@fedify/fedify 2.5.0-dev.2446 → 2.5.0-dev.2492

package/dist/{proof-Cryb1c70.mjs → proof-GH7Poos_.mjs}

@@ -3,15 +3,15 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { i as getPortableDid, l as isPortableId } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-eNpfj4oR.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-D3LHk6Z4.mjs";
-import { T as validateCryptoKey, c as getNormalizationContextLoader, v as bypassKeyCacheReads, x as fetchKey } from "./ld-CD2CsPxq.mjs";
+import { n as version, t as name } from "./deno-iOAA7iRN.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CpxvUrBz.mjs";
+import { C as fetchKey, D as validateCryptoKey, b as bypassKeyCacheReads, c as getNormalizationContextLoader } from "./ld-CdvcOEXQ.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
-import { encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseGatewayUrl, parseIri } from "@fedify/vocab-runtime";
+import { encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isTransientFetchError, parseGatewayUrl, parseIri } from "@fedify/vocab-runtime";
 import { encodeHex } from "byte-encodings/hex";
 import { getPortableActorGateways } from "@fedify/vocab-runtime/internal/jsonld-cache";
 import { isPlainJsonTree, retainSignedRepresentation } from "@fedify/vocab-runtime/internal/signed-representation";
@@ -671,6 +671,12 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 			keyId: proof.verificationMethodId.href,
 			error
 		});
+		const check = options[verificationObservation]?.check;
+		if (check != null && check.reason == null) check.reason = {
+			type: "keyFetchError",
+			keyId: new URL(proof.verificationMethodId.href),
+			result: { error: error instanceof Error ? error : new Error(String(error)) }
+		};
 		return null;
 	}
 	const publicKey = fetchedKey.key;
@@ -1199,6 +1205,39 @@ async function verifyPreparedPortableObjectProof(jsonLd, prepared, options, mess
 * @since 0.10.0
 */
 async function verifyObject(cls, jsonLd, options = {}) {
+	const result = await verifyObjectDetailed(cls, jsonLd, options);
+	return result.status === "verified" ? result.object : null;
+}
+/**
+* Same as {@link verifyObject}, but also tells who signed the verified proofs,
+* and whether a failure was caused by a key that could not be obtained for
+* a retryable reason.
+* @param cls The class of the object to verify.
+* @param jsonLd The JSON-LD object to verify.
+* @param options Additional options.
+* @returns The result.
+* @throws {TypeError} If the object is invalid or unsupported.
+* @internal
+*/
+async function verifyObjectDetailed(cls, jsonLd, options = {}) {
+	const classify = (result, checks) => {
+		if (result != null) return {
+			status: "verified",
+			object: result.object,
+			signers: result.signers
+		};
+		for (const check of checks) {
+			if (check.status === "error" && isTransientFetchError(check.error)) return {
+				status: "unavailable",
+				error: check.error
+			};
+			if (check.status === "rejected" && check.reason.type === "keyFetchError" && isRetryableKeyFetchError(check.reason.result)) return {
+				status: "unavailable",
+				error: "error" in check.reason.result ? check.reason.result.error : /* @__PURE__ */ new Error(`Fetching key ${check.reason.keyId.href} failed with ${check.reason.result.status}.`)
+			};
+		}
+		return { status: "invalid" };
+	};
 	if (options[verificationObservation]?.attempt == null) {
 		const observedOptions = {
 			...options,
@@ -1210,16 +1249,16 @@ async function verifyObject(cls, jsonLd, options = {}) {
 		return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.verify_object", async (span) => {
 			try {
 				return await observeAttempt(observedOptions, "objectIntegrity", async (observation) => {
-					const object = await verifyObject(cls, jsonLd, {
+					const result = await verifyObjectCore(cls, jsonLd, {
 						...options,
 						[verificationObservation]: observation
 					});
-					if (object == null) {
+					if (result == null) {
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						span.setAttribute("activitypub.verification.failure_reason", observation.attempt?.reason?.type ?? "signatureVerificationFailed");
 					}
-					return object;
-				}, (value) => value != null);
+					return classify(result, observation.attempt?.checks ?? []);
+				}, (value) => value.status === "verified");
 			} catch (error) {
 				span.setStatus({
 					code: SpanStatusCode.ERROR,
@@ -1231,6 +1270,15 @@ async function verifyObject(cls, jsonLd, options = {}) {
 			}
 		});
 	}
+	const checks = options[verificationObservation].attempt.checks;
+	const before = checks.length;
+	return classify(await verifyObjectCore(cls, jsonLd, options), checks.slice(before));
+}
+function isRetryableKeyFetchError(result) {
+	if ("error" in result) return isTransientFetchError(result.error);
+	return result.status >= 500 || result.status === 408 || result.status === 429;
+}
+async function verifyObjectCore(cls, jsonLd, options) {
 	const observation = options[verificationObservation];
 	const logger = getLogger([
 		"fedify",
@@ -1243,6 +1291,7 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	const defaultDocumentLoader = getDocumentLoader();
 	const proofContextLoader = options.contextLoader ?? defaultDocumentLoader;
 	const attributions = new Set(object.attributionIds.map((uri) => uri.href));
+	const signers = [];
 	if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
 	const rawProofValues = isJsonLdNode(jsonLd) ? await getRawProofValues(jsonLd, proofContextLoader) : [];
 	const rawProofCandidates = isJsonLdNode(jsonLd) ? await parseRawProofCandidates(jsonLd, rawProofValues, options, proofContextLoader) : [];
@@ -1301,6 +1350,11 @@ async function verifyObject(cls, jsonLd, options = {}) {
 			continue;
 		}
 		deleteAuthenticatedAttribution(attributions, key.controllerId, proof.verificationMethodId);
+		const signer = getAuthenticatedController(key.controllerId, proof.verificationMethodId);
+		if (signer != null && !signers.some((s) => s.kind === signer.kind && s.id.href === signer.id.href && s.keyId.href === proof.verificationMethodId.href)) signers.push({
+			...signer,
+			keyId: proof.verificationMethodId
+		});
 	}
 	if (acceptedPortableProofs < loadedPortableProofs) {
 		logger.debug("Some portable proof references could not be dereferenced.");
@@ -1314,7 +1368,41 @@ async function verifyObject(cls, jsonLd, options = {}) {
 		logger.debug("Some attributions are not authenticated by the proofs: {attributions}.", { attributions: [...attributions] });
 		return null;
 	}
-	return object;
+	return {
+		object,
+		signers
+	};
+}
+/**
+* Tells whom a key that verified an Object Integrity Proof authenticates.
+* @param key The key, i.e., the proof's verification method.
+* @returns The signer, or `null` if the key authenticates nobody.
+* @internal
+*/
+function getProofSigner(key) {
+	if (key.id == null || key.controllerId == null) return null;
+	const signer = getAuthenticatedController(key.controllerId, key.id);
+	return signer == null ? null : {
+		...signer,
+		keyId: key.id
+	};
+}
+/**
+* Tells whom a verified proof authenticates: the key's controller if it is an
+* ordinary actor, or the DID of a portable controller if the verification
+* method belongs to the same DID.
+*/
+function getAuthenticatedController(controllerId, verificationMethodId) {
+	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) return {
+		kind: "actor",
+		id: controllerId
+	};
+	const did = getPortableDid(controllerId);
+	if (did == null || !hasCryptographicOrigin(verificationMethodId.href) || getPortableDid(verificationMethodId) !== did || !URL.canParse(did)) return null;
+	return {
+		kind: "portableAuthority",
+		id: new URL(did)
+	};
 }
 function deleteAuthenticatedAttribution(attributions, controllerId, verificationMethodId) {
 	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) {
@@ -1329,4 +1417,4 @@ function hasCryptographicOrigin(iri) {
 	return /^did:/i.test(iri) || /^ap(?:\+ef61)?:\/\//i.test(iri);
 }
 //#endregion
-export { preparePortableObjectProofPolicy as a, verifyObject as c, verifyPortableObjectProofWithRoot as d, verifyPreparedPortableObjectProofPolicy as f, hasProofLike as i, verifyPortableObjectProof as l, classifyFep2277CoreType as n, signObject as o, verifyProof as p, createProof as r, verifyMapLocalProof as s, InvalidPortableObjectIdError as t, verifyPortableObjectProofPolicy as u };
+export { hasProofLike as a, verifyMapLocalProof as c, verifyPortableObjectProof as d, verifyPortableObjectProofPolicy as f, verifyProof as h, getProofSigner as i, verifyObject as l, verifyPreparedPortableObjectProofPolicy as m, classifyFep2277CoreType as n, preparePortableObjectProofPolicy as o, verifyPortableObjectProofWithRoot as p, createProof as r, signObject as s, InvalidPortableObjectIdError as t, verifyObjectDetailed as u };

package/dist/{send-AF25pWaJ.mjs → send-BgGJh6pv.mjs}

@@ -2,13 +2,14 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { d as isPortableUri } from "./portable-key-id-Ca30-hOa.mjs";
-import { n as version, t as name } from "./deno-eNpfj4oR.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-D3LHk6Z4.mjs";
-import { n as doubleKnock } from "./http-BUJ5SFh6.mjs";
+import { n as version, t as name } from "./deno-iOAA7iRN.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-CpxvUrBz.mjs";
+import { r as doubleKnockScoped } from "./http-BoJCMnjY.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
-import { FetchError, UrlError, canonicalizePortableUri, getFe34Origin, isGatewayUrl, toCompatibleEf61Id, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, canonicalizePortableUri, getFe34Origin, isGatewayUrl, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { getPortableGatewayCandidates } from "@fedify/vocab-runtime/internal/portable-dereference";
+import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";
 /**
 * Resolves a portable inbox, i.e., an `ap:` or `ap+ef61:` URI, to
 * the compatible identifiers of the inbox on the recipient's gateways.
@@ -188,9 +189,10 @@ function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
 *
 * @param parameters The parameters for sending the activity.
 *                   See also {@link SendActivityParameters}.
+* @param deps The dependencies, for tests.
 * @throws {Error} If the activity fails to send.
 */
-function sendActivity(options) {
+function sendActivity(options, deps = {}) {
 	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
 	return tracerProvider.getTracer(name, version).startActiveSpan("activitypub.send_activity", {
 		kind: SpanKind.CLIENT,
@@ -206,7 +208,7 @@ function sendActivity(options) {
 			}, () => sendActivityInternal({
 				...options,
 				tracerProvider
-			}, span));
+			}, span, deps));
 		} catch (e) {
 			span.setStatus({
 				code: SpanStatusCode.ERROR,
@@ -291,13 +293,14 @@ async function readLimitedResponseBody(response, maxBytes) {
 			totalBytes += value.length;
 		}
 	} finally {
+		if (truncated) reader.cancel().catch(() => {});
 		reader.releaseLock();
 	}
 	let result = chunks.join("");
 	if (truncated) result += "… (truncated)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span, deps) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -306,9 +309,11 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 	const federationMetrics = getFederationMetrics(meterProvider);
 	const started = performance.now();
 	let deliverySuccess = false;
-	async function validateUrl(url) {
-		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
+	const openUnvalidatedHop = deps.openHop ?? (allowPrivateAddress ? openDirectFetch : (url) => openPublicFetch(url));
+	async function openHop(url) {
+		let session;
+		try {
+			session = await openUnvalidatedHop(url);
 		} catch (error) {
 			if (error instanceof UrlError && error.reason === "dns") {
 				logger.error("DNS resolution failed for URL: {url}", {
@@ -325,82 +330,90 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 			});
 			throw error;
 		}
+		return session;
 	}
+	let initialSession;
 	try {
-		await validateUrl(inbox.href);
+		initialSession = await openHop(inbox.href);
 	} catch (error) {
 		if (error instanceof FetchError) federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
 		throw error;
 	}
-	headers = new Headers(headers);
-	headers.set("Content-Type", "application/activity+json");
-	const request = new Request(inbox, {
-		method: "POST",
-		headers,
-		body: JSON.stringify(activity),
-		redirect: "manual"
-	});
-	let rsaKey = null;
-	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		rsaKey = key;
-		break;
-	}
-	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
-		activityId,
-		inbox: inbox.href
-	});
-	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
-		inbox: inbox.href,
-		keys: keys.map((pair) => ({
-			keyId: pair.keyId.href,
-			privateKey: pair.privateKey
-		}))
-	});
-	let response;
+	let initialPending = true;
+	const openDeliveryHop = (url) => {
+		if (initialPending) {
+			initialPending = false;
+			return Promise.resolve(initialSession);
+		}
+		return openHop(url);
+	};
 	try {
-		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await doubleKnock(request, rsaKey, {
-			tracerProvider,
-			specDeterminer,
-			validateRedirect: validateUrl
+		headers = new Headers(headers);
+		headers.set("Content-Type", "application/activity+json");
+		const request = new Request(inbox, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(activity),
+			redirect: "manual"
 		});
-	} catch (error) {
-		const failure = error instanceof FetchError || error instanceof UrlError ? error : createFetchError(inbox.href, error);
-		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
+		let rsaKey = null;
+		for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
+			rsaKey = key;
+			break;
+		}
+		if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
 			activityId,
+			inbox: inbox.href
+		});
+		else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 			inbox: inbox.href,
-			error: failure
+			keys: keys.map((pair) => ({
+				keyId: pair.keyId.href,
+				privateKey: pair.privateKey
+			}))
 		});
-		federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
-		throw failure;
-	}
-	try {
-		if (!response.ok) {
-			let error;
-			try {
-				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
-			} catch (_) {
-				error = "";
-			}
-			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+		let outcome;
+		try {
+			outcome = rsaKey == null ? await fetchWithValidatedRedirects(request, openDeliveryHop, (response) => consumeSendActivityResponse(response, inbox)) : await doubleKnockScoped(request, rsaKey, {
+				tracerProvider,
+				specDeterminer
+			}, openDeliveryHop, (response) => consumeSendActivityResponse(response, inbox));
+		} catch (error) {
+			const failure = error instanceof FetchError || error instanceof UrlError ? error : createFetchError(inbox.href, error);
+			logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
 				activityId,
 				inbox: inbox.href,
-				status: response.status,
-				statusText: response.statusText,
-				error
+				error: failure
 			});
-			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
+			federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
+			throw failure;
+		}
+		try {
+			if (!outcome.ok) {
+				const { status, statusText, error, responseHeaders } = outcome;
+				logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+					activityId,
+					inbox: inbox.href,
+					status,
+					statusText,
+					error
+				});
+				throw new SendActivityError(inbox, status, `Failed to send activity ${activityId} to ${inbox.href} (${status} ${statusText}):\n${error}`, error, responseHeaders);
+			}
+			deliverySuccess = true;
+			const eventAttributes = {
+				"activitypub.inbox.url": inbox.href,
+				"activitypub.activity.id": activityId ?? ""
+			};
+			if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
+			const actorId = getActivityActorId(activity);
+			if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
+			span.addEvent("activitypub.activity.sent", eventAttributes);
+		} finally {
+			federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
 		}
-		deliverySuccess = true;
-		const eventAttributes = {
-			"activitypub.inbox.url": inbox.href,
-			"activitypub.activity.id": activityId ?? ""
-		};
-		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
-		const actorId = getActivityActorId(activity);
-		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
-		span.addEvent("activitypub.activity.sent", eventAttributes);
 	} finally {
-		federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
+		if (initialPending) await initialSession.close();
 	}
 }
 function createFetchError(url, cause) {
@@ -408,10 +421,75 @@ function createFetchError(url, cause) {
 	error.cause = cause;
 	return error;
 }
-async function fetchWithValidatedRedirects(request, validateUrl) {
+/**
+* Starts cancelling the body of a response without waiting for it to settle.
+* The cancellation of a branch of a tee (e.g., a body cloned by a fetch mock)
+* settles only after the other branch is cancelled too, per the Streams
+* standard, so awaiting it could block forever.  Failures are only logged.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		getLogger([
+			"fedify",
+			"federation",
+			"outbox"
+		]).debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
+		});
+	});
+}
+/**
+* Reads what is needed from the final response of a delivery while its
+* session is open: the body of a successful response is cancelled, and at
+* most 1 KiB of an error response body is read.
+*/
+async function consumeSendActivityResponse(response, inbox) {
+	if (response.ok) {
+		cancelResponseBody(response, response.url || inbox.href);
+		return { ok: true };
+	}
+	let error;
+	try {
+		error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
+	} catch (_) {
+		error = "";
+	}
+	return {
+		ok: false,
+		status: response.status,
+		statusText: response.statusText,
+		error,
+		responseHeaders: new Headers(response.headers)
+	};
+}
+/**
+* Sends a request without signing it, following redirects manually like the
+* Fetch standard does.  Every hop is opened with `openHop()`, which validates
+* the destination, after the previous hop is closed.  The final response is
+* passed to `consume()`, and its session is closed after that.
+* This is exported only for tests; it is not exported from any entry point.
+* @param request The request to send.
+* @param openHop The function to open a session for each hop.
+* @param consume The function to consume the final response.
+* @returns The value returned by `consume`.
+*/
+async function fetchWithValidatedRedirects(request, openHop, consume) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"outbox"
+	]);
 	let body = await request.clone().text();
 	for (let redirects = 0;; redirects++) {
-		const response = await fetch(request, { redirect: "manual" });
+		const session = await openHop(request.url);
+		let response;
+		try {
+			response = await session.fetch(request, { redirect: "manual" });
+		} catch (error) {
+			await closeAfterError(session, logger);
+			throw error;
+		}
 		const location = response.headers.get("Location");
 		if (![
 			301,
@@ -419,11 +497,21 @@ async function fetchWithValidatedRedirects(request, validateUrl) {
 			303,
 			307,
 			308
-		].includes(response.status) || location == null) return response;
-		await response.body?.cancel();
+		].includes(response.status) || location == null) try {
+			return await consume(response);
+		} catch (error) {
+			logger.debug("Failed to consume the response from {url}; closing the session: {error}", {
+				url: request.url,
+				error
+			});
+			throw error;
+		} finally {
+			await session.close();
+		}
+		cancelResponseBody(response, request.url);
+		await session.close();
 		if (redirects >= 20) throw new TypeError("Too many redirects");
 		const url = new URL(location, request.url);
-		await validateUrl(url.href);
 		const headers = new Headers(request.headers);
 		if (url.origin !== new URL(request.url).origin) {
 			headers.delete("Authorization");
@@ -451,6 +539,16 @@ async function fetchWithValidatedRedirects(request, validateUrl) {
 		});
 	}
 }
+async function closeAfterError(session, logger) {
+	try {
+		await session.close();
+	} catch (error) {
+		logger.debug("Failed to close the session for {url}: {error}", {
+			url: session.url.href,
+			error
+		});
+	}
+}
 /**
 * An error that is thrown when an activity fails to send to a remote inbox.
 * It contains structured information about the failure, including the HTTP
@@ -496,4 +594,4 @@ var SendActivityError = class extends Error {
 	}
 };
 //#endregion
-export { getOrderingDestination as a, sendActivityThroughGateways as i, extractInboxes as n, sendActivity as r, SendActivityError as t };
+export { sendActivityThroughGateways as a, sendActivity as i, extractInboxes as n, getOrderingDestination as o, fetchWithValidatedRedirects as r, SendActivityError as t };

package/dist/sig/compound-proof-discovery.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { a as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-D1djO5fa.mjs";
+import { a as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-cYtvlTgF.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-discovery.test.ts

package/dist/sig/compound-proof-producer.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { a as inspectCompoundPortableObjectApplicability, i as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-D1djO5fa.mjs";
+import { a as inspectCompoundPortableObjectApplicability, i as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-cYtvlTgF.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-producer.test.ts
 const portableId = "ap+ef61://did:key:z6MkAlice/objects/1";

package/dist/sig/compound-proof-verification.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { s as verifyMapLocalProof, u as verifyPortableObjectProofPolicy } from "../proof-Cryb1c70.mjs";
+import { c as verifyMapLocalProof, f as verifyPortableObjectProofPolicy } from "../proof-GH7Poos_.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { a as inspectCompoundPortableObjectApplicability, o as verifyCompoundPortableObjectProofs, s as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-D1djO5fa.mjs";
+import { a as inspectCompoundPortableObjectApplicability, o as verifyCompoundPortableObjectProofs, s as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-cYtvlTgF.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { CryptographicKey, Multikey, Person } from "@fedify/vocab";

package/dist/sig/compound-proof.test.mjs

@@ -6,9 +6,9 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { o as signObject, p as verifyProof } from "../proof-Cryb1c70.mjs";
+import { h as verifyProof, s as signObject } from "../proof-GH7Poos_.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { s as verifyCompoundProofDocuments } from "../compound-proof-D1djO5fa.mjs";
+import { s as verifyCompoundProofDocuments } from "../compound-proof-cYtvlTgF.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";