@fedify/fedify 2.5.0-dev.2358 → 2.5.0-dev.2370

package/dist/federation/tasks/enqueue.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../../kv-DCHkaJ9-.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, t as MockQueue } from "../../tasks-IG3pHfvZ.mjs";
 import "../../testing-t8xDeJZ5.mjs";
-import { o as createFederation } from "../../middleware-B2a3uSU7.mjs";
+import { o as createFederation } from "../../middleware-ClqRVObS.mjs";
 import { n as ParallelMessageQueue } from "../../mq-Dm1Wmtm-.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { delay } from "es-toolkit";

package/dist/federation/tasks/tasks.test.mjs

@@ -4,8 +4,8 @@ globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../../kv-DCHkaJ9-.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, t as MockQueue } from "../../tasks-IG3pHfvZ.mjs";
 import "../../testing-t8xDeJZ5.mjs";
-import { o as createFederation } from "../../middleware-B2a3uSU7.mjs";
-import { r as createFederationBuilder } from "../../builder-BMEhdUoW.mjs";
+import { o as createFederation } from "../../middleware-ClqRVObS.mjs";
+import { r as createFederationBuilder } from "../../builder-DzGfERAV.mjs";
 import { t as TaskCodec } from "../../codec-C6rTrpIp.mjs";
 import { t as InProcessMessageQueue } from "../../mq-Dm1Wmtm-.mjs";
 import { W3CTraceContextPropagator } from "@opentelemetry/core";

package/dist/federation/temporal.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-JVrtO1CV.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-CDbdX_g_.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { o as createFederation, s as handleWebFinger } from "../middleware-B2a3uSU7.mjs";
+import { o as createFederation, s as handleWebFinger } from "../middleware-ClqRVObS.mjs";
 import { Image, Link, Person, Tombstone } from "@fedify/vocab";
 import { parseIri } from "@fedify/vocab-runtime";
 import { createTestMeterProvider, test } from "@fedify/fixture";

package/dist/{federation-BlSlahiZ.cjs → federation-BkIRrGXG.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-ClQ-uy-g.cjs");
+const require_http = require("./http-CjpGhvxc.cjs");
 const require_types = require("./types-poIao40f.cjs");
-const require_portable_collection = require("./portable-collection-D4vHh15d.cjs");
-const require_kv_cache = require("./kv-cache-FrA7ESXq.cjs");
+const require_portable_collection = require("./portable-collection-BeS_vx1G.cjs");
+const require_kv_cache = require("./kv-cache-BVtotkZw.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -2054,7 +2054,7 @@ function discoverCompoundProofDocuments(json, limits) {
 		statistics: Object.freeze({ ...inspected })
 	};
 }
-async function verifyDiscoveredProofDocuments(discovered, options) {
+async function verifyDiscoveredProofDocuments(discovered, options, rejectedPolicies = /* @__PURE__ */ new Map()) {
 	const documents = await Promise.all(discovered.documents.map(async (document) => {
 		const metadata = {
 			path: document.path,
@@ -2079,10 +2079,20 @@ async function verifyDiscoveredProofDocuments(discovered, options) {
 				id: subjectId,
 				pointer: document.path
 			}
-		} }, "objectIntegrity", (observation) => require_http.verifyMapLocalProof(document.securedDocument, {
-			...options,
-			[require_http.verificationObservation]: inherited == null ? void 0 : observation
-		}), (key) => key != null);
+		} }, "objectIntegrity", async (observation) => {
+			const reason = rejectedPolicies.get(document.path);
+			if (reason != null) {
+				if (observation.attempt != null) observation.attempt.reason = {
+					type: "proofPolicy",
+					reason
+				};
+				return null;
+			}
+			return await require_http.verifyMapLocalProof(document.securedDocument, {
+				...options,
+				[require_http.verificationObservation]: inherited == null ? void 0 : observation
+			});
+		}, (key) => key != null);
 		return key == null ? Object.freeze({
 			...metadata,
 			verified: false,
@@ -2104,7 +2114,29 @@ async function verifyDiscoveredProofDocuments(discovered, options) {
 async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 	const discovered = discoverCompoundProofDocuments(json, limits);
 	if (discovered.status !== "ok") return discovered;
-	const proofs = await verifyDiscoveredProofDocuments(discovered, options);
+	const collected = collectPortableObjects(discovered.snapshot);
+	const objectByPath = new Map(collected.map((object) => [object.path, object]));
+	const isKeyCandidate = (object) => object.keyOf != null && !Object.hasOwn(object.document, "proof");
+	const prepareObject = async (object) => {
+		if (object.depth > 0 && !Object.hasOwn(object.document, "@context")) return {
+			prepared: false,
+			reason: { type: "missingContext" }
+		};
+		try {
+			const policy = await require_http.preparePortableObjectProofPolicy(object.document, options);
+			return policy.prepared ? policy : {
+				prepared: false,
+				reason: policy.result.reason
+			};
+		} catch {
+			return {
+				prepared: false,
+				reason: { type: "invalidPortableObject" }
+			};
+		}
+	};
+	const preparedByPath = new Map(await Promise.all(collected.filter((object) => !isKeyCandidate(object)).map(async (object) => [object.path, await prepareObject(object)])));
+	const proofs = await verifyDiscoveredProofDocuments(discovered, options, new Map([...preparedByPath].flatMap(([path, prepared]) => prepared.prepared ? [] : [[path, prepared.reason]])));
 	const proofByPath = new Map(proofs.map((proof) => [proof.path, proof]));
 	const verifyPortableObject = async (object) => {
 		const metadata = {
@@ -2112,15 +2144,14 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 			id: object.id,
 			depth: object.depth
 		};
-		if (object.depth > 0 && !Object.hasOwn(object.document, "@context")) return Object.freeze({
-			...metadata,
-			verified: false,
-			reason: { type: "missingContext" }
-		});
-		const proof = proofByPath.get(object.path);
-		const key = proof?.verified === true ? proof.key : null;
 		try {
-			const policy = await require_http.verifyPortableObjectProofPolicy(object.document, key, options);
+			const prepared = preparedByPath.get(object.path) ?? await prepareObject(object);
+			const proof = proofByPath.get(object.path);
+			const key = proof?.verified === true ? proof.key : null;
+			const policy = prepared.prepared ? require_http.verifyPreparedPortableObjectProofPolicy(prepared, key) : {
+				verified: false,
+				reason: prepared.reason
+			};
 			return policy.verified ? Object.freeze({
 				...metadata,
 				id: policy.objectId,
@@ -2139,9 +2170,6 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 			});
 		}
 	};
-	const collected = collectPortableObjects(discovered.snapshot);
-	const objectByPath = new Map(collected.map((object) => [object.path, object]));
-	const isKeyCandidate = (object) => object.keyOf != null && !Object.hasOwn(object.document, "proof");
 	const results = /* @__PURE__ */ new Map();
 	for (const result of await Promise.all(collected.filter((object) => !isKeyCandidate(object)).map(verifyPortableObject))) results.set(result.path, result);
 	let projections = 0;

package/dist/{http-CCnvW5x-.js → http-C2gfnrKF.js}

@@ -15,7 +15,7 @@ import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.5.0-dev.2358+1d1813b7";
+var version = "2.5.0-dev.2370+e0cfd033";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -4420,34 +4420,68 @@ async function preparePortableObjectProof(jsonLd, options) {
 	};
 }
 /**
-* Applies portable-object proof policy to one map-local cryptographic result.
+* Checks portable-object policy without resolving keys or verifying signatures.
 *
 * @internal
 */
-async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
+async function preparePortableObjectProofPolicy(jsonLd, options = {}) {
 	const policyOptions = {
 		...options,
 		contextLoader: preloadedOnlyDocumentLoader
 	};
 	const prepared = await preparePortableObjectProof(jsonLd, policyOptions);
-	if (!prepared.prepared) return prepared.result;
+	if (!prepared.prepared) return {
+		prepared: false,
+		result: prepared.result
+	};
 	const policyProof = prepared.proofs[0];
 	const literalProof = isJsonLdNode(jsonLd) && isJsonLdNode(jsonLd.proof) ? (await parseRawProofCandidates(jsonLd, [jsonLd.proof], policyOptions, prepared.proofContextLoader))[0]?.proof : null;
 	const verificationMethod = policyProof?.verificationMethodId;
-	if (prepared.proofs.length !== 1 || key == null || policyProof == null || literalProof == null || !sameProof(policyProof, literalProof) || verificationMethod == null || key.id?.href !== verificationMethod.href) return {
+	if (prepared.proofs.length !== 1 || policyProof == null || literalProof == null || !sameProof(policyProof, literalProof) || verificationMethod == null) return {
+		prepared: false,
+		result: {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex: prepared.proofs.length > 1 ? 1 : 0
+			}
+		}
+	};
+	return {
+		prepared: true,
+		verificationMethod,
+		objectId: formatIri(prepared.objectId)
+	};
+}
+/**
+* Binds prepared portable-object policy to the map-local verified key.
+*
+* @internal
+*/
+function verifyPreparedPortableObjectProofPolicy(prepared, key) {
+	if (key == null || key.id?.href !== prepared.verificationMethod.href) return {
 		verified: false,
 		reason: {
 			type: "invalidProof",
-			proofIndex: prepared.proofs.length > 1 ? 1 : 0
+			proofIndex: 0
 		}
 	};
 	return {
 		verified: true,
 		keys: [key],
-		objectId: formatIri(prepared.objectId)
+		objectId: prepared.objectId
 	};
 }
 /**
+* Applies portable-object proof policy to one map-local cryptographic result.
+*
+* @internal
+*/
+async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
+	const prepared = await preparePortableObjectProofPolicy(jsonLd, options);
+	return prepared.prepared ? verifyPreparedPortableObjectProofPolicy(prepared, key) : prepared.result;
+}
+/**
 * Verifies the FEP-ef61 Object Integrity Proof policy for a portable object.
 *
 * This applies the FEP-2277 core-type classification to the top-level JSON-LD
@@ -6524,4 +6558,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { instrumentDocumentLoader as $, hasSignature as A, isPortableUri as At, fetchActorDocument as B, InvalidContextReferenceError as C, getGatewayKeyBase as Ct, createSignature as D, isCompatibleKeyId as Dt, compactJsonLd as E, hasPortableActor as Et, verifyCompactJsonLd as F, validateCryptoKey as G, fetchKeyDetailed as H, verifyJsonLd as I, getVerifiedKeyOwnerEvidence as J, verifyKeyOwnership as K, verifySignature as L, isClearlyMalformedContextReference as M, isSamePublicKey as Mt, isInvalidUrlTypeError as N, name as Nt, detachSignature as O, isPortableId as Ot, signJsonLd as P, version as Pt, getRemoteHost as Q, wrapContextLoaderForJsonLd as R, normalizeOutgoingActivityJsonLd as S, getCanonicalPortableId as St, attachSignature as T, getRawCanonicalPortableId as Tt, generateCryptoKeyPair as U, fetchKey as V, importJwk as W, getDurationMs as X, parseKeyOwnerEvidence as Y, getFederationMetrics as Z, verifyObject as _, validateAcceptSignature as _t, signRequest as a, recordCollectionTotalItems as at, verifyPortableObjectProofWithRoot as b, verificationObservation as bt, verifyRequestDetailed as c, recordInboxActivity as ct, InvalidPortableObjectIdError as d, recordWebFingerHandle as dt, isAbortError$1 as et, classifyFep2277CoreType as f, registerQueueDepthGauge as ft, verifyMapLocalProof as g, parseAcceptSignature as gt, signObject as h, fulfillAcceptSignature as ht, selectRequestSignature as i, recordCollectionRequest as it, hasSignatureLike as j, isSameObjectId as jt, getNormalizationContextLoader as k, isPortableKeyId as kt, fetchPortableGatewayKey as l, recordOutboxActivity as lt, hasProofLike as m, formatAcceptSignature as mt, listRequestSignatures as n, recordCollectionDispatchDuration as nt, validateMaxSignatures as o, recordDocumentCache as ot, createProof as p, preloadedOnlyDocumentLoader as pt, MAX_PORTABLE_KEY_TTL as q, parseRfc9421SignatureInput as r, recordCollectionPageItems as rt, verifyRequest as s, recordFanoutRecipients as st, doubleKnock as t, recordCircuitBreakerStateChange as tt, resolvePortableActorKey as u, recordOutboxEnqueue as ut, verifyPortableObjectProof as v, observeAttempt as vt, assertSafeJsonLd as w, getPortableDid as wt, verifyProof as x, getAuthenticationOrigin as xt, verifyPortableObjectProofPolicy as y, snapshotKey as yt, exportJwk as z };
+export { getFederationMetrics as $, detachSignature as A, isPortableId as At, wrapContextLoaderForJsonLd as B, verifyProof as C, getAuthenticationOrigin as Ct, attachSignature as D, getRawCanonicalPortableId as Dt, assertSafeJsonLd as E, getPortableDid as Et, isInvalidUrlTypeError as F, name as Ft, generateCryptoKeyPair as G, fetchActorDocument as H, signJsonLd as I, version as It, verifyKeyOwnership as J, importJwk as K, verifyCompactJsonLd as L, hasSignature as M, isPortableUri as Mt, hasSignatureLike as N, isSameObjectId as Nt, compactJsonLd as O, hasPortableActor as Ot, isClearlyMalformedContextReference as P, isSamePublicKey as Pt, getDurationMs as Q, verifyJsonLd as R, verifyPreparedPortableObjectProofPolicy as S, verificationObservation as St, InvalidContextReferenceError as T, getGatewayKeyBase as Tt, fetchKey as U, exportJwk as V, fetchKeyDetailed as W, getVerifiedKeyOwnerEvidence as X, MAX_PORTABLE_KEY_TTL as Y, parseKeyOwnerEvidence as Z, verifyMapLocalProof as _, fulfillAcceptSignature as _t, signRequest as a, recordCollectionPageItems as at, verifyPortableObjectProofPolicy as b, observeAttempt as bt, verifyRequestDetailed as c, recordDocumentCache as ct, InvalidPortableObjectIdError as d, recordOutboxActivity as dt, getRemoteHost as et, classifyFep2277CoreType as f, recordOutboxEnqueue as ft, signObject as g, formatAcceptSignature as gt, preparePortableObjectProofPolicy as h, preloadedOnlyDocumentLoader as ht, selectRequestSignature as i, recordCollectionDispatchDuration as it, getNormalizationContextLoader as j, isPortableKeyId as jt, createSignature as k, isCompatibleKeyId as kt, fetchPortableGatewayKey as l, recordFanoutRecipients as lt, hasProofLike as m, registerQueueDepthGauge as mt, listRequestSignatures as n, isAbortError$1 as nt, validateMaxSignatures as o, recordCollectionRequest as ot, createProof as p, recordWebFingerHandle as pt, validateCryptoKey as q, parseRfc9421SignatureInput as r, recordCircuitBreakerStateChange as rt, verifyRequest as s, recordCollectionTotalItems as st, doubleKnock as t, instrumentDocumentLoader as tt, resolvePortableActorKey as u, recordInboxActivity as ut, verifyObject as v, parseAcceptSignature as vt, normalizeOutgoingActivityJsonLd as w, getCanonicalPortableId as wt, verifyPortableObjectProofWithRoot as x, snapshotKey as xt, verifyPortableObjectProof as y, validateAcceptSignature as yt, verifySignature as z };

package/dist/{http-ClQ-uy-g.cjs → http-CjpGhvxc.cjs}

@@ -17,7 +17,7 @@ json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.5.0-dev.2358+1d1813b7";
+var version = "2.5.0-dev.2370+e0cfd033";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -7989,34 +7989,68 @@ async function preparePortableObjectProof(jsonLd, options) {
 	};
 }
 /**
-* Applies portable-object proof policy to one map-local cryptographic result.
+* Checks portable-object policy without resolving keys or verifying signatures.
 *
 * @internal
 */
-async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
+async function preparePortableObjectProofPolicy(jsonLd, options = {}) {
 	const policyOptions = {
 		...options,
 		contextLoader: preloadedOnlyDocumentLoader
 	};
 	const prepared = await preparePortableObjectProof(jsonLd, policyOptions);
-	if (!prepared.prepared) return prepared.result;
+	if (!prepared.prepared) return {
+		prepared: false,
+		result: prepared.result
+	};
 	const policyProof = prepared.proofs[0];
 	const literalProof = isJsonLdNode(jsonLd) && isJsonLdNode(jsonLd.proof) ? (await parseRawProofCandidates(jsonLd, [jsonLd.proof], policyOptions, prepared.proofContextLoader))[0]?.proof : null;
 	const verificationMethod = policyProof?.verificationMethodId;
-	if (prepared.proofs.length !== 1 || key == null || policyProof == null || literalProof == null || !sameProof(policyProof, literalProof) || verificationMethod == null || key.id?.href !== verificationMethod.href) return {
+	if (prepared.proofs.length !== 1 || policyProof == null || literalProof == null || !sameProof(policyProof, literalProof) || verificationMethod == null) return {
+		prepared: false,
+		result: {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex: prepared.proofs.length > 1 ? 1 : 0
+			}
+		}
+	};
+	return {
+		prepared: true,
+		verificationMethod,
+		objectId: (0, _fedify_vocab_runtime.formatIri)(prepared.objectId)
+	};
+}
+/**
+* Binds prepared portable-object policy to the map-local verified key.
+*
+* @internal
+*/
+function verifyPreparedPortableObjectProofPolicy(prepared, key) {
+	if (key == null || key.id?.href !== prepared.verificationMethod.href) return {
 		verified: false,
 		reason: {
 			type: "invalidProof",
-			proofIndex: prepared.proofs.length > 1 ? 1 : 0
+			proofIndex: 0
 		}
 	};
 	return {
 		verified: true,
 		keys: [key],
-		objectId: (0, _fedify_vocab_runtime.formatIri)(prepared.objectId)
+		objectId: prepared.objectId
 	};
 }
 /**
+* Applies portable-object proof policy to one map-local cryptographic result.
+*
+* @internal
+*/
+async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
+	const prepared = await preparePortableObjectProofPolicy(jsonLd, options);
+	return prepared.prepared ? verifyPreparedPortableObjectProofPolicy(prepared, key) : prepared.result;
+}
+/**
 * Verifies the FEP-ef61 Object Integrity Proof policy for a portable object.
 *
 * This applies the FEP-2277 core-type classification to the top-level JSON-LD
@@ -10412,6 +10446,12 @@ Object.defineProperty(exports, "preloadedOnlyDocumentLoader", {
 		return preloadedOnlyDocumentLoader;
 	}
 });
+Object.defineProperty(exports, "preparePortableObjectProofPolicy", {
+	enumerable: true,
+	get: function() {
+		return preparePortableObjectProofPolicy;
+	}
+});
 Object.defineProperty(exports, "recordCircuitBreakerStateChange", {
 	enumerable: true,
 	get: function() {
@@ -10592,6 +10632,12 @@ Object.defineProperty(exports, "verifyPortableObjectProofWithRoot", {
 		return verifyPortableObjectProofWithRoot;
 	}
 });
+Object.defineProperty(exports, "verifyPreparedPortableObjectProofPolicy", {
+	enumerable: true,
+	get: function() {
+		return verifyPreparedPortableObjectProofPolicy;
+	}
+});
 Object.defineProperty(exports, "verifyProof", {
 	enumerable: true,
 	get: function() {

package/dist/{http-DeJUDufC.mjs → http-DxljNiCC.mjs}

@@ -3,12 +3,12 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { m as parseKeyIdString } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-BFtFen0c.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-jnlUnpdI.mjs";
+import { n as version, t as name } from "./deno-CkkDV5gw.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DiQRjv6y.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
 import { a as promoteKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-Cf3Vy-8d.mjs";
-import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-ebokIyiv.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-8sZWp4lR.mjs";
+import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-ENr3Sc97.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{key-Cf3Vy-8d.mjs → key-8sZWp4lR.mjs}

@@ -3,8 +3,8 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { c as isPortableActorDocument, d as isPortableUri, l as isPortableId, m as parseKeyIdString, s as isCompatibleKeyId } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as verificationObservation } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-BFtFen0c.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-jnlUnpdI.mjs";
+import { n as version, t as name } from "./deno-CkkDV5gw.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DiQRjv6y.mjs";
 import { n as attachKeyOwnerEvidence, t as MAX_PORTABLE_KEY_TTL } from "./key-owner-evidence-APB6NpSk.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";

package/dist/{key-DYxuyd-s.d.cts → key-DhsBxxZN.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { Actor, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
-import { DocumentLoader, PortableObjectVerifier } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
+import { DocumentLoader, PortableObjectVerifier } from "@fedify/vocab-runtime";
 
 //#region src/sig/proof.d.ts
 /**
@@ -272,7 +272,11 @@ type CompoundProofDiscoveryFailureReason = {
 type CompoundProofVerificationFailureReason = {
   /** A nested secured map does not carry its own JSON-LD context. */readonly type: "missingContext";
 } | {
-  /** The direct proof is malformed, unsupported, or invalid. */readonly type: "invalidProof";
+  /**
+  * The direct proof is malformed, unsupported, invalid, or left unverified
+  * because the portable-object policy rejects its map.
+  */
+  readonly type: "invalidProof";
 };
 /** Why one portable map did not pass compound proof policy. */
 type CompoundPortableObjectFailureReason = CompoundProofVerificationFailureReason | VerifyPortableObjectProofFailureReason | {

package/dist/{key-C1nv7_jD.d.ts → key-nYGY4QB9.d.cts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { Actor, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
-import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader, PortableObjectVerifier } from "@fedify/vocab-runtime";
+import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 
 //#region src/sig/proof.d.ts
 /**
@@ -272,7 +272,11 @@ type CompoundProofDiscoveryFailureReason = {
 type CompoundProofVerificationFailureReason = {
   /** A nested secured map does not carry its own JSON-LD context. */readonly type: "missingContext";
 } | {
-  /** The direct proof is malformed, unsupported, or invalid. */readonly type: "invalidProof";
+  /**
+  * The direct proof is malformed, unsupported, invalid, or left unverified
+  * because the portable-object policy rejects its map.
+  */
+  readonly type: "invalidProof";
 };
 /** Why one portable map did not pass compound proof policy. */
 type CompoundPortableObjectFailureReason = CompoundProofVerificationFailureReason | VerifyPortableObjectProofFailureReason | {

package/dist/{kv-cache-FrA7ESXq.cjs → kv-cache-BVtotkZw.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-ClQ-uy-g.cjs");
+const require_http = require("./http-CjpGhvxc.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{kv-cache-CPwTxfty.mjs → kv-cache-DDwF4zee.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-jnlUnpdI.mjs";
+import { p as recordDocumentCache } from "./metrics-DiQRjv6y.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-DD1Rm6av.js → kv-cache-nsVJF31j.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { G as validateCryptoKey, ot as recordDocumentCache, t as doubleKnock } from "./http-CCnvW5x-.js";
+import { ct as recordDocumentCache, q as validateCryptoKey, t as doubleKnock } from "./http-C2gfnrKF.js";
 import { getLogger } from "@logtape/logtape";
 import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, resolveDocumentLoaderTimeout, validatePublicUrl, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{ld-BGnEUgfY.mjs → ld-DXaIENwZ.mjs}

@@ -2,9 +2,9 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-BFtFen0c.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-jnlUnpdI.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-Cf3Vy-8d.mjs";
+import { n as version, t as name } from "./deno-CkkDV5gw.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DiQRjv6y.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-8sZWp4lR.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-jnlUnpdI.mjs → metrics-DiQRjv6y.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BFtFen0c.mjs";
+import { n as version, t as name } from "./deno-CkkDV5gw.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-BPa7IFZl.mjs → middleware-BBnHLNpJ.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-B2a3uSU7.mjs";
+import { n as FederationImpl } from "./middleware-ClqRVObS.mjs";
 export { FederationImpl };

package/dist/{middleware-BpWwcG33.js → middleware-C_EdDn9c.js}

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as instrumentDocumentLoader, A as hasSignature, At as isPortableUri, C as InvalidContextReferenceError, Ct as getGatewayKeyBase, Dt as isCompatibleKeyId, E as compactJsonLd, Et as hasPortableActor, F as verifyCompactJsonLd, G as validateCryptoKey, M as isClearlyMalformedContextReference, N as isInvalidUrlTypeError, Nt as name, O as detachSignature, Ot as isPortableId, P as signJsonLd, Pt as version, Q as getRemoteHost, R as wrapContextLoaderForJsonLd, S as normalizeOutgoingActivityJsonLd, St as getCanonicalPortableId, Tt as getRawCanonicalPortableId, W as importJwk, X as getDurationMs, Z as getFederationMetrics, _ as verifyObject, at as recordCollectionTotalItems, b as verifyPortableObjectProofWithRoot, bt as verificationObservation, c as verifyRequestDetailed, ct as recordInboxActivity, d as InvalidPortableObjectIdError, dt as recordWebFingerHandle, et as isAbortError, f as classifyFep2277CoreType, ft as registerQueueDepthGauge, g as verifyMapLocalProof, h as signObject, i as selectRequestSignature, it as recordCollectionRequest, j as hasSignatureLike, jt as isSameObjectId, k as getNormalizationContextLoader, kt as isPortableKeyId, lt as recordOutboxActivity, m as hasProofLike, mt as formatAcceptSignature, n as listRequestSignatures, nt as recordCollectionDispatchDuration, o as validateMaxSignatures, pt as preloadedOnlyDocumentLoader, q as MAX_PORTABLE_KEY_TTL, r as parseRfc9421SignatureInput, rt as recordCollectionPageItems, s as verifyRequest, st as recordFanoutRecipients, t as doubleKnock, tt as recordCircuitBreakerStateChange, ut as recordOutboxEnqueue, v as verifyPortableObjectProof, vt as observeAttempt, w as assertSafeJsonLd, wt as getPortableDid, xt as getAuthenticationOrigin, y as verifyPortableObjectProofPolicy, yt as snapshotKey, z as exportJwk } from "./http-CCnvW5x-.js";
+import { $ as getFederationMetrics, A as detachSignature, At as isPortableId, B as wrapContextLoaderForJsonLd, Ct as getAuthenticationOrigin, Dt as getRawCanonicalPortableId, E as assertSafeJsonLd, Et as getPortableDid, F as isInvalidUrlTypeError, Ft as name, I as signJsonLd, It as version, K as importJwk, L as verifyCompactJsonLd, M as hasSignature, Mt as isPortableUri, N as hasSignatureLike, Nt as isSameObjectId, O as compactJsonLd, Ot as hasPortableActor, P as isClearlyMalformedContextReference, Q as getDurationMs, S as verifyPreparedPortableObjectProofPolicy, St as verificationObservation, T as InvalidContextReferenceError, Tt as getGatewayKeyBase, V as exportJwk, Y as MAX_PORTABLE_KEY_TTL, _ as verifyMapLocalProof, at as recordCollectionPageItems, b as verifyPortableObjectProofPolicy, bt as observeAttempt, c as verifyRequestDetailed, d as InvalidPortableObjectIdError, dt as recordOutboxActivity, et as getRemoteHost, f as classifyFep2277CoreType, ft as recordOutboxEnqueue, g as signObject, gt as formatAcceptSignature, h as preparePortableObjectProofPolicy, ht as preloadedOnlyDocumentLoader, i as selectRequestSignature, it as recordCollectionDispatchDuration, j as getNormalizationContextLoader, jt as isPortableKeyId, kt as isCompatibleKeyId, lt as recordFanoutRecipients, m as hasProofLike, mt as registerQueueDepthGauge, n as listRequestSignatures, nt as isAbortError, o as validateMaxSignatures, ot as recordCollectionRequest, pt as recordWebFingerHandle, q as validateCryptoKey, r as parseRfc9421SignatureInput, rt as recordCircuitBreakerStateChange, s as verifyRequest, st as recordCollectionTotalItems, t as doubleKnock, tt as instrumentDocumentLoader, ut as recordInboxActivity, v as verifyObject, w as normalizeOutgoingActivityJsonLd, wt as getCanonicalPortableId, x as verifyPortableObjectProofWithRoot, xt as snapshotKey, y as verifyPortableObjectProof } from "./http-C2gfnrKF.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-_S2_MeLF.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-BsRW7mno.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DD1Rm6av.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-BtyE_2Rv.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-nsVJF31j.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, PUBLIC_COLLECTION, Tombstone, getTypeId, isActor, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -2053,7 +2053,7 @@ function discoverCompoundProofDocuments(json, limits) {
 		statistics: Object.freeze({ ...inspected })
 	};
 }
-async function verifyDiscoveredProofDocuments(discovered, options) {
+async function verifyDiscoveredProofDocuments(discovered, options, rejectedPolicies = /* @__PURE__ */ new Map()) {
 	const documents = await Promise.all(discovered.documents.map(async (document) => {
 		const metadata = {
 			path: document.path,
@@ -2078,10 +2078,20 @@ async function verifyDiscoveredProofDocuments(discovered, options) {
 				id: subjectId,
 				pointer: document.path
 			}
-		} }, "objectIntegrity", (observation) => verifyMapLocalProof(document.securedDocument, {
-			...options,
-			[verificationObservation]: inherited == null ? void 0 : observation
-		}), (key) => key != null);
+		} }, "objectIntegrity", async (observation) => {
+			const reason = rejectedPolicies.get(document.path);
+			if (reason != null) {
+				if (observation.attempt != null) observation.attempt.reason = {
+					type: "proofPolicy",
+					reason
+				};
+				return null;
+			}
+			return await verifyMapLocalProof(document.securedDocument, {
+				...options,
+				[verificationObservation]: inherited == null ? void 0 : observation
+			});
+		}, (key) => key != null);
 		return key == null ? Object.freeze({
 			...metadata,
 			verified: false,
@@ -2103,7 +2113,29 @@ async function verifyDiscoveredProofDocuments(discovered, options) {
 async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 	const discovered = discoverCompoundProofDocuments(json, limits);
 	if (discovered.status !== "ok") return discovered;
-	const proofs = await verifyDiscoveredProofDocuments(discovered, options);
+	const collected = collectPortableObjects(discovered.snapshot);
+	const objectByPath = new Map(collected.map((object) => [object.path, object]));
+	const isKeyCandidate = (object) => object.keyOf != null && !Object.hasOwn(object.document, "proof");
+	const prepareObject = async (object) => {
+		if (object.depth > 0 && !Object.hasOwn(object.document, "@context")) return {
+			prepared: false,
+			reason: { type: "missingContext" }
+		};
+		try {
+			const policy = await preparePortableObjectProofPolicy(object.document, options);
+			return policy.prepared ? policy : {
+				prepared: false,
+				reason: policy.result.reason
+			};
+		} catch {
+			return {
+				prepared: false,
+				reason: { type: "invalidPortableObject" }
+			};
+		}
+	};
+	const preparedByPath = new Map(await Promise.all(collected.filter((object) => !isKeyCandidate(object)).map(async (object) => [object.path, await prepareObject(object)])));
+	const proofs = await verifyDiscoveredProofDocuments(discovered, options, new Map([...preparedByPath].flatMap(([path, prepared]) => prepared.prepared ? [] : [[path, prepared.reason]])));
 	const proofByPath = new Map(proofs.map((proof) => [proof.path, proof]));
 	const verifyPortableObject = async (object) => {
 		const metadata = {
@@ -2111,15 +2143,14 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 			id: object.id,
 			depth: object.depth
 		};
-		if (object.depth > 0 && !Object.hasOwn(object.document, "@context")) return Object.freeze({
-			...metadata,
-			verified: false,
-			reason: { type: "missingContext" }
-		});
-		const proof = proofByPath.get(object.path);
-		const key = proof?.verified === true ? proof.key : null;
 		try {
-			const policy = await verifyPortableObjectProofPolicy(object.document, key, options);
+			const prepared = preparedByPath.get(object.path) ?? await prepareObject(object);
+			const proof = proofByPath.get(object.path);
+			const key = proof?.verified === true ? proof.key : null;
+			const policy = prepared.prepared ? verifyPreparedPortableObjectProofPolicy(prepared, key) : {
+				verified: false,
+				reason: prepared.reason
+			};
 			return policy.verified ? Object.freeze({
 				...metadata,
 				id: policy.objectId,
@@ -2138,9 +2169,6 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 			});
 		}
 	};
-	const collected = collectPortableObjects(discovered.snapshot);
-	const objectByPath = new Map(collected.map((object) => [object.path, object]));
-	const isKeyCandidate = (object) => object.keyOf != null && !Object.hasOwn(object.document, "proof");
 	const results = /* @__PURE__ */ new Map();
 	for (const result of await Promise.all(collected.filter((object) => !isKeyCandidate(object)).map(verifyPortableObject))) results.set(result.path, result);
 	let projections = 0;