@fedify/fedify 2.1.27 → 2.1.29

package/dist/{middleware-Bla8jBXk.cjs → middleware-CVRFS7PZ.cjs}

@@ -2,10 +2,10 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 const require_chunk = require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
-const require_http = require("./http-CsQRvInz.cjs");
+const require_http = require("./http-Cginz7L0.cjs");
 const require_types = require("./types-DRPjmHVV.cjs");
-const require_proof = require("./proof-JfqNWc2E.cjs");
-const require_kv_cache = require("./kv-cache-FfmHQljR.cjs");
+const require_proof = require("./proof-BbHMAkPG.cjs");
+const require_kv_cache = require("./kv-cache-BdylAE9w.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
@@ -53,12 +53,33 @@ var InboxListenerSet = class InboxListenerSet {
 		return this.dispatchWithClass(activity)?.listener ?? null;
 	}
 };
+/**
+* Checks whether an activity's ID and all of its actor IDs have the same
+* non-opaque origin.  Activities without an ID have no origin to authenticate.
+*
+* The caller is responsible for rejecting a missing primary actor ID before
+* relying on this check.
+* @internal
+*/
+function actorsHaveSameOrigin(activity) {
+	if (activity.id == null) return true;
+	const origin = activity.id.origin;
+	return origin !== "null" && activity.actorIds.every((actor) => actor.origin === origin);
+}
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, tracerProvider, idempotencyStrategy }) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", { activity: json });
+		span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return "missingActor";
+	}
 	let cacheKey = null;
 	if (activity.id != null) {
 		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, (0, _fedify_vocab.getTypeId)(activity).href);
@@ -93,14 +114,6 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 			return "alreadyProcessed";
 		}
 	}
-	if (activity.actorId == null) {
-		logger.error("Missing actor.", { activity: json });
-		span.setStatus({
-			code: _opentelemetry_api.SpanStatusCode.ERROR,
-			message: "Missing actor."
-		});
-		return "missingActor";
-	}
 	span.setAttribute("activitypub.actor.id", activity.actorId.href);
 	if (queue != null) {
 		const carrier = {};
@@ -337,7 +350,7 @@ var FederationBuilderImpl = class {
 		this.collectionTypeIds = {};
 	}
 	async build(options) {
-		const { FederationImpl } = await Promise.resolve().then(() => require("./middleware-Ddrg18eD.cjs"));
+		const { FederationImpl } = await Promise.resolve().then(() => require("./middleware-VvrqPwHL.cjs"));
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();
@@ -1799,6 +1812,36 @@ async function handleInboxInternal(request, parameters, span) {
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", {
+			activity: json,
+			recipient
+		});
+		span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		return new Response("Missing actor.", {
+			status: 400,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
+	if (!skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+		logger.error("The activity ({activityId}) and its actors do not have the same origin.", {
+			activity: json,
+			recipient,
+			activityId: activity.id.href,
+			actorIds: activity.actorIds.map((actor) => actor.href)
+		});
+		span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.ERROR,
+			message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+		});
+		return new Response("The activity and its actors do not have the same origin.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	const routeResult = await routeActivity({
 		context: ctx,
 		json,
@@ -3310,6 +3353,33 @@ var FederationImpl = class extends FederationBuilderImpl {
 				activity = await _fedify_vocab.Activity.fromJsonLd(parseInput, parseContext);
 				span.setAttribute("activitypub.activity.type", (0, _fedify_vocab.getTypeId)(activity).href);
 				if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
+				if (activity.actorId == null) {
+					logger.error("Missing actor in queued incoming activity.", {
+						activityId: activity.id?.href,
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: _opentelemetry_api.SpanStatusCode.ERROR,
+						message: "Missing actor."
+					});
+					span.end();
+					return;
+				}
+				if (!this.skipSignatureVerification && activity.id != null && !actorsHaveSameOrigin(activity)) {
+					logger.error("The queued activity ({activityId}) and its actors do not have the same origin.", {
+						activityId: activity.id.href,
+						actorIds: activity.actorIds.map((actor) => actor.href),
+						activity: message.activity,
+						recipient: message.identifier
+					});
+					span.setStatus({
+						code: _opentelemetry_api.SpanStatusCode.ERROR,
+						message: `The activity (${activity.id.href}) and its actors do not have the same origin.`
+					});
+					span.end();
+					return;
+				}
 				cacheKey = activity.id == null ? null : [
 					...this.kvPrefixes.activityIdempotence,
 					context.origin,
@@ -4422,20 +4492,6 @@ var ContextImpl = class ContextImpl {
 					activity: await fetched.toJsonLd({ contextLoader })
 				});
 				return false;
-			} else if (fetched.actorIds.length < 1) {
-				logger.debug("Fetched activity object is missing an actor; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
-			}
-			const activityId = fetched.id;
-			if (!fetched.actorIds.every((actor) => actor.origin === activityId.origin)) {
-				logger.debug("Fetched activity object has actors from different origins; unable to verify.", {
-					recipient,
-					activity: await fetched.toJsonLd({ contextLoader })
-				});
-				return false;
 			}
 			logger.debug("Successfully fetched the remote activity object {activityId}; ignore the original activity and use the fetched one, which is trustworthy.");
 			activity = fetched;
@@ -4444,6 +4500,20 @@ var ContextImpl = class ContextImpl {
 			recipient,
 			activity: json
 		});
+		if (activity.actorId == null) {
+			logger.debug("Activity is missing an actor; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
+		if (activity.id != null && !actorsHaveSameOrigin(activity)) {
+			logger.debug("Activity has actors from different origins; unable to verify.", {
+				recipient,
+				activity: json
+			});
+			return false;
+		}
 		const routeResult = await routeActivity({
 			context: this,
 			json,

package/dist/{middleware-C9vVE-6R.mjs → middleware-CxgFiKI3.mjs}

@@ -1,5 +1,5 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-DVaturw-.mjs";
+import { n as FederationImpl } from "./middleware-C9UCWOqw.mjs";
 export { FederationImpl };

package/dist/{middleware-Ddrg18eD.cjs → middleware-VvrqPwHL.cjs}

@@ -1,4 +1,4 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
-const require_middleware = require("./middleware-Bla8jBXk.cjs");
+const require_middleware = require("./middleware-CVRFS7PZ.cjs");
 exports.FederationImpl = require_middleware.FederationImpl;

package/dist/mod.cjs

@@ -4,11 +4,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-CsQRvInz.cjs");
-const require_middleware = require("./middleware-Bla8jBXk.cjs");
+const require_http = require("./http-Cginz7L0.cjs");
+const require_middleware = require("./middleware-CVRFS7PZ.cjs");
 const require_types = require("./types-DRPjmHVV.cjs");
-const require_proof = require("./proof-JfqNWc2E.cjs");
-const require_kv_cache = require("./kv-cache-FfmHQljR.cjs");
+const require_proof = require("./proof-BbHMAkPG.cjs");
+const require_kv_cache = require("./kv-cache-BdylAE9w.cjs");
 const require_federation_mod = require("./federation/mod.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");

package/dist/mod.js

@@ -3,11 +3,11 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./chunk-CRNNMoPX.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-BGMIq1cs.js";
 import "./compat/mod.js";
-import { _ as validateAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, g as parseAcceptSignature, h as fulfillAcceptSignature, i as verifyRequest, l as fetchKeyDetailed, m as formatAcceptSignature, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "./http-DQVY5EMT.js";
-import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "./middleware-DwEVn3gK.js";
+import { _ as validateAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, g as parseAcceptSignature, h as fulfillAcceptSignature, i as verifyRequest, l as fetchKeyDetailed, m as formatAcceptSignature, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "./http-B3rSb2GQ.js";
+import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "./middleware-41MkquTV.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-miAYfiGO.js";
-import { _ as signJsonLd, a as doesActorOwnKey, b as verifySignature, d as createSignature, f as detachSignature, i as verifyProof, l as attachSignature, n as signObject, o as getKeyOwner, r as verifyObject, t as createProof, y as verifyJsonLd } from "./proof-uEay4EIq.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-cTsPZ49Z.js";
+import { _ as signJsonLd, a as doesActorOwnKey, b as verifySignature, d as createSignature, f as detachSignature, i as verifyProof, l as attachSignature, n as signObject, o as getKeyOwner, r as verifyObject, t as createProof, y as verifyJsonLd } from "./proof-cGfRPTiV.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-8Kg2CHiD.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";

package/dist/nodeinfo/client.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as esm_default } from "../esm-DVILvP5e.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-BUOJXi-Z.mjs";
+import "../std__assert-DflMZha5.mjs";
 import { n as assertInstanceOf } from "../assert-BhQd8QHP.mjs";
 import { a as parseProtocol, c as parseUsage, i as parseOutboundService, n as parseInboundService, o as parseServices, r as parseNodeInfo, s as parseSoftware, t as getNodeInfo } from "../client-CjDMsn4a.mjs";
 import { test } from "@fedify/fixture";

package/dist/nodeinfo/handler.test.mjs

@@ -3,9 +3,9 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as createRequestContext } from "../context-Juj6bdHC.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-BUOJXi-Z.mjs";
+import "../std__assert-DflMZha5.mjs";
 import { t as MemoryKvStore } from "../kv-HvthQAHr.mjs";
-import { a as createFederation, h as handleNodeInfoJrd, m as handleNodeInfo } from "../middleware-DVaturw-.mjs";
+import { a as createFederation, h as handleNodeInfoJrd, m as handleNodeInfo } from "../middleware-C9UCWOqw.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {

package/dist/nodeinfo/types.test.mjs

@@ -2,8 +2,8 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-BUOJXi-Z.mjs";
-import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
+import "../std__assert-DflMZha5.mjs";
+import { t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { t as nodeInfoToJson } from "../types-DCP0WLdt.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/types.test.ts

package/dist/otel/exporter.test.mjs

@@ -2,7 +2,7 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-BUOJXi-Z.mjs";
+import "../std__assert-DflMZha5.mjs";
 import { t as MemoryKvStore } from "../kv-HvthQAHr.mjs";
 import { test } from "@fedify/fixture";
 import { SpanKind, SpanStatusCode, TraceFlags } from "@opentelemetry/api";

package/dist/{owner-DnOwKsK6.mjs → owner-C8IVASD3.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BR2CGENT.mjs";
-import { c as verifyKeyOwnership, n as fetchActorDocument, t as exportJwk } from "./key-CDIMbgsc.mjs";
+import { n as version, t as name } from "./deno-BiYv5RT5.mjs";
+import { c as verifyKeyOwnership, n as fetchActorDocument, t as exportJwk } from "./key-O-ATwIGS.mjs";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { getDocumentLoader } from "@fedify/vocab-runtime";

package/dist/{proof-JfqNWc2E.cjs → proof-BbHMAkPG.cjs}

@@ -1,7 +1,7 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 const require_chunk = require("./chunk-DDcVe30Y.cjs");
-const require_http = require("./http-CsQRvInz.cjs");
+const require_http = require("./http-Cginz7L0.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");

package/dist/{proof-CShmVLWt.mjs → proof-CUdcBgvg.mjs}

@@ -1,8 +1,8 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BR2CGENT.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-CDIMbgsc.mjs";
+import { n as version, t as name } from "./deno-BiYv5RT5.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-O-ATwIGS.mjs";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";

package/dist/{proof-uEay4EIq.js → proof-cGfRPTiV.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { c as fetchKey, f as validateCryptoKey, o as exportJwk, p as verifyKeyOwnership, s as fetchActorDocument, v as name, y as version } from "./http-DQVY5EMT.js";
+import { c as fetchKey, f as validateCryptoKey, o as exportJwk, p as verifyKeyOwnership, s as fetchActorDocument, v as name, y as version } from "./http-B3rSb2GQ.js";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{send-DCg0WblG.mjs → send-BoV4dyVO.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BR2CGENT.mjs";
-import { n as doubleKnock } from "./http-QzHm1vsW.mjs";
+import { n as version, t as name } from "./deno-BiYv5RT5.mjs";
+import { n as doubleKnock } from "./http-C1ga9WQu.mjs";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";

package/dist/sig/http.test.mjs

@@ -3,12 +3,12 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as esm_default } from "../esm-DVILvP5e.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import { i as assertExists, t as assertStringIncludes } from "../std__assert-BUOJXi-Z.mjs";
-import { n as assertFalse, t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
+import { i as assertExists, t as assertStringIncludes } from "../std__assert-DflMZha5.mjs";
+import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
-import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
-import { t as exportJwk } from "../key-CDIMbgsc.mjs";
-import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-QzHm1vsW.mjs";
+import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
+import { t as exportJwk } from "../key-O-ATwIGS.mjs";
+import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-C1ga9WQu.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-CtZLJq76.mjs";
 import { t as KvKeyCache } from "../keycache-RFlZObU3.mjs";
 import { t as MemoryKvStore } from "../kv-HvthQAHr.mjs";

package/dist/sig/key.test.mjs

@@ -2,15 +2,16 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-BUOJXi-Z.mjs";
-import { t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
+import { n as assertStrictEquals } from "../std__assert-DflMZha5.mjs";
+import { t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
-import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
-import { a as generateCryptoKeyPair, i as fetchKeyDetailed, o as importJwk, r as fetchKey, s as validateCryptoKey, t as exportJwk } from "../key-CDIMbgsc.mjs";
+import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
+import { a as generateCryptoKeyPair, i as fetchKeyDetailed, o as importJwk, r as fetchKey, s as validateCryptoKey, t as exportJwk } from "../key-O-ATwIGS.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CtZLJq76.mjs";
+import { g as wrapContextLoaderForJsonLd } from "../ld-C-fCGM-z.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
-import { CryptographicKey, Multikey } from "@fedify/vocab";
-import { FetchError } from "@fedify/vocab-runtime";
+import { CryptographicKey, Multikey, Person } from "@fedify/vocab";
+import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
 //#region src/sig/key.test.ts
 test("validateCryptoKey()", async () => {
 	const pkcs1v15 = await crypto.subtle.generateKey({
@@ -399,6 +400,199 @@ test("fetchKey() returns null for a malformed actor publicKey", async () => {
 		cached: true
 	});
 });
+for (const cls of [CryptographicKey, Multikey]) for (const location of [
+	"actor",
+	"key",
+	"owner"
+]) test(`fetchKey() handles JSON-LD context failures in ${cls.name} ${location} documents`, async (t) => {
+	const actorId = new URL("https://example.com/context-actor");
+	const keyId = new URL(`${actorId.href}#key`);
+	const key = cls === CryptographicKey ? rsaPublicKey1.clone({
+		id: keyId,
+		owner: actorId
+	}) : ed25519Multikey.clone({
+		id: keyId,
+		controller: actorId
+	});
+	const actorDocument = await new Person({
+		id: actorId,
+		...key instanceof CryptographicKey ? { publicKeys: [key] } : { assertionMethods: [key] }
+	}).toJsonLd({ contextLoader: mockDocumentLoader });
+	const keyDocument = await key.toJsonLd({ contextLoader: mockDocumentLoader });
+	const contextUrl = `https://example.com/context/${cls.name}/${location}`;
+	const transportErrors = [
+		/* @__PURE__ */ new TypeError("fetch failed"),
+		/* @__PURE__ */ new TypeError("error reading a body from connection"),
+		globalThis.Object.assign(/* @__PURE__ */ new TypeError("The socket connection was closed unexpectedly."), { code: "ECONNRESET" }),
+		globalThis.Object.assign(/* @__PURE__ */ new TypeError("Network request failed"), { code: "ECONNRESET" }),
+		new TypeError("Network request failed", { cause: globalThis.Object.assign(/* @__PURE__ */ new Error("connection refused"), { code: "ECONNREFUSED" }) }),
+		new FetchError(contextUrl, "HTTP 503"),
+		new FetchError(contextUrl, "HTTP 503", new Response("unavailable", { status: 503 })),
+		new UrlError("DNS lookup failed", { reason: "dns" }),
+		globalThis.Object.assign(/* @__PURE__ */ new Error("request aborted"), { name: "AbortError" })
+	];
+	const programmingErrors = [
+		/* @__PURE__ */ new Error("loader bug"),
+		/* @__PURE__ */ new ReferenceError("loader bug"),
+		/* @__PURE__ */ new TypeError("loader bug"),
+		"loader bug",
+		null,
+		void 0
+	];
+	const cases = [
+		{ kind: "inline" },
+		{
+			kind: "url",
+			wrapped: false
+		},
+		{
+			kind: "url",
+			wrapped: true
+		},
+		{
+			kind: "wrapped",
+			error: /* @__PURE__ */ new TypeError("Invalid URL string.")
+		},
+		{
+			kind: "remote",
+			document: 123
+		},
+		{
+			kind: "remote",
+			document: "not JSON"
+		},
+		{
+			kind: "remote",
+			document: { "@context": contextUrl }
+		},
+		...transportErrors.map((error) => ({
+			kind: "transport",
+			error
+		})),
+		...programmingErrors.map((error) => ({
+			kind: "programming",
+			error
+		})),
+		...location === "key" ? [{
+			kind: "transport",
+			error: /* @__PURE__ */ new TypeError("fetch failed"),
+			fallback: true
+		}, {
+			kind: "programming",
+			error: /* @__PURE__ */ new ReferenceError("fallback bug"),
+			fallback: true
+		}] : []
+	];
+	for (const scenario of cases) {
+		const description = "error" in scenario ? scenario.error instanceof Error ? `${scenario.error.name}: ${scenario.error.message}` : String(scenario.error) : "document" in scenario ? JSON.stringify(scenario.document) : "invalid type mapping";
+		await t.step(`${scenario.kind}: ${description}${"fallback" in scenario ? " (fallback)" : ""}`, async () => {
+			const cache = {};
+			let fetchError = { error: /* @__PURE__ */ new Error("stale fetch error") };
+			let recovered = false;
+			let contextLoads = 0;
+			const options = {
+				documentLoader(resource) {
+					const document = structuredClone(resource === keyId.href && location !== "actor" ? keyDocument : actorDocument);
+					if (location === "actor" || location === "key" && resource === keyId.href || location === "owner" && resource === actorId.href) {
+						const context = scenario.kind === "inline" ? { broken: {
+							"@id": "https://example.com/ns#broken",
+							"@type": "not-an-absolute-iri"
+						} } : scenario.kind === "url" ? "http://[" : contextUrl;
+						document["@context"] = [document["@context"], context].flat();
+					}
+					return Promise.resolve({
+						contextUrl: null,
+						documentUrl: resource,
+						document
+					});
+				},
+				async contextLoader(resource) {
+					if (scenario.kind === "url" && resource === "http://[") {
+						const loader = getDocumentLoader();
+						return await (scenario.wrapped ? wrapContextLoaderForJsonLd(loader) : loader)(resource);
+					}
+					if (scenario.kind === "wrapped" && resource === contextUrl) return await wrapContextLoaderForJsonLd(() => Promise.reject(scenario.error))(resource);
+					if (resource !== contextUrl) return await mockDocumentLoader(resource);
+					contextLoads++;
+					if (!recovered && "error" in scenario && (!("fallback" in scenario) || contextLoads > 1)) throw scenario.error;
+					return {
+						contextUrl: null,
+						documentUrl: resource,
+						document: !recovered && "document" in scenario ? scenario.document : { "@context": {} }
+					};
+				},
+				keyCache: {
+					get: (id) => Promise.resolve(cache[id.href]),
+					set(id, value) {
+						cache[id.href] = value;
+						return Promise.resolve();
+					},
+					getFetchError: () => Promise.resolve(fetchError),
+					setFetchError(_id, error) {
+						fetchError = error ?? void 0;
+						return Promise.resolve();
+					}
+				}
+			};
+			const lookup = () => fetchKey(keyId, cls, options);
+			if (scenario.kind === "programming" && "error" in scenario) {
+				assertStrictEquals(await assertRejects(lookup), scenario.error);
+				assertEquals(cache, {});
+				assertStrictEquals(await assertRejects(() => fetchKeyDetailed(keyId, cls, options)), scenario.error);
+				assertEquals(cache, {});
+				return;
+			}
+			assertEquals(await lookup(), {
+				key: null,
+				cached: false
+			});
+			assertEquals(cache, { [keyId.href]: null });
+			const detailed = await fetchKeyDetailed(keyId, cls, options);
+			assertEquals(detailed.cached, true);
+			if (scenario.kind === "transport" || scenario.kind === "wrapped") {
+				assert(detailed.fetchError != null);
+				if (scenario.error instanceof FetchError && scenario.error.response != null) {
+					assert("status" in detailed.fetchError);
+					assertEquals(detailed.fetchError.status, 503);
+					assertEquals(await detailed.fetchError.response.text(), "unavailable");
+				} else {
+					assert("error" in detailed.fetchError);
+					assertStrictEquals(detailed.fetchError.error, scenario.error);
+				}
+			} else assertEquals(detailed.fetchError, void 0);
+			const previousLoads = contextLoads;
+			assertEquals(await lookup(), {
+				key: null,
+				cached: true
+			});
+			assertEquals(contextLoads, previousLoads);
+			delete cache[keyId.href];
+			fetchError = void 0;
+			const fresh = await fetchKeyDetailed(keyId, cls, options);
+			assertEquals(fresh.cached, false);
+			assertEquals(fresh.key, null);
+			if (scenario.kind === "transport" || scenario.kind === "wrapped") {
+				assert(fresh.fetchError != null);
+				if (scenario.error instanceof FetchError && scenario.error.response != null) {
+					assert("status" in fresh.fetchError);
+					assertEquals(fresh.fetchError.status, 503);
+					assertEquals(await fresh.fetchError.response.text(), "unavailable");
+				} else {
+					assert("error" in fresh.fetchError);
+					assertStrictEquals(fresh.fetchError.error, scenario.error);
+				}
+			} else assertEquals(fresh.fetchError, void 0);
+			if (scenario.kind === "transport") {
+				delete cache[keyId.href];
+				recovered = true;
+				const result = await lookup();
+				assertEquals(result.cached, false);
+				assertEquals(result.key?.id, keyId);
+				assert(result.key?.publicKey != null);
+			}
+		});
+	}
+});
 test("fetchKey() rejects a key whose owner does not link back", async () => {
 	const keyId = "https://attacker.example/key";
 	const keyDocument = await rsaPublicKey1.toJsonLd({ contextLoader: mockDocumentLoader });

package/dist/sig/ld.test.mjs

@@ -2,12 +2,12 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import { n as assertFalse, t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
+import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
-import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
-import { a as generateCryptoKeyPair } from "../key-CDIMbgsc.mjs";
+import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
+import { a as generateCryptoKeyPair } from "../key-O-ATwIGS.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CtZLJq76.mjs";
-import { a as compactJsonLd, d as isInvalidUrlTypeError, f as signJsonLd, h as verifySignature, i as attachSignature, m as verifyJsonLd, n as UnsafeJsonLdError, o as createSignature, s as detachSignature } from "../ld-BpkaBh2H.mjs";
+import { a as compactJsonLd, d as isInvalidUrlTypeError, f as signJsonLd, h as verifySignature, i as attachSignature, m as verifyJsonLd, n as UnsafeJsonLdError, o as createSignature, s as detachSignature } from "../ld-C-fCGM-z.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { CryptographicKey } from "@fedify/vocab";
 import { encodeBase64 } from "byte-encodings/base64";

package/dist/sig/mod.cjs

@@ -1,8 +1,8 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-CsQRvInz.cjs");
-const require_proof = require("../proof-JfqNWc2E.cjs");
+const require_http = require("../http-Cginz7L0.cjs");
+const require_proof = require("../proof-BbHMAkPG.cjs");
 exports.attachSignature = require_proof.attachSignature;
 exports.createProof = require_proof.createProof;
 exports.createSignature = require_proof.createSignature;

package/dist/sig/mod.js

@@ -1,5 +1,5 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { _ as validateAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, g as parseAcceptSignature, h as fulfillAcceptSignature, i as verifyRequest, l as fetchKeyDetailed, m as formatAcceptSignature, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "../http-DQVY5EMT.js";
-import { _ as signJsonLd, a as doesActorOwnKey, b as verifySignature, d as createSignature, f as detachSignature, i as verifyProof, l as attachSignature, n as signObject, o as getKeyOwner, r as verifyObject, t as createProof, y as verifyJsonLd } from "../proof-uEay4EIq.js";
+import { _ as validateAcceptSignature, a as verifyRequestDetailed, c as fetchKey, d as importJwk, g as parseAcceptSignature, h as fulfillAcceptSignature, i as verifyRequest, l as fetchKeyDetailed, m as formatAcceptSignature, o as exportJwk, r as signRequest, u as generateCryptoKeyPair } from "../http-B3rSb2GQ.js";
+import { _ as signJsonLd, a as doesActorOwnKey, b as verifySignature, d as createSignature, f as detachSignature, i as verifyProof, l as attachSignature, n as signObject, o as getKeyOwner, r as verifyObject, t as createProof, y as verifyJsonLd } from "../proof-cGfRPTiV.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/owner.test.mjs

@@ -2,11 +2,11 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-BUOJXi-Z.mjs";
-import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
+import "../std__assert-DflMZha5.mjs";
+import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-CtZLJq76.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DnOwKsK6.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-C8IVASD3.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 //#region src/sig/owner.test.ts