@fedify/fedify 2.5.0-dev.2494 → 2.5.0-dev.2496

package/dist/federation/webfinger.test.mjs

@@ -1,12 +1,12 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { r as createRequestContext } from "../context-COHd1Rsh.mjs";
+import { r as createRequestContext } from "../context-A-Nde3u-.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { o as createFederation, s as handleWebFinger } from "../middleware-BEaUojg7.mjs";
+import { o as createFederation, s as handleWebFinger } from "../middleware-CREOtfQu.mjs";
 import { Image, Link, Person, Tombstone } from "@fedify/vocab";
 import { parseIri } from "@fedify/vocab-runtime";
 import { createTestMeterProvider, test } from "@fedify/fixture";

package/dist/{federation-CFaTsSMN.cjs → federation-BsYWlas-.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-2SwIR4b-.cjs");
+const require_http = require("./http-DRIP8OAf.cjs");
 const require_types = require("./types-hKCCjii0.cjs");
-const require_portable_collection = require("./portable-collection-BeS88JJp.cjs");
-const require_kv_cache = require("./kv-cache-Cd8xKv-x.cjs");
+const require_portable_collection = require("./portable-collection-CnaKW3o7.cjs");
+const require_kv_cache = require("./kv-cache-Dzr88ylV.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -2859,7 +2859,7 @@ function normalizeActorId(id) {
 * @internal
 */
 function principalAuthenticates(principal, actorId) {
-	if (principal.kind === "portableAuthority") {
+	if (principal.kind === "portable-authority") {
 		if (!require_http.isPortableId(actorId)) return false;
 		const did = require_http.getPortableDid(actorId);
 		return did != null && did === require_http.getPortableDid(principal.id);
@@ -2897,11 +2897,45 @@ function principalAuthenticates(principal, actorId) {
 function isActorAuthenticated(evidence, actorId, options = {}) {
 	return getEffectivePrincipals(evidence, options.scope).some((principal) => principalAuthenticates(principal, actorId));
 }
+const SERIALIZED_KINDS = {
+	actor: "actor",
+	"portable-authority": "portableAuthority"
+};
+const PUBLIC_KINDS = {
+	actor: "actor",
+	portableAuthority: "portable-authority"
+};
+const SERIALIZED_MECHANISMS = {
+	"http-signatures": "httpSignatures",
+	"linked-data-signatures": "linkedDataSignatures",
+	"object-integrity-proofs": "objectIntegrityProofs",
+	origin: "origin"
+};
+const PUBLIC_MECHANISMS = {
+	httpSignatures: "http-signatures",
+	linkedDataSignatures: "linked-data-signatures",
+	objectIntegrityProofs: "object-integrity-proofs",
+	origin: "origin"
+};
+/**
+* Converts an internal proof signer to the public authentication principal.
+* @param signer The authenticated signer.
+* @returns The public principal.
+* @internal
+*/
+function toProofPrincipal(signer) {
+	return {
+		kind: PUBLIC_KINDS[signer.kind],
+		id: signer.id,
+		mechanism: "object-integrity-proofs",
+		keyId: signer.keyId
+	};
+}
 function serializePrincipal(principal) {
 	return {
-		kind: principal.kind,
+		kind: SERIALIZED_KINDS[principal.kind],
 		id: principal.id.href,
-		mechanism: principal.mechanism,
+		mechanism: SERIALIZED_MECHANISMS[principal.mechanism],
 		keyId: principal.keyId?.href ?? null
 	};
 }
@@ -2917,22 +2951,15 @@ function serializeAuthentication(evidence) {
 		originAuthenticated: evidence.originAuthenticated.map(serializePrincipal)
 	};
 }
-const KINDS = /* @__PURE__ */ new Set(["actor", "portableAuthority"]);
-const MECHANISMS = /* @__PURE__ */ new Set([
-	"httpSignatures",
-	"linkedDataSignatures",
-	"objectIntegrityProofs",
-	"origin"
-]);
 function deserializePrincipals(value) {
 	if (!Array.isArray(value)) return null;
 	const principals = [];
 	for (const item of value) {
-		if (item == null || typeof item !== "object" || !KINDS.has(item.kind) || !MECHANISMS.has(item.mechanism) || typeof item.id !== "string" || !URL.canParse(item.id) || item.keyId != null && (typeof item.keyId !== "string" || !URL.canParse(item.keyId))) return null;
+		if (item == null || typeof item !== "object" || !(typeof item.kind === "string" && Object.hasOwn(PUBLIC_KINDS, item.kind)) || !(typeof item.mechanism === "string" && Object.hasOwn(PUBLIC_MECHANISMS, item.mechanism)) || typeof item.id !== "string" || !URL.canParse(item.id) || item.keyId != null && (typeof item.keyId !== "string" || !URL.canParse(item.keyId))) return null;
 		principals.push(Object.freeze({
-			kind: item.kind,
+			kind: PUBLIC_KINDS[item.kind],
 			id: new URL(item.id),
-			mechanism: item.mechanism,
+			mechanism: PUBLIC_MECHANISMS[item.mechanism],
 			keyId: item.keyId == null ? null : new URL(item.keyId)
 		}));
 	}
@@ -5567,13 +5594,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(require_http.name, require_http.version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -5619,7 +5646,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -5661,7 +5688,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(portable == null ? baseUri : pageBase);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: _opentelemetry_api.SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -5677,7 +5704,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -6503,7 +6530,7 @@ async function handleInboxInternal(request, parameters, span, snapshot) {
 		if (ldSigKey?.ownerId != null) documentSigners = [{
 			kind: "actor",
 			id: ldSigKey.ownerId,
-			mechanism: "linkedDataSignatures",
+			mechanism: "linked-data-signatures",
 			keyId: ldSigKey.id
 		}];
 		if (await isActorlessCandidate(activity, viewSource)) {
@@ -6863,7 +6890,7 @@ async function handleInboxInternal(request, parameters, span, snapshot) {
 	if (httpSigKey != null && !actorless && activity.actorId != null) requestSigners = [{
 		kind: "actor",
 		id: activity.actorId,
-		mechanism: "httpSignatures",
+		mechanism: "http-signatures",
 		keyId: httpSigKey.id
 	}];
 	if (actorless) {
@@ -6879,7 +6906,7 @@ async function handleInboxInternal(request, parameters, span, snapshot) {
 			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 			observation.authentication = {
 				status: "rejected",
-				reason: { type: "noAuthenticatedPrincipal" }
+				reason: { type: "no-authenticated-principal" }
 			};
 			logger.error("The activity {activityId} declares no actor, and no principal is authenticated for it.", {
 				activity: json,
@@ -6899,7 +6926,7 @@ async function handleInboxInternal(request, parameters, span, snapshot) {
 			observation.authentication = {
 				status: "rejected",
 				reason: {
-					type: "activityOriginMismatch",
+					type: "activity-origin-mismatch",
 					activityId: new URL(activity.id.href),
 					actorIds: check.principals.map((principal) => principal.id)
 				}
@@ -6983,7 +7010,7 @@ async function handleInboxInternal(request, parameters, span, snapshot) {
 		observation.authentication = {
 			status: "rejected",
 			reason: {
-				type: "activityOriginMismatch",
+				type: "activity-origin-mismatch",
 				activityId: new URL(activity.id.href),
 				actorIds: activity.actorIds.map((id) => new URL(id.href))
 			}
@@ -7257,8 +7284,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = _opentelemetry_api.trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = _opentelemetry_api.trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -7770,12 +7797,7 @@ const MIN_COMPONENTS = [
 * Turns the signers of verified Object Integrity Proofs into principals.
 */
 function toProofPrincipals(signers) {
-	return signers.map((signer) => ({
-		kind: signer.kind,
-		id: signer.id,
-		mechanism: "objectIntegrityProofs",
-		keyId: signer.keyId
-	}));
+	return signers.map(toProofPrincipal);
 }
 /**
 * Gets the principal of an HTTP Signature key, whose owner was confirmed by
@@ -7788,7 +7810,7 @@ function getHttpKeyPrincipal(key) {
 		return {
 			kind: "actor",
 			id: (0, _fedify_vocab_runtime.parseIri)(evidence.ownerId),
-			mechanism: "httpSignatures",
+			mechanism: "http-signatures",
 			keyId: key.id
 		};
 	} catch {
@@ -7798,7 +7820,7 @@ function getHttpKeyPrincipal(key) {
 	return {
 		kind: "actor",
 		id: key.ownerId,
-		mechanism: "httpSignatures",
+		mechanism: "http-signatures",
 		keyId: key.id
 	};
 }
@@ -12643,12 +12665,7 @@ var ContextImpl = class ContextImpl {
 				const result = verifications.get(candidate.document);
 				if (result?.verified === true && result.method === "proof") documentSigners = result.keys.flatMap((key) => {
 					const signer = require_http.getProofSigner(key);
-					return signer == null ? [] : [{
-						kind: signer.kind,
-						id: signer.id,
-						mechanism: "objectIntegrityProofs",
-						keyId: signer.keyId
-					}];
+					return signer == null ? [] : [toProofPrincipal(signer)];
 				});
 			} else originAuthenticated = fetched.actorIds.map((actorId) => ({
 				kind: "actor",
@@ -12662,12 +12679,7 @@ var ContextImpl = class ContextImpl {
 				activity: json
 			});
 			activity = verified.object;
-			documentSigners = verified.signers.map((signer) => ({
-				kind: signer.kind,
-				id: signer.id,
-				mechanism: "objectIntegrityProofs",
-				keyId: signer.keyId
-			}));
+			documentSigners = verified.signers.map(toProofPrincipal);
 			viewSource = {
 				policy: "standard",
 				source: "activity",

package/dist/{http-CxKd10Lq.mjs → http-Bexcl2MP.mjs}

@@ -3,12 +3,12 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { m as parseKeyIdString } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-D7blYLbb.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B7TvoAP7.mjs";
+import { n as version, t as name } from "./deno-Bd6U_y-w.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DS2ZFVe-.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
 import { a as promoteKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
-import { D as validateCryptoKey, b as bypassKeyCacheReads, w as fetchKeyDetailed } from "./ld-DUeBHFWH.mjs";
-import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-BpBucRfb.mjs";
+import { D as validateCryptoKey, b as bypassKeyCacheReads, w as fetchKeyDetailed } from "./ld-DrQTMLaI.mjs";
+import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-v1tXVIxd.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{http-2SwIR4b-.cjs → http-DRIP8OAf.cjs}

@@ -17,7 +17,7 @@ json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.5.0-dev.2494+f2e9b5d3";
+var version = "2.5.0-dev.2496+e18c05f8";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;

package/dist/{http-CrYxBKqG.js → http-DU8SkmyD.js}

@@ -15,7 +15,7 @@ import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.5.0-dev.2494+f2e9b5d3";
+var version = "2.5.0-dev.2496+e18c05f8";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;

package/dist/{inbox-CM0UktG8.mjs → inbox-DzY3wS80.mjs}

@@ -2,9 +2,9 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as getAuthenticationOrigin } from "./portable-key-id-Ca30-hOa.mjs";
-import { o as serializeAuthentication, r as getEffectivePrincipals } from "./inbox-authentication-DflPYlLL.mjs";
-import { n as version, t as name } from "./deno-D7blYLbb.mjs";
-import { g as recordInboxActivity, n as getDurationMs, r as getFederationMetrics } from "./metrics-B7TvoAP7.mjs";
+import { o as serializeAuthentication, r as getEffectivePrincipals } from "./inbox-authentication-CgonVRkg.mjs";
+import { n as version, t as name } from "./deno-Bd6U_y-w.mjs";
+import { g as recordInboxActivity, n as getDurationMs, r as getFederationMetrics } from "./metrics-DS2ZFVe-.mjs";
 import { getLogger } from "@logtape/logtape";
 import { getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";

package/dist/{inbox-authentication-DflPYlLL.mjs → inbox-authentication-CgonVRkg.mjs}

@@ -49,7 +49,7 @@ function normalizeActorId(id) {
 * @internal
 */
 function principalAuthenticates(principal, actorId) {
-	if (principal.kind === "portableAuthority") {
+	if (principal.kind === "portable-authority") {
 		if (!isPortableId(actorId)) return false;
 		const did = getPortableDid(actorId);
 		return did != null && did === getPortableDid(principal.id);
@@ -87,11 +87,45 @@ function principalAuthenticates(principal, actorId) {
 function isActorAuthenticated(evidence, actorId, options = {}) {
 	return getEffectivePrincipals(evidence, options.scope).some((principal) => principalAuthenticates(principal, actorId));
 }
+const SERIALIZED_KINDS = {
+	actor: "actor",
+	"portable-authority": "portableAuthority"
+};
+const PUBLIC_KINDS = {
+	actor: "actor",
+	portableAuthority: "portable-authority"
+};
+const SERIALIZED_MECHANISMS = {
+	"http-signatures": "httpSignatures",
+	"linked-data-signatures": "linkedDataSignatures",
+	"object-integrity-proofs": "objectIntegrityProofs",
+	origin: "origin"
+};
+const PUBLIC_MECHANISMS = {
+	httpSignatures: "http-signatures",
+	linkedDataSignatures: "linked-data-signatures",
+	objectIntegrityProofs: "object-integrity-proofs",
+	origin: "origin"
+};
+/**
+* Converts an internal proof signer to the public authentication principal.
+* @param signer The authenticated signer.
+* @returns The public principal.
+* @internal
+*/
+function toProofPrincipal(signer) {
+	return {
+		kind: PUBLIC_KINDS[signer.kind],
+		id: signer.id,
+		mechanism: "object-integrity-proofs",
+		keyId: signer.keyId
+	};
+}
 function serializePrincipal(principal) {
 	return {
-		kind: principal.kind,
+		kind: SERIALIZED_KINDS[principal.kind],
 		id: principal.id.href,
-		mechanism: principal.mechanism,
+		mechanism: SERIALIZED_MECHANISMS[principal.mechanism],
 		keyId: principal.keyId?.href ?? null
 	};
 }
@@ -107,22 +141,15 @@ function serializeAuthentication(evidence) {
 		originAuthenticated: evidence.originAuthenticated.map(serializePrincipal)
 	};
 }
-const KINDS = /* @__PURE__ */ new Set(["actor", "portableAuthority"]);
-const MECHANISMS = /* @__PURE__ */ new Set([
-	"httpSignatures",
-	"linkedDataSignatures",
-	"objectIntegrityProofs",
-	"origin"
-]);
 function deserializePrincipals(value) {
 	if (!Array.isArray(value)) return null;
 	const principals = [];
 	for (const item of value) {
-		if (item == null || typeof item !== "object" || !KINDS.has(item.kind) || !MECHANISMS.has(item.mechanism) || typeof item.id !== "string" || !URL.canParse(item.id) || item.keyId != null && (typeof item.keyId !== "string" || !URL.canParse(item.keyId))) return null;
+		if (item == null || typeof item !== "object" || !(typeof item.kind === "string" && Object.hasOwn(PUBLIC_KINDS, item.kind)) || !(typeof item.mechanism === "string" && Object.hasOwn(PUBLIC_MECHANISMS, item.mechanism)) || typeof item.id !== "string" || !URL.canParse(item.id) || item.keyId != null && (typeof item.keyId !== "string" || !URL.canParse(item.keyId))) return null;
 		principals.push(Object.freeze({
-			kind: item.kind,
+			kind: PUBLIC_KINDS[item.kind],
 			id: new URL(item.id),
-			mechanism: item.mechanism,
+			mechanism: PUBLIC_MECHANISMS[item.mechanism],
 			keyId: item.keyId == null ? null : new URL(item.keyId)
 		}));
 	}
@@ -168,4 +195,4 @@ function createAuthenticationEvidence(evidence) {
 	});
 }
 //#endregion
-export { isActorAuthenticated as a, getEmptyAuthenticationEvidence as i, deserializeAuthentication as n, serializeAuthentication as o, getEffectivePrincipals as r, createAuthenticationEvidence as t };
+export { isActorAuthenticated as a, getEmptyAuthenticationEvidence as i, deserializeAuthentication as n, serializeAuthentication as o, getEffectivePrincipals as r, toProofPrincipal as s, createAuthenticationEvidence as t };

package/dist/{inbox-view-BJ5DBPFo.mjs → inbox-view-CXoRpTuL.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader, p as markEffectiveContextLoader, s as detachSignature, y as wrapContextLoaderForJsonLd } from "./ld-DUeBHFWH.mjs";
+import { c as getNormalizationContextLoader, p as markEffectiveContextLoader, s as detachSignature, y as wrapContextLoaderForJsonLd } from "./ld-DrQTMLaI.mjs";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 import { encodeHex } from "byte-encodings/hex";
 import jsonld from "@fedify/vocab-runtime/jsonld";

package/dist/{kv-cache-DbgFe35y.js → kv-cache-C1GxDlbI.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { X as validateCryptoKey, dt as recordDocumentCache, t as doubleKnockScoped } from "./http-CrYxBKqG.js";
+import { X as validateCryptoKey, dt as recordDocumentCache, t as doubleKnockScoped } from "./http-DU8SkmyD.js";
 import { getLogger } from "@logtape/logtape";
 import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, resolveDocumentLoaderTimeout, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{kv-cache-Cd8xKv-x.cjs → kv-cache-Dzr88ylV.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-2SwIR4b-.cjs");
+const require_http = require("./http-DRIP8OAf.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{kv-cache-CIdGATck.mjs → kv-cache-fvy2JeOS.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-B7TvoAP7.mjs";
+import { p as recordDocumentCache } from "./metrics-DS2ZFVe-.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{ld-DUeBHFWH.mjs → ld-DrQTMLaI.mjs}

@@ -3,8 +3,8 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { c as isPortableActorDocument, d as isPortableUri, l as isPortableId, m as parseKeyIdString, s as isCompatibleKeyId } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-D7blYLbb.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch, t as classifyFetchError } from "./metrics-B7TvoAP7.mjs";
+import { n as version, t as name } from "./deno-Bd6U_y-w.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch, t as classifyFetchError } from "./metrics-DS2ZFVe-.mjs";
 import { n as attachKeyOwnerEvidence, t as MAX_PORTABLE_KEY_TTL } from "./key-owner-evidence-APB6NpSk.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Multikey, Object as Object$1, getTypeId, isActor } from "@fedify/vocab";

package/dist/{metrics-B7TvoAP7.mjs → metrics-DS2ZFVe-.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-D7blYLbb.mjs";
+import { n as version, t as name } from "./deno-Bd6U_y-w.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-BEaUojg7.mjs → middleware-CREOtfQu.mjs}

@@ -3,32 +3,32 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { d as isPortableUri, f as isSameObjectId, i as getPortableDid, l as isPortableId, n as getCanonicalPortableId, o as hasPortableActor, r as getGatewayKeyBase, s as isCompatibleKeyId, t as getAuthenticationOrigin, u as isPortableKeyId } from "./portable-key-id-Ca30-hOa.mjs";
 import { n as isPubliclyAddressedNode, t as isInAudience } from "./audience-CHQ-FlLD.mjs";
-import { i as getEmptyAuthenticationEvidence, n as deserializeAuthentication, t as createAuthenticationEvidence } from "./inbox-authentication-DflPYlLL.mjs";
+import { i as getEmptyAuthenticationEvidence, n as deserializeAuthentication, s as toProofPrincipal, t as createAuthenticationEvidence } from "./inbox-authentication-CgonVRkg.mjs";
 import { a as verificationObservation, r as snapshotKey, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-D7blYLbb.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-B7TvoAP7.mjs";
+import { n as version, t as name } from "./deno-Bd6U_y-w.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DS2ZFVe-.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
 import { r as getVerifiedKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
-import { D as validateCryptoKey, E as importJwk, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, g as verifyCompactJsonLdDetailed, l as hasSignature, m as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike, x as exportJwk, y as wrapContextLoaderForJsonLd } from "./ld-DUeBHFWH.mjs";
+import { D as validateCryptoKey, E as importJwk, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, g as verifyCompactJsonLdDetailed, l as hasSignature, m as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike, x as exportJwk, y as wrapContextLoaderForJsonLd } from "./ld-DrQTMLaI.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { a as hasProofLike, d as verifyPortableObjectProof, i as getProofSigner, l as verifyObject, p as verifyPortableObjectProofWithRoot, s as signObject, t as InvalidPortableObjectIdError, u as verifyObjectDetailed } from "./proof-DQh2z9fx.mjs";
-import { c as parseRfc9421SignatureInput, f as validateMaxSignatures, l as selectRequestSignature, m as verifyRequestDetailed, o as listRequestSignatures, p as verifyRequest } from "./http-CxKd10Lq.mjs";
-import { n as getAuthenticatedDocumentLoader } from "./docloader-DbBbDaY-.mjs";
-import { n as kvCache } from "./kv-cache-CIdGATck.mjs";
+import { a as hasProofLike, d as verifyPortableObjectProof, i as getProofSigner, l as verifyObject, p as verifyPortableObjectProofWithRoot, s as signObject, t as InvalidPortableObjectIdError, u as verifyObjectDetailed } from "./proof-CzS2dAmn.mjs";
+import { c as parseRfc9421SignatureInput, f as validateMaxSignatures, l as selectRequestSignature, m as verifyRequestDetailed, o as listRequestSignatures, p as verifyRequest } from "./http-Bexcl2MP.mjs";
+import { n as getAuthenticatedDocumentLoader } from "./docloader-CDPwFfMf.mjs";
+import { n as kvCache } from "./kv-cache-fvy2JeOS.mjs";
 import { d as MAX_BODY_SIZE, f as readBoundedText, t as getNodeInfo, u as BodyTooLargeError } from "./client-5SIFzW3q.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CwijV0c5.mjs";
-import { t as verifyPortableObject } from "./portable-collection-B023xqhZ.mjs";
-import { a as sendActivityThroughGateways, i as sendActivity, n as extractInboxes, o as getOrderingDestination, t as SendActivityError } from "./send-DN5HNBv-.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-Y3pokaG2.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-56YVyohg.mjs";
+import { t as verifyPortableObject } from "./portable-collection-baJxIrh8.mjs";
+import { a as sendActivityThroughGateways, i as sendActivity, n as extractInboxes, o as getOrderingDestination, t as SendActivityError } from "./send-BqrsM02_.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-CUVoluZR.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-XJ53md4S.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as inspectCompoundPortableObjectApplicability, c as verifyServedPortableObjects, i as findUnsupportedCompoundProofShape, o as verifyCompoundPortableObjectProofs, r as findEmbeddedProofWithoutContext, t as containsCompoundPortableObject } from "./compound-proof-BM7AINht.mjs";
-import { a as isActorlessActivityAuthenticated, i as getInboxIdempotencyKey, n as checkActorlessActivity, o as isInboxActivityProcessed, s as routeActivity, t as actorsHaveSameOrigin } from "./inbox-CM0UktG8.mjs";
-import { c as expandDocument, d as parseSerializedVerifiedActivityView, f as restoreVerifiedActivityView, i as createReleasableLoader, l as getActorPresence, n as buildVerifiedActivityView, o as deepFreeze, r as createContextSnapshot, t as ContextSnapshotMissError } from "./inbox-view-BJ5DBPFo.mjs";
+import { a as inspectCompoundPortableObjectApplicability, c as verifyServedPortableObjects, i as findUnsupportedCompoundProofShape, o as verifyCompoundPortableObjectProofs, r as findEmbeddedProofWithoutContext, t as containsCompoundPortableObject } from "./compound-proof-DSHBRvPr.mjs";
+import { a as isActorlessActivityAuthenticated, i as getInboxIdempotencyKey, n as checkActorlessActivity, o as isInboxActivityProcessed, s as routeActivity, t as actorsHaveSameOrigin } from "./inbox-DzY3wS80.mjs";
+import { c as expandDocument, d as parseSerializedVerifiedActivityView, f as restoreVerifiedActivityView, i as createReleasableLoader, l as getActorPresence, n as buildVerifiedActivityView, o as deepFreeze, r as createContextSnapshot, t as ContextSnapshotMissError } from "./inbox-view-CXoRpTuL.mjs";
 import { t as KvKeyCache } from "./keycache-N2opu4-3.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-yl7Z7A6y.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-DgPS8S4x.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -2507,7 +2507,7 @@ async function handleInboxInternal(request, parameters, span, snapshot) {
 		if (ldSigKey?.ownerId != null) documentSigners = [{
 			kind: "actor",
 			id: ldSigKey.ownerId,
-			mechanism: "linkedDataSignatures",
+			mechanism: "linked-data-signatures",
 			keyId: ldSigKey.id
 		}];
 		if (await isActorlessCandidate(activity, viewSource)) {
@@ -2867,7 +2867,7 @@ async function handleInboxInternal(request, parameters, span, snapshot) {
 	if (httpSigKey != null && !actorless && activity.actorId != null) requestSigners = [{
 		kind: "actor",
 		id: activity.actorId,
-		mechanism: "httpSignatures",
+		mechanism: "http-signatures",
 		keyId: httpSigKey.id
 	}];
 	if (actorless) {
@@ -2883,7 +2883,7 @@ async function handleInboxInternal(request, parameters, span, snapshot) {
 			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 			observation.authentication = {
 				status: "rejected",
-				reason: { type: "noAuthenticatedPrincipal" }
+				reason: { type: "no-authenticated-principal" }
 			};
 			logger.error("The activity {activityId} declares no actor, and no principal is authenticated for it.", {
 				activity: json,
@@ -2903,7 +2903,7 @@ async function handleInboxInternal(request, parameters, span, snapshot) {
 			observation.authentication = {
 				status: "rejected",
 				reason: {
-					type: "activityOriginMismatch",
+					type: "activity-origin-mismatch",
 					activityId: new URL(activity.id.href),
 					actorIds: check.principals.map((principal) => principal.id)
 				}
@@ -2987,7 +2987,7 @@ async function handleInboxInternal(request, parameters, span, snapshot) {
 		observation.authentication = {
 			status: "rejected",
 			reason: {
-				type: "activityOriginMismatch",
+				type: "activity-origin-mismatch",
 				activityId: new URL(activity.id.href),
 				actorIds: activity.actorIds.map((id) => new URL(id.href))
 			}
@@ -3774,12 +3774,7 @@ const MIN_COMPONENTS = [
 * Turns the signers of verified Object Integrity Proofs into principals.
 */
 function toProofPrincipals(signers) {
-	return signers.map((signer) => ({
-		kind: signer.kind,
-		id: signer.id,
-		mechanism: "objectIntegrityProofs",
-		keyId: signer.keyId
-	}));
+	return signers.map(toProofPrincipal);
 }
 /**
 * Gets the principal of an HTTP Signature key, whose owner was confirmed by
@@ -3792,7 +3787,7 @@ function getHttpKeyPrincipal(key) {
 		return {
 			kind: "actor",
 			id: parseIri(evidence.ownerId),
-			mechanism: "httpSignatures",
+			mechanism: "http-signatures",
 			keyId: key.id
 		};
 	} catch {
@@ -3802,7 +3797,7 @@ function getHttpKeyPrincipal(key) {
 	return {
 		kind: "actor",
 		id: key.ownerId,
-		mechanism: "httpSignatures",
+		mechanism: "http-signatures",
 		keyId: key.id
 	};
 }
@@ -8147,12 +8142,7 @@ var ContextImpl = class ContextImpl {
 				const result = verifications.get(candidate.document);
 				if (result?.verified === true && result.method === "proof") documentSigners = result.keys.flatMap((key) => {
 					const signer = getProofSigner(key);
-					return signer == null ? [] : [{
-						kind: signer.kind,
-						id: signer.id,
-						mechanism: "objectIntegrityProofs",
-						keyId: signer.keyId
-					}];
+					return signer == null ? [] : [toProofPrincipal(signer)];
 				});
 			} else originAuthenticated = fetched.actorIds.map((actorId) => ({
 				kind: "actor",
@@ -8166,12 +8156,7 @@ var ContextImpl = class ContextImpl {
 				activity: json
 			});
 			activity = verified.object;
-			documentSigners = verified.signers.map((signer) => ({
-				kind: signer.kind,
-				id: signer.id,
-				mechanism: "objectIntegrityProofs",
-				keyId: signer.keyId
-			}));
+			documentSigners = verified.signers.map(toProofPrincipal);
 			viewSource = {
 				policy: "standard",
 				source: "activity",