@fedify/fedify 2.4.0-dev.2253 → 2.4.0-dev.2259

package/dist/sig/compound-proof-producer.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-CcWDD5VB.mjs";
+import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-CMPv4UK0.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-producer.test.ts
 const portableId = "ap+ef61://did:key:z6MkAlice/objects/1";

package/dist/sig/compound-proof-verification.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { l as verifyPortableObjectProofPolicy, o as verifyMapLocalProof } from "../proof-CZrjvoJ3.mjs";
+import { l as verifyPortableObjectProofPolicy, o as verifyMapLocalProof } from "../proof-BHRf_jMG.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-CcWDD5VB.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, o as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-CMPv4UK0.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { CryptographicKey, Multikey, Person } from "@fedify/vocab";
@@ -812,5 +812,22 @@ test("verifyCompoundPortableObjectProofs() leaves keys at DID URLs alone", async
 	assert(result.verified);
 	assertEquals(result.portableObjects.map((o) => o.path), [""]);
 });
+test("compound proof observation does not throw for malformed subject IDs", async () => {
+	const { verificationObservation } = await import("../verification-C3954hQh.mjs");
+	const evidence = { attempts: [] };
+	const result = await verifyCompoundPortableObjectProofs({
+		"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+		id: "ap://did%ZZkey/objects/1",
+		type: "Note",
+		proof: {}
+	}, limits, {
+		...options,
+		[verificationObservation]: evidence
+	});
+	assertEquals(result.status, "ok");
+	assert(result.status === "ok" && !result.verified);
+	assertEquals(evidence.attempts[0].subject.id, null);
+	assertEquals(evidence.attempts[0].subject.pointer, "");
+});
 //#endregion
 export {};

package/dist/sig/compound-proof.test.mjs

@@ -6,9 +6,9 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as signObject, d as verifyProof } from "../proof-CZrjvoJ3.mjs";
+import { a as signObject, d as verifyProof } from "../proof-BHRf_jMG.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { o as verifyCompoundProofDocuments } from "../compound-proof-CcWDD5VB.mjs";
+import { o as verifyCompoundProofDocuments } from "../compound-proof-CMPv4UK0.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";

package/dist/sig/http.test.mjs

@@ -12,8 +12,8 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as exportJwk } from "../key-BlTaKABr.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, f as verifyRequest, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, p as verifyRequestDetailed, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-CUyBaVsQ.mjs";
+import { n as exportJwk } from "../key-DecAtABm.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, f as verifyRequest, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, p as verifyRequestDetailed, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-BqSbUEiQ.mjs";
 import { a as rsaPrivateKey3, i as rsaPrivateKey2, l as rsaPublicKey5, n as ed25519PrivateKey, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
 import { t as KvKeyCache } from "../keycache-Da8A8mZa.mjs";
 import { FetchError, exportSpki, getDocumentLoader } from "@fedify/vocab-runtime";

package/dist/sig/key.test.mjs

@@ -6,7 +6,7 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-BlTaKABr.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-DecAtABm.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 import { FetchError, exportDidKey } from "@fedify/vocab-runtime";

package/dist/sig/ld.test.mjs

@@ -8,8 +8,8 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { o as generateCryptoKeyPair } from "../key-BlTaKABr.mjs";
-import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-Dx8r_qJU.mjs";
+import { o as generateCryptoKeyPair } from "../key-DecAtABm.mjs";
+import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-UsN-TIPh.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/mitra-receive-interop.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/sig/mitra-receive-interop.test.mjs

@@ -0,0 +1,260 @@
+import { Temporal } from "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { c as verifyPortableObjectProof } from "../proof-BHRf_jMG.mjs";
+import { p as verifyRequestDetailed } from "../http-BqSbUEiQ.mjs";
+import { o as createFederation } from "../middleware-CkjwiEBd.mjs";
+import { t as doesActorOwnKey } from "../owner-CEBn81LD.mjs";
+import { Create, Person } from "@fedify/vocab";
+import { canonicalizePortableUri, decodeMultibase, importDidKey } from "@fedify/vocab-runtime";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+import { encodeHex } from "byte-encodings/hex";
+import serialize from "json-canon";
+//#region test-vectors/fep-ef61/mitra-v5.10.0/receive/actor.json
+var actor_default = {
+	"@context": [
+		"https://www.w3.org/ns/activitystreams",
+		"https://w3id.org/security/v1",
+		"https://www.w3.org/ns/did/v1",
+		"https://w3id.org/security/data-integrity/v1",
+		"https://w3id.org/security/multikey/v1",
+		"https://w3id.org/fep/ef61"
+	],
+	assertionMethod: [
+		{
+			"controller": "ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor",
+			"id": "ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor#main-key",
+			"publicKeyMultibase": "z4MXj1wBzi9jUstyPQj1tJmBTCJQwSmgdEH3r3AcgJRwZBMkP3rY67NfsjsVyeRAH24e8frWsjLuhKJ3G9yRWp2R848U8Yeh8kNyR9GF2vmGEi6BHNEqhGnZMMQnAnLovqzQ7p9vfSsHUYU19yrzEwCSFumsDkk4np96HCjbkpejfNkDDAjPexavs9KSdovfFhJdb1uy4wcyG3ynZFSKsyPQyEUVFd72ufLKgG4h8j4fNHqwzvVQG1tRnqMqzFgS6uXJfftXGsAC6QVE5keYdicLvJ6n2t5UrCsVSeoMwgSuDpXVB8vXuhFkxNz4v2bKBHuHVUzA7cKWxoY5gaczcq4on1P23vsRbtxhkWUQgUA4KMenYWDLk",
+			"type": "Multikey"
+		},
+		{
+			"controller": "ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor",
+			"id": "ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor#ed25519-key",
+			"publicKeyMultibase": "z6MknVDBdr3PRNFK35WPFbHxy7m5g18iuoSTht4vRwzt9WKq",
+			"type": "Multikey"
+		},
+		{
+			"controller": "ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor",
+			"id": "http://localhost:18498/.well-known/apgateway/did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor#fedify-rsa",
+			"publicKeyMultibase": "zgghBUVkqmWS8e1imM79CWx4zopmbKaBcdbLUSHjyo3KNnBVZscUs1T8HXSrY7yeSQJZSrrEjtnXq1tWc9fKL31uDYYbr8iSbtiRiXDxUQLA1ZDRH2tsz8a8PufoKK3w9qwNaxkcFVa5YKZ99ahxvvEJ86oDpPexr1HoE5wux1XihNx7kPtpJseQVKjTPYM1YcWe3SqDvy374ZaGFZx5YpxcVCr5gfF9iDHP8KWnYwWF3ge6icMQiqkiCZxsjeV8DL7ww7DJiQniYbk4qZ7mvcpqts657MPR7NWeFKim9wKy6mzaKEdDnkkVeTPbQYFgCUsZyrZcbBFTZp3YAnpTA2k4vmjBvKUyUKzrtXrJAuNgU7Y2cvdxRSCKorAJ38brzReEHA8Vwk72t9Le2P7PVqbUNScKt3L1v1pvQr28rim9Ff7uqPmK4R9j5FR7Tse4qq8zGoxYVAoH5isp9udJjLCs7BsF9MekS1D4aardVzMmqCzjiWCfjeUtTGdkqREsUkGyD3seFUGKui2aqafzVATZQCze4X3KcXL8vLWfq1W7VEx5HVCy5aCAV9E2VCUwimuUNfuSVYGaSY6S3XGXpMYCftak9VA4r22pZCCePC6fXwGhVNwo2mznyZNGbWc1fRLVCr45pS1RaXd58RrXWc2d4HcXdpsQ3XK6tiA4GJUe276bvKmktYKzcfn7KXs9ZHddFNe1SyctHP2JNL",
+			"type": "Multikey"
+		}
+	],
+	gateways: ["http://127.0.0.1:18497", "http://localhost:18498"],
+	id: "ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor",
+	inbox: "ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor/inbox",
+	name: "Fedify live portable client",
+	outbox: "ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor/outbox",
+	preferredUsername: "fepsgnpakpb",
+	proof: {
+		"@context": [
+			"https://www.w3.org/ns/activitystreams",
+			"https://w3id.org/security/v1",
+			"https://www.w3.org/ns/did/v1",
+			"https://w3id.org/security/data-integrity/v1",
+			"https://w3id.org/security/multikey/v1",
+			"https://w3id.org/fep/ef61"
+		],
+		"created": "2026-09-30T14:46:57.846825928Z",
+		"cryptosuite": "eddsa-jcs-2022",
+		"proofPurpose": "assertionMethod",
+		"proofValue": "z32F5XC6bGuzR6ZE5jCiKTQXcFm2F6fp7WLFWM69bkv7RDXSxe67fXjJXgtdLoQBYqsWnqZqczVvivhACfAYaj1kG",
+		"type": "DataIntegrityProof",
+		"verificationMethod": "did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB#z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB"
+	},
+	publicKey: {
+		"id": "http://localhost:18498/.well-known/apgateway/did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor#fedify-rsa",
+		"owner": "ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor",
+		"publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAoSFdSVINqqwdCPZrEo8H\nqwx1bmlm/sT7RXpb53oDt0kWOnjhGrNnRSXa4PbHKCPH6yrzV3xGpmN1zVAXcShg\nu44m1NXbtBtfuEVHSOebRQWu2wyQRYlDk76MEyT33GDtNJf/4OnjnBXO71ebEFVY\nSKWkZacdS0Ft42sqvFaAK4/RDUEiUWE2t4YsEthT90fo+rXz/Snnv74p70eHnjD8\n6P29f8JKITTaqXp1ltuoiS9oEIFV/6FQ7HPMfzdBIgMvg/3pDDr1stFT56Slsvrr\nnMF4J2jy1HNYEo1V7HvS7wStZmGRPNYoiSTHvbk5Vm3ZCmE3Qzng/Sus19KN/B57\njkeOA8ObS5OXCjshZ+GrBmSnAzZjl+Gm6gQDKBk8/ilaSXH2QtCR4TQmvbsCjRFA\njoXcKvMh4SfnWGXC5XdkbVjXJuFSHHFNbHBCLygk/IJdbvEHQpPH4Rsqbc3f4TvL\n3ge/Jd6rm7huVlax3UMq7qUWTtb1PRjjSlrV0Tj5REv1KNe5VGvhMpQmHfJe7zd0\nBVbgi4I91QRJg9XF/dYXgm330skdSkM0UapBNo9xbgK3ejyNWG5aHcazO+DSdWNu\n5AbkXLB7m5djxb5ONrOYzz7llW4kg2H0zWNLFbRvdfKowdG906J4h9+6ZYhwufMa\ndVHS/5EyQbbwVeqe+MG0Qo8CAwEAAQ==\n-----END PUBLIC KEY-----\n",
+		"type": "CryptographicKey"
+	},
+	type: "Person"
+};
+//#endregion
+//#region test-vectors/fep-ef61/mitra-v5.10.0/receive/request.json
+var url$1 = "https://fedify.example:18444/users/alice/inbox";
+var method = "POST";
+var headers = [
+	["accept", "*/*"],
+	["content-length", "2409"],
+	["content-type", "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""],
+	["date", "Wed, 30 Sep 2026 14:47:04 GMT"],
+	["digest", "SHA-256=d1ozC9i0ryDU//wSsMAzw9wD/r5HN0ti5wovjUSqN8k="],
+	["host", "fedify.example:18444"],
+	["signature", "keyId=\"http://127.0.0.1:18497/.well-known/apgateway/did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date digest\",signature=\"PQHhIZUyBNsH779V+IB0Q08Pw8fsgq9RflyLExtYqNWwd/DXRyddBG1Y0RRCKrzigwFnW74rvuZpjU35gZzPaQA+TFxQvl8wBcPKLrYuc+NkIwGrCIpnFkUCglG6JagZ3cJfSqIB7DU7RIEvYfPjK9IchHug8ZghLnWhwLTE9UpKmtH/nJrU2Pd3n2Dn+EkfcYFe+n2KZxS7cjgPiRDRgei31WaCIIDRK4x7PvKq0VmrLwsNSKJzFsUp+KxiwoOHT1Ad9d6BPAJI8p+HqvWu0b2rMu4EK/nqHNwDYB7uYcundCYeQNI8wHmt2qxHxC2JuCuuV99WJxvXMSTbfUfgWg==\""],
+	["user-agent", "Mitra 5.10.0; http://127.0.0.1:18497"]
+];
+var capturedAt$1 = "2026-09-30T14:47:04.185Z";
+//#endregion
+//#region test-vectors/fep-ef61/mitra-v5.10.0/receive/metadata.json
+var capturedAt = "2026-09-30T14:47:04.185Z";
+var httpKeyId = "http://127.0.0.1:18497/.well-known/apgateway/did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor#main-key";
+var sha256$1 = {
+	"requestBody": "775a330bd8b4af20d4fffc12b0c033c3dc03febe47374b62e70a2f8d44aa37c9",
+	"actorBody": "f24c677b3854353c272c29164342f94f420b7570aaf2999d1ea179c7c24ba4bc"
+};
+//#endregion
+//#region test-vectors/fep-ef61/mitra-v5.10.0/receive/raw-bodies.json
+var requestBody = "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/v1\",\"https://www.w3.org/ns/did/v1\",\"https://w3id.org/security/data-integrity/v1\",\"https://w3id.org/security/multikey/v1\",\"https://w3id.org/fep/ef61\"],\"actor\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor\",\"id\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/creates/1\",\"object\":{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/v1\",\"https://www.w3.org/ns/did/v1\",\"https://w3id.org/security/data-integrity/v1\",\"https://w3id.org/security/multikey/v1\",\"https://w3id.org/fep/ef61\"],\"attributedTo\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor\",\"content\":\"<p>@alice Fedify to Mitra portable C2S live interop.</p>\",\"id\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/notes/1\",\"proof\":{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/v1\",\"https://www.w3.org/ns/did/v1\",\"https://w3id.org/security/data-integrity/v1\",\"https://w3id.org/security/multikey/v1\",\"https://w3id.org/fep/ef61\"],\"created\":\"2026-09-30T14:47:01.910135986Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"proofValue\":\"z33dM5LxM7KnmoDjVMnYb44y8skPARP8qur6TiRDLr5P51SQZu3goY2JCVAFVLNjmnxE6dHPRRrcGW6qHr8vusyjt\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB#z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB\"},\"tag\":{\"href\":\"https://fedify.example:18444/users/alice\",\"name\":\"@alice\",\"type\":\"Mention\"},\"to\":[\"https://www.w3.org/ns/activitystreams#Public\",\"https://fedify.example:18444/users/alice\"],\"type\":\"Note\"},\"proof\":{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/v1\",\"https://www.w3.org/ns/did/v1\",\"https://w3id.org/security/data-integrity/v1\",\"https://w3id.org/security/multikey/v1\",\"https://w3id.org/fep/ef61\"],\"created\":\"2026-09-30T14:47:01.923062012Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"proofValue\":\"z4AqgJsruzRmAz7JZdmTY5zRNXZknLomUgGNmN4jwwBZorMg19MurHvhsHaSfW6Uooc5zXSTRZZK4T6uaLc4hJoL1\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB#z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB\"},\"to\":[\"https://www.w3.org/ns/activitystreams#Public\",\"https://fedify.example:18444/users/alice\"],\"type\":\"Create\"}";
+var actorBody = "{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/v1\",\"https://www.w3.org/ns/did/v1\",\"https://w3id.org/security/data-integrity/v1\",\"https://w3id.org/security/multikey/v1\",\"https://w3id.org/fep/ef61\"],\"assertionMethod\":[{\"controller\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor\",\"id\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor#main-key\",\"publicKeyMultibase\":\"z4MXj1wBzi9jUstyPQj1tJmBTCJQwSmgdEH3r3AcgJRwZBMkP3rY67NfsjsVyeRAH24e8frWsjLuhKJ3G9yRWp2R848U8Yeh8kNyR9GF2vmGEi6BHNEqhGnZMMQnAnLovqzQ7p9vfSsHUYU19yrzEwCSFumsDkk4np96HCjbkpejfNkDDAjPexavs9KSdovfFhJdb1uy4wcyG3ynZFSKsyPQyEUVFd72ufLKgG4h8j4fNHqwzvVQG1tRnqMqzFgS6uXJfftXGsAC6QVE5keYdicLvJ6n2t5UrCsVSeoMwgSuDpXVB8vXuhFkxNz4v2bKBHuHVUzA7cKWxoY5gaczcq4on1P23vsRbtxhkWUQgUA4KMenYWDLk\",\"type\":\"Multikey\"},{\"controller\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor\",\"id\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor#ed25519-key\",\"publicKeyMultibase\":\"z6MknVDBdr3PRNFK35WPFbHxy7m5g18iuoSTht4vRwzt9WKq\",\"type\":\"Multikey\"},{\"controller\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor\",\"id\":\"http://localhost:18498/.well-known/apgateway/did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor#fedify-rsa\",\"publicKeyMultibase\":\"zgghBUVkqmWS8e1imM79CWx4zopmbKaBcdbLUSHjyo3KNnBVZscUs1T8HXSrY7yeSQJZSrrEjtnXq1tWc9fKL31uDYYbr8iSbtiRiXDxUQLA1ZDRH2tsz8a8PufoKK3w9qwNaxkcFVa5YKZ99ahxvvEJ86oDpPexr1HoE5wux1XihNx7kPtpJseQVKjTPYM1YcWe3SqDvy374ZaGFZx5YpxcVCr5gfF9iDHP8KWnYwWF3ge6icMQiqkiCZxsjeV8DL7ww7DJiQniYbk4qZ7mvcpqts657MPR7NWeFKim9wKy6mzaKEdDnkkVeTPbQYFgCUsZyrZcbBFTZp3YAnpTA2k4vmjBvKUyUKzrtXrJAuNgU7Y2cvdxRSCKorAJ38brzReEHA8Vwk72t9Le2P7PVqbUNScKt3L1v1pvQr28rim9Ff7uqPmK4R9j5FR7Tse4qq8zGoxYVAoH5isp9udJjLCs7BsF9MekS1D4aardVzMmqCzjiWCfjeUtTGdkqREsUkGyD3seFUGKui2aqafzVATZQCze4X3KcXL8vLWfq1W7VEx5HVCy5aCAV9E2VCUwimuUNfuSVYGaSY6S3XGXpMYCftak9VA4r22pZCCePC6fXwGhVNwo2mznyZNGbWc1fRLVCr45pS1RaXd58RrXWc2d4HcXdpsQ3XK6tiA4GJUe276bvKmktYKzcfn7KXs9ZHddFNe1SyctHP2JNL\",\"type\":\"Multikey\"}],\"gateways\":[\"http://127.0.0.1:18497\",\"http://localhost:18498\"],\"id\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor\",\"inbox\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor/inbox\",\"name\":\"Fedify live portable client\",\"outbox\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor/outbox\",\"preferredUsername\":\"fepsgnpakpb\",\"proof\":{\"@context\":[\"https://www.w3.org/ns/activitystreams\",\"https://w3id.org/security/v1\",\"https://www.w3.org/ns/did/v1\",\"https://w3id.org/security/data-integrity/v1\",\"https://w3id.org/security/multikey/v1\",\"https://w3id.org/fep/ef61\"],\"created\":\"2026-09-30T14:46:57.846825928Z\",\"cryptosuite\":\"eddsa-jcs-2022\",\"proofPurpose\":\"assertionMethod\",\"proofValue\":\"z32F5XC6bGuzR6ZE5jCiKTQXcFm2F6fp7WLFWM69bkv7RDXSxe67fXjJXgtdLoQBYqsWnqZqczVvivhACfAYaj1kG\",\"type\":\"DataIntegrityProof\",\"verificationMethod\":\"did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB#z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB\"},\"publicKey\":{\"id\":\"http://localhost:18498/.well-known/apgateway/did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor#fedify-rsa\",\"owner\":\"ap+ef61://did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor\",\"publicKeyPem\":\"-----BEGIN PUBLIC KEY-----\\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAoSFdSVINqqwdCPZrEo8H\\nqwx1bmlm/sT7RXpb53oDt0kWOnjhGrNnRSXa4PbHKCPH6yrzV3xGpmN1zVAXcShg\\nu44m1NXbtBtfuEVHSOebRQWu2wyQRYlDk76MEyT33GDtNJf/4OnjnBXO71ebEFVY\\nSKWkZacdS0Ft42sqvFaAK4/RDUEiUWE2t4YsEthT90fo+rXz/Snnv74p70eHnjD8\\n6P29f8JKITTaqXp1ltuoiS9oEIFV/6FQ7HPMfzdBIgMvg/3pDDr1stFT56Slsvrr\\nnMF4J2jy1HNYEo1V7HvS7wStZmGRPNYoiSTHvbk5Vm3ZCmE3Qzng/Sus19KN/B57\\njkeOA8ObS5OXCjshZ+GrBmSnAzZjl+Gm6gQDKBk8/ilaSXH2QtCR4TQmvbsCjRFA\\njoXcKvMh4SfnWGXC5XdkbVjXJuFSHHFNbHBCLygk/IJdbvEHQpPH4Rsqbc3f4TvL\\n3ge/Jd6rm7huVlax3UMq7qUWTtb1PRjjSlrV0Tj5REv1KNe5VGvhMpQmHfJe7zd0\\nBVbgi4I91QRJg9XF/dYXgm330skdSkM0UapBNo9xbgK3ejyNWG5aHcazO+DSdWNu\\n5AbkXLB7m5djxb5ONrOYzz7llW4kg2H0zWNLFbRvdfKowdG906J4h9+6ZYhwufMa\\ndVHS/5EyQbbwVeqe+MG0Qo8CAwEAAQ==\\n-----END PUBLIC KEY-----\\n\",\"type\":\"CryptographicKey\"},\"type\":\"Person\"}";
+//#endregion
+//#region test-vectors/fep-ef61/mitra-v5.10.0/receive/response.json
+var status$1 = 202;
+//#endregion
+//#region test-vectors/fep-ef61/mitra-v5.10.0/receive/listener.json
+var type = "Create";
+var id = "ap+ef61://did%3Akey%3Az6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/creates/1";
+var actor = "ap+ef61://did%3Akey%3Az6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor";
+//#endregion
+//#region test-vectors/fep-ef61/mitra-v5.10.0/receive/verification.json
+var verified = true;
+var key = "http://127.0.0.1:18497/.well-known/apgateway/did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor#main-key";
+//#endregion
+//#region test-vectors/fep-ef61/mitra-v5.10.0/receive/actor-response.json
+var url = "http://127.0.0.1:18497/.well-known/apgateway/did:key:z6MkuLKdSc7GHbgu9zDC8sZEjSbhAn7GzoHKXxsgsGNPakpB/actor#main-key";
+var status = 200;
+//#endregion
+//#region src/sig/mitra-receive-interop.test.ts
+const body = requestBody;
+const activity = JSON.parse(body);
+async function sha256(value) {
+	return encodeHex(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value))));
+}
+async function digest(value) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)));
+}
+async function verifyRawJcs(document) {
+	const { proof, ...unsecured } = document;
+	assert(proof != null && typeof proof === "object" && !Array.isArray(proof));
+	const { proofValue, ...configuration } = proof;
+	assertEquals(configuration.cryptosuite, "eddsa-jcs-2022");
+	configuration["@context"] ??= document["@context"];
+	assert(typeof configuration.verificationMethod === "string");
+	assert(typeof proofValue === "string");
+	const key = await importDidKey(configuration.verificationMethod.split("#")[0]);
+	const combined = /* @__PURE__ */ new Uint8Array(64);
+	combined.set(await digest(serialize(configuration)), 0);
+	combined.set(await digest(serialize(unsecured)), 32);
+	return await crypto.subtle.verify("Ed25519", key, new Uint8Array(decodeMultibase(proofValue)), combined);
+}
+function loader(document = actor_default) {
+	return (url) => {
+		assertEquals(url.split("#")[0], httpKeyId.split("#")[0]);
+		return Promise.resolve({
+			document: structuredClone(document),
+			documentUrl: httpKeyId.split("#")[0],
+			contextUrl: null
+		});
+	};
+}
+const options = {
+	documentLoader: loader(),
+	contextLoader: mockDocumentLoader,
+	currentTime: Temporal.Instant.from(capturedAt$1)
+};
+function request(requestBody = body, url = url$1, headers$1 = new Headers(headers)) {
+	return new Request(url, {
+		method,
+		headers: headers$1,
+		body: requestBody
+	});
+}
+async function deliver(requestBody) {
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderFactory: () => loader(),
+		contextLoaderFactory: () => mockDocumentLoader,
+		signatureTimeWindow: false
+	});
+	federation.setActorDispatcher("/users/{identifier}", (ctx, identifier) => identifier === "alice" ? new Person({
+		id: ctx.getActorUri(identifier),
+		inbox: ctx.getInboxUri(identifier)
+	}) : null).setKeyPairsDispatcher(() => []);
+	const received = [];
+	federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Create, (_ctx, create) => {
+		received.push(create);
+	});
+	return {
+		response: await federation.fetch(request(requestBody), { contextData: void 0 }),
+		received
+	};
+}
+test("Mitra v5.10.0 forwarded client-proved Create verifies its proof and HTTP signature", async () => {
+	const actorBody$1 = actorBody;
+	assertEquals(await sha256(body), sha256$1.requestBody);
+	assertEquals(await sha256(actorBody$1), sha256$1.actorBody);
+	assertEquals(JSON.parse(actorBody$1), actor_default);
+	assertEquals(status, 200);
+	assertEquals(url, httpKeyId);
+	assertEquals(verified, true);
+	assertEquals(key, httpKeyId);
+	assertEquals(activity.type, "Create");
+	assertEquals(actor_default.type, "Person");
+	assert((await verifyPortableObjectProof(activity.object, options)).verified);
+	assertEquals(activity.actor, actor_default.id);
+	assert(await verifyRawJcs(actor_default));
+	assert(await verifyRawJcs(activity));
+	assert(await verifyRawJcs(activity.object));
+	assert((await verifyPortableObjectProof(actor_default, options)).verified);
+	assert((await verifyPortableObjectProof(activity, options)).verified);
+	const verified$1 = await verifyRequestDetailed(request(), options);
+	assert(verified$1.verified);
+	assertEquals(verified$1.key.id?.href, httpKeyId);
+	assert(verified$1.key.id?.href !== actor_default.publicKey.id);
+	assert(await doesActorOwnKey(await Create.fromJsonLd(activity, options), verified$1.key, options));
+	assertEquals(capturedAt$1, capturedAt);
+});
+test("Mitra v5.10.0 forwarded client-proved Create reaches the Fedify inbox listener", async () => {
+	assertEquals(status$1, 202);
+	assertEquals(type, "Create");
+	assertEquals(canonicalizePortableUri(id), canonicalizePortableUri(activity.id));
+	assertEquals(canonicalizePortableUri(actor), canonicalizePortableUri(activity.actor));
+	const { response, received } = await deliver(body);
+	assertEquals(response.status, 202);
+	assertEquals(received.length, 1);
+	assert(received[0].id != null);
+	assertEquals(canonicalizePortableUri(received[0].id.href), canonicalizePortableUri(activity.id));
+	assert(received[0].actorId != null);
+	assertEquals(canonicalizePortableUri(received[0].actorId.href), canonicalizePortableUri(actor_default.id));
+});
+test("Mitra v5.10.0 forwarded client-proved Create rejects body tampering", async () => {
+	const tampered = {
+		...activity,
+		object: {
+			...activity.object,
+			content: "Tampered received Note"
+		}
+	};
+	assertEquals((await verifyPortableObjectProof(tampered, options)).verified, false);
+	assertEquals(await verifyRawJcs(tampered), false);
+	assertEquals(await verifyRawJcs(tampered.object), false);
+	const changedBody = JSON.stringify(tampered);
+	assertEquals((await verifyRequestDetailed(request(changedBody), options)).verified, false);
+	const { response, received } = await deliver(changedBody);
+	assertEquals(response.status, 401);
+	assertEquals(received.length, 0);
+});
+test("Mitra v5.10.0 forwarded client-proved Create rejects signed header and path tampering", async () => {
+	const headers$2 = new Headers(headers);
+	headers$2.set("Date", new Date(Date.parse(new Headers(headers).get("Date")) + 1e3).toUTCString());
+	assertEquals((await verifyRequestDetailed(request(body, url$1, headers$2), options)).verified, false);
+	assertEquals((await verifyRequestDetailed(request(body, `${url$1}/tampered`), options)).verified, false);
+});
+test("Mitra v5.10.0 forwarded client-proved Create rejects a tampered actor proof", async () => {
+	const tampered = {
+		...actor_default,
+		preferredUsername: "mallory"
+	};
+	assertEquals(await verifyRawJcs(tampered), false);
+	assertEquals((await verifyPortableObjectProof(tampered, options)).verified, false);
+	assertEquals((await verifyRequestDetailed(request(), {
+		...options,
+		documentLoader: loader(tampered)
+	})).verified, false);
+});
+//#endregion
+export {};

package/dist/sig/mitra-send-interop.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";