@fedify/vocab 2.4.0-dev.1599 → 2.4.0-dev.1618

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab",
-  "version": "2.4.0-dev.1599+7b19967f",
+  "version": "2.4.0-dev.1618+58858243",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts"

package/dist/mod.cjs

@@ -34,7 +34,7 @@ let _fedify_vocab_runtime_temporal = require("@fedify/vocab-runtime/temporal");
 let es_toolkit = require("es-toolkit");
 //#region deno.json
 var name = "@fedify/vocab";
-var version = "2.4.0-dev.1599+7b19967f";
+var version = "2.4.0-dev.1618+58858243";
 //#endregion
 //#region src/type.ts
 function getTypeId(object) {
@@ -3755,6 +3755,7 @@ const PORTABLE_IRI_KEYS = new Set([
 	"https://www.w3.org/ns/activitystreams#target",
 	"https://www.w3.org/ns/activitystreams#to",
 	"https://www.w3.org/ns/activitystreams#units",
+	"https://www.w3.org/ns/activitystreams#uploadMedia",
 	"https://www.w3.org/ns/activitystreams#url",
 	"https://www.w3.org/ns/did#service",
 	"https://www.w3.org/ns/did#serviceEndpoint",
@@ -3816,6 +3817,7 @@ const PORTABLE_IRI_KEYS = new Set([
 	"target",
 	"to",
 	"units",
+	"uploadMedia",
 	"url"
 ]);
 /** Describes an object of any kind. The Object type serves as the base type for
@@ -32208,6 +32210,7 @@ var Endpoints = class {
 	#_8Bx9qN8oU7Bpt2xi6khaxWp1gMr_provideClientKey = [];
 	#_3dU7PMVQZJpsCpo2F4RQXxBXdPmS_signClientKey = [];
 	#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = [];
+	#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = [];
 	/**
 	* Constructs a new instance of Endpoints with the given values.
 	* @param values The values to initialize the instance with.
@@ -32234,6 +32237,8 @@ var Endpoints = class {
 		else throw new TypeError("The signClientKey must be of type URL.");
 		if ("sharedInbox" in values && values.sharedInbox != null) if (values.sharedInbox instanceof URL) this.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = [values.sharedInbox];
 		else throw new TypeError("The sharedInbox must be of type URL.");
+		if ("uploadMedia" in values && values.uploadMedia != null) if (values.uploadMedia instanceof URL) this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = [values.uploadMedia];
+		else throw new TypeError("The uploadMedia must be of type URL.");
 	}
 	/**
 	* Clones this instance, optionally updating it with the given values.
@@ -32268,6 +32273,9 @@ var Endpoints = class {
 		clone.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = this.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox;
 		if ("sharedInbox" in values && values.sharedInbox != null) if (values.sharedInbox instanceof URL) clone.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = [values.sharedInbox];
 		else throw new TypeError("The sharedInbox must be of type URL.");
+		clone.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia;
+		if ("uploadMedia" in values && values.uploadMedia != null) if (values.uploadMedia instanceof URL) clone.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = [values.uploadMedia];
+		else throw new TypeError("The uploadMedia must be of type URL.");
 		return clone;
 	}
 	/** Endpoint URI so this actor's clients may access remote ActivityStreams
@@ -32335,6 +32343,18 @@ var Endpoints = class {
 		if (this.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox.length < 1) return null;
 		return this.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox[0];
 	}
+	/** Upload endpoint URI for this user for binary data, such as an image or
+	* video, as described in the [ActivityPub Media
+	* Upload](https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload) extension.
+	* Clients `POST` a `multipart/form-data` request containing a `file` part
+	* (the binary payload) and an `object` part (an ActivityStreams object shell)
+	* to this endpoint.
+	*/
+	get uploadMedia() {
+		if (this._warning != null) (0, _logtape_logtape.getLogger)(this._warning.category).warn(this._warning.message, this._warning.values);
+		if (this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia.length < 1) return null;
+		return this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia[0];
+	}
 	/**
 	* Converts this object to a JSON-LD structure.
 	* @param options The options to use.
@@ -32390,6 +32410,12 @@ var Endpoints = class {
 				compactItems.push(item);
 			}
 			if (compactItems.length > 0) result["sharedInbox"] = compactItems.length > 1 ? compactItems : compactItems[0];
+			compactItems = [];
+			for (const v of this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia) {
+				const item = (0, _fedify_vocab_runtime.formatIri)(v);
+				compactItems.push(item);
+			}
+			if (compactItems.length > 0) result["uploadMedia"] = compactItems.length > 1 ? compactItems : compactItems[0];
 			if (this.id != null) result["id"] = (0, _fedify_vocab_runtime.formatIri)(this.id);
 			result["@context"] = "https://www.w3.org/ns/activitystreams";
 			return result;
@@ -32432,6 +32458,12 @@ var Endpoints = class {
 			array.push(element);
 		}
 		if (array.length > 0) values["https://www.w3.org/ns/activitystreams#sharedInbox"] = array;
+		array = [];
+		for (const v of this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia) {
+			const element = { "@id": (0, _fedify_vocab_runtime.formatIri)(v) };
+			array.push(element);
+		}
+		if (array.length > 0) values["https://www.w3.org/ns/activitystreams#uploadMedia"] = array;
 		if (this.id != null) values["@id"] = (0, _fedify_vocab_runtime.formatIri)(this.id);
 		if (options.format === "expand") return await _fedify_vocab_runtime_jsonld.default.expand(values, { documentLoader: options.contextLoader });
 		const docContext = options.context ?? "https://www.w3.org/ns/activitystreams";
@@ -32557,6 +32589,15 @@ var Endpoints = class {
 			_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox.push(decoded);
 		}
 		instance.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = _3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox;
+		const _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = [];
+		let _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array = values["https://www.w3.org/ns/activitystreams#uploadMedia"];
+		for (const v of _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array == null ? [] : _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array.length === 1 && "@list" in _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array[0] ? _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array[0]["@list"] : _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array) {
+			if (v == null) continue;
+			const decoded = (0, _fedify_vocab_runtime.parseIri)(v["@id"], options.baseUrl);
+			if (typeof decoded === "undefined") continue;
+			_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia.push(decoded);
+		}
+		instance.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia;
 		if (!("_fromSubclass" in options) || !options._fromSubclass) try {
 			if (cacheJsonLd != null && cacheJsonLd !== expanded) {
 				const compactArray = Array.isArray(json) && json.length === 1;
@@ -32605,6 +32646,11 @@ var Endpoints = class {
 			[Symbol.for("nodejs.util.inspect.custom")]: (_depth, options, inspect) => "URL " + inspect(v.href, options)
 		} : v);
 		if (_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox.length == 1) proxy.sharedInbox = _3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox[0];
+		const _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia.map((v) => v instanceof URL ? {
+			[Symbol.for("Deno.customInspect")]: (inspect, options) => "URL " + inspect(v.href, options),
+			[Symbol.for("nodejs.util.inspect.custom")]: (_depth, options, inspect) => "URL " + inspect(v.href, options)
+		} : v);
+		if (_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia.length == 1) proxy.uploadMedia = _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia[0];
 		return proxy;
 	}
 };
@@ -56787,7 +56833,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 		}
 		throw error;
 	}
-	if (options.crossOrigin !== "trust" && object.id != null && !(0, _fedify_vocab_runtime.haveSameIriOrigin)(object.id, documentUrl)) {
+	if (options.crossOrigin !== "trust" && object.id != null && !(0, _fedify_vocab_runtime.haveSameIriOrigin)(object.id, documentUrl) && !(0, _fedify_vocab_runtime.haveSameFe34Origin)(object.id, documentUrl)) {
 		if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
 		logger.warn("The object's @id ({objectId}) has a different origin than the document URL ({documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to \"trust\".", {
 			...remoteDoc,

package/dist/mod.d.cts

@@ -10269,6 +10269,7 @@ declare class Endpoints {
     provideClientKey?: URL | null;
     signClientKey?: URL | null;
     sharedInbox?: URL | null;
+    uploadMedia?: URL | null;
   }, options?: {
     documentLoader?: DocumentLoader$1;
     contextLoader?: DocumentLoader$1;
@@ -10288,6 +10289,7 @@ declare class Endpoints {
     provideClientKey?: URL | null;
     signClientKey?: URL | null;
     sharedInbox?: URL | null;
+    uploadMedia?: URL | null;
   }, options?: {
     documentLoader?: DocumentLoader$1;
     contextLoader?: DocumentLoader$1;
@@ -10333,6 +10335,14 @@ declare class Endpoints {
   * objects which are not addressed to the `Public`` endpoint.
   */
   get sharedInbox(): URL | null;
+  /** Upload endpoint URI for this user for binary data, such as an image or
+  * video, as described in the [ActivityPub Media
+  * Upload](https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload) extension.
+  * Clients `POST` a `multipart/form-data` request containing a `file` part
+  * (the binary payload) and an `object` part (an ActivityStreams object shell)
+  * to this endpoint.
+  */
+  get uploadMedia(): URL | null;
   /**
   * Converts this object to a JSON-LD structure.
   * @param options The options to use.

package/dist/mod.d.ts

@@ -10269,6 +10269,7 @@ declare class Endpoints {
     provideClientKey?: URL | null;
     signClientKey?: URL | null;
     sharedInbox?: URL | null;
+    uploadMedia?: URL | null;
   }, options?: {
     documentLoader?: DocumentLoader$1;
     contextLoader?: DocumentLoader$1;
@@ -10288,6 +10289,7 @@ declare class Endpoints {
     provideClientKey?: URL | null;
     signClientKey?: URL | null;
     sharedInbox?: URL | null;
+    uploadMedia?: URL | null;
   }, options?: {
     documentLoader?: DocumentLoader$1;
     contextLoader?: DocumentLoader$1;
@@ -10333,6 +10335,14 @@ declare class Endpoints {
   * objects which are not addressed to the `Public`` endpoint.
   */
   get sharedInbox(): URL | null;
+  /** Upload endpoint URI for this user for binary data, such as an image or
+  * video, as described in the [ActivityPub Media
+  * Upload](https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload) extension.
+  * Clients `POST` a `multipart/form-data` request containing a `file` part
+  * (the binary payload) and an `object` part (an ActivityStreams object shell)
+  * to this endpoint.
+  */
+  get uploadMedia(): URL | null;
   /**
   * Converts this object to a JSON-LD structure.
   * @param options The options to use.

package/dist/mod.js

@@ -4,13 +4,13 @@ import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { domainToASCII, domainToUnicode } from "node:url";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import { getLogger } from "@logtape/logtape";
-import { LanguageString, LanguageString as LanguageString$1, decodeMultibase, encodeMultibase, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, haveSameIriOrigin, importMultibaseKey, importPem, isDecimal, parseDecimal, parseIri, parseJsonLdId } from "@fedify/vocab-runtime";
+import { LanguageString, LanguageString as LanguageString$1, decodeMultibase, encodeMultibase, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, haveSameFe34Origin, haveSameIriOrigin, importMultibaseKey, importPem, isDecimal, parseDecimal, parseIri, parseJsonLdId } from "@fedify/vocab-runtime";
 import { compactJsonLdCache, isTrustedIriOrigin, normalizeJsonLdIris } from "@fedify/vocab-runtime/internal/jsonld-cache";
 import { isTemporalDuration, isTemporalInstant } from "@fedify/vocab-runtime/temporal";
 import { delay } from "es-toolkit";
 //#region deno.json
 var name = "@fedify/vocab";
-var version = "2.4.0-dev.1599+7b19967f";
+var version = "2.4.0-dev.1618+58858243";
 //#endregion
 //#region src/type.ts
 function getTypeId(object) {
@@ -172,6 +172,7 @@ const PORTABLE_IRI_KEYS = new Set([
 	"https://www.w3.org/ns/activitystreams#target",
 	"https://www.w3.org/ns/activitystreams#to",
 	"https://www.w3.org/ns/activitystreams#units",
+	"https://www.w3.org/ns/activitystreams#uploadMedia",
 	"https://www.w3.org/ns/activitystreams#url",
 	"https://www.w3.org/ns/did#service",
 	"https://www.w3.org/ns/did#serviceEndpoint",
@@ -233,6 +234,7 @@ const PORTABLE_IRI_KEYS = new Set([
 	"target",
 	"to",
 	"units",
+	"uploadMedia",
 	"url"
 ]);
 /** Describes an object of any kind. The Object type serves as the base type for
@@ -28625,6 +28627,7 @@ var Endpoints = class {
 	#_8Bx9qN8oU7Bpt2xi6khaxWp1gMr_provideClientKey = [];
 	#_3dU7PMVQZJpsCpo2F4RQXxBXdPmS_signClientKey = [];
 	#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = [];
+	#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = [];
 	/**
 	* Constructs a new instance of Endpoints with the given values.
 	* @param values The values to initialize the instance with.
@@ -28651,6 +28654,8 @@ var Endpoints = class {
 		else throw new TypeError("The signClientKey must be of type URL.");
 		if ("sharedInbox" in values && values.sharedInbox != null) if (values.sharedInbox instanceof URL) this.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = [values.sharedInbox];
 		else throw new TypeError("The sharedInbox must be of type URL.");
+		if ("uploadMedia" in values && values.uploadMedia != null) if (values.uploadMedia instanceof URL) this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = [values.uploadMedia];
+		else throw new TypeError("The uploadMedia must be of type URL.");
 	}
 	/**
 	* Clones this instance, optionally updating it with the given values.
@@ -28685,6 +28690,9 @@ var Endpoints = class {
 		clone.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = this.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox;
 		if ("sharedInbox" in values && values.sharedInbox != null) if (values.sharedInbox instanceof URL) clone.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = [values.sharedInbox];
 		else throw new TypeError("The sharedInbox must be of type URL.");
+		clone.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia;
+		if ("uploadMedia" in values && values.uploadMedia != null) if (values.uploadMedia instanceof URL) clone.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = [values.uploadMedia];
+		else throw new TypeError("The uploadMedia must be of type URL.");
 		return clone;
 	}
 	/** Endpoint URI so this actor's clients may access remote ActivityStreams
@@ -28752,6 +28760,18 @@ var Endpoints = class {
 		if (this.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox.length < 1) return null;
 		return this.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox[0];
 	}
+	/** Upload endpoint URI for this user for binary data, such as an image or
+	* video, as described in the [ActivityPub Media
+	* Upload](https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload) extension.
+	* Clients `POST` a `multipart/form-data` request containing a `file` part
+	* (the binary payload) and an `object` part (an ActivityStreams object shell)
+	* to this endpoint.
+	*/
+	get uploadMedia() {
+		if (this._warning != null) getLogger(this._warning.category).warn(this._warning.message, this._warning.values);
+		if (this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia.length < 1) return null;
+		return this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia[0];
+	}
 	/**
 	* Converts this object to a JSON-LD structure.
 	* @param options The options to use.
@@ -28807,6 +28827,12 @@ var Endpoints = class {
 				compactItems.push(item);
 			}
 			if (compactItems.length > 0) result["sharedInbox"] = compactItems.length > 1 ? compactItems : compactItems[0];
+			compactItems = [];
+			for (const v of this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia) {
+				const item = formatIri(v);
+				compactItems.push(item);
+			}
+			if (compactItems.length > 0) result["uploadMedia"] = compactItems.length > 1 ? compactItems : compactItems[0];
 			if (this.id != null) result["id"] = formatIri(this.id);
 			result["@context"] = "https://www.w3.org/ns/activitystreams";
 			return result;
@@ -28849,6 +28875,12 @@ var Endpoints = class {
 			array.push(element);
 		}
 		if (array.length > 0) values["https://www.w3.org/ns/activitystreams#sharedInbox"] = array;
+		array = [];
+		for (const v of this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia) {
+			const element = { "@id": formatIri(v) };
+			array.push(element);
+		}
+		if (array.length > 0) values["https://www.w3.org/ns/activitystreams#uploadMedia"] = array;
 		if (this.id != null) values["@id"] = formatIri(this.id);
 		if (options.format === "expand") return await jsonld.expand(values, { documentLoader: options.contextLoader });
 		const docContext = options.context ?? "https://www.w3.org/ns/activitystreams";
@@ -28974,6 +29006,15 @@ var Endpoints = class {
 			_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox.push(decoded);
 		}
 		instance.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = _3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox;
+		const _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = [];
+		let _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array = values["https://www.w3.org/ns/activitystreams#uploadMedia"];
+		for (const v of _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array == null ? [] : _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array.length === 1 && "@list" in _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array[0] ? _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array[0]["@list"] : _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array) {
+			if (v == null) continue;
+			const decoded = parseIri(v["@id"], options.baseUrl);
+			if (typeof decoded === "undefined") continue;
+			_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia.push(decoded);
+		}
+		instance.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia;
 		if (!("_fromSubclass" in options) || !options._fromSubclass) try {
 			if (cacheJsonLd != null && cacheJsonLd !== expanded) {
 				const compactArray = Array.isArray(json) && json.length === 1;
@@ -29022,6 +29063,11 @@ var Endpoints = class {
 			[Symbol.for("nodejs.util.inspect.custom")]: (_depth, options, inspect) => "URL " + inspect(v.href, options)
 		} : v);
 		if (_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox.length == 1) proxy.sharedInbox = _3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox[0];
+		const _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia.map((v) => v instanceof URL ? {
+			[Symbol.for("Deno.customInspect")]: (inspect, options) => "URL " + inspect(v.href, options),
+			[Symbol.for("nodejs.util.inspect.custom")]: (_depth, options, inspect) => "URL " + inspect(v.href, options)
+		} : v);
+		if (_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia.length == 1) proxy.uploadMedia = _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia[0];
 		return proxy;
 	}
 };
@@ -53203,7 +53249,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 		}
 		throw error;
 	}
-	if (options.crossOrigin !== "trust" && object.id != null && !haveSameIriOrigin(object.id, documentUrl)) {
+	if (options.crossOrigin !== "trust" && object.id != null && !haveSameIriOrigin(object.id, documentUrl) && !haveSameFe34Origin(object.id, documentUrl)) {
 		if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
 		logger.warn("The object's @id ({objectId}) has a different origin than the document URL ({documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to \"trust\".", {
 			...remoteDoc,

package/dist-tests/{actor-NhcklZK0.mjs → actor-COnJgcOw.mjs}

@@ -1,6 +1,6 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { A as Person, G as __toESM, L as Service, U as __commonJSMin, a as Application, k as Organization, v as Group } from "./vocab-BQ8y6QS7.mjs";
+import { A as Organization, K as __toESM, R as Service, W as __commonJSMin, a as Application, j as Person, v as Group } from "./vocab-OU5GYbNg.mjs";
 import { t as getTypeId } from "./type-_BlsfT3S.mjs";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -1206,7 +1206,7 @@ var esm_default = new class FetchMock {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab";
-var version = "2.4.0-dev.1599+7b19967f";
+var version = "2.4.0-dev.1618+58858243";
 //#endregion
 //#region src/actor.ts
 const ACTOR_DISCOVERY_HISTOGRAM_BUCKETS = [

package/dist-tests/actor.test.mjs

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { A as Person, L as Service, W as __exportAll, a as Application, k as Organization, v as Group } from "./vocab-BQ8y6QS7.mjs";
-import { a as normalizeActorHandle, c as esm_default, i as isActor, n as getActorHandle, r as getActorTypeName, t as getActorClassByTypeName } from "./actor-NhcklZK0.mjs";
+import { A as Organization, G as __exportAll, R as Service, a as Application, j as Person, v as Group } from "./vocab-OU5GYbNg.mjs";
+import { a as normalizeActorHandle, c as esm_default, i as isActor, n as getActorHandle, r as getActorTypeName, t as getActorClassByTypeName } from "./actor-COnJgcOw.mjs";
 import { createTestMeterProvider, test } from "@fedify/fixture";
 import { deepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert/strict";
 //#region ../../node_modules/.pnpm/fast-check@3.23.2/node_modules/fast-check/lib/esm/check/precondition/PreconditionFailure.js

package/dist-tests/endpoints.yaml

@@ -84,3 +84,17 @@ properties:
     objects which are not addressed to the `Public`` endpoint.
   range:
   - "http://www.w3.org/2001/XMLSchema#anyURI"
+
+- singularName: uploadMedia
+  functional: true
+  compactName: uploadMedia
+  uri: "https://www.w3.org/ns/activitystreams#uploadMedia"
+  description: |
+    Upload endpoint URI for this user for binary data, such as an image or
+    video, as described in the [ActivityPub Media
+    Upload](https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload) extension.
+    Clients `POST` a `multipart/form-data` request containing a `file` part
+    (the binary payload) and an `object` part (an ActivityStreams object shell)
+    to this endpoint.
+  range:
+  - "http://www.w3.org/2001/XMLSchema#anyURI"

package/dist-tests/lookup.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { A as Person, E as Object$1, T as Note, o as Collection } from "./vocab-BQ8y6QS7.mjs";
-import { c as esm_default, i as isActor, o as name, s as version } from "./actor-NhcklZK0.mjs";
+import { D as Object$1, E as Note, j as Person, o as Collection } from "./vocab-OU5GYbNg.mjs";
+import { c as esm_default, i as isActor, o as name, s as version } from "./actor-COnJgcOw.mjs";
 import { t as getTypeId } from "./type-_BlsfT3S.mjs";
 import { t as assertInstanceOf } from "./utils-CQjrpUkt.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
@@ -9,7 +9,7 @@ import { deepStrictEqual, equal, ok, rejects } from "node:assert/strict";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";
-import { getDocumentLoader, haveSameIriOrigin, parseIri } from "@fedify/vocab-runtime";
+import { getDocumentLoader, haveSameFe34Origin, haveSameIriOrigin, parseIri } from "@fedify/vocab-runtime";
 import { delay } from "es-toolkit";
 //#region src/handle.ts
 /**
@@ -223,7 +223,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 		}
 		throw error;
 	}
-	if (options.crossOrigin !== "trust" && object.id != null && !haveSameIriOrigin(object.id, documentUrl)) {
+	if (options.crossOrigin !== "trust" && object.id != null && !haveSameIriOrigin(object.id, documentUrl) && !haveSameFe34Origin(object.id, documentUrl)) {
 		if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
 		logger.warn("The object's @id ({objectId}) has a different origin than the document URL ({documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to \"trust\".", {
 			...remoteDoc,
@@ -538,6 +538,73 @@ test("FEP-fe34: lookupObject() cross-origin security", {
 		deepStrictEqual(result.id, new URL("https://example.com/note"));
 		deepStrictEqual(result.content, "This is a legitimate note from the same origin");
 	});
+	await t.step("same-authority non-FE34 IRIs are still trusted", async () => {
+		const atProtoDocumentLoader = async (url) => {
+			if (url === "https://gateway.example/at-item") return {
+				documentUrl: "at://did%3Aplc%3Aexample/collection/item",
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "at://did:plc:example/collection/reply",
+					content: "AT Protocol note"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://gateway.example/at-item", {
+			documentLoader: atProtoDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertInstanceOf(result, Note);
+		deepStrictEqual(result.id, new URL("at://did%3Aplc%3Aexample/collection/reply"));
+		deepStrictEqual(result.content, "AT Protocol note");
+	});
+	await t.step("portable object IDs are trusted by DID cryptographic origin", async () => {
+		const portableDocumentLoader = async (url) => {
+			if (url === "https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note") return {
+				documentUrl: "ap+ef61://did:key:z6Mkabc/note",
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "ap://did:key:z6Mkabc/note",
+					content: "Portable note"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note", {
+			documentLoader: portableDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertInstanceOf(result, Note);
+		deepStrictEqual(result.content, "Portable note");
+	});
+	await t.step("portable object IDs reject mismatched cryptographic origins", async () => {
+		const portableDocumentLoader = async (url) => {
+			if (url === "https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note") return {
+				documentUrl: "ap+ef61://did:key:z6Mkabc/note",
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "ap://did:key:z6Mkdef/note",
+					content: "Spoofed portable note"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		deepStrictEqual(await lookupObject("https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note", {
+			documentLoader: portableDocumentLoader,
+			contextLoader: mockDocumentLoader
+		}), null);
+		await rejects(() => lookupObject("https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note", {
+			documentLoader: portableDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "throw"
+		}), Error, "The object's @id (ap+ef61://did%3Akey%3Az6Mkdef/note) has a different origin than the document URL (ap+ef61://did:key:z6Mkabc/note)");
+	});
 	await t.step("objects without @id are trusted", async () => {
 		const noIdDocumentLoader = async (url) => {
 			if (url === "https://example.com/note") return {

package/dist-tests/type.test.mjs

@@ -1,6 +1,6 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { A as Person, B as getEntityTypeById, C as Link, V as isEntityType } from "./vocab-BQ8y6QS7.mjs";
+import { C as Link, H as isEntityType, V as getEntityTypeById, j as Person } from "./vocab-OU5GYbNg.mjs";
 import { t as getTypeId } from "./type-_BlsfT3S.mjs";
 import { test } from "@fedify/fixture";
 import { deepStrictEqual } from "node:assert/strict";

package/dist-tests/{vocab-BQ8y6QS7.mjs → vocab-OU5GYbNg.mjs}

@@ -282,6 +282,7 @@ const PORTABLE_IRI_KEYS = new Set([
 	"https://www.w3.org/ns/activitystreams#target",
 	"https://www.w3.org/ns/activitystreams#to",
 	"https://www.w3.org/ns/activitystreams#units",
+	"https://www.w3.org/ns/activitystreams#uploadMedia",
 	"https://www.w3.org/ns/activitystreams#url",
 	"https://www.w3.org/ns/did#service",
 	"https://www.w3.org/ns/did#serviceEndpoint",
@@ -343,6 +344,7 @@ const PORTABLE_IRI_KEYS = new Set([
 	"target",
 	"to",
 	"units",
+	"uploadMedia",
 	"url"
 ]);
 /** Describes an object of any kind. The Object type serves as the base type for
@@ -28735,6 +28737,7 @@ var Endpoints = class {
 	#_8Bx9qN8oU7Bpt2xi6khaxWp1gMr_provideClientKey = [];
 	#_3dU7PMVQZJpsCpo2F4RQXxBXdPmS_signClientKey = [];
 	#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = [];
+	#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = [];
 	/**
 	* Constructs a new instance of Endpoints with the given values.
 	* @param values The values to initialize the instance with.
@@ -28761,6 +28764,8 @@ var Endpoints = class {
 		else throw new TypeError("The signClientKey must be of type URL.");
 		if ("sharedInbox" in values && values.sharedInbox != null) if (values.sharedInbox instanceof URL) this.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = [values.sharedInbox];
 		else throw new TypeError("The sharedInbox must be of type URL.");
+		if ("uploadMedia" in values && values.uploadMedia != null) if (values.uploadMedia instanceof URL) this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = [values.uploadMedia];
+		else throw new TypeError("The uploadMedia must be of type URL.");
 	}
 	/**
 	* Clones this instance, optionally updating it with the given values.
@@ -28795,6 +28800,9 @@ var Endpoints = class {
 		clone.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = this.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox;
 		if ("sharedInbox" in values && values.sharedInbox != null) if (values.sharedInbox instanceof URL) clone.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = [values.sharedInbox];
 		else throw new TypeError("The sharedInbox must be of type URL.");
+		clone.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia;
+		if ("uploadMedia" in values && values.uploadMedia != null) if (values.uploadMedia instanceof URL) clone.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = [values.uploadMedia];
+		else throw new TypeError("The uploadMedia must be of type URL.");
 		return clone;
 	}
 	/** Endpoint URI so this actor's clients may access remote ActivityStreams
@@ -28862,6 +28870,18 @@ var Endpoints = class {
 		if (this.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox.length < 1) return null;
 		return this.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox[0];
 	}
+	/** Upload endpoint URI for this user for binary data, such as an image or
+	* video, as described in the [ActivityPub Media
+	* Upload](https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload) extension.
+	* Clients `POST` a `multipart/form-data` request containing a `file` part
+	* (the binary payload) and an `object` part (an ActivityStreams object shell)
+	* to this endpoint.
+	*/
+	get uploadMedia() {
+		if (this._warning != null) getLogger(this._warning.category).warn(this._warning.message, this._warning.values);
+		if (this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia.length < 1) return null;
+		return this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia[0];
+	}
 	/**
 	* Converts this object to a JSON-LD structure.
 	* @param options The options to use.
@@ -28917,6 +28937,12 @@ var Endpoints = class {
 				compactItems.push(item);
 			}
 			if (compactItems.length > 0) result["sharedInbox"] = compactItems.length > 1 ? compactItems : compactItems[0];
+			compactItems = [];
+			for (const v of this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia) {
+				const item = formatIri(v);
+				compactItems.push(item);
+			}
+			if (compactItems.length > 0) result["uploadMedia"] = compactItems.length > 1 ? compactItems : compactItems[0];
 			if (this.id != null) result["id"] = formatIri(this.id);
 			result["@context"] = "https://www.w3.org/ns/activitystreams";
 			return result;
@@ -28959,6 +28985,12 @@ var Endpoints = class {
 			array.push(element);
 		}
 		if (array.length > 0) values["https://www.w3.org/ns/activitystreams#sharedInbox"] = array;
+		array = [];
+		for (const v of this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia) {
+			const element = { "@id": formatIri(v) };
+			array.push(element);
+		}
+		if (array.length > 0) values["https://www.w3.org/ns/activitystreams#uploadMedia"] = array;
 		if (this.id != null) values["@id"] = formatIri(this.id);
 		if (options.format === "expand") return await jsonld.expand(values, { documentLoader: options.contextLoader });
 		const docContext = options.context ?? "https://www.w3.org/ns/activitystreams";
@@ -29084,6 +29116,15 @@ var Endpoints = class {
 			_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox.push(decoded);
 		}
 		instance.#_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox = _3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox;
+		const _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = [];
+		let _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array = values["https://www.w3.org/ns/activitystreams#uploadMedia"];
+		for (const v of _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array == null ? [] : _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array.length === 1 && "@list" in _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array[0] ? _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array[0]["@list"] : _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia__array) {
+			if (v == null) continue;
+			const decoded = parseIri(v["@id"], options.baseUrl);
+			if (typeof decoded === "undefined") continue;
+			_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia.push(decoded);
+		}
+		instance.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia;
 		if (!("_fromSubclass" in options) || !options._fromSubclass) try {
 			if (cacheJsonLd != null && cacheJsonLd !== expanded) {
 				const compactArray = Array.isArray(json) && json.length === 1;
@@ -29132,6 +29173,11 @@ var Endpoints = class {
 			[Symbol.for("nodejs.util.inspect.custom")]: (_depth, options, inspect) => "URL " + inspect(v.href, options)
 		} : v);
 		if (_3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox.length == 1) proxy.sharedInbox = _3JprUSDLVqqX4dwHRi37qGZZCRCc_sharedInbox[0];
+		const _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia = this.#_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia.map((v) => v instanceof URL ? {
+			[Symbol.for("Deno.customInspect")]: (inspect, options) => "URL " + inspect(v.href, options),
+			[Symbol.for("nodejs.util.inspect.custom")]: (_depth, options, inspect) => "URL " + inspect(v.href, options)
+		} : v);
+		if (_KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia.length == 1) proxy.uploadMedia = _KukVKGqFRETxAxXA15YCYAA7XAT_uploadMedia[0];
 		return proxy;
 	}
 };
@@ -52874,4 +52920,4 @@ function getEntityTypeById(id) {
 	return entityTypeIds.get(typeof id === "string" ? id : id?.href);
 }
 //#endregion
-export { Person as A, getEntityTypeById as B, Link as C, Offer as D, Object$1 as E, QuoteRequest as F, __toESM as G, vocab_exports as H, Reject as I, Service as L, Proposal as M, Question as N, OrderedCollectionPage as O, QuoteAuthorization as P, Source as R, InteractionRule as S, Note as T, __commonJSMin as U, isEntityType as V, __exportAll as W, Follow as _, Application as a, Intent as b, Create as c, Document as d, Endpoints as f, FeaturedItem as g, FeaturedCollection as h, Announce as i, Place as j, Organization as k, CryptographicKey as l, FeatureRequest as m, Activity as n, Collection as o, FeatureAuthorization as p, Agreement as r, Commitment as s, Accept as t, Delete as u, Group as v, Measure as w, InteractionPolicy as x, Hashtag as y, Tombstone as z };
+export { Organization as A, Tombstone as B, Link as C, Object$1 as D, Note as E, QuoteAuthorization as F, __exportAll as G, isEntityType as H, QuoteRequest as I, __toESM as K, Reject as L, Place as M, Proposal as N, Offer as O, Question as P, Service as R, InteractionRule as S, Multikey as T, vocab_exports as U, getEntityTypeById as V, __commonJSMin as W, Follow as _, Application as a, Intent as b, Create as c, Document as d, Endpoints as f, FeaturedItem as g, FeaturedCollection as h, Announce as i, Person as j, OrderedCollectionPage as k, CryptographicKey as l, FeatureRequest as m, Activity as n, Collection as o, FeatureAuthorization as p, Agreement as r, Commitment as s, Accept as t, Delete as u, Group as v, Measure as w, InteractionPolicy as x, Hashtag as y, Source as z };

package/dist-tests/vocab.test.mjs

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { A as Person, C as Link, D as Offer, E as Object$1, F as QuoteRequest, H as vocab_exports, I as Reject, M as Proposal, N as Question, O as OrderedCollectionPage, P as QuoteAuthorization, R as Source, S as InteractionRule, T as Note, _ as Follow, b as Intent, c as Create, d as Document, f as Endpoints, g as FeaturedItem, h as FeaturedCollection, i as Announce, j as Place, l as CryptographicKey, m as FeatureRequest, n as Activity, o as Collection, p as FeatureAuthorization, r as Agreement, s as Commitment, t as Accept, u as Delete, w as Measure, x as InteractionPolicy, y as Hashtag, z as Tombstone } from "./vocab-BQ8y6QS7.mjs";
+import { B as Tombstone, C as Link, D as Object$1, E as Note, F as QuoteAuthorization, I as QuoteRequest, L as Reject, M as Place, N as Proposal, O as Offer, P as Question, S as InteractionRule, T as Multikey, U as vocab_exports, _ as Follow, b as Intent, c as Create, d as Document, f as Endpoints, g as FeaturedItem, h as FeaturedCollection, i as Announce, j as Person, k as OrderedCollectionPage, l as CryptographicKey, m as FeatureRequest, n as Activity, o as Collection, p as FeatureAuthorization, r as Agreement, s as Commitment, t as Accept, u as Delete, w as Measure, x as InteractionPolicy, y as Hashtag, z as Source } from "./vocab-OU5GYbNg.mjs";
 import { t as assertInstanceOf } from "./utils-CQjrpUkt.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, notDeepStrictEqual, ok, rejects, throws } from "node:assert/strict";
@@ -1311,6 +1311,25 @@ test("Endpoints.toJsonLd() omits type", async () => {
 		contextLoader: mockDocumentLoader
 	}), ep);
 });
+test("Endpoints.uploadMedia round-trips", async () => {
+	const ep = new Endpoints({ uploadMedia: new URL("https://example.com/users/alice/media") });
+	deepStrictEqual(ep.uploadMedia?.href, "https://example.com/users/alice/media");
+	deepStrictEqual((await ep.toJsonLd())["uploadMedia"], "https://example.com/users/alice/media");
+	for (const format of [
+		void 0,
+		"compact",
+		"expand"
+	]) {
+		const jsonLd = await ep.toJsonLd({
+			format,
+			contextLoader: mockDocumentLoader
+		});
+		deepStrictEqual((await Endpoints.fromJsonLd(jsonLd, {
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader
+		})).uploadMedia?.href, "https://example.com/users/alice/media", `round-trip failed for format=${format ?? "heuristic"}`);
+	}
+});
 test("Source.toJsonLd() omits type", async () => {
 	const src = new Source({
 		content: "Hello, world!",
@@ -1361,7 +1380,8 @@ test("Endpoints with all properties set omits type", async () => {
 		oauthTokenEndpoint: new URL("https://example.com/oauth/token"),
 		provideClientKey: new URL("https://example.com/provide-key"),
 		signClientKey: new URL("https://example.com/sign-key"),
-		sharedInbox: new URL("https://example.com/inbox")
+		sharedInbox: new URL("https://example.com/inbox"),
+		uploadMedia: new URL("https://example.com/upload-media")
 	});
 	const compact = await ep.toJsonLd();
 	ok(!("type" in compact), "compact output should not have 'type'");
@@ -1371,6 +1391,7 @@ test("Endpoints with all properties set omits type", async () => {
 	deepStrictEqual(compact["provideClientKey"], "https://example.com/provide-key");
 	deepStrictEqual(compact["signClientKey"], "https://example.com/sign-key");
 	deepStrictEqual(compact["sharedInbox"], "https://example.com/inbox");
+	deepStrictEqual(compact["uploadMedia"], "https://example.com/upload-media");
 	for (const format of [
 		void 0,
 		"compact",
@@ -2555,6 +2576,23 @@ test("FEP-fe34: Same origin objects are trusted", async () => {
 	deepStrictEqual(result?.id, new URL("https://example.com/note"));
 	deepStrictEqual(result?.content, "This is a legitimate note");
 });
+test("FEP-fe34: Same-authority non-FE34 embedded objects are trusted", async () => {
+	const result = await (await Create.fromJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		"@type": "Create",
+		"@id": "at://did:plc:example/collection/item",
+		"actor": "at://did:plc:example/actor/self",
+		"object": {
+			"@type": "Note",
+			"@id": "at://did:plc:example/collection/reply",
+			"content": "Embedded AT Protocol note"
+		}
+	})).getObject({ documentLoader: async (url) => {
+		throw new Error(`Unexpected fetch: ${url}`);
+	} });
+	assertInstanceOf(result, Note);
+	deepStrictEqual(result.content, "Embedded AT Protocol note");
+});
 test("FEP-fe34: Embedded cross-origin objects from JSON-LD are ignored by default", async () => {
 	const createDocumentLoader = async (url) => {
 		if (url === "https://example.com/create") return {
@@ -2656,6 +2694,47 @@ test("FEP-fe34: Portable DID authorities are cross-origin boundaries", async ()
 	assertInstanceOf(result, Note);
 	deepStrictEqual(result.content, "Fetched portable note");
 });
+test("FEP-fe34: DID verification methods share portable actor cryptographic origin", async () => {
+	const person = await Person.fromJsonLd({
+		"@id": "ap://did:key:z6MkOwner/actor",
+		"@type": ["https://www.w3.org/ns/activitystreams#Person"],
+		"https://w3id.org/security#assertionMethod": [{
+			"@id": "did:key:z6MkOwner#z6MkOwner",
+			"@type": ["https://w3id.org/security#Multikey"],
+			"https://w3id.org/security#controller": [{ "@id": "did:key:z6MkOwner" }]
+		}]
+	});
+	const documentLoader = async (url) => {
+		throw new Error(`Unexpected fetch: ${url}`);
+	};
+	const methods = [];
+	for await (const method of person.getAssertionMethods({ documentLoader })) methods.push(method);
+	deepStrictEqual(methods.length, 1);
+	assertInstanceOf(methods[0], Multikey);
+	deepStrictEqual(methods[0].id, new URL("did:key:z6MkOwner#z6MkOwner"));
+});
+test("FEP-fe34: DID verification methods from another cryptographic origin are untrusted", async () => {
+	const person = await Person.fromJsonLd({
+		"@id": "ap://did:key:z6MkOwner/actor",
+		"@type": ["https://www.w3.org/ns/activitystreams#Person"],
+		"https://w3id.org/security#assertionMethod": [{
+			"@id": "did:key:z6MkOther#z6MkOther",
+			"@type": ["https://w3id.org/security#Multikey"],
+			"https://w3id.org/security#controller": [{ "@id": "did:key:z6MkOther" }]
+		}]
+	});
+	let fetches = 0;
+	const methods = [];
+	for await (const method of person.getAssertionMethods({
+		suppressError: true,
+		documentLoader: async (url) => {
+			fetches++;
+			throw new Error(`Unexpected fetch: ${url}`);
+		}
+	})) methods.push(method);
+	deepStrictEqual(methods, []);
+	deepStrictEqual(fetches, 1);
+});
 test("FEP-fe34: Array properties respect cross-origin policy", async () => {
 	const crossOriginDocumentLoader = async (url) => {
 		if (url === "https://different-origin.com/note1") return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab",
-  "version": "2.4.0-dev.1599+7b19967f",
+  "version": "2.4.0-dev.1618+58858243",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -43,9 +43,9 @@
     "jsonld": "^9.0.0",
     "pkijs": "^3.3.3",
     "temporal-polyfill": "^1.0.1",
-    "@fedify/vocab-tools": "2.4.0-dev.1599+7b19967f",
-    "@fedify/vocab-runtime": "2.4.0-dev.1599+7b19967f",
-    "@fedify/webfinger": "2.4.0-dev.1599+7b19967f"
+    "@fedify/vocab-tools": "2.4.0-dev.1618+58858243",
+    "@fedify/webfinger": "2.4.0-dev.1618+58858243",
+    "@fedify/vocab-runtime": "2.4.0-dev.1618+58858243"
   },
   "devDependencies": {
     "@types/node": "^22.17.0",

package/src/__snapshots__/vocab.test.ts.snap

@@ -5003,7 +5003,8 @@ snapshot[`Deno.inspect(Endpoints) [auto] 1`] = `
   oauthTokenEndpoint: URL "https://example.com/",
   provideClientKey: URL "https://example.com/",
   signClientKey: URL "https://example.com/",
-  sharedInbox: URL "https://example.com/"
+  sharedInbox: URL "https://example.com/",
+  uploadMedia: URL "https://example.com/"
 }'
 `;
 
@@ -5015,7 +5016,8 @@ snapshot[`Deno.inspect(Endpoints) [auto] 2`] = `
   oauthTokenEndpoint: URL "https://example.com/",
   provideClientKey: URL "https://example.com/",
   signClientKey: URL "https://example.com/",
-  sharedInbox: URL "https://example.com/"
+  sharedInbox: URL "https://example.com/",
+  uploadMedia: URL "https://example.com/"
 }'
 `;
 
@@ -5027,7 +5029,8 @@ snapshot[`Deno.inspect(Endpoints) [auto] 3`] = `
   oauthTokenEndpoint: URL "https://example.com/",
   provideClientKey: URL "https://example.com/",
   signClientKey: URL "https://example.com/",
-  sharedInbox: URL "https://example.com/"
+  sharedInbox: URL "https://example.com/",
+  uploadMedia: URL "https://example.com/"
 }'
 `;
 

package/src/endpoints.yaml

@@ -84,3 +84,17 @@ properties:
     objects which are not addressed to the `Public`` endpoint.
   range:
   - "http://www.w3.org/2001/XMLSchema#anyURI"
+
+- singularName: uploadMedia
+  functional: true
+  compactName: uploadMedia
+  uri: "https://www.w3.org/ns/activitystreams#uploadMedia"
+  description: |
+    Upload endpoint URI for this user for binary data, such as an image or
+    video, as described in the [ActivityPub Media
+    Upload](https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload) extension.
+    Clients `POST` a `multipart/form-data` request containing a `file` part
+    (the binary payload) and an `object` part (an ActivityStreams object shell)
+    to this endpoint.
+  range:
+  - "http://www.w3.org/2001/XMLSchema#anyURI"

package/src/lookup.test.ts

@@ -416,6 +416,127 @@ test("FEP-fe34: lookupObject() cross-origin security", {
     );
   });
 
+  await t.step(
+    "same-authority non-FE34 IRIs are still trusted",
+    async () => {
+      // deno-lint-ignore require-await
+      const atProtoDocumentLoader = async (url: string) => {
+        if (url === "https://gateway.example/at-item") {
+          return {
+            documentUrl: "at://did%3Aplc%3Aexample/collection/item",
+            contextUrl: null,
+            document: {
+              "@context": "https://www.w3.org/ns/activitystreams",
+              type: "Note",
+              id: "at://did:plc:example/collection/reply",
+              content: "AT Protocol note",
+            },
+          };
+        }
+        throw new Error(`Unexpected URL: ${url}`);
+      };
+
+      const result = await lookupObject(
+        "https://gateway.example/at-item",
+        {
+          documentLoader: atProtoDocumentLoader,
+          contextLoader: mockDocumentLoader,
+        },
+      );
+
+      assertInstanceOf(result, Note);
+      deepStrictEqual(
+        result.id,
+        new URL("at://did%3Aplc%3Aexample/collection/reply"),
+      );
+      deepStrictEqual(result.content, "AT Protocol note");
+    },
+  );
+
+  await t.step(
+    "portable object IDs are trusted by DID cryptographic origin",
+    async () => {
+      // deno-lint-ignore require-await
+      const portableDocumentLoader = async (url: string) => {
+        if (
+          url ===
+            "https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note"
+        ) {
+          return {
+            documentUrl: "ap+ef61://did:key:z6Mkabc/note",
+            contextUrl: null,
+            document: {
+              "@context": "https://www.w3.org/ns/activitystreams",
+              type: "Note",
+              id: "ap://did:key:z6Mkabc/note",
+              content: "Portable note",
+            },
+          };
+        }
+        throw new Error(`Unexpected URL: ${url}`);
+      };
+
+      const result = await lookupObject(
+        "https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note",
+        {
+          documentLoader: portableDocumentLoader,
+          contextLoader: mockDocumentLoader,
+        },
+      );
+
+      assertInstanceOf(result, Note);
+      deepStrictEqual(result.content, "Portable note");
+    },
+  );
+
+  await t.step(
+    "portable object IDs reject mismatched cryptographic origins",
+    async () => {
+      // deno-lint-ignore require-await
+      const portableDocumentLoader = async (url: string) => {
+        if (
+          url ===
+            "https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note"
+        ) {
+          return {
+            documentUrl: "ap+ef61://did:key:z6Mkabc/note",
+            contextUrl: null,
+            document: {
+              "@context": "https://www.w3.org/ns/activitystreams",
+              type: "Note",
+              id: "ap://did:key:z6Mkdef/note",
+              content: "Spoofed portable note",
+            },
+          };
+        }
+        throw new Error(`Unexpected URL: ${url}`);
+      };
+
+      const result = await lookupObject(
+        "https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note",
+        {
+          documentLoader: portableDocumentLoader,
+          contextLoader: mockDocumentLoader,
+        },
+      );
+
+      deepStrictEqual(result, null);
+      await rejects(
+        () =>
+          lookupObject(
+            "https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note",
+            {
+              documentLoader: portableDocumentLoader,
+              contextLoader: mockDocumentLoader,
+              crossOrigin: "throw",
+            },
+          ),
+        Error,
+        "The object's @id (ap+ef61://did%3Akey%3Az6Mkdef/note) has a different origin than the document URL (ap+ef61://did:key:z6Mkabc/note)",
+      );
+    },
+  );
+
   await t.step("objects without @id are trusted", async () => {
     // deno-lint-ignore require-await
     const noIdDocumentLoader = async (url: string) => {

package/src/lookup.ts

@@ -2,6 +2,7 @@ import type { GetUserAgentOptions } from "@fedify/vocab-runtime";
 import {
   type DocumentLoader,
   getDocumentLoader,
+  haveSameFe34Origin,
   haveSameIriOrigin,
   parseIri,
   type RemoteDocument,
@@ -335,7 +336,8 @@ async function lookupObjectInternal(
   }
   if (
     options.crossOrigin !== "trust" && object.id != null &&
-    !haveSameIriOrigin(object.id, documentUrl)
+    !haveSameIriOrigin(object.id, documentUrl) &&
+    !haveSameFe34Origin(object.id, documentUrl)
   ) {
     if (options.crossOrigin === "throw") {
       throw new Error(

package/src/vocab.test.ts

@@ -47,6 +47,7 @@ import {
   InteractionRule,
   Link,
   Measure,
+  Multikey,
   Note,
   Object,
   Offer,
@@ -1963,6 +1964,39 @@ test("Endpoints.toJsonLd() omits type", async () => {
   deepStrictEqual(restored, ep);
 });
 
+test("Endpoints.uploadMedia round-trips", async () => {
+  const ep = new Endpoints({
+    uploadMedia: new URL("https://example.com/users/alice/media"),
+  });
+  deepStrictEqual(
+    ep.uploadMedia?.href,
+    "https://example.com/users/alice/media",
+  );
+
+  const compact = await ep.toJsonLd() as Record<string, unknown>;
+  deepStrictEqual(
+    compact["uploadMedia"],
+    "https://example.com/users/alice/media",
+  );
+
+  // Round-trip through every format under the standard AS term.
+  for (const format of [undefined, "compact" as const, "expand" as const]) {
+    const jsonLd = await ep.toJsonLd({
+      format,
+      contextLoader: mockDocumentLoader,
+    });
+    const restored = await Endpoints.fromJsonLd(jsonLd, {
+      documentLoader: mockDocumentLoader,
+      contextLoader: mockDocumentLoader,
+    });
+    deepStrictEqual(
+      restored.uploadMedia?.href,
+      "https://example.com/users/alice/media",
+      `round-trip failed for format=${format ?? "heuristic"}`,
+    );
+  }
+});
+
 test("Source.toJsonLd() omits type", async () => {
   const src = new Source({
     content: "Hello, world!",
@@ -2029,6 +2063,7 @@ test("Endpoints with all properties set omits type", async () => {
     provideClientKey: new URL("https://example.com/provide-key"),
     signClientKey: new URL("https://example.com/sign-key"),
     sharedInbox: new URL("https://example.com/inbox"),
+    uploadMedia: new URL("https://example.com/upload-media"),
   });
 
   // Compact heuristic path
@@ -2049,6 +2084,7 @@ test("Endpoints with all properties set omits type", async () => {
   );
   deepStrictEqual(compact["signClientKey"], "https://example.com/sign-key");
   deepStrictEqual(compact["sharedInbox"], "https://example.com/inbox");
+  deepStrictEqual(compact["uploadMedia"], "https://example.com/upload-media");
 
   // Round-trip all three formats
   for (
@@ -3800,6 +3836,30 @@ test("FEP-fe34: Same origin objects are trusted", async () => {
   deepStrictEqual(result?.content, "This is a legitimate note");
 });
 
+test("FEP-fe34: Same-authority non-FE34 embedded objects are trusted", async () => {
+  const create = await Create.fromJsonLd({
+    "@context": "https://www.w3.org/ns/activitystreams",
+    "@type": "Create",
+    "@id": "at://did:plc:example/collection/item",
+    "actor": "at://did:plc:example/actor/self",
+    "object": {
+      "@type": "Note",
+      "@id": "at://did:plc:example/collection/reply",
+      "content": "Embedded AT Protocol note",
+    },
+  });
+
+  const result = await create.getObject({
+    // deno-lint-ignore require-await
+    documentLoader: async (url) => {
+      throw new Error(`Unexpected fetch: ${url}`);
+    },
+  });
+
+  assertInstanceOf(result, Note);
+  deepStrictEqual(result.content, "Embedded AT Protocol note");
+});
+
 test(
   "FEP-fe34: Embedded cross-origin objects from JSON-LD are ignored by default",
   async () => {
@@ -3951,6 +4011,74 @@ test(
   },
 );
 
+test(
+  "FEP-fe34: DID verification methods share portable actor cryptographic origin",
+  async () => {
+    const person = await Person.fromJsonLd({
+      "@id": "ap://did:key:z6MkOwner/actor",
+      "@type": ["https://www.w3.org/ns/activitystreams#Person"],
+      "https://w3id.org/security#assertionMethod": [{
+        "@id": "did:key:z6MkOwner#z6MkOwner",
+        "@type": ["https://w3id.org/security#Multikey"],
+        "https://w3id.org/security#controller": [{
+          "@id": "did:key:z6MkOwner",
+        }],
+      }],
+    });
+
+    // deno-lint-ignore require-await
+    const documentLoader = async (url: string) => {
+      throw new Error(`Unexpected fetch: ${url}`);
+    };
+
+    const methods = [];
+    for await (const method of person.getAssertionMethods({ documentLoader })) {
+      methods.push(method);
+    }
+
+    deepStrictEqual(methods.length, 1);
+    assertInstanceOf(methods[0], Multikey);
+    deepStrictEqual(
+      methods[0].id,
+      new URL("did:key:z6MkOwner#z6MkOwner"),
+    );
+  },
+);
+
+test(
+  "FEP-fe34: DID verification methods from another cryptographic origin are untrusted",
+  async () => {
+    const person = await Person.fromJsonLd({
+      "@id": "ap://did:key:z6MkOwner/actor",
+      "@type": ["https://www.w3.org/ns/activitystreams#Person"],
+      "https://w3id.org/security#assertionMethod": [{
+        "@id": "did:key:z6MkOther#z6MkOther",
+        "@type": ["https://w3id.org/security#Multikey"],
+        "https://w3id.org/security#controller": [{
+          "@id": "did:key:z6MkOther",
+        }],
+      }],
+    });
+
+    let fetches = 0;
+    const methods = [];
+    for await (
+      const method of person.getAssertionMethods({
+        suppressError: true,
+        // deno-lint-ignore require-await
+        documentLoader: async (url) => {
+          fetches++;
+          throw new Error(`Unexpected fetch: ${url}`);
+        },
+      })
+    ) {
+      methods.push(method);
+    }
+    deepStrictEqual(methods, []);
+    deepStrictEqual(fetches, 1);
+  },
+);
+
 test("FEP-fe34: Array properties respect cross-origin policy", async () => {
   // deno-lint-ignore require-await
   const crossOriginDocumentLoader = async (url: string) => {