@fedify/fedify 2.4.0-dev.2155 → 2.4.0-dev.2159

package/dist/{federation-D9TufmIO.cjs → federation-dBOqmJcA.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-eqYXHRkz.cjs");
-const require_types = require("./types-Be2zbyeG.cjs");
-const require_portable_collection = require("./portable-collection-wBWbuHOH.cjs");
-const require_kv_cache = require("./kv-cache-DzClEalR.cjs");
+const require_http = require("./http-wdsia0-O.cjs");
+const require_types = require("./types-poIao40f.cjs");
+const require_portable_collection = require("./portable-collection-C65SwL2l.cjs");
+const require_kv_cache = require("./kv-cache-BHNtQi9e.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -2823,6 +2823,43 @@ function parsePortableGatewayRequest(url) {
 	};
 }
 /**
+* Recognizes an FEP-ef61 portable ID, i.e., an `ap:` or `ap+ef61:` URI, or
+* a compatible identifier on any gateway, and splits it into its DID and
+* the object path to route.
+*
+* It accepts the same IDs as the gateway endpoint does: the query, e.g.,
+* location hints, and the fragment are ignored, and a malformed DID, or
+* a `did:key` DID that is not encoded in base58-btc, is refused.
+*
+* @param uri The ID to recognize.
+* @returns The DID normalized as an FEP-fe34 origin, and the object path,
+*          or `null` if the ID is not a portable ID or is malformed.
+*/
+function parsePortableId(uri) {
+	if (uri.username !== "" || uri.password !== "") return null;
+	if (uri.protocol !== "ap:" && uri.protocol !== "ap+ef61:") {
+		const request = parsePortableGatewayRequest(uri);
+		if (request?.type !== "object") return null;
+		return {
+			authority: request.portableRequest.authority,
+			path: request.path
+		};
+	}
+	try {
+		const id = (0, _fedify_vocab_runtime.parseIri)(uri);
+		(0, _fedify_vocab_runtime.canonicalizePortableUri)((0, _fedify_vocab_runtime.formatIri)(id));
+		const authority = (0, _fedify_vocab_runtime.getFe34Origin)(id);
+		assertBase58BtcDidKey(authority);
+		return {
+			authority,
+			path: id.pathname
+		};
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
 * Builds a portable ID from a DID authority and an object path.
 * @param authority The bare DID, e.g., `did:key:z6Mk...`.
 * @param path The object path, e.g., `/notes/123`.
@@ -3016,6 +3053,15 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 		if (!allowPrivateAddress) try {
 			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
 		} catch (error) {
+			if (error instanceof _fedify_vocab_runtime.UrlError && error.reason === "dns") {
+				logger.error("DNS resolution failed for URL: {url}", {
+					url,
+					error
+				});
+				const failure = new _fedify_vocab_runtime.FetchError(url, error.message);
+				failure.cause = error;
+				throw failure;
+			}
 			if (error instanceof _fedify_vocab_runtime.UrlError) logger.error("Disallowed private URL: {url}", {
 				url,
 				error
@@ -3023,7 +3069,12 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 			throw error;
 		}
 	}
-	await validateUrl(inbox.href);
+	try {
+		await validateUrl(inbox.href);
+	} catch (error) {
+		if (error instanceof _fedify_vocab_runtime.FetchError) federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), false, activityType);
+		throw error;
+	}
 	headers = new Headers(headers);
 	headers.set("Content-Type", "application/activity+json");
 	const request = new Request(inbox, {
@@ -9470,12 +9521,25 @@ var ContextImpl = class ContextImpl {
 		if (path === null) throw new _fedify_uri_template.RouterError(`No collection dispatcher registered for "${String(name)}".`);
 		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
-	parseUri(uri) {
+	parseUri(uri, options = {}) {
 		if (uri == null) return null;
-		if (uri.origin !== this.origin && uri.origin !== this.canonicalOrigin) return null;
-		const route = this.federation.router.route(uri.pathname);
-		if (route == null) return null;
-		else if (route.name === "sharedInbox") return {
+		if (uri.origin === this.origin || uri.origin === this.canonicalOrigin) {
+			const route = this.federation.router.route(uri.pathname);
+			if (route != null) return this.#parseRoute(route);
+		}
+		if (!options.portable) return null;
+		const portable = parsePortableId(uri);
+		if (portable == null) return null;
+		const route = this.federation.router.route(portable.path);
+		if (route == null || route.name === "sharedInbox") return null;
+		const result = this.#parseRoute(route);
+		return result == null ? null : {
+			...result,
+			authority: portable.authority
+		};
+	}
+	#parseRoute(route) {
+		if (route.name === "sharedInbox") return {
 			type: "inbox",
 			identifier: void 0
 		};

package/dist/{http-CXnNbRe_.mjs → http-DV_yW4dv.mjs}

@@ -1,12 +1,12 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-YLLbRq06.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CBHhbHgG.mjs";
+import { n as version, t as name } from "./deno-CE_s0yQb.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-ByOQOHHS.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
 import { f as parseKeyIdString } from "./portable-key-id-Bg259c4Z.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-BZ-Z4uez.mjs";
-import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-BL6K88p2.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-C6jnekFI.mjs";
+import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-BXsVLSMa.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -804,6 +804,8 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 		failure = result;
 		failureAlgorithm = algorithm;
 	};
+	let body = null;
+	let digestValid = null;
 	for (const sigName of signatureNames) {
 		if (!signatures[sigName]) {
 			setFailure(invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId)));
@@ -855,7 +857,9 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 				setFailure(invalidSignatureResult(keyId));
 				continue;
 			}
-			if (!await verifyRfc9421ContentDigest(contentDigestHeader, await request.arrayBuffer())) {
+			body ??= await request.arrayBuffer();
+			digestValid ??= await verifyRfc9421ContentDigest(contentDigestHeader, body);
+			if (!digestValid) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
 				setFailure(invalidSignatureResult(keyId));
 				continue;

package/dist/{http-Dk4O3WM0.js → http-nTZuTacw.js}

@@ -14,7 +14,7 @@ import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2155+2ccc5085";
+var version = "2.4.0-dev.2159+bb072eda";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -2238,7 +2238,7 @@ function normalizeContextReference(reference, baseUrl) {
 /** @internal */
 function isInvalidUrlTypeError(error) {
 	const code = error.code;
-	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+	return error instanceof TypeError && (code === "ERR_INVALID_URL" || error.message === "Invalid URL string." || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
 }
 async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
 	if (context === null) return createGraphAliasContextState();
@@ -5340,6 +5340,8 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 		failure = result;
 		failureAlgorithm = algorithm;
 	};
+	let body = null;
+	let digestValid = null;
 	for (const sigName of signatureNames) {
 		if (!signatures[sigName]) {
 			setFailure(invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId)));
@@ -5391,7 +5393,9 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 				setFailure(invalidSignatureResult(keyId));
 				continue;
 			}
-			if (!await verifyRfc9421ContentDigest(contentDigestHeader, await request.arrayBuffer())) {
+			body ??= await request.arrayBuffer();
+			digestValid ??= await verifyRfc9421ContentDigest(contentDigestHeader, body);
+			if (!digestValid) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
 				setFailure(invalidSignatureResult(keyId));
 				continue;

package/dist/{http-eqYXHRkz.cjs → http-wdsia0-O.cjs}

@@ -16,7 +16,7 @@ json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2155+2ccc5085";
+var version = "2.4.0-dev.2159+bb072eda";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -5804,7 +5804,7 @@ function normalizeContextReference(reference, baseUrl) {
 /** @internal */
 function isInvalidUrlTypeError(error) {
 	const code = error.code;
-	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+	return error instanceof TypeError && (code === "ERR_INVALID_URL" || error.message === "Invalid URL string." || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
 }
 async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
 	if (context === null) return createGraphAliasContextState();
@@ -8908,6 +8908,8 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 		failure = result;
 		failureAlgorithm = algorithm;
 	};
+	let body = null;
+	let digestValid = null;
 	for (const sigName of signatureNames) {
 		if (!signatures[sigName]) {
 			setFailure(invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId)));
@@ -8959,7 +8961,9 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 				setFailure(invalidSignatureResult(keyId));
 				continue;
 			}
-			if (!await verifyRfc9421ContentDigest(contentDigestHeader, await request.arrayBuffer())) {
+			body ??= await request.arrayBuffer();
+			digestValid ??= await verifyRfc9421ContentDigest(contentDigestHeader, body);
+			if (!digestValid) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
 				setFailure(invalidSignatureResult(keyId));
 				continue;

package/dist/{key-BZ-Z4uez.mjs → key-C6jnekFI.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-YLLbRq06.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-CBHhbHgG.mjs";
+import { n as version, t as name } from "./deno-CE_s0yQb.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-ByOQOHHS.mjs";
 import { c as isPortableId, f as parseKeyIdString, o as isCompatibleKeyId, s as isPortableActorDocument, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";

package/dist/{kv-cache-DzClEalR.cjs → kv-cache-BHNtQi9e.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-eqYXHRkz.cjs");
+const require_http = require("./http-wdsia0-O.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");
@@ -9,10 +9,13 @@ const logger$1 = (0, _logtape_logtape.getLogger)([
 	"utils",
 	"docloader"
 ]);
+const DEFAULT_MAX_REDIRECTION = 20;
 /**
 * Gets an authenticated {@link DocumentLoader} for the given identity.
 * Note that an authenticated document loader intentionally does not cache
 * the fetched documents.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 * @param identity The identity to get the document loader for.
 *                 The actor's key pair.
 * @param options The options for the document loader.
@@ -22,29 +25,52 @@ const logger$1 = (0, _logtape_logtape.getLogger)([
 */
 function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, tracerProvider } = {}) {
 	require_http.validateCryptoKey(identity.privateKey);
-	async function load(url, options) {
-		await validateUrl(url, options);
-		return (0, _fedify_vocab_runtime.getRemoteDocument)(url, await require_http.doubleKnock((0, _fedify_vocab_runtime.createActivityPubRequest)(url, { userAgent }), identity, {
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
+		options?.signal?.throwIfAborted();
+		let currentUrl = new URL(url).href;
+		await validateUrl(currentUrl, options);
+		visited.add(currentUrl);
+		const originalRequest = (0, _fedify_vocab_runtime.createActivityPubRequest)(currentUrl, { userAgent });
+		function follow(nextUrl) {
+			options?.signal?.throwIfAborted();
+			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new _fedify_vocab_runtime.FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+			if (visited.has(nextUrl)) throw new _fedify_vocab_runtime.FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
+			redirected++;
+		}
+		const response = await require_http.doubleKnock(originalRequest, identity, {
 			maxRedirection,
 			specDeterminer,
 			log: (0, es_toolkit.curry)(_fedify_vocab_runtime.logRequest)(logger$1),
 			tracerProvider,
 			signal: options?.signal,
-			validateRedirect: (url) => validateUrl(url, options)
-		}), load, options);
+			validateRedirect: async (nextUrl) => {
+				follow(nextUrl);
+				await validateUrl(nextUrl, options);
+				visited.add(nextUrl);
+				currentUrl = nextUrl;
+			}
+		});
+		return (0, _fedify_vocab_runtime.getRemoteDocument)(currentUrl, response, (alternateUrl) => {
+			follow(alternateUrl);
+			return load(alternateUrl, options, redirected, visited);
+		}, options);
 	}
 	async function validateUrl(url, options) {
 		if (!allowPrivateAddress) try {
 			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
 		} catch (error) {
-			if (error instanceof _fedify_vocab_runtime.UrlError) logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+			if (error instanceof _fedify_vocab_runtime.UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
 				url,
 				error
 			});
 			throw error;
 		}
 	}
-	return load;
+	return (url, options) => load(url, options);
 }
 //#endregion
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-DZr8HTel.mjs → kv-cache-Bxm0a0Ww.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-CBHhbHgG.mjs";
+import { p as recordDocumentCache } from "./metrics-ByOQOHHS.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-3uKc0G76.js → kv-cache-DhIl9YlV.js}

@@ -1,8 +1,8 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { W as validateCryptoKey, nt as recordDocumentCache, t as doubleKnock } from "./http-Dk4O3WM0.js";
+import { W as validateCryptoKey, nt as recordDocumentCache, t as doubleKnock } from "./http-nTZuTacw.js";
 import { getLogger } from "@logtape/logtape";
-import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";
 //#region src/utils/docloader.ts
 const logger$1 = getLogger([
@@ -10,10 +10,13 @@ const logger$1 = getLogger([
 	"utils",
 	"docloader"
 ]);
+const DEFAULT_MAX_REDIRECTION = 20;
 /**
 * Gets an authenticated {@link DocumentLoader} for the given identity.
 * Note that an authenticated document loader intentionally does not cache
 * the fetched documents.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 * @param identity The identity to get the document loader for.
 *                 The actor's key pair.
 * @param options The options for the document loader.
@@ -23,29 +26,52 @@ const logger$1 = getLogger([
 */
 function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, tracerProvider } = {}) {
 	validateCryptoKey(identity.privateKey);
-	async function load(url, options) {
-		await validateUrl(url, options);
-		return getRemoteDocument(url, await doubleKnock(createActivityPubRequest(url, { userAgent }), identity, {
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
+		options?.signal?.throwIfAborted();
+		let currentUrl = new URL(url).href;
+		await validateUrl(currentUrl, options);
+		visited.add(currentUrl);
+		const originalRequest = createActivityPubRequest(currentUrl, { userAgent });
+		function follow(nextUrl) {
+			options?.signal?.throwIfAborted();
+			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+			if (visited.has(nextUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
+			redirected++;
+		}
+		const response = await doubleKnock(originalRequest, identity, {
 			maxRedirection,
 			specDeterminer,
 			log: curry(logRequest)(logger$1),
 			tracerProvider,
 			signal: options?.signal,
-			validateRedirect: (url) => validateUrl(url, options)
-		}), load, options);
+			validateRedirect: async (nextUrl) => {
+				follow(nextUrl);
+				await validateUrl(nextUrl, options);
+				visited.add(nextUrl);
+				currentUrl = nextUrl;
+			}
+		});
+		return getRemoteDocument(currentUrl, response, (alternateUrl) => {
+			follow(alternateUrl);
+			return load(alternateUrl, options, redirected, visited);
+		}, options);
 	}
 	async function validateUrl(url, options) {
 		if (!allowPrivateAddress) try {
 			await validatePublicUrl(url);
 		} catch (error) {
-			if (error instanceof UrlError) logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+			if (error instanceof UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
 				url,
 				error
 			});
 			throw error;
 		}
 	}
-	return load;
+	return (url, options) => load(url, options);
 }
 //#endregion
 //#region src/utils/kv-cache.ts

package/dist/{ld-Djxsq6JR.mjs → ld-ya2C1Xip.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-YLLbRq06.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CBHhbHgG.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-BZ-Z4uez.mjs";
+import { n as version, t as name } from "./deno-CE_s0yQb.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-ByOQOHHS.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-C6jnekFI.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -206,7 +206,7 @@ function normalizeContextReference(reference, baseUrl) {
 /** @internal */
 function isInvalidUrlTypeError(error) {
 	const code = error.code;
-	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+	return error instanceof TypeError && (code === "ERR_INVALID_URL" || error.message === "Invalid URL string." || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
 }
 async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
 	if (context === null) return createGraphAliasContextState();

package/dist/{metrics-CBHhbHgG.mjs → metrics-ByOQOHHS.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-YLLbRq06.mjs";
+import { n as version, t as name } from "./deno-CE_s0yQb.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-DDa8pCUa.mjs → middleware-Bdwd_Gg8.mjs}

@@ -1,29 +1,29 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-YLLbRq06.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-CBHhbHgG.mjs";
+import { n as version, t as name } from "./deno-CE_s0yQb.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-ByOQOHHS.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
 import { a as hasPortableActor, c as isPortableId, l as isPortableKeyId, n as getGatewayKeyBase, o as isCompatibleKeyId, r as getPortableDid, t as getCanonicalPortableId, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
-import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-BZ-Z4uez.mjs";
+import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-C6jnekFI.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-Djxsq6JR.mjs";
-import { a as signObject, c as verifyPortableObjectProof, i as hasProofLike, s as verifyObject, t as InvalidPortableObjectIdError, u as verifyPortableObjectProofWithRoot } from "./proof-vZ04IAjq.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-CXnNbRe_.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-vc-pSu9-.mjs";
-import { n as kvCache } from "./kv-cache-DZr8HTel.mjs";
-import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-ya2C1Xip.mjs";
+import { a as signObject, c as verifyPortableObjectProof, i as hasProofLike, s as verifyObject, t as InvalidPortableObjectIdError, u as verifyPortableObjectProofWithRoot } from "./proof-BdO3BbLh.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-DV_yW4dv.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-C5p26tpa.mjs";
+import { n as kvCache } from "./kv-cache-Bxm0a0Ww.mjs";
+import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-CEnNz8O7.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-OdWSE8am.mjs";
-import { t as verifyPortableObject } from "./portable-collection-DAV7Ho3m.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-ylV8KCLx.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-CxHALSwA.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-C6Nv5yyw.mjs";
+import { t as verifyPortableObject } from "./portable-collection-uWj3hfzv.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-BwANxryy.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-D89oOfHC.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, s as verifyServedPortableObjects, t as containsCompoundPortableObject } from "./compound-proof-nhrXTRQO.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, s as verifyServedPortableObjects, t as containsCompoundPortableObject } from "./compound-proof-B02Os8h2.mjs";
 import { t as KvKeyCache } from "./keycache-BInaECGj.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-BTD4f_mZ.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CbPfRGZq.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -583,6 +583,43 @@ function parsePortableGatewayRequest(url) {
 	};
 }
 /**
+* Recognizes an FEP-ef61 portable ID, i.e., an `ap:` or `ap+ef61:` URI, or
+* a compatible identifier on any gateway, and splits it into its DID and
+* the object path to route.
+*
+* It accepts the same IDs as the gateway endpoint does: the query, e.g.,
+* location hints, and the fragment are ignored, and a malformed DID, or
+* a `did:key` DID that is not encoded in base58-btc, is refused.
+*
+* @param uri The ID to recognize.
+* @returns The DID normalized as an FEP-fe34 origin, and the object path,
+*          or `null` if the ID is not a portable ID or is malformed.
+*/
+function parsePortableId(uri) {
+	if (uri.username !== "" || uri.password !== "") return null;
+	if (uri.protocol !== "ap:" && uri.protocol !== "ap+ef61:") {
+		const request = parsePortableGatewayRequest(uri);
+		if (request?.type !== "object") return null;
+		return {
+			authority: request.portableRequest.authority,
+			path: request.path
+		};
+	}
+	try {
+		const id = parseIri(uri);
+		canonicalizePortableUri(formatIri(id));
+		const authority = getFe34Origin(id);
+		assertBase58BtcDidKey(authority);
+		return {
+			authority,
+			path: id.pathname
+		};
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
 * Builds a portable ID from a DID authority and an object path.
 * @param authority The bare DID, e.g., `did:key:z6Mk...`.
 * @param path The object path, e.g., `/notes/123`.
@@ -6348,12 +6385,25 @@ var ContextImpl = class ContextImpl {
 		if (path === null) throw new RouterError(`No collection dispatcher registered for "${String(name)}".`);
 		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
-	parseUri(uri) {
+	parseUri(uri, options = {}) {
 		if (uri == null) return null;
-		if (uri.origin !== this.origin && uri.origin !== this.canonicalOrigin) return null;
-		const route = this.federation.router.route(uri.pathname);
-		if (route == null) return null;
-		else if (route.name === "sharedInbox") return {
+		if (uri.origin === this.origin || uri.origin === this.canonicalOrigin) {
+			const route = this.federation.router.route(uri.pathname);
+			if (route != null) return this.#parseRoute(route);
+		}
+		if (!options.portable) return null;
+		const portable = parsePortableId(uri);
+		if (portable == null) return null;
+		const route = this.federation.router.route(portable.path);
+		if (route == null || route.name === "sharedInbox") return null;
+		const result = this.#parseRoute(route);
+		return result == null ? null : {
+			...result,
+			authority: portable.authority
+		};
+	}
+	#parseRoute(route) {
+		if (route.name === "sharedInbox") return {
 			type: "inbox",
 			identifier: void 0
 		};

package/dist/{middleware-BahNnLfD.mjs → middleware-DoVWq8mE.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-DDa8pCUa.mjs";
+import { n as FederationImpl } from "./middleware-Bdwd_Gg8.mjs";
 export { FederationImpl };