@fedify/fedify 2.4.0-dev.2253 → 2.4.0-dev.2256

package/dist/sig/portable-interop.test.mjs

@@ -0,0 +1,156 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { c as verifyPortableObjectProof, d as verifyProof } from "../proof-8WiH_-Gq.mjs";
+import { n as getKeyOwner } from "../owner-DSJ7nFgy.mjs";
+import { t as verifyPortableObject } from "../portable-collection-qskqXJrH.mjs";
+import { Application, DataIntegrityProof, lookupObject } from "@fedify/vocab";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+//#region test-vectors/fep-ef61/tootik-v0.25.4/actor.json
+var actor_default = {
+	"@context": [
+		"https://www.w3.org/ns/activitystreams",
+		"https://w3id.org/security/data-integrity/v1",
+		"https://w3id.org/security/v1"
+	],
+	id: "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor",
+	type: "Application",
+	inbox: "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor/inbox",
+	outbox: "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor/outbox",
+	preferredUsername: "actor",
+	followers: "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor/followers",
+	publicKey: {
+		"id": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor#main-key",
+		"owner": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor",
+		"publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr70sLuCyvDBKblca6Jsk\nJW5ZmTpmyFK4gY6dpDkjvsokBjTR6oUO5GF7QGT4xGaGDtnzhd+K0/IE2Jo2cbBu\nTAK92xo3qB4nL+0XIfqXK/ju/pIo4ClZ1oHYNeJnmjGDAJmZmaf9/b0sd0osfTPX\nWSqAkgZuxZYrWSXKs6WYuEJof5YfTHgH5PBzwtQGyexZKYkumyrq5lazeEvqBLyx\nyNc5u6LdkkHP+HR9DJIQ3CDv6d1yQ7ELiP5pXvKRV9jJKlBQ1TK1vlMGC8GcBlDy\nQT0UsbM/1lRbxnbbqiwY6rFlT6FpHd5cl9tblGU6sF9gyCDATCHAdZ/2laUzParD\n+QIDAQAB\n-----END PUBLIC KEY-----\n"
+	},
+	icon: [{
+		"type": "Image",
+		"mediaType": "image/gif",
+		"url": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor/icon.gif"
+	}],
+	manuallyApprovesFollowers: false,
+	assertionMethod: [{
+		"id": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor#ed25519-key",
+		"type": "Multikey",
+		"controller": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor",
+		"publicKeyMultibase": "z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE"
+	}, {
+		"id": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor#ml-dsa-44-key",
+		"type": "Multikey",
+		"controller": "https://tootik.example/.well-known/apgateway/did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE/actor",
+		"publicKeyMultibase": "ukCRpmFGeqQvqCAsbrRIKdfH1ZD2Y-2NiDr5tmgYFceiWCipFyeJKL65fEBcHa3gIBJbuzwvTfFeiMppDxvQySHhXFMf12o2mZ1d9Rw5fP9JKxSgCH7TyjeXEsvN6Zv_3q3ignCU3UxQKL5q2Yks9bfQkDxPJdDvzgyP5D0lDWulx1I9wyQS_f0SXG-Muph2rHBIT_u30ZuN7PHNNk7VAv4AWn7DlbJ6h2871YgFD7YHmtZiq_YCWerBe9TPBAoIOYEY1LV_nPVEe5xDIBlQ2EXYcfJviKQ1rB1iP4c0uoxdGm1RLDOXd65EDmtzil_R1Y5Le4s5td6AV2iFanIQtoJabH1IfL3Ju9n1nM-X3T8YM5FCngvoFME7UxhUHUggZ7vbWy_hy99tRvlaPG3U2OogtyPELx1o91itRjVH276UB8frLb06oJj6RzHE8pwfImH7POETjxEMPzfX4RA7BQVge6TU3fiBx4V4wmofJ3eiMu6yo497mUjJMiFjnt4AC1xiY8_XzdAauJag55HjKDf1xKNHIpQe2IE_n2zJvjfh__coWwl5qJLyszAVBZTn-MTg8nS--PTZMZPaDJSwk9NAT6qdCAnaP5PPkoWlTedCVbDNE-az45x9rKs3sob1OVoJW-2Ogf0S37noPe3L2lfUidr32k5fXPCsg3GfB0F5ZS9sQ-ZBzQvgchArohI1DnX9cbObTj4bGrJu_N9SPFLp0jYQb5bujeIDdpiVu46PVbv4fV4gxQAt4XPZLExZq_WQhKVVn3A89NU6qwxKsAp1LWoouehQSSNaC-Wif7ev5vaCSE0eeTOCO0Ip1URirY7hKhjbp-hfAMx_Vnoj5gQeiRQkUW2oxkgXEpfdzJDvVoeaTmJ_k3soJlJYjp9ZJAc9qn8ygsFpRKFMUYZQL3Wcj7vFxjlX_42a-5p0_0UHA7JjK3UlvE_nG9cIeoqU-WgygEU9rf1CCJflppbwXMFmBQvJ1oMDoutbZTuDIdnRO5DVQ4uNEPyT3p_kv0smEGU3lzZERTYHPM-CNEF5Pk2rrVea9WxpC0TG2njHxmHsO0nCWmUgoB3cAMWpby-YBaen1xvXt5po7ge5KD3SC_cXMSLAJem_ZMVWtR070zXCJdsoB-GN8nFTchyjPpI6SLxXcVwWXNEzI_dEvcx0YTEwlI9OEDuF2rizU4UzZMIT_Ec5OgEehh-o0MLpgLRvLo15TOz0FFZfaKYWfVS6CEBxHg0g3XwmvbrhA47ZJNfLYniPV4K7ELTp3nsoe9xZo2yORy8KiYUV9AETu90oZd-ZnZG_J1IXY7HmzT3DQ5rXWRMHx1Uym_SU7TCk0hIvFpta012lS_Hv8OZ2cnXC70VUx8_LS27ICE4k6xJbwxZCZZ0oLZ_XSicvg9vOP_N7KWbR_Jc7sxjpIDc2IY9EUNn0FiGs6IDy-YJJ5kq31N0Di28uYuX910sAbymPGl--SD1feo4-SBXA9qejrfq85iHcgKWpOVmID1HxulHKZRcKM-T_TfEVlHUPvkiPo61xda2ak1ni05GpPc_iknAFUbM1D6eIh4mFSxdnLTDXVkvNByPb8QCaZCwOSiN5bDy-CvHseH7uuDrwilnqgMruLQmVj0oj2HM1vsjQqXMdVWi6dtfaj1qqyf8Cti_bt7m0qPKe4B6Mc9ALBFtk6gGLjAuygg4_WSCAr8WPnDjrLEI7Xmo_uFvPRsDEfQUCvXVP_vapaCr6vSPvQ-hJmXy2-u5qe"
+	}],
+	"implements": [
+		{
+			"href": "https://datatracker.ietf.org/doc/html/rfc9421",
+			"name": "RFC-9421: HTTP Message Signatures"
+		},
+		{
+			"href": "https://datatracker.ietf.org/doc/html/rfc9421#name-eddsa-using-curve-edwards25",
+			"name": "RFC-9421 signatures using the Ed25519 algorithm"
+		},
+		{
+			"href": "https://c2sp.org/httpsig-pq@v1.0.0#ml-dsa-44",
+			"name": "RFC-9421 signatures using the ml-dsa-44 algorithm"
+		}
+	],
+	gateways: ["https://tootik.example"],
+	proof: {
+		"@context": [
+			"https://www.w3.org/ns/activitystreams",
+			"https://w3id.org/security/data-integrity/v1",
+			"https://w3id.org/security/v1"
+		],
+		"type": "DataIntegrityProof",
+		"cryptosuite": "eddsa-jcs-2022",
+		"verificationMethod": "did:key:z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE#z6MknxT9xX8cmnsEqBk2u74aYaGQNjVQL1eHxhn1qb27p5vE",
+		"proofPurpose": "assertionMethod",
+		"proofValue": "zjGdNqPpqgx45ecMAz8jY3gVRrTphG5Cn7v9EiBKn7WyeHtdvTYPSkzyvWqZqfQuw92Kn3pD58qXw6wFTLAvkWee",
+		"created": "2026-09-30T11:57:45Z"
+	}
+};
+//#endregion
+//#region src/sig/portable-interop.test.ts
+const options = {
+	contextLoader: mockDocumentLoader,
+	documentLoader() {
+		throw new TypeError("The captured did:key proof must resolve locally");
+	}
+};
+test("tootik v0.25.4 actor has a valid DID proof", async () => {
+	const key = await verifyProof(actor_default, await DataIntegrityProof.fromJsonLd(actor_default.proof, options), options);
+	assert(key != null);
+	assertEquals(key.id?.href, actor_default.proof.verificationMethod);
+});
+test("tootik v0.25.4 actor proof rejects tampering", async () => {
+	const proof = await DataIntegrityProof.fromJsonLd(actor_default.proof, options);
+	assertEquals(await verifyProof({
+		...actor_default,
+		preferredUsername: "tampered"
+	}, proof, options), null);
+});
+test("tootik v0.25.4 actor retains its unmapped gateways", async () => {
+	const original = structuredClone(actor_default);
+	assertEquals(actor_default.gateways, ["https://tootik.example"]);
+	const parsed = await Application.fromJsonLd(actor_default, options);
+	assertEquals(parsed.id?.href, actor_default.id);
+	assertEquals(parsed.gateways, [new URL("https://tootik.example")]);
+	assert((await verifyPortableObjectProof(actor_default, options)).verified);
+	assertEquals(actor_default, original);
+});
+const loadedOptions = {
+	contextLoader: mockDocumentLoader,
+	documentLoader(url) {
+		assertEquals(url.split("#")[0], actor_default.id);
+		return Promise.resolve({
+			document: structuredClone(actor_default),
+			documentUrl: actor_default.id,
+			contextUrl: null
+		});
+	}
+};
+test("tootik v0.25.4 actor can be looked up and own a gateway key", async () => {
+	const parsed = await lookupObject(actor_default.id, {
+		...loadedOptions,
+		verifyPortableObject: verifyPortableObjectProof
+	});
+	assert(parsed instanceof Application);
+	assertEquals(parsed.gateways, [new URL("https://tootik.example")]);
+	const owner = await getKeyOwner(new URL(actor_default.publicKey.id), loadedOptions);
+	assert(owner != null);
+	assertEquals(owner.id?.href, actor_default.id);
+	assertEquals(owner.gateways, [new URL("https://tootik.example")]);
+});
+test("tootik v0.25.4 actor authenticates its gateway for collections", async () => {
+	const result = await verifyPortableObject({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: actor_default.outbox,
+		type: "OrderedCollection",
+		attributedTo: actor_default.id,
+		orderedItems: []
+	}, {
+		...loadedOptions,
+		documentUrl: new URL(actor_default.outbox)
+	});
+	assert(result.verified);
+	assertEquals(result.method, "gateway");
+	if (result.method === "gateway") assertEquals(result.gateway, new URL("https://tootik.example"));
+});
+test("tootik v0.25.4 actor rejects tampered gateways", async () => {
+	assertEquals(await verifyPortableObjectProof({
+		...actor_default,
+		gateways: ["https://attacker.example"]
+	}, options), {
+		verified: false,
+		reason: {
+			type: "invalidProof",
+			proofIndex: 0
+		}
+	});
+});
+//#endregion
+export {};

package/dist/sig/portable-key.test.mjs

@@ -2,13 +2,13 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
-import { a as fetchKeyDetailed, i as fetchKey } from "../key-BlTaKABr.mjs";
-import { h as verifyJsonLd, p as signJsonLd } from "../ld-Dx8r_qJU.mjs";
-import { d as verifyProof, r as createProof } from "../proof-CZrjvoJ3.mjs";
-import { n as resolvePortableActorKey } from "../portable-key-CPN0QZSA.mjs";
-import { f as verifyRequest, l as signRequest, p as verifyRequestDetailed } from "../http-CUyBaVsQ.mjs";
+import { a as fetchKeyDetailed, i as fetchKey } from "../key-CEsu7oaD.mjs";
+import { h as verifyJsonLd, p as signJsonLd } from "../ld-Cf4CPWN_.mjs";
+import { d as verifyProof, r as createProof } from "../proof-8WiH_-Gq.mjs";
+import { n as resolvePortableActorKey } from "../portable-key-woGH_1nn.mjs";
+import { f as verifyRequest, l as signRequest, p as verifyRequestDetailed } from "../http-DkqWu-sm.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-B61jjp5K.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DSJ7nFgy.mjs";
 import { t as KvKeyCache } from "../keycache-Da8A8mZa.mjs";
 import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 import { FetchError, encodeMultibase, exportDidKey, exportSpki, parseIri, preloadedContexts } from "@fedify/vocab-runtime";

package/dist/sig/proof.test.mjs

@@ -10,10 +10,10 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as signObject, c as verifyPortableObjectProof, d as verifyProof, i as hasProofLike, r as createProof, s as verifyObject } from "../proof-CZrjvoJ3.mjs";
-import { f as verifyRequest } from "../http-CUyBaVsQ.mjs";
+import { a as signObject, c as verifyPortableObjectProof, d as verifyProof, i as hasProofLike, r as createProof, s as verifyObject } from "../proof-8WiH_-Gq.mjs";
+import { f as verifyRequest } from "../http-DkqWu-sm.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-fbmPhCdS.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-CIP_SG39.mjs";
 import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place, Translation } from "@fedify/vocab";
 import { decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
@@ -1032,6 +1032,91 @@ test("verifyPortableObjectProof()", async (t) => {
 			reason: { type: "invalidGateways" }
 		});
 	});
+	await t.step("verifies JCS-signed actors with unmapped gateways", async () => {
+		for (const id of [`ap+ef61://${portableDid}/actor`, `https://gateway.example/.well-known/apgateway/${portableDid}/actor`]) {
+			const signed = await signPortableJsonLd({
+				"@context": portableContext,
+				id,
+				type: "Person",
+				inbox: `${id}/inbox`,
+				outbox: `${id}/outbox`,
+				gateways: ["https://gateway.example", "https://other.example"]
+			});
+			const original = structuredClone(signed);
+			assert((await verifyPortableObjectProof(signed, options)).verified);
+			assertEquals(signed, original);
+			assertEquals(await verifyPortableObjectProof({
+				...signed,
+				gateways: ["https://attacker.example"]
+			}, options), {
+				verified: false,
+				reason: {
+					type: "invalidProof",
+					proofIndex: 0
+				}
+			});
+		}
+	});
+	await t.step("rejects malformed unmapped actor gateways", async () => {
+		const id = `ap+ef61://${portableDid}/actor`;
+		for (const gateways of [
+			[],
+			["https://gateway.example", 42],
+			[{ bad: "https://gateway.example" }],
+			["ftp://gateway.example"],
+			["https://gateway.example/path"],
+			["https://gateway.example/?query"],
+			["https://gateway.example/#fragment"],
+			["https://user:password@gateway.example"]
+		]) assertEquals(await verifyPortableObjectProof(await signPortableJsonLd({
+			"@context": portableContext,
+			id,
+			type: "Person",
+			inbox: `${id}/inbox`,
+			outbox: `${id}/outbox`,
+			gateways
+		}), options), {
+			verified: false,
+			reason: { type: "invalidGateways" }
+		}, JSON.stringify(gateways));
+	});
+	await t.step("does not replace context-defined gateway semantics", async () => {
+		const id = `ap+ef61://${portableDid}/actor`;
+		const actor = {
+			"@context": portableContext,
+			id,
+			type: "Person",
+			inbox: `${id}/inbox`,
+			outbox: `${id}/outbox`,
+			gateways: ["https://gateway.example"]
+		};
+		const property = "https://w3id.org/fep/ef61/gateways";
+		for (const extra of [
+			{ [property]: { "@list": [] } },
+			{ [property]: { "@list": [{ "@id": "https://bad.example/path" }] } },
+			{ "@context": [...portableContext, { gateways: null }] },
+			{ "@context": [...portableContext, { gateways: "https://other.example/gateways" }] },
+			{ "@context": [...portableContext, { Person: {
+				"@id": "https://www.w3.org/ns/activitystreams#Person",
+				"@context": { gateways: null }
+			} }] }
+		]) assertEquals(await verifyPortableObjectProof(await signPortableJsonLd({
+			...actor,
+			...extra
+		}), options), {
+			verified: false,
+			reason: { type: "invalidGateways" }
+		}, JSON.stringify(extra));
+		assert((await verifyPortableObjectProof(await signPortableJsonLd({
+			...actor,
+			gateways: ["https://bad.example/path"],
+			[property]: { "@list": [{ "@id": "https://canonical.example" }] }
+		}), options)).verified);
+		assertEquals(await verifyPortableObjectProof(await signPortableJsonLd(actor, { proofOptions: { cryptosuite: "eddsa-rdfc-2022" } }), options), {
+			verified: false,
+			reason: { type: "invalidGateways" }
+		});
+	});
 	await t.step("checks gateways only for FEP-2277 actors", async () => {
 		assert((await verifyPortableObjectProof(await signPortableJsonLd({
 			"@context": portableContext,

package/dist/sig/tootik-request-interop.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/sig/tootik-request-interop.test.mjs

@@ -0,0 +1,190 @@
+import { Temporal } from "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { c as verifyPortableObjectProof } from "../proof-8WiH_-Gq.mjs";
+import { p as verifyRequestDetailed } from "../http-DkqWu-sm.mjs";
+import { o as createFederation } from "../middleware-Dxn0E9ES.mjs";
+import { t as doesActorOwnKey } from "../owner-DSJ7nFgy.mjs";
+import { Follow, Person } from "@fedify/vocab";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+import { encodeHex } from "byte-encodings/hex";
+//#region test-vectors/fep-ef61/tootik-v0.25.4/follow/actor.json
+var actor_default = {
+	"@context": [
+		"https://www.w3.org/ns/activitystreams",
+		"https://w3id.org/security/data-integrity/v1",
+		"https://w3id.org/security/v1"
+	],
+	id: "https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor",
+	type: "Person",
+	inbox: "https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor/inbox",
+	outbox: "https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor/outbox",
+	preferredUsername: "alice",
+	followers: "https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor/followers",
+	publicKey: {
+		"id": "https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor#main-key",
+		"owner": "https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor",
+		"publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyLpYZnhnVih6ToB4UThp\nEZIcxbBcGng71XeEfiR42v+cCyUL+jzQm12x/I0a3FNh4dzIicMvtbmLewQ/HscR\nUNIxAFHF8GqshIjg2tDAmGswTQDsvTzBsaEixXtL0qTTX8X0tFzVKJEsMJJ99jzg\nodERW73G55WwpJYyI4v1RT3G5tU3p0tmD52hhCLCRLRCPKy75iz416nCwDt5sA8B\nowVE5n/J+tjqG3umnnI3gJpTtuJxTyB/SVjLjnC604RKowwQQTHGAmcl3E5F3IrK\nfnmfqdXNCrNbfvJFFAWB+XNXFB0I+fJbGUZAOYMfjhMGEpPzzkKI8cI1eR+Z5DeZ\nGQIDAQAB\n-----END PUBLIC KEY-----\n"
+	},
+	icon: [{
+		"type": "Image",
+		"mediaType": "image/gif",
+		"url": "https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor/icon.gif"
+	}],
+	manuallyApprovesFollowers: false,
+	assertionMethod: [{
+		"id": "https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor#ed25519-key",
+		"type": "Multikey",
+		"controller": "https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor",
+		"publicKeyMultibase": "z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR"
+	}, {
+		"id": "https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor#ml-dsa-44-key",
+		"type": "Multikey",
+		"controller": "https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor",
+		"publicKeyMultibase": "ukCQjRdBDVD0QfnNnj4wFAJE82TmNXoNQ80Rf6s3ivFXlFCzb5_tZHVhfsR5JysgCbOqYPnXYyXIgXAm_klgaj1a4_MB-KLhmueucnnMKUjl60ORt4RG2fDAjZoCzBy-m7PMX5hByOfuDTXbAhSFhG44xvBumN2x877PLudpMqhe9hhBDwgL4NTxUWOP3xJR4KhO0GMzjA6r4HGw0F2Mw3cYQNJs2t40k9w_Yt1qiVfyr4Qk0pk5vnZEkNFF71OBm-SUUSPtrHQEo02HhElN7uFE8wgYmziC_RqzrvyWAi9XQofgDGps2d-xXQew28NkyhAjv-7yIwd3ukjm_0UxjslLFpcjRAW7hNkrIm6oxV_Wv3ynpUVII7uc6v3Q3hkTtJxL4bcsl-oOpZKAqJide5A09G0XE_PvPrnVU3n9hH1HIhs4aWUeo3xda_gLfA5yoavGhqh1oOKnT3yiZYysjKt4GbdcLE_AMCDvWAqLdHTywnl5CG_9gUa3GlgjEsrJK8-SWCXoVgjQmGtdLWWMXTwzAwNZZwkoiR72v0uVOAzE54U_0oz6_Fowdgr29o0qu8TTb6NY70fF34XMWDDlKOWpgo7s5ejL15jfsrzcLhzP1xQlcBqQRZIsSQ_e0z_6mPJlYMu-UjsJIu4SM1__mn48TAQbw__B7VtClD_wGpedwF8gPpATziNsmOVvK8LKtYt983i2bzLYlV3Um31R4r-0i13JY6tBDC3SXkbOyOW3HkfecC1EJ11ffqoBwYT6KJGYH1pd8YR7cvwQn6C4kItLQnoUcIPBY7hKmw6B78e0ZexMMZlmQkW_JEHpgRi0Fb9atgSfGs8IIHTZGOkU5MGUUH1Evqz995dqFjoUxZaCGNKE2Rh-c0F4UdVToex7ZniQOFL1-D16mTloNwPgA9tvd7SUnSY2fr_E4Vyt-Rvcy_azBWBZWPzKdOy9u0OEW8uLeX680qp1Qbx97zDwCsiNAoTRMPyS_azqB12RThb3L-o28UXw5cPyeW9NSSN3G4yaweaIDmQ16vB1biKknrOU9XNVwkwZ4ilzYoESkGmQoCOomrNjGclx99d42S_7laMBlOkQcy846EyxhaHpkOj7t5LIU4Vs1TKeXXDV08wZQHz_r557uwtly8ltLHCg1pWm6MJNRgkhcGBhlE7Jt3gybA9HkYrg_x3NTR-uQocckeUbZZI1Q0aQuMa_F6_qC8WJOAkGDfERlFs7-gVjqYtTSHFLky3B_CgZukp_YZ-HLDlbxAO2qw_itfcn3fn95LLPUxiOZvB49xyha_z2r4rHt9R0BymvDM9ufp-pg2CiLBe3cPiy1Ck_BE7kvA7TyjShi3YyQIGfUcwAoWXOj4lKwejeqUmsjJ-gpD2iVJ3frWao9Cu846ubamb6wQZf5faAx6yTJsHLYdeDBqqJRCMSVEnOYHf6SaNfzdE8EFqCJ7LP2IYDnSFaiZovhja6BJBM4fphH27mnkrQ10whn35XX843QVAOLJa5fn4GoIwkSFY0PSL1J4MT1MobKfA0lROfF5fE29sKLRt-wbnHveAFE_CRiyzW6IFQO9flnSmn83VxigN2hv_xD51KX6p8dCzX1QLl0S9fWF1K9iHkq4ulz6slvypfacesLLGvbVnAWX491PPq9LIOHjCLoZbr1Ap8vkLw61-XvDFSBHUxGKvrlpPOKO5V3zop0sT_QiEymx9DpGAGrbYiyDEC3LhNmD14DxRdRqQLG3wW6HFTMJtl6"
+	}],
+	gateways: ["https://tootik.example"],
+	proof: {
+		"@context": [
+			"https://www.w3.org/ns/activitystreams",
+			"https://w3id.org/security/data-integrity/v1",
+			"https://w3id.org/security/v1"
+		],
+		"type": "DataIntegrityProof",
+		"cryptosuite": "eddsa-jcs-2022",
+		"verificationMethod": "did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR#z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR",
+		"proofPurpose": "assertionMethod",
+		"proofValue": "z2G5haKKAJk3rfL8njG9V2jybnPuHrXjR8ipPBjDSFim9cFuJ9xEMEWBLQLdBmoQKXmHhqXfheadf8EaNW3cEpX8s",
+		"created": "2026-09-30T13:25:15Z"
+	}
+};
+//#endregion
+//#region test-vectors/fep-ef61/tootik-v0.25.4/follow/request.json
+var url = "https://fedify.example:18444/users/alice/inbox";
+var method = "POST";
+var headers = [
+	["accept-encoding", "gzip"],
+	["content-length", "1033"],
+	["content-type", "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""],
+	["date", "Wed, 30 Sep 2026 13:30:43 GMT"],
+	["digest", "SHA-256=ZlDZCndYkYcCvPMpFmRZJE+QT1SVtwope+KPaV5U/r8="],
+	["host", "fedify.example:18444"],
+	["signature", "keyId=\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date content-type digest\",signature=\"Rqd+mtn7knlPY5SXUE2Zz93ICDgBeamFu5v8SagsII8vYcBTX1gan+S0oded4+f4gLB0cs+xdlaqeAUBj3BtWYBJ/cEcCWDFp+bB0xhq/grE/xt4fkdgCCfXWSU2EnJuFCEmUoB1zRemNvTOHwZV4wDrkLVwQsIxrUIjPbMFTVGyMjnpY71Ydta3rdia7VW0VWK3gEC4FJ6YweFxV52dmcOTmA3Qj1h0riHHVEZXs5UOzPJLL6FJQoz8ezyjE7LanxSoXpeOSHa5K1fAo9i35eJr1/eQdFpHt7ftabpv3+6u6MhCFAt2lJs3XJbJZL8DYNkYwJNAYi9fqmH8JOVuMw==\""],
+	["user-agent", "tootik/0.25.4"]
+];
+var capturedAt$1 = "2026-09-30T13:30:43.325Z";
+//#endregion
+//#region test-vectors/fep-ef61/tootik-v0.25.4/follow/metadata.json
+var capturedAt = "2026-09-30T13:30:43.325Z";
+var requestBodySha256 = "6650d90a7758918702bcf329166459244f904f5495b70a297be28f695e54febf";
+var actorBodySha256 = "a58dad10d1051aed670bd79ee7dbfb9d3606cc8e6f231a9a742edd9317b28cd8";
+//#endregion
+//#region test-vectors/fep-ef61/tootik-v0.25.4/follow/raw-bodies.json
+var requestBody = "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\",\"https://w3id.org/security/v1\"],\"id\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor/follow/01a0f282-9cba-7125-af77-e8c7210b7b65\",\"type\":\"Follow\",\"actor\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor\",\"object\":\"https://fedify.example:18444/users/alice\",\"to\":[\"https://fedify.example:18444/users/alice\"],\"cc\":[],\"proof\":{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\",\"https://w3id.org/security/v1\"],\"type\":\"DataIntegrityProof\",\"cryptosuite\":\"eddsa-jcs-2022\",\"verificationMethod\":\"did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR#z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR\",\"proofPurpose\":\"assertionMethod\",\"proofValue\":\"z4yttRN3ak6xdXqdkg6KF9UyiVLv85tbcEvGFEcAKRSg5hpzhMFZzK2A8dp3o3wnJq5CA9t6nc47umjJkjmT5Kpmk\",\"created\":\"2026-09-30T13:30:41Z\"}}";
+var actorBody = "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\",\"https://w3id.org/security/v1\"],\"id\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor\",\"type\":\"Person\",\"inbox\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor/inbox\",\"outbox\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor/outbox\",\"preferredUsername\":\"alice\",\"followers\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor/followers\",\"publicKey\":{\"id\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor#main-key\",\"owner\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor\",\"publicKeyPem\":\"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyLpYZnhnVih6ToB4UThp\\nEZIcxbBcGng71XeEfiR42v+cCyUL+jzQm12x/I0a3FNh4dzIicMvtbmLewQ/HscR\\nUNIxAFHF8GqshIjg2tDAmGswTQDsvTzBsaEixXtL0qTTX8X0tFzVKJEsMJJ99jzg\\nodERW73G55WwpJYyI4v1RT3G5tU3p0tmD52hhCLCRLRCPKy75iz416nCwDt5sA8B\\nowVE5n/J+tjqG3umnnI3gJpTtuJxTyB/SVjLjnC604RKowwQQTHGAmcl3E5F3IrK\\nfnmfqdXNCrNbfvJFFAWB+XNXFB0I+fJbGUZAOYMfjhMGEpPzzkKI8cI1eR+Z5DeZ\\nGQIDAQAB\\n-----END PUBLIC KEY-----\\n\"},\"icon\":[{\"type\":\"Image\",\"mediaType\":\"image/gif\",\"url\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor/icon.gif\"}],\"manuallyApprovesFollowers\":false,\"assertionMethod\":[{\"id\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor#ed25519-key\",\"type\":\"Multikey\",\"controller\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor\",\"publicKeyMultibase\":\"z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR\"},{\"id\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor#ml-dsa-44-key\",\"type\":\"Multikey\",\"controller\":\"https://tootik.example/.well-known/apgateway/did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR/actor\",\"publicKeyMultibase\":\"ukCQjRdBDVD0QfnNnj4wFAJE82TmNXoNQ80Rf6s3ivFXlFCzb5_tZHVhfsR5JysgCbOqYPnXYyXIgXAm_klgaj1a4_MB-KLhmueucnnMKUjl60ORt4RG2fDAjZoCzBy-m7PMX5hByOfuDTXbAhSFhG44xvBumN2x877PLudpMqhe9hhBDwgL4NTxUWOP3xJR4KhO0GMzjA6r4HGw0F2Mw3cYQNJs2t40k9w_Yt1qiVfyr4Qk0pk5vnZEkNFF71OBm-SUUSPtrHQEo02HhElN7uFE8wgYmziC_RqzrvyWAi9XQofgDGps2d-xXQew28NkyhAjv-7yIwd3ukjm_0UxjslLFpcjRAW7hNkrIm6oxV_Wv3ynpUVII7uc6v3Q3hkTtJxL4bcsl-oOpZKAqJide5A09G0XE_PvPrnVU3n9hH1HIhs4aWUeo3xda_gLfA5yoavGhqh1oOKnT3yiZYysjKt4GbdcLE_AMCDvWAqLdHTywnl5CG_9gUa3GlgjEsrJK8-SWCXoVgjQmGtdLWWMXTwzAwNZZwkoiR72v0uVOAzE54U_0oz6_Fowdgr29o0qu8TTb6NY70fF34XMWDDlKOWpgo7s5ejL15jfsrzcLhzP1xQlcBqQRZIsSQ_e0z_6mPJlYMu-UjsJIu4SM1__mn48TAQbw__B7VtClD_wGpedwF8gPpATziNsmOVvK8LKtYt983i2bzLYlV3Um31R4r-0i13JY6tBDC3SXkbOyOW3HkfecC1EJ11ffqoBwYT6KJGYH1pd8YR7cvwQn6C4kItLQnoUcIPBY7hKmw6B78e0ZexMMZlmQkW_JEHpgRi0Fb9atgSfGs8IIHTZGOkU5MGUUH1Evqz995dqFjoUxZaCGNKE2Rh-c0F4UdVToex7ZniQOFL1-D16mTloNwPgA9tvd7SUnSY2fr_E4Vyt-Rvcy_azBWBZWPzKdOy9u0OEW8uLeX680qp1Qbx97zDwCsiNAoTRMPyS_azqB12RThb3L-o28UXw5cPyeW9NSSN3G4yaweaIDmQ16vB1biKknrOU9XNVwkwZ4ilzYoESkGmQoCOomrNjGclx99d42S_7laMBlOkQcy846EyxhaHpkOj7t5LIU4Vs1TKeXXDV08wZQHz_r557uwtly8ltLHCg1pWm6MJNRgkhcGBhlE7Jt3gybA9HkYrg_x3NTR-uQocckeUbZZI1Q0aQuMa_F6_qC8WJOAkGDfERlFs7-gVjqYtTSHFLky3B_CgZukp_YZ-HLDlbxAO2qw_itfcn3fn95LLPUxiOZvB49xyha_z2r4rHt9R0BymvDM9ufp-pg2CiLBe3cPiy1Ck_BE7kvA7TyjShi3YyQIGfUcwAoWXOj4lKwejeqUmsjJ-gpD2iVJ3frWao9Cu846ubamb6wQZf5faAx6yTJsHLYdeDBqqJRCMSVEnOYHf6SaNfzdE8EFqCJ7LP2IYDnSFaiZovhja6BJBM4fphH27mnkrQ10whn35XX843QVAOLJa5fn4GoIwkSFY0PSL1J4MT1MobKfA0lROfF5fE29sKLRt-wbnHveAFE_CRiyzW6IFQO9flnSmn83VxigN2hv_xD51KX6p8dCzX1QLl0S9fWF1K9iHkq4ulz6slvypfacesLLGvbVnAWX491PPq9LIOHjCLoZbr1Ap8vkLw61-XvDFSBHUxGKvrlpPOKO5V3zop0sT_QiEymx9DpGAGrbYiyDEC3LhNmD14DxRdRqQLG3wW6HFTMJtl6\"}],\"gateways\":[\"https://tootik.example\"],\"proof\":{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/data-integrity/v1\",\"https://w3id.org/security/v1\"],\"type\":\"DataIntegrityProof\",\"cryptosuite\":\"eddsa-jcs-2022\",\"verificationMethod\":\"did:key:z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR#z6MkpWqhz4YAuBfC4ddjU49mGfs6CAuYcm243K5hW2YEGAyR\",\"proofPurpose\":\"assertionMethod\",\"proofValue\":\"z2G5haKKAJk3rfL8njG9V2jybnPuHrXjR8ipPBjDSFim9cFuJ9xEMEWBLQLdBmoQKXmHhqXfheadf8EaNW3cEpX8s\",\"created\":\"2026-09-30T13:25:15Z\"}}";
+//#endregion
+//#region src/sig/tootik-request-interop.test.ts
+const body = requestBody;
+const activity = JSON.parse(body);
+async function sha256(value) {
+	return encodeHex(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value))));
+}
+function loader(document = actor_default) {
+	return (url) => {
+		assertEquals(url.split("#")[0], actor_default.id);
+		return Promise.resolve({
+			document: structuredClone(document),
+			documentUrl: actor_default.id,
+			contextUrl: null
+		});
+	};
+}
+const options = {
+	documentLoader: loader(),
+	contextLoader: mockDocumentLoader,
+	currentTime: Temporal.Instant.from(capturedAt$1)
+};
+function request(requestBody = body, url$1 = url, headers$2 = new Headers(headers)) {
+	return new Request(url$1, {
+		method,
+		headers: headers$2,
+		body: requestBody
+	});
+}
+async function deliver(requestBody) {
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderFactory: () => loader(),
+		contextLoaderFactory: () => mockDocumentLoader,
+		signatureTimeWindow: false
+	});
+	federation.setActorDispatcher("/users/{identifier}", (ctx, identifier) => identifier === "alice" ? new Person({
+		id: ctx.getActorUri(identifier),
+		inbox: ctx.getInboxUri(identifier)
+	}) : null).setKeyPairsDispatcher(() => []);
+	const received = [];
+	federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Follow, (_ctx, follow) => {
+		received.push(follow);
+	});
+	return {
+		response: await federation.fetch(request(requestBody), { contextData: void 0 }),
+		received
+	};
+}
+test("tootik v0.25.4 captured Follow verifies its proof and HTTP signature", async () => {
+	const actorBody$1 = actorBody;
+	assertEquals(await sha256(body), requestBodySha256);
+	assertEquals(await sha256(actorBody$1), actorBodySha256);
+	assertEquals(JSON.parse(actorBody$1), actor_default);
+	assertEquals(activity.type, "Follow");
+	assertEquals(actor_default.type, "Person");
+	assertEquals(activity.actor, actor_default.id);
+	assert((await verifyPortableObjectProof(activity, options)).verified);
+	const verified = await verifyRequestDetailed(request(), options);
+	assert(verified.verified);
+	assertEquals(verified.key.id?.href, actor_default.publicKey.id);
+	assert(await doesActorOwnKey(await Follow.fromJsonLd(activity, options), verified.key, options));
+	assertEquals(capturedAt$1, capturedAt);
+});
+test("tootik v0.25.4 captured Follow reaches the Fedify inbox listener", async () => {
+	const { response, received } = await deliver(body);
+	assertEquals(response.status, 202);
+	assertEquals(received.length, 1);
+	assertEquals(received[0].id?.href, activity.id);
+	assertEquals(received[0].actorId?.href, actor_default.id);
+});
+test("tootik v0.25.4 captured Follow rejects body tampering", async () => {
+	const tampered = {
+		...activity,
+		object: "https://fedify.example:18444/users/mallory"
+	};
+	assertEquals((await verifyPortableObjectProof(tampered, options)).verified, false);
+	const changedBody = JSON.stringify(tampered);
+	assertEquals((await verifyRequestDetailed(request(changedBody), options)).verified, false);
+	const { response, received } = await deliver(changedBody);
+	assertEquals(response.status, 401);
+	assertEquals(received.length, 0);
+});
+test("tootik v0.25.4 captured Follow rejects signed header and path tampering", async () => {
+	const headers$1 = new Headers(headers);
+	headers$1.set("Content-Type", "application/json");
+	assertEquals((await verifyRequestDetailed(request(body, url, headers$1), options)).verified, false);
+	assertEquals((await verifyRequestDetailed(request(body, `${url}/tampered`), options)).verified, false);
+});
+test("tootik v0.25.4 captured Follow rejects a tampered actor proof", async () => {
+	const tampered = {
+		...actor_default,
+		preferredUsername: "mallory"
+	};
+	assertEquals((await verifyPortableObjectProof(tampered, options)).verified, false);
+	assertEquals((await verifyRequestDetailed(request(), {
+		...options,
+		documentLoader: loader(tampered)
+	})).verified, false);
+});
+//#endregion
+export {};

package/dist/sig/tootik-send-interop.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";