@fedify/fedify 2.4.0-dev.2157 → 2.4.0-dev.2164

package/dist/{proof-C2YwD8a_.mjs → proof-CRTPWbVh.mjs}

@@ -1,13 +1,13 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-D1gcWWqB.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B41pRPfd.mjs";
+import { n as version, t as name } from "./deno-CizGaYeG.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CFBEehTc.mjs";
 import { c as isPortableId, r as getPortableDid } from "./portable-key-id-Bg259c4Z.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-CPM4r6tP.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-D5awqp7u.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { c as getNormalizationContextLoader } from "./ld-lU_ZqzsQ.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CyliEU48.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{send-D9SGhxTB.mjs → send-2dULlZc8.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-D1gcWWqB.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-B41pRPfd.mjs";
-import { n as doubleKnock } from "./http-CGcLv8rh.mjs";
+import { n as version, t as name } from "./deno-CizGaYeG.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-CFBEehTc.mjs";
+import { n as doubleKnock } from "./http-DRH0n8TD.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/sig/compound-proof-discovery.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-D7K94KPz.mjs";
+import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-CxDBdtNz.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-discovery.test.ts

package/dist/sig/compound-proof-producer.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-D7K94KPz.mjs";
+import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-CxDBdtNz.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-producer.test.ts
 const portableId = "ap+ef61://did:key:z6MkAlice/objects/1";

package/dist/sig/compound-proof-verification.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { l as verifyPortableObjectProofPolicy, o as verifyMapLocalProof } from "../proof-C2YwD8a_.mjs";
+import { l as verifyPortableObjectProofPolicy, o as verifyMapLocalProof } from "../proof-CRTPWbVh.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-D7K94KPz.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-CxDBdtNz.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { CryptographicKey, Multikey, Person } from "@fedify/vocab";

package/dist/sig/compound-proof.test.mjs

@@ -6,9 +6,9 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as signObject, d as verifyProof } from "../proof-C2YwD8a_.mjs";
+import { a as signObject, d as verifyProof } from "../proof-CRTPWbVh.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { o as verifyCompoundProofDocuments } from "../compound-proof-D7K94KPz.mjs";
+import { o as verifyCompoundProofDocuments } from "../compound-proof-CxDBdtNz.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";

package/dist/sig/http.test.mjs

@@ -11,8 +11,8 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as exportJwk } from "../key-CPM4r6tP.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-CGcLv8rh.mjs";
+import { n as exportJwk } from "../key-D5awqp7u.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-DRH0n8TD.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";

package/dist/sig/key-owner-evidence.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/sig/key-owner-evidence.test.mjs

@@ -0,0 +1,100 @@
+import { Temporal } from "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { t as getCanonicalPortableId } from "../portable-key-id-Bg259c4Z.mjs";
+import { a as promoteKeyOwnerEvidence, i as parseKeyOwnerEvidence, n as attachKeyOwnerEvidence, r as getVerifiedKeyOwnerEvidence } from "../key-owner-evidence-Bo3yaeL5.mjs";
+import { r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { CryptographicKey, Person } from "@fedify/vocab";
+import { test } from "@fedify/fixture";
+import { exportDidKey, parseIri } from "@fedify/vocab-runtime";
+//#region src/sig/key-owner-evidence.test.ts
+const did = await exportDidKey(ed25519PublicKey.publicKey);
+const rawActorId = `ap://${did}/actors/alice`;
+const actorId = parseIri(rawActorId);
+const keyId = new URL(`https://gw.example/.well-known/apgateway/${did}/actors/alice#main-key`);
+const document = {
+	"@id": rawActorId,
+	"@type": ["https://www.w3.org/ns/activitystreams#Person"],
+	"https://www.w3.org/ns/activitystreams#name": [{ "@value": "Alice" }]
+};
+const expires = Temporal.Now.instant().add({ hours: 1 });
+function createKey(owner = actorId) {
+	return new CryptographicKey({
+		id: new URL(keyId.href),
+		owner: parseIri(owner.href),
+		publicKey: rsaPublicKey2.publicKey
+	});
+}
+test("getVerifiedKeyOwnerEvidence() only returns promoted evidence", () => {
+	const key = createKey();
+	assert(attachKeyOwnerEvidence(key, document, expires));
+	assertEquals(getVerifiedKeyOwnerEvidence(key), void 0);
+	promoteKeyOwnerEvidence(key);
+	const evidence = getVerifiedKeyOwnerEvidence(key);
+	assertEquals(evidence?.ownerId, getCanonicalPortableId(actorId));
+	assertEquals(evidence?.keyId, keyId.href);
+	assertEquals(evidence?.expires, expires);
+	const other = createKey();
+	promoteKeyOwnerEvidence(other);
+	assertEquals(getVerifiedKeyOwnerEvidence(other), void 0);
+});
+test("attachKeyOwnerEvidence() refuses evidence about other actors", () => {
+	const otherActorId = parseIri(`ap://${did}/actors/bob`);
+	assertFalse(attachKeyOwnerEvidence(createKey(otherActorId), {
+		...document,
+		"@id": otherActorId.href
+	}, expires));
+	assertFalse(attachKeyOwnerEvidence(createKey(), {
+		...document,
+		"@id": `ap://${did}/actors/bob`
+	}, expires));
+	assertFalse(attachKeyOwnerEvidence(createKey(), {
+		...document,
+		"@id": `ap://${did}/x/../actors/alice`
+	}, expires));
+	assertFalse(attachKeyOwnerEvidence(createKey(), {}, expires));
+	assertFalse(attachKeyOwnerEvidence(createKey(), [document], expires));
+});
+test("getVerifiedKeyOwnerEvidence() ignores expired evidence", () => {
+	const key = createKey();
+	attachKeyOwnerEvidence(key, document, expires);
+	promoteKeyOwnerEvidence(key);
+	assert(getVerifiedKeyOwnerEvidence(key, expires.subtract({ seconds: 1 })));
+	assertEquals(getVerifiedKeyOwnerEvidence(key, expires), void 0);
+});
+test("getVerifiedKeyOwnerEvidence() ignores keys changed since", () => {
+	const key = createKey();
+	attachKeyOwnerEvidence(key, document, expires);
+	promoteKeyOwnerEvidence(key);
+	key.clone({}).ownerId.href = parseIri(`ap://${did}/actors/bob`).href;
+	assertEquals(getVerifiedKeyOwnerEvidence(key), void 0);
+	const moved = createKey();
+	attachKeyOwnerEvidence(moved, document, expires);
+	promoteKeyOwnerEvidence(moved);
+	moved.ownerId.href = `https://other.example/.well-known/apgateway/${did}/actors/alice`;
+	assertEquals(getVerifiedKeyOwnerEvidence(moved), void 0);
+	const verified = createKey();
+	attachKeyOwnerEvidence(verified, document, expires);
+	promoteKeyOwnerEvidence(verified);
+	assertEquals(getVerifiedKeyOwnerEvidence(verified.clone({})), void 0);
+});
+test("parseKeyOwnerEvidence() parses a new actor every time", async () => {
+	const key = createKey();
+	const doc = structuredClone(document);
+	attachKeyOwnerEvidence(key, doc, expires);
+	promoteKeyOwnerEvidence(key);
+	doc["@id"] = `ap://${did}/actors/bob`;
+	const evidence = getVerifiedKeyOwnerEvidence(key);
+	const actor = await parseKeyOwnerEvidence(evidence);
+	assert(actor instanceof Person);
+	assertEquals(actor.id?.href, actorId.href);
+	assertEquals(actor.name?.toString(), "Alice");
+	actor.id.href = parseIri(`ap://${did}/actors/bob`).href;
+	assertEquals((await parseKeyOwnerEvidence(evidence))?.id?.href, actorId.href);
+});
+//#endregion
+export {};

package/dist/sig/key.test.mjs

@@ -6,7 +6,7 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-CPM4r6tP.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-D5awqp7u.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/ld.test.mjs

@@ -8,8 +8,8 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { o as generateCryptoKeyPair } from "../key-CPM4r6tP.mjs";
-import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-lU_ZqzsQ.mjs";
+import { o as generateCryptoKeyPair } from "../key-D5awqp7u.mjs";
+import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-CyliEU48.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/mod.cjs

@@ -1,7 +1,7 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-BObQoB0j.cjs");
-const require_portable_collection = require("../portable-collection-B8ojoQ50.cjs");
+const require_http = require("../http-R4g1McwE.cjs");
+const require_portable_collection = require("../portable-collection-UajqDrSL.cjs");
 exports.attachSignature = require_http.attachSignature;
 exports.createProof = require_http.createProof;
 exports.createSignature = require_http.createSignature;

package/dist/sig/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-CjezPjFX.cjs";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-DC1cqAQ2.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BF0L9cMt.cjs";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-S--JxYjo.cjs";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-CPPqkyV_.cjs";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-C-x_OLSp.js";
+import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "../http-Cok5-vIC.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-BSzr5-I8.js";
-import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod-Bz9tFXI2.js";
+import { C as createSignature, D as verifyJsonLd, E as signJsonLd, O as verifySignature, S as attachSignature, T as hasSignatureLike, _ as verifyProof, a as CreateProofOptions, b as VerifyJsonLdOptions, c as VerifyPortableObjectProofFailureReason, d as VerifyProofOptions, f as createProof, g as verifyPortableObjectProof, h as verifyObject, i as verifyPortableObject, l as VerifyPortableObjectProofOptions, m as signObject, n as VerifyPortableObjectOptions, o as SignObjectOptions, p as hasProofLike, r as VerifyPortableObjectResult, s as VerifyObjectOptions, t as VerifyPortableObjectFailureReason, u as VerifyPortableObjectProofResult, v as CreateSignatureOptions, w as detachSignature, x as VerifySignatureOptions, y as SignJsonLdOptions } from "../mod--jv6vyrP.js";
 export { AcceptSignatureMember, AcceptSignatureParameters, CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyDetailedResult, FetchKeyErrorResult, FetchKeyOptions, FetchKeyResult, FulfillAcceptSignatureResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, Rfc9421SignRequestOptions, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyPortableObjectFailureReason, VerifyPortableObjectOptions, VerifyPortableObjectProofFailureReason, VerifyPortableObjectProofOptions, VerifyPortableObjectProofResult, VerifyPortableObjectResult, VerifyProofOptions, VerifyRequestDetailedResult, VerifyRequestFailureReason, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/mod.js

@@ -1,5 +1,5 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { A as hasSignatureLike, B as fetchKey, D as detachSignature, E as createSignature, F as verifyJsonLd, H as generateCryptoKeyPair, I as verifySignature, N as signJsonLd, R as exportJwk, U as importJwk, V as fetchKeyDetailed, _ as verifyPortableObjectProof, a as signRequest, b as verifyProof, dt as fulfillAcceptSignature, f as createProof, ft as parseAcceptSignature, g as verifyObject, m as signObject, o as verifyRequest, p as hasProofLike, pt as validateAcceptSignature, s as verifyRequestDetailed, ut as formatAcceptSignature, w as attachSignature } from "../http-Dgtt45-K.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-C3xEzYri.js";
+import { A as hasSignatureLike, B as fetchKey, D as detachSignature, E as createSignature, F as verifyJsonLd, H as generateCryptoKeyPair, I as verifySignature, N as signJsonLd, R as exportJwk, U as importJwk, V as fetchKeyDetailed, _ as verifyPortableObjectProof, a as signRequest, b as verifyProof, f as createProof, g as verifyObject, gt as validateAcceptSignature, ht as parseAcceptSignature, m as signObject, mt as fulfillAcceptSignature, o as verifyRequest, p as hasProofLike, pt as formatAcceptSignature, s as verifyRequestDetailed, w as attachSignature } from "../http-Baovr6xq.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-uv4CuQXm.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-D63yPo_i.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DKdtsrEq.mjs";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/owner.test.ts

package/dist/sig/portable-collection.test.mjs

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { t as verifyPortableObject } from "../portable-collection-_lZg-osX.mjs";
+import { t as verifyPortableObject } from "../portable-collection-Cb5cdPIU.mjs";
 import { Collection, CollectionPage, Note, OrderedCollection, Person, traverseCollection } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 import { FetchError, encodeMultibase, exportDidKey, preloadedContexts } from "@fedify/vocab-runtime";

package/dist/sig/portable-key.test.mjs

@@ -2,13 +2,13 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
-import { i as fetchKey } from "../key-CPM4r6tP.mjs";
-import { h as verifyJsonLd, p as signJsonLd } from "../ld-lU_ZqzsQ.mjs";
-import { d as verifyProof, r as createProof } from "../proof-C2YwD8a_.mjs";
-import { d as verifyRequest, f as verifyRequestDetailed, l as signRequest } from "../http-CGcLv8rh.mjs";
+import { i as fetchKey } from "../key-D5awqp7u.mjs";
+import { h as verifyJsonLd, p as signJsonLd } from "../ld-CyliEU48.mjs";
+import { d as verifyProof, r as createProof } from "../proof-CRTPWbVh.mjs";
+import { d as verifyRequest, f as verifyRequestDetailed, l as signRequest } from "../http-DRH0n8TD.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-D63yPo_i.mjs";
-import { t as KvKeyCache } from "../keycache-BInaECGj.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DKdtsrEq.mjs";
+import { t as KvKeyCache } from "../keycache-PiOM9pM0.mjs";
 import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 import { FetchError, encodeMultibase, exportDidKey, exportSpki, parseIri, preloadedContexts } from "@fedify/vocab-runtime";

package/dist/sig/proof.test.mjs

@@ -10,10 +10,10 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as signObject, c as verifyPortableObjectProof, d as verifyProof, i as hasProofLike, r as createProof, s as verifyObject } from "../proof-C2YwD8a_.mjs";
-import { d as verifyRequest } from "../http-CGcLv8rh.mjs";
+import { a as signObject, c as verifyPortableObjectProof, d as verifyProof, i as hasProofLike, r as createProof, s as verifyObject } from "../proof-CRTPWbVh.mjs";
+import { d as verifyRequest } from "../http-DRH0n8TD.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-BMqr3hji.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-BBFAItNB.mjs";
 import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place, Translation } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";

package/dist/{temporal-q6FSekcN.mjs → temporal-Dhsk6aUT.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-lU_ZqzsQ.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CyliEU48.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/kv.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-IG3pHfvZ.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
-import { o as createFederation } from "../middleware-xdukzV3x.mjs";
+import { o as createFederation } from "../middleware-B99JjvFn.mjs";
 //#region src/testing/kv.test.ts
 test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
 	const kv = new ManualClockKvStore();

package/dist/testing/mod.d.mts

@@ -3317,12 +3317,38 @@ interface Context<TContextData> {
   getPortableFeaturedTagsUri(identifier: string, authority: string): URL;
   /**
    * Determines the type of the URI and extracts the associated data.
+   *
+   * By default, only URIs on this server's origin are recognized.  With
+   * the `portable` option, [FEP-ef61] portable IDs, e.g.,
+   * `ap+ef61://did:key:z6Mk.../users/alice`, and their compatible
+   * identifiers on any gateway, e.g.,
+   * `https://example.com/.well-known/apgateway/did:key:z6Mk.../users/alice`,
+   * are also recognized by the same paths that the gateway endpoint routes
+   * to the dispatchers, and the result has the DID in its `authority`
+   * property.
+   *
+   * The DID of a portable ID is anyone's to choose, so recognizing it does
+   * not mean that this server hosts anything for the DID.  Check that
+   * `authority` is the DID that the application stores for the actor or
+   * object before acting on it:
+   *
+   * ~~~~ typescript
+   * const parsed = ctx.parseUri(follow.objectId, { portable: true });
+   * if (parsed?.type !== "actor") return;
+   * const user = await getUser(parsed.identifier);
+   * if (user == null) return;
+   * if (parsed.authority != null && parsed.authority !== user.did) return;
+   * ~~~~
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
    * @param uri The URI to parse.
+   * @param options Options for parsing the URI.  Since 2.4.0.
    * @returns The result of parsing the URI.  If `null` is given or
    *          the URI is not recognized, `null` is returned.
    * @since 0.9.0
    */
-  parseUri(uri: URL | null): ParseUriResult | null;
+  parseUri(uri: URL | null, options?: ParseUriOptions): ParseUriResult | null;
   /**
    * Gets the key pairs for an actor.
    * @param identifier The actor's identifier.
@@ -4220,6 +4246,30 @@ interface OutboxContext<TContextData> extends Context<TContextData> {
    */
   clone(data: TContextData): OutboxContext<TContextData>;
 }
+/**
+ * Options for {@link Context.parseUri}.
+ * @since 2.4.0
+ */
+interface ParseUriOptions {
+  /**
+   * Whether to also recognize [FEP-ef61] portable IDs, i.e., `ap:` and
+   * `ap+ef61:` URIs, and their compatible identifiers on any gateway.
+   * The result of a portable ID has its DID, without percent-encoding, in
+   * the `authority` property, which the caller has to compare with the DID
+   * that it stores for the actor or object, since anyone can make a portable
+   * ID with the same path under another DID.
+   *
+   * Like URIs on this server's origin, a portable ID is recognized by its
+   * path, and its query, e.g., location hints, and fragment are ignored.
+   * A shared inbox is never recognized in a portable ID, and a portable ID
+   * with a malformed DID, or with a `did:key` DID that is not encoded in
+   * base58-btc, is not recognized either.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @default `false`
+   */
+  readonly portable?: boolean;
+}
 /**
  * A result of parsing an URI.
  */
@@ -4230,6 +4280,12 @@ type ParseUriResult =
 {
   readonly type: "actor";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of an object URI.
@@ -4239,6 +4295,12 @@ type ParseUriResult =
   readonly class: ConstructorWithTypeId<Object$1>;
   readonly typeId: URL;
   readonly values: Record<string, string>;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of an shared inbox URI.
@@ -4246,6 +4308,7 @@ type ParseUriResult =
 | {
   readonly type: "inbox";
   readonly identifier: undefined;
+  readonly authority?: undefined;
 }
 /**
  * The case of an personal inbox URI.
@@ -4253,6 +4316,12 @@ type ParseUriResult =
 | {
   readonly type: "inbox";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of an outbox collection URI.
@@ -4260,6 +4329,12 @@ type ParseUriResult =
 | {
   readonly type: "outbox";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a following collection URI.
@@ -4267,6 +4342,12 @@ type ParseUriResult =
 | {
   readonly type: "following";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a followers collection URI.
@@ -4274,6 +4355,12 @@ type ParseUriResult =
 | {
   readonly type: "followers";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a liked collection URI.
@@ -4282,6 +4369,12 @@ type ParseUriResult =
 | {
   readonly type: "liked";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a featured collection URI.
@@ -4290,6 +4383,12 @@ type ParseUriResult =
 | {
   readonly type: "featured";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a featured tags collection URI.
@@ -4298,6 +4397,12 @@ type ParseUriResult =
 | {
   readonly type: "featuredTags";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a custom collection URI.
@@ -4309,6 +4414,12 @@ type ParseUriResult =
   readonly class: ConstructorWithTypeId<Object$1>;
   readonly typeId: URL;
   readonly values: Record<string, string>;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a custom ordered collection URI.
@@ -4320,6 +4431,12 @@ type ParseUriResult =
   readonly class: ConstructorWithTypeId<Object$1>;
   readonly typeId: URL;
   readonly values: Record<string, string>;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 };
 /**
  * Options for {@link Context.sendActivity} method.

package/dist/utils/docloader.test.mjs

@@ -5,9 +5,9 @@ import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { d as verifyRequest } from "../http-CGcLv8rh.mjs";
+import { d as verifyRequest } from "../http-DRH0n8TD.mjs";
 import { i as rsaPrivateKey2 } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-BMqr3hji.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-BBFAItNB.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";

package/dist/utils/kv-cache.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-bdPqTR1k.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-C7RWL7hz.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { preloadedContexts } from "@fedify/vocab-runtime";

package/dist/utils/mod.cjs

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-D2fnB8qu.cjs");
+const require_kv_cache = require("../kv-cache-Ct-KWRta.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.d.cts

@@ -1,3 +1,3 @@
 /// <reference lib="esnext.temporal" />
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-Mt4aO3DX.cjs";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-BA_F2x53.cjs";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.d.ts

@@ -1,3 +1,3 @@
 /// <reference lib="esnext.temporal" />
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-DaiBrWDW.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-B5z_q9TH.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-BweyIZTb.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-CZiBDLPi.js";
 export { getAuthenticatedDocumentLoader, kvCache };