@fedify/vocab-runtime 2.4.0-dev.2027 → 2.4.0-dev.2035

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.4.0-dev.2027+fcf88bfc",
+  "version": "2.4.0-dev.2035+d1f8f8e2",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",

package/dist/internal/jsonld-cache.cjs

@@ -1,6 +1,6 @@
 
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_url = require("../url-i33c0US6.cjs");
+const require_url = require("../url-Cke4irYD.cjs");
 const require_jsonld = require("../jsonld.cjs");
 //#region src/internal/jsonld-cache.ts
 const noJsonLdContext = Symbol("noJsonLdContext");

package/dist/internal/jsonld-cache.js

@@ -1,5 +1,5 @@
 
-import { a as formatIri, c as haveSameIriOrigin, s as haveSameFe34Origin } from "../url-BHAShw9J.js";
+import { a as formatIri, c as haveSameFe34Origin, l as haveSameIriOrigin } from "../url-CEhi4hb4.js";
 import jsonld_default from "../jsonld.js";
 //#region src/internal/jsonld-cache.ts
 const noJsonLdContext = Symbol("noJsonLdContext");

package/dist/mod.cjs

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-B7lfambq.cjs");
 const require_contexts = require("./contexts-2hEbs3Qk.cjs");
-const require_url = require("./url-i33c0US6.cjs");
+const require_url = require("./url-Cke4irYD.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 let node_process = require("node:process");
@@ -16,7 +16,7 @@ let _multiformats_base_x = require("@multiformats/base-x");
 _multiformats_base_x = require_rolldown_runtime.__toESM(_multiformats_base_x, 1);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.2027+fcf88bfc";
+var version = "2.4.0-dev.2035+d1f8f8e2";
 //#endregion
 //#region src/request.ts
 /**
@@ -1379,6 +1379,7 @@ exports.exportDidKey = exportDidKey;
 exports.exportMultibaseKey = exportMultibaseKey;
 exports.exportSpki = exportSpki;
 exports.formatIri = require_url.formatIri;
+exports.fromCompatibleEf61Id = require_url.fromCompatibleEf61Id;
 exports.getDocumentLoader = getDocumentLoader;
 exports.getFe34Origin = require_url.getFe34Origin;
 exports.getRemoteDocument = getRemoteDocument;
@@ -1403,6 +1404,7 @@ exports.parseHashlink = parseHashlink;
 exports.parseIri = require_url.parseIri;
 exports.parseJsonLdId = require_url.parseJsonLdId;
 exports.preloadedContexts = require_contexts.preloadedContexts;
+exports.toCompatibleEf61Id = require_url.toCompatibleEf61Id;
 exports.validatePublicUrl = require_url.validatePublicUrl;
 exports.verifyDigestMultibase = verifyDigestMultibase;
 exports.verifyHashlink = verifyHashlink;

package/dist/mod.d.cts

@@ -466,6 +466,79 @@ declare function isGatewayUrl(url: URL): boolean;
 */
 declare function parseGatewayUrl(url: string): URL;
 /**
+* Converts an [FEP-ef61] compatible identifier into a portable ActivityPub
+* URI.
+*
+* A compatible identifier is an HTTP(S) URL under a gateway's fixed
+* `/.well-known/apgateway/` path, such as
+* `https://server.example/.well-known/apgateway/did:key:z6Mk.../objects/1`.
+* This function removes the gateway part and returns the corresponding
+* portable URI, e.g., `ap+ef61://did:key:z6Mk.../objects/1`, in the same
+* internal `URL` form that {@link parseIri} produces.  The path, query, and
+* fragment are preserved, so the result is a portable URI, not a comparison
+* form; pass its `href` to {@link canonicalizePortableUri} or
+* {@link arePortableUrisEqual} to compare it with other portable URIs.
+*
+* The conversion only reveals the *claimed* portable identifier.  Anyone can
+* publish a compatible identifier for any DID on their own server, so the
+* gateway that served it is neither the object's origin nor authorized to act
+* for the DID.  Callers must still verify the retrieved document's Object
+* Integrity Proof against the DID, as FEP-ef61 requires, and should keep the
+* original URL if they need the gateway as a retrieval hint.
+*
+* Arbitrary gateway paths are not supported.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param input The URL to convert.
+* @returns The portable ActivityPub URI, or `null` if the input is not an
+*          HTTP(S) URL whose path starts with `/.well-known/apgateway/did:`.
+*          Other gateway routes, such as the gateway discovery endpoint and
+*          hashlink media URLs, also yield `null`.
+* @throws {TypeError} If the input looks like a compatible identifier but is
+*                     malformed, e.g., it has an invalid DID, no object path,
+*                     invalid percent-encoding, credentials, or location
+*                     hints (`@gateway` query parameters, or the legacy
+*                     `gateways` parameter), which FEP-ef61 forbids in
+*                     compatible identifiers.
+* @since 2.4.0
+*/
+declare function fromCompatibleEf61Id(input: string | URL): URL | null;
+/**
+* Converts a portable ActivityPub URI into an [FEP-ef61] compatible
+* identifier, which is an HTTP(S) URL under the gateway's fixed
+* `/.well-known/apgateway/` path.
+*
+* For example, `ap+ef61://did:key:z6Mk.../objects/1` and
+* `https://server.example` yield
+* `https://server.example/.well-known/apgateway/did:key:z6Mk.../objects/1`.
+* Both `ap:` and `ap+ef61:` URIs with decoded or percent-encoded DID
+* authorities are accepted.  Publishers should use the first gateway in the
+* actor's `gateways` list, as FEP-ef61 requires.
+*
+* The path and fragment are preserved, with characters that are not allowed
+* in HTTP(S) URLs percent-encoded the same way as
+* {@link canonicalizePortableUri} does.  FEP-ef61 location hints (`@gateway`
+* query parameters, and the legacy `gateways` parameter) are removed, since
+* compatible identifiers must not have them; other query parameters are kept
+* in order.
+*
+* Arbitrary gateway paths are not supported.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI to convert.
+* @param gateway The gateway's HTTP(S) origin, e.g., `https://server.example`.
+* @returns The compatible identifier.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI, if its path has `.` or `..` segments (which
+*                     HTTP(S) URLs cannot represent), or if the gateway is
+*                     not an HTTP(S) origin with no credentials, path, query,
+*                     or fragment.
+* @since 2.4.0
+*/
+declare function toCompatibleEf61Id(portableId: string | URL, gateway: string | URL): URL;
+/**
 * Validates a URL to prevent SSRF attacks.
 */
 declare function validatePublicUrl(url: string): Promise<void>;
@@ -473,4 +546,4 @@ declare function isValidPublicIPv4Address(address: string): boolean;
 declare function isValidPublicIPv6Address(address: string): boolean;
 declare function expandIPv6Address(address: string): string;
 //#endregion
-export { type AuthenticatedDocumentLoaderFactory, type CreateRequestOptions, type Decimal, type DidKeyVerificationMethod, type DocumentLoader, type DocumentLoaderFactory, type DocumentLoaderFactoryOptions, type DocumentLoaderOptions, FetchError, type GetDocumentLoaderOptions, type GetUserAgentOptions, type Json, LanguageString, type ParsedDigestMultibase, type ParsedHashlink, type PropertyPreprocessor, type PropertyPreprocessorContext, type RemoteDocument, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, computeDigestMultibase, createActivityPubRequest, createHashlink, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseDigestMultibase, parseGatewayUrl, parseHashlink, parseIri, parseJsonLdId, preloadedContexts, validatePublicUrl, verifyDigestMultibase, verifyHashlink };
+export { type AuthenticatedDocumentLoaderFactory, type CreateRequestOptions, type Decimal, type DidKeyVerificationMethod, type DocumentLoader, type DocumentLoaderFactory, type DocumentLoaderFactoryOptions, type DocumentLoaderOptions, FetchError, type GetDocumentLoaderOptions, type GetUserAgentOptions, type Json, LanguageString, type ParsedDigestMultibase, type ParsedHashlink, type PropertyPreprocessor, type PropertyPreprocessorContext, type RemoteDocument, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, computeDigestMultibase, createActivityPubRequest, createHashlink, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseDigestMultibase, parseGatewayUrl, parseHashlink, parseIri, parseJsonLdId, preloadedContexts, toCompatibleEf61Id, validatePublicUrl, verifyDigestMultibase, verifyHashlink };

package/dist/mod.d.ts

@@ -465,6 +465,79 @@ declare function isGatewayUrl(url: URL): boolean;
 */
 declare function parseGatewayUrl(url: string): URL;
 /**
+* Converts an [FEP-ef61] compatible identifier into a portable ActivityPub
+* URI.
+*
+* A compatible identifier is an HTTP(S) URL under a gateway's fixed
+* `/.well-known/apgateway/` path, such as
+* `https://server.example/.well-known/apgateway/did:key:z6Mk.../objects/1`.
+* This function removes the gateway part and returns the corresponding
+* portable URI, e.g., `ap+ef61://did:key:z6Mk.../objects/1`, in the same
+* internal `URL` form that {@link parseIri} produces.  The path, query, and
+* fragment are preserved, so the result is a portable URI, not a comparison
+* form; pass its `href` to {@link canonicalizePortableUri} or
+* {@link arePortableUrisEqual} to compare it with other portable URIs.
+*
+* The conversion only reveals the *claimed* portable identifier.  Anyone can
+* publish a compatible identifier for any DID on their own server, so the
+* gateway that served it is neither the object's origin nor authorized to act
+* for the DID.  Callers must still verify the retrieved document's Object
+* Integrity Proof against the DID, as FEP-ef61 requires, and should keep the
+* original URL if they need the gateway as a retrieval hint.
+*
+* Arbitrary gateway paths are not supported.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param input The URL to convert.
+* @returns The portable ActivityPub URI, or `null` if the input is not an
+*          HTTP(S) URL whose path starts with `/.well-known/apgateway/did:`.
+*          Other gateway routes, such as the gateway discovery endpoint and
+*          hashlink media URLs, also yield `null`.
+* @throws {TypeError} If the input looks like a compatible identifier but is
+*                     malformed, e.g., it has an invalid DID, no object path,
+*                     invalid percent-encoding, credentials, or location
+*                     hints (`@gateway` query parameters, or the legacy
+*                     `gateways` parameter), which FEP-ef61 forbids in
+*                     compatible identifiers.
+* @since 2.4.0
+*/
+declare function fromCompatibleEf61Id(input: string | URL): URL | null;
+/**
+* Converts a portable ActivityPub URI into an [FEP-ef61] compatible
+* identifier, which is an HTTP(S) URL under the gateway's fixed
+* `/.well-known/apgateway/` path.
+*
+* For example, `ap+ef61://did:key:z6Mk.../objects/1` and
+* `https://server.example` yield
+* `https://server.example/.well-known/apgateway/did:key:z6Mk.../objects/1`.
+* Both `ap:` and `ap+ef61:` URIs with decoded or percent-encoded DID
+* authorities are accepted.  Publishers should use the first gateway in the
+* actor's `gateways` list, as FEP-ef61 requires.
+*
+* The path and fragment are preserved, with characters that are not allowed
+* in HTTP(S) URLs percent-encoded the same way as
+* {@link canonicalizePortableUri} does.  FEP-ef61 location hints (`@gateway`
+* query parameters, and the legacy `gateways` parameter) are removed, since
+* compatible identifiers must not have them; other query parameters are kept
+* in order.
+*
+* Arbitrary gateway paths are not supported.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI to convert.
+* @param gateway The gateway's HTTP(S) origin, e.g., `https://server.example`.
+* @returns The compatible identifier.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI, if its path has `.` or `..` segments (which
+*                     HTTP(S) URLs cannot represent), or if the gateway is
+*                     not an HTTP(S) origin with no credentials, path, query,
+*                     or fragment.
+* @since 2.4.0
+*/
+declare function toCompatibleEf61Id(portableId: string | URL, gateway: string | URL): URL;
+/**
 * Validates a URL to prevent SSRF attacks.
 */
 declare function validatePublicUrl(url: string): Promise<void>;
@@ -472,4 +545,4 @@ declare function isValidPublicIPv4Address(address: string): boolean;
 declare function isValidPublicIPv6Address(address: string): boolean;
 declare function expandIPv6Address(address: string): string;
 //#endregion
-export { type AuthenticatedDocumentLoaderFactory, type CreateRequestOptions, type Decimal, type DidKeyVerificationMethod, type DocumentLoader, type DocumentLoaderFactory, type DocumentLoaderFactoryOptions, type DocumentLoaderOptions, FetchError, type GetDocumentLoaderOptions, type GetUserAgentOptions, type Json, LanguageString, type ParsedDigestMultibase, type ParsedHashlink, type PropertyPreprocessor, type PropertyPreprocessorContext, type RemoteDocument, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, computeDigestMultibase, createActivityPubRequest, createHashlink, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseDigestMultibase, parseGatewayUrl, parseHashlink, parseIri, parseJsonLdId, preloadedContexts, validatePublicUrl, verifyDigestMultibase, verifyHashlink };
+export { type AuthenticatedDocumentLoaderFactory, type CreateRequestOptions, type Decimal, type DidKeyVerificationMethod, type DocumentLoader, type DocumentLoaderFactory, type DocumentLoaderFactoryOptions, type DocumentLoaderOptions, FetchError, type GetDocumentLoaderOptions, type GetUserAgentOptions, type Json, LanguageString, type ParsedDigestMultibase, type ParsedHashlink, type PropertyPreprocessor, type PropertyPreprocessorContext, type RemoteDocument, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, computeDigestMultibase, createActivityPubRequest, createHashlink, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseDigestMultibase, parseGatewayUrl, parseHashlink, parseIri, parseJsonLdId, preloadedContexts, toCompatibleEf61Id, validatePublicUrl, verifyDigestMultibase, verifyHashlink };

package/dist/mod.js

@@ -1,6 +1,6 @@
 
 import { t as preloadedContexts } from "./contexts-DoZUIW7y.js";
-import { a as formatIri, c as haveSameIriOrigin, d as isValidPublicIPv6Address, f as parseGatewayUrl, h as validatePublicUrl, i as expandIPv6Address, l as isGatewayUrl, m as parseJsonLdId, n as arePortableUrisEqual, o as getFe34Origin, p as parseIri, r as canonicalizePortableUri, s as haveSameFe34Origin, t as UrlError, u as isValidPublicIPv4Address } from "./url-BHAShw9J.js";
+import { _ as validatePublicUrl, a as formatIri, c as haveSameFe34Origin, d as isValidPublicIPv4Address, f as isValidPublicIPv6Address, g as toCompatibleEf61Id, h as parseJsonLdId, i as expandIPv6Address, l as haveSameIriOrigin, m as parseIri, n as arePortableUrisEqual, o as fromCompatibleEf61Id, p as parseGatewayUrl, r as canonicalizePortableUri, s as getFe34Origin, t as UrlError, u as isGatewayUrl } from "./url-CEhi4hb4.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import process from "node:process";
@@ -12,7 +12,7 @@ import { PublicKeyInfo } from "pkijs";
 import baseX from "@multiformats/base-x";
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.2027+fcf88bfc";
+var version = "2.4.0-dev.2035+d1f8f8e2";
 //#endregion
 //#region src/request.ts
 /**
@@ -1358,4 +1358,4 @@ LanguageString.prototype[Symbol.for("nodejs.util.inspect.custom")] = function(_d
 	return `<${this.locale.baseName}> ${inspect(this.toString(), options)}`;
 };
 //#endregion
-export { FetchError, LanguageString, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, computeDigestMultibase, createActivityPubRequest, createHashlink, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseDigestMultibase, parseGatewayUrl, parseHashlink, parseIri, parseJsonLdId, preloadedContexts, validatePublicUrl, verifyDigestMultibase, verifyHashlink };
+export { FetchError, LanguageString, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, computeDigestMultibase, createActivityPubRequest, createHashlink, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseDigestMultibase, parseGatewayUrl, parseHashlink, parseIri, parseJsonLdId, preloadedContexts, toCompatibleEf61Id, validatePublicUrl, verifyDigestMultibase, verifyHashlink };

package/dist/tests/{body-C8W6PG-f.mjs → body-BEIDQFV6.mjs}

@@ -1,4 +1,4 @@
-import { t as FetchError } from "./request-CeEwiwiU.mjs";
+import { t as FetchError } from "./request-eP_YLVjb.mjs";
 import { getLogger } from "@logtape/logtape";
 //#region src/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */

package/dist/tests/{body-CjqMU6be.cjs → body-DRpkDnEg.cjs}

@@ -1,4 +1,4 @@
-const require_request = require("./request-DV2_yz3V.cjs");
+const require_request = require("./request-BbczASfn.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 //#region src/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */

package/dist/tests/body.test.cjs

@@ -1,4 +1,4 @@
-const require_body = require("./body-CjqMU6be.cjs");
+const require_body = require("./body-DRpkDnEg.cjs");
 let node_assert_strict = require("node:assert/strict");
 let node_test = require("node:test");
 let node_zlib = require("node:zlib");

package/dist/tests/body.test.mjs

@@ -1,4 +1,4 @@
-import { r as readBoundedText, t as BodyTooLargeError } from "./body-C8W6PG-f.mjs";
+import { r as readBoundedText, t as BodyTooLargeError } from "./body-BEIDQFV6.mjs";
 import { deepStrictEqual, ok, rejects } from "node:assert/strict";
 import { test } from "node:test";
 import { gunzipSync, gzipSync } from "node:zlib";

package/dist/tests/decimal.test.cjs

@@ -1,5 +1,5 @@
-require("./url-CPfMatUL.cjs");
-require("./docloader-DDwe-rFE.cjs");
+require("./url-BqlldzT8.cjs");
+require("./docloader-M8t8o-GD.cjs");
 require("./key-8Qg2SbZi.cjs");
 require("./multibase-B5Mea7Ip.cjs");
 require("./digest-3FeH2Y-Q.cjs");

package/dist/tests/decimal.test.mjs

@@ -1,5 +1,5 @@
-import "./url-Basm1L_c.mjs";
-import "./docloader-BcthkJvx.mjs";
+import "./url-DgJM9WJn.mjs";
+import "./docloader-DHux1ztB.mjs";
 import "./key-C7MNhlkO.mjs";
 import "./multibase-BPnF_L4e.mjs";
 import "./digest-COC7xDiQ.mjs";

package/dist/tests/{docloader-BcthkJvx.mjs → docloader-DHux1ztB.mjs}

@@ -1,8 +1,8 @@
-import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-CeEwiwiU.mjs";
-import { n as MAX_BODY_SIZE, r as readBoundedText, t as BodyTooLargeError } from "./body-C8W6PG-f.mjs";
+import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-eP_YLVjb.mjs";
+import { n as MAX_BODY_SIZE, r as readBoundedText, t as BodyTooLargeError } from "./body-BEIDQFV6.mjs";
 import { t as preloadedContexts } from "./contexts-BBX_qhBL.mjs";
 import { t as HttpHeaderLink } from "./link-Cevmc87v.mjs";
-import { g as validatePublicUrl, t as UrlError } from "./url-Basm1L_c.mjs";
+import { t as UrlError, v as validatePublicUrl } from "./url-DgJM9WJn.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region src/docloader.ts

package/dist/tests/{docloader-DDwe-rFE.cjs → docloader-M8t8o-GD.cjs}

@@ -1,8 +1,8 @@
-const require_request = require("./request-DV2_yz3V.cjs");
-const require_body = require("./body-CjqMU6be.cjs");
+const require_request = require("./request-BbczASfn.cjs");
+const require_body = require("./body-DRpkDnEg.cjs");
 const require_contexts = require("./contexts-Ch3v2Cgu.cjs");
 const require_link = require("./link-DlKm8bEr.cjs");
-const require_url = require("./url-CPfMatUL.cjs");
+const require_url = require("./url-BqlldzT8.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 //#region src/docloader.ts

package/dist/tests/docloader.test.cjs

@@ -1,8 +1,8 @@
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
-const require_request = require("./request-DV2_yz3V.cjs");
+const require_request = require("./request-BbczASfn.cjs");
 const require_contexts = require("./contexts-Ch3v2Cgu.cjs");
-const require_url = require("./url-CPfMatUL.cjs");
-const require_docloader = require("./docloader-DDwe-rFE.cjs");
+const require_url = require("./url-BqlldzT8.cjs");
+const require_docloader = require("./docloader-M8t8o-GD.cjs");
 let node_test = require("node:test");
 let node_zlib = require("node:zlib");
 let node_assert = require("node:assert");

package/dist/tests/docloader.test.mjs

@@ -1,7 +1,7 @@
-import { t as FetchError } from "./request-CeEwiwiU.mjs";
+import { t as FetchError } from "./request-eP_YLVjb.mjs";
 import { n as cid_v1_default, t as preloadedContexts } from "./contexts-BBX_qhBL.mjs";
-import { t as UrlError } from "./url-Basm1L_c.mjs";
-import { n as getRemoteDocument, t as getDocumentLoader } from "./docloader-BcthkJvx.mjs";
+import { t as UrlError } from "./url-DgJM9WJn.mjs";
+import { n as getRemoteDocument, t as getDocumentLoader } from "./docloader-DHux1ztB.mjs";
 import { test } from "node:test";
 import { gzipSync } from "node:zlib";
 import { deepStrictEqual, ok, rejects } from "node:assert";

package/dist/tests/jsonld-cache.test.cjs

@@ -1,5 +1,5 @@
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
-const require_url = require("./url-CPfMatUL.cjs");
+const require_url = require("./url-BqlldzT8.cjs");
 let node_test = require("node:test");
 let node_assert = require("node:assert");
 let jsonld_dist_jsonld_esm_js = require("jsonld/dist/jsonld.esm.js");

package/dist/tests/jsonld-cache.test.mjs

@@ -1,4 +1,4 @@
-import { a as formatIri, c as haveSameIriOrigin, p as parseIri, s as haveSameFe34Origin } from "./url-Basm1L_c.mjs";
+import { a as formatIri, c as haveSameFe34Origin, l as haveSameIriOrigin, m as parseIri } from "./url-DgJM9WJn.mjs";
 import { test } from "node:test";
 import { deepStrictEqual, ok, strictEqual } from "node:assert";
 import jsonld from "jsonld/dist/jsonld.esm.js";

package/dist/tests/{request-DV2_yz3V.cjs → request-BbczASfn.cjs}

@@ -3,7 +3,7 @@ let node_process = require("node:process");
 node_process = require_rolldown_runtime.__toESM(node_process, 1);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.2027+fcf88bfc";
+var version = "2.4.0-dev.2035+d1f8f8e2";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/{request-CeEwiwiU.mjs → request-eP_YLVjb.mjs}

@@ -1,7 +1,7 @@
 import process from "node:process";
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.2027+fcf88bfc";
+var version = "2.4.0-dev.2035+d1f8f8e2";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/request.test.cjs

@@ -1,5 +1,5 @@
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
-const require_request = require("./request-DV2_yz3V.cjs");
+const require_request = require("./request-BbczASfn.cjs");
 let node_test = require("node:test");
 let node_process = require("node:process");
 node_process = require_rolldown_runtime.__toESM(node_process, 1);

package/dist/tests/request.test.mjs

@@ -1,4 +1,4 @@
-import { o as version, r as getUserAgent } from "./request-CeEwiwiU.mjs";
+import { o as version, r as getUserAgent } from "./request-eP_YLVjb.mjs";
 import { test } from "node:test";
 import process from "node:process";
 import { deepStrictEqual } from "node:assert";

package/dist/{url-i33c0US6.cjs → tests/url-BqlldzT8.cjs}

@@ -1,4 +1,3 @@
-
 let node_dns_promises = require("node:dns/promises");
 let node_net = require("node:net");
 //#region src/url.ts
@@ -224,6 +223,152 @@ function parseGatewayUrl(url) {
 	if (!isGatewayUrl(parsed)) throw new TypeError("FEP-ef61 gateways must be HTTP(S) base URIs with no credentials, path, query, or fragment.");
 	return parsed;
 }
+const COMPATIBLE_ID_PATH_PREFIX = "/.well-known/apgateway/";
+const COMPATIBLE_ID_DID_PATTERN = /^did(?::|%3A)/i;
+const LOCATION_HINT_PARAMETERS = /* @__PURE__ */ new Set(["@gateway", "gateways"]);
+/**
+* Converts an [FEP-ef61] compatible identifier into a portable ActivityPub
+* URI.
+*
+* A compatible identifier is an HTTP(S) URL under a gateway's fixed
+* `/.well-known/apgateway/` path, such as
+* `https://server.example/.well-known/apgateway/did:key:z6Mk.../objects/1`.
+* This function removes the gateway part and returns the corresponding
+* portable URI, e.g., `ap+ef61://did:key:z6Mk.../objects/1`, in the same
+* internal `URL` form that {@link parseIri} produces.  The path, query, and
+* fragment are preserved, so the result is a portable URI, not a comparison
+* form; pass its `href` to {@link canonicalizePortableUri} or
+* {@link arePortableUrisEqual} to compare it with other portable URIs.
+*
+* The conversion only reveals the *claimed* portable identifier.  Anyone can
+* publish a compatible identifier for any DID on their own server, so the
+* gateway that served it is neither the object's origin nor authorized to act
+* for the DID.  Callers must still verify the retrieved document's Object
+* Integrity Proof against the DID, as FEP-ef61 requires, and should keep the
+* original URL if they need the gateway as a retrieval hint.
+*
+* Arbitrary gateway paths are not supported.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param input The URL to convert.
+* @returns The portable ActivityPub URI, or `null` if the input is not an
+*          HTTP(S) URL whose path starts with `/.well-known/apgateway/did:`.
+*          Other gateway routes, such as the gateway discovery endpoint and
+*          hashlink media URLs, also yield `null`.
+* @throws {TypeError} If the input looks like a compatible identifier but is
+*                     malformed, e.g., it has an invalid DID, no object path,
+*                     invalid percent-encoding, credentials, or location
+*                     hints (`@gateway` query parameters, or the legacy
+*                     `gateways` parameter), which FEP-ef61 forbids in
+*                     compatible identifiers.
+* @since 2.4.0
+*/
+function fromCompatibleEf61Id(input) {
+	return convertCompatibleEf61Id(input)?.url ?? null;
+}
+function convertCompatibleEf61Id(input) {
+	let url;
+	if (input instanceof URL) url = input;
+	else if (typeof input === "string" && URL.canParse(input)) url = new URL(input);
+	else return null;
+	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+	if (!url.pathname.startsWith(COMPATIBLE_ID_PATH_PREFIX)) return null;
+	const tail = url.pathname.slice(23);
+	if (!COMPATIBLE_ID_DID_PATTERN.test(tail)) return null;
+	if (url.username !== "" || url.password !== "") throw new TypeError("Invalid FEP-ef61 compatible identifier: credentials are not allowed.");
+	const iri = "ap+ef61://" + url.href.slice(url.origin.length + 23);
+	try {
+		const parsed = parsePortableIri(iri);
+		if (parsed == null) throw new TypeError("Not a portable IRI.");
+		canonicalizePortableUri(iri);
+		if ((url.search === "" ? [] : normalizePortableComponent(url.search.slice(1)).split("&")).some(isLocationHint)) throw new TypeError("Location hints are not allowed.");
+		return {
+			url: parsed,
+			iri
+		};
+	} catch (error) {
+		if (error instanceof TypeError) throw new TypeError("Invalid FEP-ef61 compatible identifier.", { cause: error });
+		throw error;
+	}
+}
+/**
+* Converts a portable ActivityPub URI into an [FEP-ef61] compatible
+* identifier, which is an HTTP(S) URL under the gateway's fixed
+* `/.well-known/apgateway/` path.
+*
+* For example, `ap+ef61://did:key:z6Mk.../objects/1` and
+* `https://server.example` yield
+* `https://server.example/.well-known/apgateway/did:key:z6Mk.../objects/1`.
+* Both `ap:` and `ap+ef61:` URIs with decoded or percent-encoded DID
+* authorities are accepted.  Publishers should use the first gateway in the
+* actor's `gateways` list, as FEP-ef61 requires.
+*
+* The path and fragment are preserved, with characters that are not allowed
+* in HTTP(S) URLs percent-encoded the same way as
+* {@link canonicalizePortableUri} does.  FEP-ef61 location hints (`@gateway`
+* query parameters, and the legacy `gateways` parameter) are removed, since
+* compatible identifiers must not have them; other query parameters are kept
+* in order.
+*
+* Arbitrary gateway paths are not supported.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI to convert.
+* @param gateway The gateway's HTTP(S) origin, e.g., `https://server.example`.
+* @returns The compatible identifier.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI, if its path has `.` or `..` segments (which
+*                     HTTP(S) URLs cannot represent), or if the gateway is
+*                     not an HTTP(S) origin with no credentials, path, query,
+*                     or fragment.
+* @since 2.4.0
+*/
+function toCompatibleEf61Id(portableId, gateway) {
+	const gatewayUrl = parseCompatibleEf61Gateway(gateway);
+	const raw = getRawPortableIri(portableId);
+	const match = raw.match(PORTABLE_IRI_PATTERN);
+	const parsed = parsePortableIri(raw);
+	if (match == null || parsed == null) throw new TypeError("Invalid portable ActivityPub IRI.");
+	let did = decodePortableAuthority(parsed.host);
+	if (/%25/i.test(did)) did = did.replace(/%/g, "%25");
+	const path = normalizePortableComponent(match[3]);
+	if (path.split("/").some((segment) => segment === "." || segment === "..")) throw new TypeError("FEP-ef61 compatible identifiers cannot represent portable IRI paths with dot segments.");
+	const query = match[4] == null ? "" : stripLocationHints(normalizePortableComponent(match[4].slice(1)));
+	const fragment = match[5] == null ? "" : normalizePortableComponent(match[5]);
+	const result = new URL(gatewayUrl.origin + COMPATIBLE_ID_PATH_PREFIX + did + path + query + fragment);
+	const converted = convertCompatibleEf61Id(result);
+	if (converted == null || canonicalizePortableUri(converted.iri) !== canonicalizePortableUri(raw)) throw new TypeError("The portable ActivityPub IRI cannot be represented as an FEP-ef61 compatible identifier.");
+	return result;
+}
+function parseCompatibleEf61Gateway(gateway) {
+	const url = gateway instanceof URL ? gateway : typeof gateway === "string" && URL.canParse(gateway) ? new URL(gateway) : null;
+	if (url == null || url.protocol !== "http:" && url.protocol !== "https:" || url.href !== `${url.origin}/`) throw new TypeError("FEP-ef61 gateways for compatible identifiers must be HTTP(S) origins with no credentials, path, query, or fragment.");
+	return url;
+}
+function getRawPortableIri(portableId) {
+	if (portableId instanceof URL) {
+		if (portableId.protocol !== "ap:" && portableId.protocol !== "ap+ef61:") throw new TypeError("Invalid portable ActivityPub IRI.");
+		if (portableId.username !== "" || portableId.password !== "" || portableId.port !== "") throw new TypeError("Invalid portable ActivityPub IRI authority.");
+		return portableId.href;
+	}
+	if (typeof portableId !== "string") throw new TypeError("Invalid portable ActivityPub IRI.");
+	return portableId;
+}
+function stripLocationHints(query) {
+	const pairs = query.split("&").filter((pair) => !isLocationHint(pair));
+	return pairs.length < 1 ? "" : `?${pairs.join("&")}`;
+}
+function isLocationHint(pair) {
+	const name = pair.split("=", 1)[0].replace(/\+/g, " ");
+	try {
+		return LOCATION_HINT_PARAMETERS.has(decodeURIComponent(name));
+	} catch (error) {
+		if (error instanceof URIError) return false;
+		throw error;
+	}
+}
 /**
 * Validates a URL to prevent SSRF attacks.
 */
@@ -447,6 +592,12 @@ Object.defineProperty(exports, "formatIri", {
 		return formatIri;
 	}
 });
+Object.defineProperty(exports, "fromCompatibleEf61Id", {
+	enumerable: true,
+	get: function() {
+		return fromCompatibleEf61Id;
+	}
+});
 Object.defineProperty(exports, "getFe34Origin", {
 	enumerable: true,
 	get: function() {
@@ -501,6 +652,18 @@ Object.defineProperty(exports, "parseJsonLdId", {
 		return parseJsonLdId;
 	}
 });
+Object.defineProperty(exports, "toCompatibleEf61Id", {
+	enumerable: true,
+	get: function() {
+		return toCompatibleEf61Id;
+	}
+});
+Object.defineProperty(exports, "validateLookupAddresses", {
+	enumerable: true,
+	get: function() {
+		return validateLookupAddresses;
+	}
+});
 Object.defineProperty(exports, "validatePublicUrl", {
 	enumerable: true,
 	get: function() {