@fedify/fedify 2.4.0-dev.2169 → 2.4.0-dev.2193

package/dist/mod.js

@@ -3,11 +3,11 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./rolldown-runtime-BC-Eo5Mj.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-DAtXl_Kc.js";
 import "./compat/mod.js";
-import { A as hasSignatureLike, B as fetchKey, D as detachSignature, E as createSignature, F as verifyJsonLd, H as generateCryptoKeyPair, I as verifySignature, N as signJsonLd, R as exportJwk, U as importJwk, V as fetchKeyDetailed, _ as verifyPortableObjectProof, a as signRequest, b as verifyProof, f as createProof, g as verifyObject, gt as validateAcceptSignature, ht as parseAcceptSignature, m as signObject, mt as fulfillAcceptSignature, o as verifyRequest, p as hasProofLike, pt as formatAcceptSignature, s as verifyRequestDetailed, w as attachSignature } from "./http-BGpexPO7.js";
-import { a as respondWithObjectIfAcceptable, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as respondWithObject, l as CircuitBreaker, n as handleWebFinger, o as SendActivityError, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-DlxMxVp5.js";
+import { D as createSignature, H as fetchKeyDetailed, I as verifyJsonLd, L as verifySignature, O as detachSignature, P as signJsonLd, T as attachSignature, U as generateCryptoKeyPair, V as fetchKey, W as importJwk, _ as verifyObject, _t as validateAcceptSignature, a as signRequest, c as verifyRequestDetailed, gt as parseAcceptSignature, h as signObject, ht as fulfillAcceptSignature, j as hasSignatureLike, m as hasProofLike, mt as formatAcceptSignature, p as createProof, s as verifyRequest, v as verifyPortableObjectProof, x as verifyProof, z as exportJwk } from "./http-BGmxtpo2.js";
+import { a as respondWithObjectIfAcceptable, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as respondWithObject, l as CircuitBreaker, n as handleWebFinger, o as SendActivityError, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-ClaUFaLb.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-_S2_MeLF.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-Bkdh_WpL.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-iR55fqlk.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-D535cSz_.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DduYhpee.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";

package/dist/nodeinfo/handler.test.mjs

@@ -5,7 +5,7 @@ import { r as createRequestContext } from "../context-B2rlkkyJ.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { C as handleNodeInfo, o as createFederation, w as handleNodeInfoJrd } from "../middleware-Coqgp-K0.mjs";
+import { C as handleNodeInfo, o as createFederation, w as handleNodeInfoJrd } from "../middleware-BqqycC0P.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {

package/dist/{owner-D3GoetXS.mjs → owner-BVpZBM-V.mjs}

@@ -1,11 +1,11 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DU8dvnWk.mjs";
-import { c as isPortableId, d as isSamePublicKey$1, o as isCompatibleKeyId, t as getCanonicalPortableId, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
-import { i as parseKeyOwnerEvidence, r as getVerifiedKeyOwnerEvidence } from "./key-owner-evidence-Bo3yaeL5.mjs";
-import { l as verifyKeyOwnership, n as exportJwk, r as fetchActorDocument } from "./key-gIhVZO3p.mjs";
-import { n as resolvePortableActorKey, t as fetchPortableGatewayKey } from "./portable-key-DyF5AnZo.mjs";
+import { n as version, t as name } from "./deno-DB_Sh0LK.mjs";
+import { d as isPortableUri, l as isPortableId, n as getCanonicalPortableId, p as isSamePublicKey$1, s as isCompatibleKeyId } from "./portable-key-id-Ca30-hOa.mjs";
+import { i as parseKeyOwnerEvidence, r as getVerifiedKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
+import { l as verifyKeyOwnership, n as exportJwk, r as fetchActorDocument } from "./key-DA3Yx8p2.mjs";
+import { n as resolvePortableActorKey, t as fetchPortableGatewayKey } from "./portable-key-Bmwmq7Y6.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{portable-collection-CnlCamup.cjs → portable-collection-BFSShzwh.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-5CJBdU8n.cjs");
+const require_http = require("./http-BEivI0TS.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");

package/dist/{portable-collection-Bkdh_WpL.js → portable-collection-D535cSz_.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { Ct as isPortableId, Dt as name, Et as isSamePublicKey$1, G as verifyKeyOwnership, J as parseKeyOwnerEvidence, Ot as version, R as exportJwk, St as isCompatibleKeyId, Tt as isPortableUri, _ as verifyPortableObjectProof, _t as getCanonicalPortableId, c as fetchPortableGatewayKey, l as resolvePortableActorKey, q as getVerifiedKeyOwnerEvidence, y as verifyPortableObjectProofWithRoot, z as fetchActorDocument } from "./http-BGpexPO7.js";
+import { At as name, B as fetchActorDocument, Dt as isPortableUri, J as getVerifiedKeyOwnerEvidence, K as verifyKeyOwnership, Tt as isPortableId, Y as parseKeyOwnerEvidence, b as verifyPortableObjectProofWithRoot, jt as version, kt as isSamePublicKey$1, l as fetchPortableGatewayKey, u as resolvePortableActorKey, v as verifyPortableObjectProof, wt as isCompatibleKeyId, yt as getCanonicalPortableId, z as exportJwk } from "./http-BGmxtpo2.js";
 import { getLogger } from "@logtape/logtape";
 import { CollectionPage, CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{portable-collection-C60_acmx.mjs → portable-collection-Dn2GdZdI.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DU8dvnWk.mjs";
-import { c as verifyPortableObjectProof, u as verifyPortableObjectProofWithRoot } from "./proof-CQAYqWdj.mjs";
+import { n as version, t as name } from "./deno-DB_Sh0LK.mjs";
+import { c as verifyPortableObjectProof, u as verifyPortableObjectProofWithRoot } from "./proof-DrJWKeOl.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CollectionPage, Object as Object$1, isActor } from "@fedify/vocab";
 import { trace } from "@opentelemetry/api";

package/dist/{portable-key-DyF5AnZo.mjs → portable-key-Bmwmq7Y6.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { d as isSamePublicKey, i as getRawCanonicalPortableId, s as isPortableActorDocument, t as getCanonicalPortableId, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
-import { u as verifyPortableObjectProofWithRoot } from "./proof-CQAYqWdj.mjs";
+import { a as getRawCanonicalPortableId, c as isPortableActorDocument, d as isPortableUri, n as getCanonicalPortableId, p as isSamePublicKey } from "./portable-key-id-Ca30-hOa.mjs";
+import { u as verifyPortableObjectProofWithRoot } from "./proof-DrJWKeOl.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { FetchError, formatIri, getDocumentLoader, isGatewayUrl, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";

package/dist/{portable-key-id-Bg259c4Z.mjs → portable-key-id-Ca30-hOa.mjs}

@@ -103,6 +103,50 @@ function getCanonicalPortableId(id) {
 	}
 }
 /**
+* Gets the [FEP-fe34] origin of an ID for same-origin checks.  The origin of
+* an `ap:` or `ap+ef61:` URI, or of a compatible identifier on any gateway,
+* is the DID of its canonical portable ID, as FEP-ef61 treats a compatible
+* identifier as the portable ID it stands for; unlike `getFe34Origin()`,
+* which gives a compatible identifier the web origin of its gateway.  The
+* origin of any other HTTP(S) URL is its web origin, and that of a DID URL
+* is its DID.
+*
+* Only the parsed `URL` is validated, so dot segments that URL parsing has
+* already resolved cannot be detected here.
+*
+* [FEP-fe34]: https://w3id.org/fep/fe34
+* @returns The origin, or `null` if the ID has none that is supported, or is
+*          a malformed portable ID or compatible identifier.
+* @internal
+*/
+function getAuthenticationOrigin(id) {
+	try {
+		if (isPortableId(id)) {
+			const canonical = getCanonicalPortableId(id);
+			return canonical == null ? null : getFe34Origin(canonical);
+		}
+		return getFe34Origin(id);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Checks whether two IDs identify the same object.  Two portable IDs, i.e.,
+* `ap:` or `ap+ef61:` URIs or compatible identifiers, are compared by their
+* canonical portable IDs, so that the same object on different gateways and
+* with different location hints matches.  Other IDs have to be equal as
+* they are.
+* @internal
+*/
+function isSameObjectId(a, b) {
+	const aPortable = isPortableId(a);
+	if (aPortable !== isPortableId(b)) return false;
+	if (!aPortable) return a.href === b.href;
+	const canonical = getCanonicalPortableId(a);
+	return canonical != null && canonical === getCanonicalPortableId(b);
+}
+/**
 * Gets the canonical portable ID of an `ap:` or `ap+ef61:` URI or
 * a compatible identifier as it is written, before any URL parsing.
 * Parsing an ID into a `URL` resolves dot segments in its path, which would
@@ -201,4 +245,4 @@ async function isSamePublicKey(a, b) {
 	return x.kty === y.kty && x.crv === y.crv && x.n === y.n && x.e === y.e && x.x === y.x && x.y === y.y;
 }
 //#endregion
-export { hasPortableActor as a, isPortableId as c, isSamePublicKey as d, parseKeyIdString as f, getRawCanonicalPortableId as i, isPortableKeyId as l, getGatewayKeyBase as n, isCompatibleKeyId as o, getPortableDid as r, isPortableActorDocument as s, getCanonicalPortableId as t, isPortableUri as u };
+export { getRawCanonicalPortableId as a, isPortableActorDocument as c, isPortableUri as d, isSameObjectId as f, getPortableDid as i, isPortableId as l, parseKeyIdString as m, getCanonicalPortableId as n, hasPortableActor as o, isSamePublicKey as p, getGatewayKeyBase as r, isCompatibleKeyId as s, getAuthenticationOrigin as t, isPortableKeyId as u };

package/dist/{proof-CQAYqWdj.mjs → proof-DrJWKeOl.mjs}

@@ -1,17 +1,17 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DU8dvnWk.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-jUDFfVgi.mjs";
-import { c as isPortableId, r as getPortableDid } from "./portable-key-id-Bg259c4Z.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-gIhVZO3p.mjs";
+import { n as version, t as name } from "./deno-DB_Sh0LK.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B1H23mlq.mjs";
+import { i as getPortableDid, l as isPortableId } from "./portable-key-id-Ca30-hOa.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-DA3Yx8p2.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { c as getNormalizationContextLoader } from "./ld-BsTkRrwF.mjs";
+import { c as getNormalizationContextLoader } from "./ld-C15yzuY6.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
-import { encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseIri } from "@fedify/vocab-runtime";
+import { encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseGatewayUrl, parseIri } from "@fedify/vocab-runtime";
 import { encodeHex } from "byte-encodings/hex";
 import { isPlainJsonTree, retainSignedRepresentation } from "@fedify/vocab-runtime/internal/signed-representation";
 import jsonld from "@fedify/vocab-runtime/jsonld";
@@ -676,6 +676,7 @@ const FEP_2277_COLLECTION_PROPERTIES = [
 	"prev",
 	"current"
 ].map((property) => AS_NAMESPACE + property);
+const FEP_EF61_GATEWAYS = "https://w3id.org/fep/ef61/gateways";
 const PORTABLE_OBJECT_ID_PATTERN = /^ap(?:\+ef61)?:\/\//i;
 const FUNCTIONAL_PROOF_PROPERTIES = [
 	`${SECURITY_NAMESPACE}cryptosuite`,
@@ -702,6 +703,35 @@ function hasValidPortableProofShape(proofValue) {
 	});
 }
 /**
+* Checks whether an expanded portable actor node has the `gateways` that
+* FEP-ef61 requires: a non-empty list whose items are all HTTP(S) URIs with
+* an empty path, query, and fragment.  Like the generated vocabulary decoder,
+* this also tolerates a plain set of values instead of a `@list`, and gateway
+* strings given as `@value`s instead of `@id`s.
+*/
+function hasValidPortableActorGateways(node) {
+	const values = node[FEP_EF61_GATEWAYS];
+	if (!Array.isArray(values)) return false;
+	let items = values;
+	if (values.some((value) => isJsonLdNode(value) && "@list" in value)) {
+		if (values.length !== 1) return false;
+		items = values[0]["@list"];
+	}
+	if (!Array.isArray(items) || items.length < 1) return false;
+	return items.every((item) => {
+		if (!isJsonLdNode(item)) return false;
+		const gateway = typeof item["@id"] === "string" ? item["@id"] : item["@value"];
+		if (typeof gateway !== "string") return false;
+		try {
+			parseGatewayUrl(gateway);
+		} catch (error) {
+			if (error instanceof TypeError) return false;
+			throw error;
+		}
+		return true;
+	});
+}
+/**
 * Classifies an expanded JSON-LD node into an FEP-2277 core type by the
 * properties it has.
 * @internal
@@ -905,6 +935,15 @@ async function preparePortableObjectProof(jsonLd, options) {
 			}
 		};
 	}
+	if (objectType === "actor" && !hasValidPortableActorGateways(root)) return {
+		prepared: false,
+		root,
+		objectType,
+		result: {
+			verified: false,
+			reason: { type: "invalidGateways" }
+		}
+	};
 	return {
 		prepared: true,
 		root,
@@ -958,7 +997,10 @@ async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
 *
 * Every proof must use a DID URL whose DID matches the portable object's
 * authority, i.e., the DID of its canonical portable ID, and every proof must
-* pass {@link verifyProof}.  The proofs are verified over the document as
+* pass {@link verifyProof}.  A portable actor must also have a non-empty
+* `gateways` list whose items are all HTTP(S) URIs with an empty path, query,
+* and fragment; otherwise, it is rejected with the `invalidGateways` reason
+* before its proofs are verified.  The proofs are verified over the document as
 * given; a compatible identifier is never rewritten into a portable ID.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61

package/dist/{send-DjkQrxt5.mjs → send-CT3a-0Vd.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DU8dvnWk.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-jUDFfVgi.mjs";
-import { n as doubleKnock } from "./http-Bd6rZlJX.mjs";
+import { n as version, t as name } from "./deno-DB_Sh0LK.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-B1H23mlq.mjs";
+import { n as doubleKnock } from "./http-DQf9Mw4V.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/sig/compound-proof-discovery.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-D28gMFqP.mjs";
+import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-B-Fk6Slo.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-discovery.test.ts

package/dist/sig/compound-proof-producer.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-D28gMFqP.mjs";
+import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-B-Fk6Slo.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-producer.test.ts
 const portableId = "ap+ef61://did:key:z6MkAlice/objects/1";

package/dist/sig/compound-proof-verification.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { l as verifyPortableObjectProofPolicy, o as verifyMapLocalProof } from "../proof-CQAYqWdj.mjs";
+import { l as verifyPortableObjectProofPolicy, o as verifyMapLocalProof } from "../proof-DrJWKeOl.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-D28gMFqP.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-B-Fk6Slo.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { CryptographicKey, Multikey, Person } from "@fedify/vocab";

package/dist/sig/compound-proof.test.mjs

@@ -6,9 +6,9 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as signObject, d as verifyProof } from "../proof-CQAYqWdj.mjs";
+import { a as signObject, d as verifyProof } from "../proof-DrJWKeOl.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { o as verifyCompoundProofDocuments } from "../compound-proof-D28gMFqP.mjs";
+import { o as verifyCompoundProofDocuments } from "../compound-proof-B-Fk6Slo.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";