors", async () => {
+	const actor = withKeyIds(await compatibleActor(), apActorId, { id: apActorId });
+	const signed = await signCompatible(actor);
+	const unverified = {
+		"": true,
+		"/object": false,
+		"/object/publicKey": false,
+		"/object/assertionMethod/0": false
+	};
+	const cases = {
+		"an unsigned actor": [actor, unverified],
+		"a tampered actor": [{
+			...signed,
+			name: "Tampered"
+		}, unverified],
+		"an actor with a key with an invalid proof": [await signCompatible({
+			...actor,
+			publicKey: {
+				...asRecord(actor.publicKey),
+				"@context": [...compatibleContext],
+				proof: asRecord(signed.proof)
+			}
+		}), {
+			"": true,
+			"/object": true,
+			"/object/publicKey": false
+		}]
+	};
+	for (const [name, [object, expected]] of Object.entries(cases)) {
+		const result = await verifyCompoundPortableObjectProofs(await signCompatible({
+			"@context": [...compatibleContext],
+			id: `ap://${compatibleDid}/activities/1`,
+			type: "Update",
+			actor: apActorId,
+			object
+		}), limits, options);
+		assert(result.status === "ok", name);
+		assertEquals(result.verified, false, name);
+		assertEquals(Object.fromEntries(result.portableObjects.map((o) => [o.path, o.verified])), expected, name);
+	}
+});
+test("verifyCompoundPortableObjectProofs() leaves keys at DID URLs alone", async () => {
+	const result = await verifyCompoundPortableObjectProofs(await signCompatible(withKeyIds(await compatibleActor(), compatibleDid, { id: apActorId })), limits, options);
+	assert(result.status === "ok");
+	assert(result.verified);
+	assertEquals(result.portableObjects.map((o) => o.path), [""]);
+});
 //#endregion
 export {};

package/dist/sig/compound-proof.test.mjs

@@ -6,9 +6,9 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { i as signObject, u as verifyProof } from "../proof-B4_0E-KU.mjs";
+import { i as signObject, u as verifyProof } from "../proof-B5s-W6Sm.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { o as verifyCompoundProofDocuments } from "../compound-proof-D9Kljk_7.mjs";
+import { o as verifyCompoundProofDocuments } from "../compound-proof-D0H4LLvQ.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";

package/dist/sig/http.test.mjs

@@ -11,8 +11,8 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as exportJwk } from "../key-DolJjJab.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-BpOiZE09.mjs";
+import { n as exportJwk } from "../key-C0giKuki.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-CEx2SZjf.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";

package/dist/sig/key.test.mjs

@@ -6,7 +6,7 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-DolJjJab.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-C0giKuki.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/ld.test.mjs

@@ -8,8 +8,8 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { o as generateCryptoKeyPair } from "../key-DolJjJab.mjs";
-import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-Dwc176V4.mjs";
+import { o as generateCryptoKeyPair } from "../key-C0giKuki.mjs";
+import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-CWDReGMZ.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/mod.cjs

@@ -1,7 +1,7 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-B1J6E-bT.cjs");
-const require_portable_collection = require("../portable-collection-PTGD0q70.cjs");
+const require_http = require("../http-DSYQQn23.cjs");
+const require_portable_collection = require("../portable-collection-BD8fE3j3.cjs");
 exports.attachSignature = require_http.attachSignature;
 exports.createProof = require_http.createProof;
 exports.createSignature = require_http.createSignature;

package/dist/sig/mod.js

@@ -1,5 +1,5 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { B as fetchKeyDetailed, C as attachSignature, E as detachSignature, F as verifySignature, H as importJwk, L as exportJwk, M as signJsonLd, P as verifyJsonLd, T as createSignature, V as generateCryptoKeyPair, a as signRequest, d as createProof, dt as parseAcceptSignature, f as hasProofLike, ft as validateAcceptSignature, g as verifyPortableObjectProof, h as verifyObject, k as hasSignatureLike, lt as formatAcceptSignature, o as verifyRequest, p as signObject, s as verifyRequestDetailed, ut as fulfillAcceptSignature, y as verifyProof, z as fetchKey } from "../http-C2M6wcs8.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-CgglAI9B.js";
+import { B as fetchKeyDetailed, C as attachSignature, E as detachSignature, F as verifySignature, H as importJwk, L as exportJwk, M as signJsonLd, P as verifyJsonLd, T as createSignature, V as generateCryptoKeyPair, a as signRequest, d as createProof, dt as parseAcceptSignature, f as hasProofLike, ft as validateAcceptSignature, g as verifyPortableObjectProof, h as verifyObject, k as hasSignatureLike, lt as formatAcceptSignature, o as verifyRequest, p as signObject, s as verifyRequestDetailed, ut as fulfillAcceptSignature, y as verifyProof, z as fetchKey } from "../http-D4KW2GTi.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-CG9P_i0E.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-BNHhwjNu.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-CgoCOTUQ.mjs";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/owner.test.ts

package/dist/sig/portable-collection.test.mjs

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { t as verifyPortableObject } from "../portable-collection-CRpTUHCY.mjs";
+import { t as verifyPortableObject } from "../portable-collection-0_5DyXMt.mjs";
 import { Collection, CollectionPage, Note, OrderedCollection, Person, traverseCollection } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 import { FetchError, encodeMultibase, exportDidKey, preloadedContexts } from "@fedify/vocab-runtime";

package/dist/sig/portable-key.test.mjs

@@ -2,12 +2,12 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
-import { i as fetchKey } from "../key-DolJjJab.mjs";
-import { h as verifyJsonLd, p as signJsonLd } from "../ld-Dwc176V4.mjs";
-import { n as createProof, u as verifyProof } from "../proof-B4_0E-KU.mjs";
-import { d as verifyRequest, f as verifyRequestDetailed, l as signRequest } from "../http-BpOiZE09.mjs";
+import { i as fetchKey } from "../key-C0giKuki.mjs";
+import { h as verifyJsonLd, p as signJsonLd } from "../ld-CWDReGMZ.mjs";
+import { n as createProof, u as verifyProof } from "../proof-B5s-W6Sm.mjs";
+import { d as verifyRequest, f as verifyRequestDetailed, l as signRequest } from "../http-CEx2SZjf.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-BNHhwjNu.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-CgoCOTUQ.mjs";
 import { t as KvKeyCache } from "../keycache-BInaECGj.mjs";
 import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";

package/dist/sig/proof.test.mjs

@@ -10,10 +10,10 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { i as signObject, n as createProof, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, u as verifyProof } from "../proof-B4_0E-KU.mjs";
-import { d as verifyRequest } from "../http-BpOiZE09.mjs";
+import { i as signObject, n as createProof, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, u as verifyProof } from "../proof-B5s-W6Sm.mjs";
+import { d as verifyRequest } from "../http-CEx2SZjf.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-BbS0rO-Y.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-B5BIo7e9.mjs";
 import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place, Translation } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";
@@ -1655,6 +1655,48 @@ test("verifyObject() hydrates pending proof references", async () => {
 	assertEquals(proofFetches, 1);
 	assertInstanceOf(verified, Note);
 });
+test("verifyObject() does not pass its proof verifier on to cached proofs", async () => {
+	const did = await exportDidKey(ed25519PublicKey.publicKey);
+	const method = did.substring(8);
+	const keyId = new URL(`${did}#${method}`);
+	const proofUrl = `ap://did:key:${method}/proofs/1`;
+	const signed = await signPortableJsonLd({
+		"@context": portableContext,
+		id: `ap://did:key:${method}/objects/1`,
+		type: "Note",
+		attributedTo: `ap://did:key:${method}/actor`,
+		content: "Portable note with a referenced proof"
+	}, {
+		verificationMethod: keyId,
+		proofOptions: { id: proofUrl }
+	});
+	const rawProof = signed.proof;
+	const referencedJsonLd = { ...signed };
+	delete referencedJsonLd.proof;
+	referencedJsonLd["https://w3id.org/security#proof"] = [{ "@graph": [rawProof] }, { "@graph": [{ "@id": proofUrl }] }];
+	const rootVerifier = async () => ({ verified: false });
+	for (const verifyPortableObject of [void 0, rootVerifier]) {
+		let proofFetches = 0;
+		const verified = await verifyObject(Note, referencedJsonLd, {
+			documentLoader(url) {
+				proofFetches++;
+				return Promise.resolve({
+					contextUrl: null,
+					document: structuredClone(rawProof),
+					documentUrl: url
+				});
+			},
+			contextLoader: mockDocumentLoader,
+			...verifyPortableObject == null ? {} : { verifyPortableObject }
+		});
+		assertInstanceOf(verified, Note);
+		assertEquals(proofFetches, 1);
+		const proofs = await Array.fromAsync(verified.getProofs());
+		assertEquals(proofs.length, 2);
+		assertEquals(proofFetches, 1);
+		for (const proof of proofs) assert(proof._verifyPortableObject === verifyPortableObject);
+	}
+});
 test("verifyObject() hydrates portable proof references with gateway hints", async () => {
 	const did = await exportDidKey(ed25519PublicKey.publicKey);
 	const method = did.substring(8);

package/dist/{temporal-78JVR3GK.mjs → temporal-BkCPJ_uC.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-Dwc176V4.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CWDReGMZ.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/kv.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
-import { o as createFederation } from "../middleware-DN3MdTDg.mjs";
+import { o as createFederation } from "../middleware-CAWRGSwH.mjs";
 //#region src/testing/kv.test.ts
 test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
 	const kv = new ManualClockKvStore();

package/dist/testing/mod.d.mts

@@ -2891,8 +2891,9 @@ interface Context<TContextData> {
    * property accessors, `lookupObject()`, and `traverseCollection()`, passing
    * a context as their options applies the policy, e.g.,
    * `await create.getObject(ctx)`.  Objects parsed with a context as options,
-   * such as activities that inboxes receive, also use it by default for
-   * their property accessors.  It never verifies an object by itself being
+   * such as activities that inboxes receive, and objects that accessors
+   * fetch with a context as options also use it by default for their
+   * property accessors.  It never verifies an object by itself being
    * there: it only applies to objects that are dereferenced.
    *
    * It is optional only so that custom implementations of this interface

package/dist/utils/docloader.test.mjs

@@ -5,9 +5,9 @@ import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { d as verifyRequest } from "../http-BpOiZE09.mjs";
+import { d as verifyRequest } from "../http-CEx2SZjf.mjs";
 import { i as rsaPrivateKey2 } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-BbS0rO-Y.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-B5BIo7e9.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";

package/dist/utils/kv-cache.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-Bq2cah0c.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-AWTrxTq3.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { preloadedContexts } from "@fedify/vocab-runtime";

package/dist/utils/mod.cjs

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-D9nRbG2Q.cjs");
+const require_kv_cache = require("../kv-cache-BcsvaCCL.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-D7TiyMxv.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-D_E-2K3i.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "2.4.0-dev.2129+c0ddb433",
+  "version": "2.4.0-dev.2141+881cc858",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",
@@ -151,10 +151,10 @@
     "structured-field-values": "^2.0.4",
     "temporal-polyfill": "^1.0.1",
     "urlpattern-polyfill": "^10.1.0",
-    "@fedify/uri-template": "2.4.0-dev.2129+c0ddb433",
-    "@fedify/vocab": "2.4.0-dev.2129+c0ddb433",
-    "@fedify/webfinger": "2.4.0-dev.2129+c0ddb433",
-    "@fedify/vocab-runtime": "2.4.0-dev.2129+c0ddb433"
+    "@fedify/uri-template": "2.4.0-dev.2141+881cc858",
+    "@fedify/vocab": "2.4.0-dev.2141+881cc858",
+    "@fedify/vocab-runtime": "2.4.0-dev.2141+881cc858",
+    "@fedify/webfinger": "2.4.0-dev.2141+881cc858"
   },
   "devDependencies": {
     "@std/assert": "npm:@jsr/std__assert@^0.226.0",
@@ -167,7 +167,7 @@
     "typescript": "^6.0.0",
     "wrangler": "^4.17.0",
     "@fedify/fixture": "2.0.0",
-    "@fedify/vocab-tools": "^2.4.0-dev.2129+c0ddb433"
+    "@fedify/vocab-tools": "^2.4.0-dev.2141+881cc858"
   },
   "scripts": {
     "build:self": "tsdown",