@fedify/fedify 2.5.0-dev.2364 → 2.5.0-dev.2378

package/dist/federation/tasks/enqueue.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../../kv-DCHkaJ9-.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, t as MockQueue } from "../../tasks-IG3pHfvZ.mjs";
 import "../../testing-t8xDeJZ5.mjs";
-import { o as createFederation } from "../../middleware-Hl0lTClT.mjs";
+import { o as createFederation } from "../../middleware-BbBsa5iR.mjs";
 import { n as ParallelMessageQueue } from "../../mq-Dm1Wmtm-.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { delay } from "es-toolkit";

package/dist/federation/tasks/tasks.test.mjs

@@ -4,8 +4,8 @@ globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../../kv-DCHkaJ9-.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, t as MockQueue } from "../../tasks-IG3pHfvZ.mjs";
 import "../../testing-t8xDeJZ5.mjs";
-import { o as createFederation } from "../../middleware-Hl0lTClT.mjs";
-import { r as createFederationBuilder } from "../../builder-ClDm_1c7.mjs";
+import { o as createFederation } from "../../middleware-BbBsa5iR.mjs";
+import { r as createFederationBuilder } from "../../builder-J1K0IJj6.mjs";
 import { t as TaskCodec } from "../../codec-C6rTrpIp.mjs";
 import { t as InProcessMessageQueue } from "../../mq-Dm1Wmtm-.mjs";
 import { W3CTraceContextPropagator } from "@opentelemetry/core";

package/dist/federation/temporal.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-Bvota1RR.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-BRaCTxVe.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { o as createFederation, s as handleWebFinger } from "../middleware-Hl0lTClT.mjs";
+import { o as createFederation, s as handleWebFinger } from "../middleware-BbBsa5iR.mjs";
 import { Image, Link, Person, Tombstone } from "@fedify/vocab";
 import { parseIri } from "@fedify/vocab-runtime";
 import { createTestMeterProvider, test } from "@fedify/fixture";

package/dist/{federation-BW53Wxj7.cjs → federation-lzy7M3hT.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-Btzv2JZU.cjs");
+const require_http = require("./http-D1RPHoq3.cjs");
 const require_types = require("./types-poIao40f.cjs");
-const require_portable_collection = require("./portable-collection-CyTnj1m9.cjs");
-const require_kv_cache = require("./kv-cache-0qHe-sN1.cjs");
+const require_portable_collection = require("./portable-collection-BvWxS1sL.cjs");
+const require_kv_cache = require("./kv-cache-Jym5nP3J.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -2054,7 +2054,7 @@ function discoverCompoundProofDocuments(json, limits) {
 		statistics: Object.freeze({ ...inspected })
 	};
 }
-async function verifyDiscoveredProofDocuments(discovered, options) {
+async function verifyDiscoveredProofDocuments(discovered, options, rejectedPolicies = /* @__PURE__ */ new Map()) {
 	const documents = await Promise.all(discovered.documents.map(async (document) => {
 		const metadata = {
 			path: document.path,
@@ -2079,10 +2079,20 @@ async function verifyDiscoveredProofDocuments(discovered, options) {
 				id: subjectId,
 				pointer: document.path
 			}
-		} }, "objectIntegrity", (observation) => require_http.verifyMapLocalProof(document.securedDocument, {
-			...options,
-			[require_http.verificationObservation]: inherited == null ? void 0 : observation
-		}), (key) => key != null);
+		} }, "objectIntegrity", async (observation) => {
+			const reason = rejectedPolicies.get(document.path);
+			if (reason != null) {
+				if (observation.attempt != null) observation.attempt.reason = {
+					type: "proofPolicy",
+					reason
+				};
+				return null;
+			}
+			return await require_http.verifyMapLocalProof(document.securedDocument, {
+				...options,
+				[require_http.verificationObservation]: inherited == null ? void 0 : observation
+			});
+		}, (key) => key != null);
 		return key == null ? Object.freeze({
 			...metadata,
 			verified: false,
@@ -2104,7 +2114,29 @@ async function verifyDiscoveredProofDocuments(discovered, options) {
 async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 	const discovered = discoverCompoundProofDocuments(json, limits);
 	if (discovered.status !== "ok") return discovered;
-	const proofs = await verifyDiscoveredProofDocuments(discovered, options);
+	const collected = collectPortableObjects(discovered.snapshot);
+	const objectByPath = new Map(collected.map((object) => [object.path, object]));
+	const isKeyCandidate = (object) => object.keyOf != null && !Object.hasOwn(object.document, "proof");
+	const prepareObject = async (object) => {
+		if (object.depth > 0 && !Object.hasOwn(object.document, "@context")) return {
+			prepared: false,
+			reason: { type: "missingContext" }
+		};
+		try {
+			const policy = await require_http.preparePortableObjectProofPolicy(object.document, options);
+			return policy.prepared ? policy : {
+				prepared: false,
+				reason: policy.result.reason
+			};
+		} catch {
+			return {
+				prepared: false,
+				reason: { type: "invalidPortableObject" }
+			};
+		}
+	};
+	const preparedByPath = new Map(await Promise.all(collected.filter((object) => !isKeyCandidate(object)).map(async (object) => [object.path, await prepareObject(object)])));
+	const proofs = await verifyDiscoveredProofDocuments(discovered, options, new Map([...preparedByPath].flatMap(([path, prepared]) => prepared.prepared ? [] : [[path, prepared.reason]])));
 	const proofByPath = new Map(proofs.map((proof) => [proof.path, proof]));
 	const verifyPortableObject = async (object) => {
 		const metadata = {
@@ -2112,15 +2144,14 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 			id: object.id,
 			depth: object.depth
 		};
-		if (object.depth > 0 && !Object.hasOwn(object.document, "@context")) return Object.freeze({
-			...metadata,
-			verified: false,
-			reason: { type: "missingContext" }
-		});
-		const proof = proofByPath.get(object.path);
-		const key = proof?.verified === true ? proof.key : null;
 		try {
-			const policy = await require_http.verifyPortableObjectProofPolicy(object.document, key, options);
+			const prepared = preparedByPath.get(object.path) ?? await prepareObject(object);
+			const proof = proofByPath.get(object.path);
+			const key = proof?.verified === true ? proof.key : null;
+			const policy = prepared.prepared ? require_http.verifyPreparedPortableObjectProofPolicy(prepared, key) : {
+				verified: false,
+				reason: prepared.reason
+			};
 			return policy.verified ? Object.freeze({
 				...metadata,
 				id: policy.objectId,
@@ -2139,9 +2170,6 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 			});
 		}
 	};
-	const collected = collectPortableObjects(discovered.snapshot);
-	const objectByPath = new Map(collected.map((object) => [object.path, object]));
-	const isKeyCandidate = (object) => object.keyOf != null && !Object.hasOwn(object.document, "proof");
 	const results = /* @__PURE__ */ new Map();
 	for (const result of await Promise.all(collected.filter((object) => !isKeyCandidate(object)).map(verifyPortableObject))) results.set(result.path, result);
 	let projections = 0;

package/dist/{http-D6JDnBO1.mjs → http-CFyizTHa.mjs}

@@ -3,12 +3,12 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { m as parseKeyIdString } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-Bp8q024B.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DUdlIyrB.mjs";
+import { n as version, t as name } from "./deno-Ci6tSK9-.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-Dwgav7s_.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
 import { a as promoteKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-R5cUSA6S.mjs";
-import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-BOBhrrKN.mjs";
+import { S as fetchKeyDetailed, T as validateCryptoKey, v as bypassKeyCacheReads } from "./ld-DJ--ZUpr.mjs";
+import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-Cwti99nP.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{http-Cg5Yj_yk.js → http-Cmz7x6Iw.js}

@@ -3,7 +3,7 @@ import { URLPattern } from "urlpattern-polyfill";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, PUBLIC_COLLECTION, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, metrics, trace } from "@opentelemetry/api";
-import { FetchError, canonicalizePortableUri, encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDidKeyVerificationMethod, parseGatewayUrl, parseIri, preloadedContexts, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, canonicalizePortableUri, encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDidKeyVerificationMethod, parseGatewayUrl, parseIri, preloadedContexts, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { getPortableGatewayCandidates, isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { encodeHex } from "byte-encodings/hex";
 import jsonld from "@fedify/vocab-runtime/jsonld";
@@ -15,7 +15,7 @@ import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.5.0-dev.2364+4d9b5f4d";
+var version = "2.5.0-dev.2378+fea9c751";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -1430,6 +1430,65 @@ async function parseKeyOwnerEvidence(evidence, options = {}) {
 }
 //#endregion
 //#region src/sig/key.ts
+/** Classifies decoding failures without hiding unexpected loader errors. */
+function classifyKeyJsonLdError(error, seen = /* @__PURE__ */ new Set()) {
+	if (!(error instanceof Error) || !error.name.startsWith("jsonld.")) return null;
+	if (seen.has(error)) throw error;
+	seen.add(error);
+	const details = error.details;
+	if (typeof details?.code !== "string") return null;
+	if (details.code !== "loading remote context failed" || !("cause" in details) && !("cause" in error)) return "invalid";
+	const cause = "cause" in details ? details.cause : error.cause;
+	const nestedFailure = classifyKeyJsonLdError(cause, seen);
+	if (nestedFailure != null) return nestedFailure;
+	if (cause instanceof SyntaxError) return "invalid";
+	if (cause instanceof FetchError || cause instanceof UrlError) return "fetch";
+	if (cause instanceof Error && [
+		"AbortError",
+		"TimeoutError",
+		"NetworkError"
+	].includes(cause.name)) return "fetch";
+	if (cause instanceof TypeError) {
+		const urlCode = cause.code;
+		if (cause.name === "InvalidContextReferenceError") return "invalid";
+		if (urlCode === "ERR_INVALID_URL" || cause.message === "Invalid URL string." || /^Invalid URL(?::|$)/.test(cause.message) || / cannot be parsed as a URL\.?$/.test(cause.message)) return typeof details.url === "string" && /^[A-Za-z][A-Za-z0-9+.-]*:/.test(details.url) && !URL.canParse(details.url) ? "invalid" : "fetch";
+		const networkCause = cause.cause;
+		const code = cause.code ?? networkCause?.code;
+		if (typeof code === "string" && [
+			"ECONNREFUSED",
+			"ECONNRESET",
+			"ECONNABORTED",
+			"ETIMEDOUT",
+			"EHOSTUNREACH",
+			"ENETUNREACH",
+			"ENOTFOUND",
+			"EAI_AGAIN",
+			"UND_ERR_CONNECT_TIMEOUT",
+			"UND_ERR_HEADERS_TIMEOUT",
+			"UND_ERR_BODY_TIMEOUT",
+			"UND_ERR_SOCKET"
+		].includes(code) || /^(fetch failed|Failed to fetch|error sending request|error reading a body from connection|Unable to connect|ConnectionRefused|Network connection lost|The socket connection was closed unexpectedly)/.test(cause.message)) return "fetch";
+	}
+	throw cause;
+}
+/** Carries a context transport failure through the key decoding boundary. */
+var KeyContextFetchError = class extends Error {
+	error;
+	constructor(error) {
+		super("Failed to fetch a key's JSON-LD context.", { cause: error });
+		this.error = error;
+	}
+};
+function contextFetchError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	while (error instanceof Error && !seen.has(error)) {
+		seen.add(error);
+		const details = error.details;
+		if (!error.name.startsWith("jsonld.") || details?.code !== "loading remote context failed") break;
+		error = "cause" in details ? details.cause : error.cause;
+	}
+	return new KeyContextFetchError(error);
+}
 /**
 * Checks if the given key is valid and supported.  No-op if the key is valid,
 * otherwise throws an error.
@@ -1524,6 +1583,9 @@ async function importJwk(jwk, type) {
 * @internal
 */
 async function fetchActorDocument(actorId, options = {}) {
+	return await fetchActorDocumentInternal(actorId, options, false);
+}
+async function fetchActorDocumentInternal(actorId, options, propagateContextFetchErrors) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -1558,9 +1620,12 @@ async function fetchActorDocument(actorId, options = {}) {
 			baseUrl: documentUrl
 		});
 	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+		const failure = classifyKeyJsonLdError(error);
+		if (failure === "fetch" && propagateContextFetchErrors) throw contextFetchError(error);
+		if (failure == null && !(error instanceof TypeError)) throw error;
+		logger.debug("Failed to decode the actor document at {documentUrl}: {error}", {
 			documentUrl: documentUrl.href,
+			failure: failure ?? "invalid",
 			error
 		});
 		return null;
@@ -1606,6 +1671,9 @@ async function fetchActorDocument(actorId, options = {}) {
 * @internal
 */
 async function verifyKeyOwnership(key, options = {}) {
+	return await verifyKeyOwnershipInternal(key, options, false);
+}
+async function verifyKeyOwnershipInternal(key, options, propagateContextFetchErrors) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -1615,7 +1683,7 @@ async function verifyKeyOwnership(key, options = {}) {
 	if (keyId == null) return null;
 	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
 	if (claimedOwnerId == null) return null;
-	const owner = await fetchActorDocument(claimedOwnerId, options);
+	const owner = await fetchActorDocumentInternal(claimedOwnerId, options, propagateContextFetchErrors);
 	if (owner == null) {
 		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
 			keyId: keyId.href,
@@ -1941,6 +2009,21 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 			tracerProvider
 		});
 	} catch (e) {
+		const failure = classifyKeyJsonLdError(e);
+		if (failure === "fetch") throw contextFetchError(e);
+		if (failure != null) {
+			logger.debug("Failed to decode key {keyId}: {error}", {
+				keyId,
+				failure,
+				error: e
+			});
+			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
+			return {
+				key: null,
+				cached: false
+			};
+		}
 		if (!(e instanceof TypeError)) throw e;
 		try {
 			object = await cls.fromJsonLd(document, {
@@ -1949,8 +2032,14 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 				tracerProvider
 			});
 		} catch (e) {
-			if (e instanceof TypeError) {
-				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+			const failure = classifyKeyJsonLdError(e);
+			if (failure === "fetch") throw contextFetchError(e);
+			if (failure != null || e instanceof TypeError) {
+				logger.debug("Failed to decode key {keyId}: {error}", {
+					keyId,
+					failure: failure ?? "invalid",
+					error: e
+				});
 				await keyCache?.set(cacheKey, null);
 				await clearFetchErrorMetadata(cacheKey, keyCache);
 				return {
@@ -2089,16 +2178,17 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 		}
 		if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
 		else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
-			if (await verifyKeyOwnership(key, {
+			if (await verifyKeyOwnershipInternal(key, {
 				documentLoader,
 				contextLoader,
 				tracerProvider
-			}) == null) {
+			}, true) == null) {
 				logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
 					keyId,
 					claimedOwnerId: claimedOwnerId.href
 				});
 				await keyCache?.set(cacheKey, null);
+				await clearFetchErrorMetadata(cacheKey, keyCache);
 				return {
 					key: null,
 					cached: false
@@ -2175,9 +2265,17 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 			outcome = classified;
 			return errored;
 		}
-		const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
-		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
-		return resolved;
+		try {
+			const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
+			outcome = { result: resolved.key != null ? "fetched" : "invalid" };
+			return resolved;
+		} catch (error) {
+			if (!(error instanceof KeyContextFetchError)) throw error;
+			const classified = classifyFetchError(error.error);
+			const errored = await onFetchError(error.error, cacheKey, keyId, keyCache, logger);
+			outcome = classified;
+			return errored;
+		}
 	} finally {
 		recordKeyLookup(options.meterProvider, {
 			durationMs: getDurationMs(start),
@@ -4420,34 +4518,68 @@ async function preparePortableObjectProof(jsonLd, options) {
 	};
 }
 /**
-* Applies portable-object proof policy to one map-local cryptographic result.
+* Checks portable-object policy without resolving keys or verifying signatures.
 *
 * @internal
 */
-async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
+async function preparePortableObjectProofPolicy(jsonLd, options = {}) {
 	const policyOptions = {
 		...options,
 		contextLoader: preloadedOnlyDocumentLoader
 	};
 	const prepared = await preparePortableObjectProof(jsonLd, policyOptions);
-	if (!prepared.prepared) return prepared.result;
+	if (!prepared.prepared) return {
+		prepared: false,
+		result: prepared.result
+	};
 	const policyProof = prepared.proofs[0];
 	const literalProof = isJsonLdNode(jsonLd) && isJsonLdNode(jsonLd.proof) ? (await parseRawProofCandidates(jsonLd, [jsonLd.proof], policyOptions, prepared.proofContextLoader))[0]?.proof : null;
 	const verificationMethod = policyProof?.verificationMethodId;
-	if (prepared.proofs.length !== 1 || key == null || policyProof == null || literalProof == null || !sameProof(policyProof, literalProof) || verificationMethod == null || key.id?.href !== verificationMethod.href) return {
+	if (prepared.proofs.length !== 1 || policyProof == null || literalProof == null || !sameProof(policyProof, literalProof) || verificationMethod == null) return {
+		prepared: false,
+		result: {
+			verified: false,
+			reason: {
+				type: "invalidProof",
+				proofIndex: prepared.proofs.length > 1 ? 1 : 0
+			}
+		}
+	};
+	return {
+		prepared: true,
+		verificationMethod,
+		objectId: formatIri(prepared.objectId)
+	};
+}
+/**
+* Binds prepared portable-object policy to the map-local verified key.
+*
+* @internal
+*/
+function verifyPreparedPortableObjectProofPolicy(prepared, key) {
+	if (key == null || key.id?.href !== prepared.verificationMethod.href) return {
 		verified: false,
 		reason: {
 			type: "invalidProof",
-			proofIndex: prepared.proofs.length > 1 ? 1 : 0
+			proofIndex: 0
 		}
 	};
 	return {
 		verified: true,
 		keys: [key],
-		objectId: formatIri(prepared.objectId)
+		objectId: prepared.objectId
 	};
 }
 /**
+* Applies portable-object proof policy to one map-local cryptographic result.
+*
+* @internal
+*/
+async function verifyPortableObjectProofPolicy(jsonLd, key, options = {}) {
+	const prepared = await preparePortableObjectProofPolicy(jsonLd, options);
+	return prepared.prepared ? verifyPreparedPortableObjectProofPolicy(prepared, key) : prepared.result;
+}
+/**
 * Verifies the FEP-ef61 Object Integrity Proof policy for a portable object.
 *
 * This applies the FEP-2277 core-type classification to the top-level JSON-LD
@@ -6524,4 +6656,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { instrumentDocumentLoader as $, hasSignature as A, isPortableUri as At, fetchActorDocument as B, InvalidContextReferenceError as C, getGatewayKeyBase as Ct, createSignature as D, isCompatibleKeyId as Dt, compactJsonLd as E, hasPortableActor as Et, verifyCompactJsonLd as F, validateCryptoKey as G, fetchKeyDetailed as H, verifyJsonLd as I, getVerifiedKeyOwnerEvidence as J, verifyKeyOwnership as K, verifySignature as L, isClearlyMalformedContextReference as M, isSamePublicKey as Mt, isInvalidUrlTypeError as N, name as Nt, detachSignature as O, isPortableId as Ot, signJsonLd as P, version as Pt, getRemoteHost as Q, wrapContextLoaderForJsonLd as R, normalizeOutgoingActivityJsonLd as S, getCanonicalPortableId as St, attachSignature as T, getRawCanonicalPortableId as Tt, generateCryptoKeyPair as U, fetchKey as V, importJwk as W, getDurationMs as X, parseKeyOwnerEvidence as Y, getFederationMetrics as Z, verifyObject as _, validateAcceptSignature as _t, signRequest as a, recordCollectionTotalItems as at, verifyPortableObjectProofWithRoot as b, verificationObservation as bt, verifyRequestDetailed as c, recordInboxActivity as ct, InvalidPortableObjectIdError as d, recordWebFingerHandle as dt, isAbortError$1 as et, classifyFep2277CoreType as f, registerQueueDepthGauge as ft, verifyMapLocalProof as g, parseAcceptSignature as gt, signObject as h, fulfillAcceptSignature as ht, selectRequestSignature as i, recordCollectionRequest as it, hasSignatureLike as j, isSameObjectId as jt, getNormalizationContextLoader as k, isPortableKeyId as kt, fetchPortableGatewayKey as l, recordOutboxActivity as lt, hasProofLike as m, formatAcceptSignature as mt, listRequestSignatures as n, recordCollectionDispatchDuration as nt, validateMaxSignatures as o, recordDocumentCache as ot, createProof as p, preloadedOnlyDocumentLoader as pt, MAX_PORTABLE_KEY_TTL as q, parseRfc9421SignatureInput as r, recordCollectionPageItems as rt, verifyRequest as s, recordFanoutRecipients as st, doubleKnock as t, recordCircuitBreakerStateChange as tt, resolvePortableActorKey as u, recordOutboxEnqueue as ut, verifyPortableObjectProof as v, observeAttempt as vt, assertSafeJsonLd as w, getPortableDid as wt, verifyProof as x, getAuthenticationOrigin as xt, verifyPortableObjectProofPolicy as y, snapshotKey as yt, exportJwk as z };
+export { getFederationMetrics as $, detachSignature as A, isPortableId as At, wrapContextLoaderForJsonLd as B, verifyProof as C, getAuthenticationOrigin as Ct, attachSignature as D, getRawCanonicalPortableId as Dt, assertSafeJsonLd as E, getPortableDid as Et, isInvalidUrlTypeError as F, name as Ft, generateCryptoKeyPair as G, fetchActorDocument as H, signJsonLd as I, version as It, verifyKeyOwnership as J, importJwk as K, verifyCompactJsonLd as L, hasSignature as M, isPortableUri as Mt, hasSignatureLike as N, isSameObjectId as Nt, compactJsonLd as O, hasPortableActor as Ot, isClearlyMalformedContextReference as P, isSamePublicKey as Pt, getDurationMs as Q, verifyJsonLd as R, verifyPreparedPortableObjectProofPolicy as S, verificationObservation as St, InvalidContextReferenceError as T, getGatewayKeyBase as Tt, fetchKey as U, exportJwk as V, fetchKeyDetailed as W, getVerifiedKeyOwnerEvidence as X, MAX_PORTABLE_KEY_TTL as Y, parseKeyOwnerEvidence as Z, verifyMapLocalProof as _, fulfillAcceptSignature as _t, signRequest as a, recordCollectionPageItems as at, verifyPortableObjectProofPolicy as b, observeAttempt as bt, verifyRequestDetailed as c, recordDocumentCache as ct, InvalidPortableObjectIdError as d, recordOutboxActivity as dt, getRemoteHost as et, classifyFep2277CoreType as f, recordOutboxEnqueue as ft, signObject as g, formatAcceptSignature as gt, preparePortableObjectProofPolicy as h, preloadedOnlyDocumentLoader as ht, selectRequestSignature as i, recordCollectionDispatchDuration as it, getNormalizationContextLoader as j, isPortableKeyId as jt, createSignature as k, isCompatibleKeyId as kt, fetchPortableGatewayKey as l, recordFanoutRecipients as lt, hasProofLike as m, registerQueueDepthGauge as mt, listRequestSignatures as n, isAbortError$1 as nt, validateMaxSignatures as o, recordCollectionRequest as ot, createProof as p, recordWebFingerHandle as pt, validateCryptoKey as q, parseRfc9421SignatureInput as r, recordCircuitBreakerStateChange as rt, verifyRequest as s, recordCollectionTotalItems as st, doubleKnock as t, instrumentDocumentLoader as tt, resolvePortableActorKey as u, recordInboxActivity as ut, verifyObject as v, parseAcceptSignature as vt, normalizeOutgoingActivityJsonLd as w, getCanonicalPortableId as wt, verifyPortableObjectProofWithRoot as x, snapshotKey as xt, verifyPortableObjectProof as y, validateAcceptSignature as yt, verifySignature as z };