Support FEP-ef61 portable ActivityPub IRIs in vocab codecs#850
Conversation
dahlia
added
component/vocab
✅ Deploy Preview for fedify-json-schema canceled.
|
|
@codex review |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds portable ChangesFEP-ef61 Portable ActivityPub IRI Support
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related issues
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
dahlia
moved this to In review
in STF 2025–2026 Milestone 7: Advanced Features and Standards (FEP-ef61, new FEPs)
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces support for FEP-ef61 portable ActivityPub IRIs (using ap: and ap+ef61: schemes) within the generated vocabulary codecs. It adds new utility functions (canParseIri, parseIri, and formatIri) to handle parsing and canonical serialization of these IRIs, updates the vocabulary generation tools to integrate these utilities, and includes comprehensive tests. The review feedback suggests refining the PORTABLE_IRI_PATTERN regular expression in the class generator to prefix it with a double quote, ensuring it only matches the start of JSON string values and avoiding false positives in text properties.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5c67df65fe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Generated codecs now look for portable ActivityPub IRIs only in ID-valued JSON-LD positions before deciding whether to bypass the raw JSON-LD cache. This keeps ordinary text such as post content from causing cache misses and dropping extension properties on default serialization. fedify-dev#850 (comment) fedify-dev#850 (comment) Assisted-by: Codex:gpt-5.5
|
@codex review |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request adds support for FEP-ef61 portable ActivityPub IRIs in generated vocabulary codecs, allowing "ap:" and "ap+ef61:" schemes to be parsed, serialized, and validated. Feedback on the changes highlights a potential Denial of Service (DoS) vulnerability in the generated "hasPortableIri" recursive function, which traverses JSON-LD objects without a depth limit or skipping the "@context" property. It is recommended to implement a recursion depth limit and skip "@context" to prevent stack overflow errors.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6f9581bd2a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Portable IRI formatting now preserves pct-encoded DID authority boundaries, and generated cache detection now inspects expanded JSON-LD with bounded traversal. That keeps alias-expanded portable IRIs from being cached in their raw form while avoiding unnecessary context walks. fedify-dev#850 (comment) fedify-dev#850 (comment) fedify-dev#850 (comment) Assisted-by: Codex:gpt-5.5
|
@codex review |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces support for FEP-ef61 portable ActivityPub IRIs in the generated vocabulary codecs. It adds utility functions (canParseIri, parseIri, and formatIri) to handle ap: and ap+ef61: schemes with DID authorities, ensuring they are correctly parsed into URL objects and serialized back to canonical ap+ef61: formats. The code generator and runtime codecs have been updated to integrate these utilities, and comprehensive tests have been added. The feedback suggests minor code simplifications: optimizing parseAtUri to avoid redundant string searches and using optional chaining in canContainIriValue to improve readability.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/vocab-runtime/src/url.ts`:
- Around line 67-71: Route URL inputs through the same portable-authority
normalization used by parsePortableIri(). In normalizePortableUrl(), do not
reconstruct the URL directly from iri.host/pathname; instead apply the same
did:-only authority validation and encodeURIComponent re-encoding logic so URL
and string inputs behave identically. Preserve the existing ap:/ap+ef61:
protocol acceptance in normalizePortableUrl(), but ensure the returned URL uses
the same internal portable-authority form as the parser.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: f66ccc6c-1f52-48ea-ac0a-c389348f1a57
⛔ Files ignored due to path filters (3)
packages/vocab-tools/src/__snapshots__/class.test.ts.deno.snapis excluded by!**/*.snappackages/vocab-tools/src/__snapshots__/class.test.ts.node.snapis excluded by!**/*.snappackages/vocab-tools/src/__snapshots__/class.test.ts.snapis excluded by!**/*.snap
📒 Files selected for processing (5)
packages/vocab-runtime/src/url.test.tspackages/vocab-runtime/src/url.tspackages/vocab-tools/src/class.tspackages/vocab-tools/src/codec.tspackages/vocab/src/vocab.test.ts
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8108116bdd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Portable URL instances now use the same authority validation and encoding path as string inputs, so DID boundaries and DID-internal percent escapes round-trip consistently. Generated cache detection also treats fedify:url scalar values as IRI-bearing fields without disabling caching for plain text fields. fedify-dev#850 (comment) fedify-dev#850 (comment) fedify-dev#850 (comment) fedify-dev#850 (comment) fedify-dev#850 (comment) Assisted-by: Codex:gpt-5.5
|
@codex review |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces support for FEP-ef61 portable ActivityPub IRIs in the generated vocabulary codecs, allowing both ap: and ap+ef61: schemes to be parsed as URL objects and serialized canonically. To support this, new utility functions canParseIri, parseIri, and formatIri were added to the runtime and integrated into the vocabulary generation tools. Feedback on the changes highlights a potential TypeError in formatIri when processing relative URI strings, as it attempts to instantiate a URL without a base URL; a fallback check is recommended to improve robustness.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b6047f952
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Pathless portable ActivityPub IRIs are now rejected before URL normalization, matching FEP-ef61's required path component. Non-portable relative strings passed to formatIri now remain unchanged instead of raising from the fallback URL formatter. fedify-dev#850 (comment) fedify-dev#850 (comment) Assisted-by: Codex:gpt-5.5
|
@codex review |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces support for FEP-ef61 portable ActivityPub IRIs across the vocabulary codecs, documentation, and runtime. It adds utilities for parsing, formatting, and comparing portable IRIs, and implements a JSON-LD cache normalization and compaction mechanism in jsonld-cache.ts. The vocabulary generator is updated to utilize these new features. Feedback on the pull request suggests optimizing mergeUnmappedTerms in jsonld-cache.ts by avoiding cloning the compacted object tree when there are no unmapped keys to merge, which helps preserve object identity and minimize cloning costs.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 02426e5720
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
2chanhaeng
left a comment
2chanhaeng
left a comment
There was a problem hiding this comment.
Great! The very last thing: remove canParseIri from packages/vocab-runtime/src/mod.ts, packages/vocab-runtime/src/url.test.ts, and packages/vocab-runtime/src/url.ts.
Remove the unused canParseIri runtime export, keep no-context cache compaction from borrowing nested child contexts, and fetch portable IRI references through their canonical external spelling. fedify-dev#850 (review) fedify-dev#850 (comment) fedify-dev#850 (comment) Assisted-by: Codex:gpt-5.5
|
Addressed 2chanhaeng’s final review request in 96937a5: canParseIri has been removed from the runtime export, implementation, and tests. |
|
/gemini review |
|
@codex review |
Return the compacted JSON-LD object directly when there are no unmapped terms to merge, preserving object identity for unchanged cache subtrees. fedify-dev#850 (comment) Assisted-by: Codex:gpt-5.5
|
/gemini review |
|
@codex review |
|
Warning Gemini encountered an error creating the review. You can try again by commenting |
There was a problem hiding this comment.
Code Review
This pull request introduces comprehensive support for FEP-ef61 portable ActivityPub IRIs (using ap: and ap+ef61: schemes with DID authorities) across the vocabulary codecs, runtime, and tools. It adds utility functions for parsing, formatting, and comparing portable IRIs, integrates JSON-LD cache normalization and compaction, and updates code generation tools to handle these IRIs correctly. One critical issue was identified in the JSON-LD context combination logic, where combining array contexts could result in invalid nested arrays; a flattening approach is suggested to resolve this.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Nested objects can provide their own context as an array. When that context is merged with an inherited context, keep the resulting JSON-LD context flat so processors do not see an invalid nested array. fedify-dev#850 (comment) Assisted-by: Codex:gpt-5.5
|
@codex review |
|
/gemini review |
|
Warning Gemini encountered an error creating the review. You can try again by commenting |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e22d8dd060
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Generated getters should still respect crossOrigin: "trust" when the owning object has no id. Without that, id-less parsed objects replaced embedded property objects with their ids and fetched unnecessarily. fedify-dev#850 (comment) Assisted-by: Codex:gpt-5.5
|
@codex review |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces support for FEP-ef61 portable ActivityPub IRIs (using ap: and ap+ef61: schemes) across the vocabulary codecs and runtime. It adds new utility functions for parsing, formatting, and comparing portable IRIs, and implements a JSON-LD cache normalization and compaction mechanism (compactJsonLdCache) to preserve portable IRIs and unmapped terms in cached JSON-LD data. Additionally, code generation tools and property lookup mechanisms have been updated to utilize these new utilities and enforce proper cross-origin trust boundaries. I have no feedback to provide as there are no review comments.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b291ae9ffd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Explicit null contexts reset inherited terms, so cache recompaction should not apply parent aliases to those nested objects. fedify-dev#850 (comment) Assisted-by: Codex:gpt-5.5
|
@codex review |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces support for FEP-ef61 portable ActivityPub IRIs in the generated vocabulary codecs. It allows both ap: and ap+ef61: schemes to be parsed as URL objects, handling both decoded and percent-encoded DID authorities, and serializes them back to canonical ap+ef61: values. To support this, a new internal module jsonld-cache.ts was added to handle JSON-LD cache normalization and compaction, and several helper functions (parseIri, formatIri, haveSameIriOrigin, and parseJsonLdId) were introduced in the URL utility module. The code generation tools and vocabulary lookup logic have been updated to utilize these new utilities, accompanied by comprehensive test coverage. There are no review comments to address, and I have no additional feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
3 participants
Fixes #826.
Why this is shaped this way
Fedify vocabulary objects already use
URLas the internal representation for IRI-like fields. This PR keeps that contract instead of introducing a parallel portable IRI type. The awkward part of FEP-ef61 is that the readable form uses a decoded DID authority, such asap+ef61://did:key:.../actor, while the platformURLparser needs that authority to be URL-safe. The new runtime helpers in packages/vocab-runtime/src/url.ts make that boundary explicit: parse portable ActivityPub IRIs into normalURLobjects with encoded authorities, then format thoseURLobjects back to canonicalap+ef61:strings when JSON-LD is emitted.That keeps the generated vocabulary classes from having to know the details of portable IRI parsing. packages/vocab-tools/src/codec.ts and packages/vocab-tools/src/type.ts now call the shared helpers wherever generated code previously reached for
new URL(),URL.canParse(), or.hrefon an IRI field. This also preserves the existingat://workaround in one place instead of duplicating it in the generated code.The JSON-LD cache path needed a small extra guard. When an object is built from JSON-LD that already contains portable IRIs, returning the raw cached document would skip the formatter and leak the input spelling back out. Generated codecs now only reuse the raw JSON-LD cache when the input does not contain
ap:orap+ef61:portable IRI syntax.Scope
This PR handles parsing and formatting for generated vocab codecs. It accepts
ap:andap+ef61:values with decoded or percent-encoded DID authorities, stores them internally as URL-safeURLobjects, and emits canonicalap+ef61:values with decoded DID authorities.It intentionally does not add comparison canonicalization that ignores query components. That belongs to the follow-up comparison work tracked separately in #828.
Verification
I covered the behavior at both levels: focused tests for the runtime helpers in packages/vocab-runtime/src/url.test.ts, and generated vocab behavior in packages/vocab/src/vocab.test.ts. The vocab test exercises object IDs, link-like properties, collection page links, decoded DID authorities, percent-encoded DID authorities, uppercase schemes, query strings, and JSON-LD round-tripping through
toJsonLd().I also regenerated the vocab-tools snapshots and updated the manual and changelog.
Commands run: