@fedify/fedify 2.4.0-dev.2190 → 2.4.0-dev.2193

package/dist/federation/temporal.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-DKchpKyp.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-DNqluyEc.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { o as createFederation, s as handleWebFinger } from "../middleware-Bdu2-OPD.mjs";
+import { o as createFederation, s as handleWebFinger } from "../middleware-BqqycC0P.mjs";
 import { Image, Link, Person, Tombstone } from "@fedify/vocab";
 import { createTestMeterProvider, test } from "@fedify/fixture";
 import { parseIri } from "@fedify/vocab-runtime";

package/dist/{federation-BSS2dUO7.cjs → federation-BsGo0EH2.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-CCr2_ipG.cjs");
+const require_http = require("./http-BEivI0TS.cjs");
 const require_types = require("./types-poIao40f.cjs");
-const require_portable_collection = require("./portable-collection-DJe_bk50.cjs");
-const require_kv_cache = require("./kv-cache-DUXluAc0.cjs");
+const require_portable_collection = require("./portable-collection-BFSShzwh.cjs");
+const require_kv_cache = require("./kv-cache-1hafSoqH.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -210,6 +210,7 @@ var FederationBuilderImpl = class {
 			if (actor.id == null) logger.warn("Actor dispatcher returned an actor without an id property.  Set the property with Context.getActorUri(identifier).");
 			else if (!portable && actor.id.href != context.getActorUri(identifier).href) logger.warn("Actor dispatcher returned an actor with an id property that does not match the actor URI.  Set the property with Context.getActorUri(identifier).");
 			if (actor instanceof _fedify_vocab.Tombstone) return actor;
+			if (portable && actor.id != null) warnPortableActorGateways(actor.id, actor.gateways);
 			if (actor.id != null && (0, _fedify_vocab_runtime_internal_portable_dereference.isCompatibleEf61Iri)(actor.id)) warnCompatibleActorId(actor.id, actor.gateway);
 			if (portable) this.#warnPortableCollectionIds(context, identifier, actor);
 			if (this.followingCallbacks != null && this.followingCallbacks.dispatcher != null) {
@@ -813,9 +814,28 @@ function warnMismatchedTombstoneId(context, cls, values, tombstone) {
 	});
 }
 /**
+* Warns about an FEP-ef61 portable actor whose `gateways` is empty or has
+* an item that is not an HTTP(S) origin, which FEP-ef61 does not allow.
+* Every item is checked, since the list and its URLs can be mutated after
+* the actor is constructed.
+*/
+function warnPortableActorGateways(actorId, gateways) {
+	if (gateways.length > 0 && gateways.every(_fedify_vocab_runtime.isGatewayUrl)) return;
+	(0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"actor"
+	]).warn("Actor dispatcher returned an FEP-ef61 portable actor, {actorId}, whose gateways property is empty or has an item that is not an HTTP(S) origin.  FEP-ef61 requires a portable actor to have at least one gateway, and every gateway to be an HTTP(S) URI with an empty path, query, and fragment.  Set the gateways property.", {
+		actorId: actorId.href,
+		gateways: gateways.map((g) => g.href)
+	});
+}
+/**
 * Warns about an FEP-ef61 portable actor identified by a compatible identifier
 * that is malformed, or is not on the actor's first gateway, where FEP-ef61
-* requires publishers to construct compatible identifiers.
+* requires publishers to construct compatible identifiers.  A missing or
+* invalid first gateway is reported by {@link warnPortableActorGateways}
+* instead.
 */
 function warnCompatibleActorId(actorId, gateway) {
 	const logger = (0, _logtape_logtape.getLogger)([
@@ -833,8 +853,8 @@ function warnCompatibleActorId(actorId, gateway) {
 		});
 		return;
 	}
-	if (gateway == null || !(0, _fedify_vocab_runtime.isGatewayUrl)(gateway)) logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is an FEP-ef61 compatible identifier, but whose first gateway is not an HTTP(S) origin.  Set the gateways property, and construct the compatible identifier with its first gateway.", { actorId: actorId.href });
-	else if (actorId.origin !== gateway.origin) logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is an FEP-ef61 compatible identifier on another gateway than its first gateway, {gateway}.  FEP-ef61 requires publishers to construct compatible identifiers with the first gateway in the actor's gateways.", {
+	if (gateway == null || !(0, _fedify_vocab_runtime.isGatewayUrl)(gateway)) return;
+	if (actorId.origin !== gateway.origin) logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is an FEP-ef61 compatible identifier on another gateway than its first gateway, {gateway}.  FEP-ef61 requires publishers to construct compatible identifiers with the first gateway in the actor's gateways.", {
 		actorId: actorId.href,
 		gateway: gateway.origin
 	});
@@ -3792,7 +3812,7 @@ function isInvalidJsonLdError(error) {
 	return name === "UnsafeJsonLdError" || error instanceof require_http.InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
 }
 function isValidationTypeError(error) {
-	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || require_http.isInvalidUrlTypeError(error));
+	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:|Invalid FEP-ef61 gateway:)/.test(error.message) || require_http.isInvalidUrlTypeError(error));
 }
 function isPermanentActivityParseError(error) {
 	return isInvalidJsonLdError(error) || isValidationTypeError(error);
@@ -3935,7 +3955,11 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 			return await onNotFound(request);
 		}
 		if (tombstone || result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
-			logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, objects, and tombstones need an Object Integrity Proof made with a key of the DID in their ID.", {
+			if (result.reason.type === "invalidGateways") logger.error("Refusing to serve the portable actor {portableId}, as its gateways property is missing, empty, or has an item that is not an HTTP(S) origin.  FEP-ef61 requires a portable actor to list at least one gateway where it can be retrieved.", {
+				portableId: canonicalId,
+				reason: result.reason.type
+			});
+			else logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, objects, and tombstones need an Object Integrity Proof made with a key of the DID in their ID.", {
 				portableId: canonicalId,
 				reason: result.reason.type
 			});
@@ -4054,13 +4078,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$1.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(require_http.name, require_http.version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$1),
+		kind: getCollectionMetricKind(name$2),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -4106,7 +4130,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 							span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$1, filterPredicate);
+						const items = filterCollectionItems(page.items, name$2, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -4148,7 +4172,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 		} else {
 			const uri = new URL(portable == null ? baseUri : pageBase);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
 				kind: _opentelemetry_api.SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -4164,7 +4188,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 						span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$1, filterPredicate);
+					const items = filterCollectionItems(page.items, name$2, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -5355,8 +5379,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$2, values, context, callbacks, tracerProvider = _opentelemetry_api.trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
-		this.name = name$2;
+	constructor(name$1, values, context, callbacks, tracerProvider = _opentelemetry_api.trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
+		this.name = name$1;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -7235,7 +7259,7 @@ function isPermanentRemoteContextError(error) {
 	return isRemoteContextLoadingFailure(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_http.isClearlyMalformedContextReference(details.url);
 }
 function isPermanentInboxParseError(error) {
-	return error instanceof Error && (error.name === "UnsafeJsonLdError" || error instanceof require_http.InvalidContextReferenceError || isPermanentRemoteContextError(error) || error.name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure(error)) || error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || require_http.isInvalidUrlTypeError(error));
+	return error instanceof Error && (error.name === "UnsafeJsonLdError" || error instanceof require_http.InvalidContextReferenceError || isPermanentRemoteContextError(error) || error.name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure(error)) || error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:|Invalid FEP-ef61 gateway:)/.test(error.message) || require_http.isInvalidUrlTypeError(error));
 }
 function hasLinkedDataSignatureJsonLdProcessingError(error) {
 	if (error.message.startsWith("Maximum deep iterations exceeded")) return true;

package/dist/{http-CCr2_ipG.cjs → http-BEivI0TS.cjs}

@@ -16,7 +16,7 @@ json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2190+be3a8be0";
+var version = "2.4.0-dev.2193+402149b5";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -7473,6 +7473,7 @@ const FEP_2277_COLLECTION_PROPERTIES = [
 	"prev",
 	"current"
 ].map((property) => AS_NAMESPACE + property);
+const FEP_EF61_GATEWAYS = "https://w3id.org/fep/ef61/gateways";
 const PORTABLE_OBJECT_ID_PATTERN = /^ap(?:\+ef61)?:\/\//i;
 const FUNCTIONAL_PROOF_PROPERTIES = [
 	`${SECURITY_NAMESPACE}cryptosuite`,
@@ -7499,6 +7500,35 @@ function hasValidPortableProofShape(proofValue) {
 	});
 }
 /**
+* Checks whether an expanded portable actor node has the `gateways` that
+* FEP-ef61 requires: a non-empty list whose items are all HTTP(S) URIs with
+* an empty path, query, and fragment.  Like the generated vocabulary decoder,
+* this also tolerates a plain set of values instead of a `@list`, and gateway
+* strings given as `@value`s instead of `@id`s.
+*/
+function hasValidPortableActorGateways(node) {
+	const values = node[FEP_EF61_GATEWAYS];
+	if (!Array.isArray(values)) return false;
+	let items = values;
+	if (values.some((value) => isJsonLdNode(value) && "@list" in value)) {
+		if (values.length !== 1) return false;
+		items = values[0]["@list"];
+	}
+	if (!Array.isArray(items) || items.length < 1) return false;
+	return items.every((item) => {
+		if (!isJsonLdNode(item)) return false;
+		const gateway = typeof item["@id"] === "string" ? item["@id"] : item["@value"];
+		if (typeof gateway !== "string") return false;
+		try {
+			(0, _fedify_vocab_runtime.parseGatewayUrl)(gateway);
+		} catch (error) {
+			if (error instanceof TypeError) return false;
+			throw error;
+		}
+		return true;
+	});
+}
+/**
 * Classifies an expanded JSON-LD node into an FEP-2277 core type by the
 * properties it has.
 * @internal
@@ -7702,6 +7732,15 @@ async function preparePortableObjectProof(jsonLd, options) {
 			}
 		};
 	}
+	if (objectType === "actor" && !hasValidPortableActorGateways(root)) return {
+		prepared: false,
+		root,
+		objectType,
+		result: {
+			verified: false,
+			reason: { type: "invalidGateways" }
+		}
+	};
 	return {
 		prepared: true,
 		root,
@@ -7755,7 +7794,10 @@ async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
 *
 * Every proof must use a DID URL whose DID matches the portable object's
 * authority, i.e., the DID of its canonical portable ID, and every proof must
-* pass {@link verifyProof}.  The proofs are verified over the document as
+* pass {@link verifyProof}.  A portable actor must also have a non-empty
+* `gateways` list whose items are all HTTP(S) URIs with an empty path, query,
+* and fragment; otherwise, it is rejected with the `invalidGateways` reason
+* before its proofs are verified.  The proofs are verified over the document as
 * given; a compatible identifier is never rewritten into a portable ID.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61

package/dist/{http-BqN5kyUf.js → http-BGmxtpo2.js}

@@ -3,7 +3,7 @@ import { URLPattern } from "urlpattern-polyfill";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, PUBLIC_COLLECTION, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, metrics, trace } from "@opentelemetry/api";
-import { FetchError, canonicalizePortableUri, encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDidKeyVerificationMethod, parseIri, preloadedContexts, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { FetchError, canonicalizePortableUri, encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDidKeyVerificationMethod, parseGatewayUrl, parseIri, preloadedContexts, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { getPortableGatewayCandidates, isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { encodeHex } from "byte-encodings/hex";
 import jsonld from "@fedify/vocab-runtime/jsonld";
@@ -14,7 +14,7 @@ import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2190+be3a8be0";
+var version = "2.4.0-dev.2193+402149b5";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -3904,6 +3904,7 @@ const FEP_2277_COLLECTION_PROPERTIES = [
 	"prev",
 	"current"
 ].map((property) => AS_NAMESPACE + property);
+const FEP_EF61_GATEWAYS = "https://w3id.org/fep/ef61/gateways";
 const PORTABLE_OBJECT_ID_PATTERN = /^ap(?:\+ef61)?:\/\//i;
 const FUNCTIONAL_PROOF_PROPERTIES = [
 	`${SECURITY_NAMESPACE}cryptosuite`,
@@ -3930,6 +3931,35 @@ function hasValidPortableProofShape(proofValue) {
 	});
 }
 /**
+* Checks whether an expanded portable actor node has the `gateways` that
+* FEP-ef61 requires: a non-empty list whose items are all HTTP(S) URIs with
+* an empty path, query, and fragment.  Like the generated vocabulary decoder,
+* this also tolerates a plain set of values instead of a `@list`, and gateway
+* strings given as `@value`s instead of `@id`s.
+*/
+function hasValidPortableActorGateways(node) {
+	const values = node[FEP_EF61_GATEWAYS];
+	if (!Array.isArray(values)) return false;
+	let items = values;
+	if (values.some((value) => isJsonLdNode(value) && "@list" in value)) {
+		if (values.length !== 1) return false;
+		items = values[0]["@list"];
+	}
+	if (!Array.isArray(items) || items.length < 1) return false;
+	return items.every((item) => {
+		if (!isJsonLdNode(item)) return false;
+		const gateway = typeof item["@id"] === "string" ? item["@id"] : item["@value"];
+		if (typeof gateway !== "string") return false;
+		try {
+			parseGatewayUrl(gateway);
+		} catch (error) {
+			if (error instanceof TypeError) return false;
+			throw error;
+		}
+		return true;
+	});
+}
+/**
 * Classifies an expanded JSON-LD node into an FEP-2277 core type by the
 * properties it has.
 * @internal
@@ -4133,6 +4163,15 @@ async function preparePortableObjectProof(jsonLd, options) {
 			}
 		};
 	}
+	if (objectType === "actor" && !hasValidPortableActorGateways(root)) return {
+		prepared: false,
+		root,
+		objectType,
+		result: {
+			verified: false,
+			reason: { type: "invalidGateways" }
+		}
+	};
 	return {
 		prepared: true,
 		root,
@@ -4186,7 +4225,10 @@ async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
 *
 * Every proof must use a DID URL whose DID matches the portable object's
 * authority, i.e., the DID of its canonical portable ID, and every proof must
-* pass {@link verifyProof}.  The proofs are verified over the document as
+* pass {@link verifyProof}.  A portable actor must also have a non-empty
+* `gateways` list whose items are all HTTP(S) URIs with an empty path, query,
+* and fragment; otherwise, it is rejected with the `invalidGateways` reason
+* before its proofs are verified.  The proofs are verified over the document as
 * given; a compatible identifier is never rewritten into a portable ID.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61

package/dist/{http-Y1ObT1A8.mjs → http-DQf9Mw4V.mjs}

@@ -1,13 +1,13 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-EopndaNb.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-zMe834ID.mjs";
+import { n as version, t as name } from "./deno-DB_Sh0LK.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B1H23mlq.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
 import { m as parseKeyIdString } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as promoteKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-DyXf88bq.mjs";
-import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-Duue9Y2Y.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-DA3Yx8p2.mjs";
+import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-Bmwmq7Y6.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{key-DyXf88bq.mjs → key-DA3Yx8p2.mjs}

@@ -1,8 +1,8 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-EopndaNb.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-zMe834ID.mjs";
+import { n as version, t as name } from "./deno-DB_Sh0LK.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-B1H23mlq.mjs";
 import { c as isPortableActorDocument, d as isPortableUri, l as isPortableId, m as parseKeyIdString, s as isCompatibleKeyId } from "./portable-key-id-Ca30-hOa.mjs";
 import { n as attachKeyOwnerEvidence, t as MAX_PORTABLE_KEY_TTL } from "./key-owner-evidence-APB6NpSk.mjs";
 import { getLogger } from "@logtape/logtape";

package/dist/{kv-cache-DUXluAc0.cjs → kv-cache-1hafSoqH.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-CCr2_ipG.cjs");
+const require_http = require("./http-BEivI0TS.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{kv-cache-C02XitwK.js → kv-cache-DduYhpee.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { G as validateCryptoKey, ot as recordDocumentCache, t as doubleKnock } from "./http-BqN5kyUf.js";
+import { G as validateCryptoKey, ot as recordDocumentCache, t as doubleKnock } from "./http-BGmxtpo2.js";
 import { getLogger } from "@logtape/logtape";
 import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, resolveDocumentLoaderTimeout, validatePublicUrl, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{kv-cache-C8YjNAi_.mjs → kv-cache-OFBvrKh3.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-zMe834ID.mjs";
+import { p as recordDocumentCache } from "./metrics-B1H23mlq.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{ld-oQj6j_hP.mjs → ld-C15yzuY6.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-EopndaNb.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-zMe834ID.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-DyXf88bq.mjs";
+import { n as version, t as name } from "./deno-DB_Sh0LK.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B1H23mlq.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-DA3Yx8p2.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-zMe834ID.mjs → metrics-B1H23mlq.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-EopndaNb.mjs";
+import { n as version, t as name } from "./deno-DB_Sh0LK.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-Ck9yghxs.mjs → middleware-BZQnf0nI.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-Bdu2-OPD.mjs";
+import { n as FederationImpl } from "./middleware-BqqycC0P.mjs";
 export { FederationImpl };

package/dist/{middleware-Bdu2-OPD.mjs → middleware-BqqycC0P.mjs}

@@ -1,29 +1,29 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-EopndaNb.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-zMe834ID.mjs";
+import { n as version, t as name } from "./deno-DB_Sh0LK.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-B1H23mlq.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
 import { d as isPortableUri, f as isSameObjectId, i as getPortableDid, l as isPortableId, n as getCanonicalPortableId, o as hasPortableActor, r as getGatewayKeyBase, s as isCompatibleKeyId, t as getAuthenticationOrigin, u as isPortableKeyId } from "./portable-key-id-Ca30-hOa.mjs";
-import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-DyXf88bq.mjs";
+import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-DA3Yx8p2.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-oQj6j_hP.mjs";
-import { a as signObject, c as verifyPortableObjectProof, i as hasProofLike, s as verifyObject, t as InvalidPortableObjectIdError, u as verifyPortableObjectProofWithRoot } from "./proof-C9115DX_.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as validateMaxSignatures, f as verifyRequest, p as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-Y1ObT1A8.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-u6zzOExF.mjs";
-import { n as kvCache } from "./kv-cache-C8YjNAi_.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-C15yzuY6.mjs";
+import { a as signObject, c as verifyPortableObjectProof, i as hasProofLike, s as verifyObject, t as InvalidPortableObjectIdError, u as verifyPortableObjectProofWithRoot } from "./proof-DrJWKeOl.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as validateMaxSignatures, f as verifyRequest, p as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-DQf9Mw4V.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-DpWYYY6a.mjs";
+import { n as kvCache } from "./kv-cache-OFBvrKh3.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-CEnNz8O7.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-Dem4fbwc.mjs";
-import { t as verifyPortableObject } from "./portable-collection-BL6aZlQ0.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-D0hxFFRB.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-CFF0YNTp.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BVpZBM-V.mjs";
+import { t as verifyPortableObject } from "./portable-collection-Dn2GdZdI.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-CT3a-0Vd.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-0onlMY4u.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-XJ53md4S.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, s as verifyServedPortableObjects, t as containsCompoundPortableObject } from "./compound-proof-F2jjkrt0.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, s as verifyServedPortableObjects, t as containsCompoundPortableObject } from "./compound-proof-B-Fk6Slo.mjs";
 import { t as KvKeyCache } from "./keycache-Da8A8mZa.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-DKchpKyp.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-DNqluyEc.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -1127,7 +1127,7 @@ function isInvalidJsonLdError(error) {
 	return name === "UnsafeJsonLdError" || error instanceof InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
 }
 function isValidationTypeError(error) {
-	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || isInvalidUrlTypeError(error));
+	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:|Invalid FEP-ef61 gateway:)/.test(error.message) || isInvalidUrlTypeError(error));
 }
 function isPermanentActivityParseError(error) {
 	return isInvalidJsonLdError(error) || isValidationTypeError(error);
@@ -1270,7 +1270,11 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 			return await onNotFound(request);
 		}
 		if (tombstone || result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
-			logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, objects, and tombstones need an Object Integrity Proof made with a key of the DID in their ID.", {
+			if (result.reason.type === "invalidGateways") logger.error("Refusing to serve the portable actor {portableId}, as its gateways property is missing, empty, or has an item that is not an HTTP(S) origin.  FEP-ef61 requires a portable actor to list at least one gateway where it can be retrieved.", {
+				portableId: canonicalId,
+				reason: result.reason.type
+			});
+			else logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, objects, and tombstones need an Object Integrity Proof made with a key of the DID in their ID.", {
 				portableId: canonicalId,
 				reason: result.reason.type
 			});
@@ -1389,13 +1393,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$1.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$1),
+		kind: getCollectionMetricKind(name$2),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -1441,7 +1445,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$1, filterPredicate);
+						const items = filterCollectionItems(page.items, name$2, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -1483,7 +1487,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 		} else {
 			const uri = new URL(portable == null ? baseUri : pageBase);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -1499,7 +1503,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$1, filterPredicate);
+					const items = filterCollectionItems(page.items, name$2, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -2690,8 +2694,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
-		this.name = name$2;
+	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
+		this.name = name$1;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -4070,7 +4074,7 @@ function isPermanentRemoteContextError(error) {
 	return isRemoteContextLoadingFailure(error) && typeof details?.url === "string" && !URL.canParse(details.url) && isClearlyMalformedContextReference(details.url);
 }
 function isPermanentInboxParseError(error) {
-	return error instanceof Error && (error.name === "UnsafeJsonLdError" || error instanceof InvalidContextReferenceError || isPermanentRemoteContextError(error) || error.name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure(error)) || error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || isInvalidUrlTypeError(error));
+	return error instanceof Error && (error.name === "UnsafeJsonLdError" || error instanceof InvalidContextReferenceError || isPermanentRemoteContextError(error) || error.name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure(error)) || error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:|Invalid FEP-ef61 gateway:)/.test(error.message) || isInvalidUrlTypeError(error));
 }
 function hasLinkedDataSignatureJsonLdProcessingError(error) {
 	if (error.message.startsWith("Maximum deep iterations exceeded")) return true;