@fedify/fedify 2.3.12-dev.2365 → 2.3.13

package/dist/{http-LMsqGo8j.js → http-GHVGCeb5.js}

@@ -4,13 +4,13 @@ import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, metrics, trace } from "@opentelemetry/api";
 import { encodeHex } from "byte-encodings/hex";
-import { FetchError, getDocumentLoader } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
 import { Item, decodeDict, encodeDict, encodeItem } from "structured-field-values";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.3.12-dev.2365+89254121";
+var version = "2.3.13";
 //#endregion
 //#region src/sig/accept.ts
 /**
@@ -960,6 +960,65 @@ function getDurationMs(start) {
 }
 //#endregion
 //#region src/sig/key.ts
+/** Classifies decoding failures without hiding unexpected loader errors. */
+function classifyKeyJsonLdError(error, seen = /* @__PURE__ */ new Set()) {
+	if (!(error instanceof Error) || !error.name.startsWith("jsonld.")) return null;
+	if (seen.has(error)) throw error;
+	seen.add(error);
+	const details = error.details;
+	if (typeof details?.code !== "string") return null;
+	if (details.code !== "loading remote context failed" || !("cause" in details) && !("cause" in error)) return "invalid";
+	const cause = "cause" in details ? details.cause : error.cause;
+	const nestedFailure = classifyKeyJsonLdError(cause, seen);
+	if (nestedFailure != null) return nestedFailure;
+	if (cause instanceof SyntaxError) return "invalid";
+	if (cause instanceof FetchError || cause instanceof UrlError) return "fetch";
+	if (cause instanceof Error && [
+		"AbortError",
+		"TimeoutError",
+		"NetworkError"
+	].includes(cause.name)) return "fetch";
+	if (cause instanceof TypeError) {
+		const urlCode = cause.code;
+		if (cause.name === "InvalidContextReferenceError") return "invalid";
+		if (urlCode === "ERR_INVALID_URL" || cause.message === "Invalid URL string." || /^Invalid URL(?::|$)/.test(cause.message) || / cannot be parsed as a URL\.?$/.test(cause.message)) return typeof details.url === "string" && /^[A-Za-z][A-Za-z0-9+.-]*:/.test(details.url) && !URL.canParse(details.url) ? "invalid" : "fetch";
+		const networkCause = cause.cause;
+		const code = cause.code ?? networkCause?.code;
+		if (typeof code === "string" && [
+			"ECONNREFUSED",
+			"ECONNRESET",
+			"ECONNABORTED",
+			"ETIMEDOUT",
+			"EHOSTUNREACH",
+			"ENETUNREACH",
+			"ENOTFOUND",
+			"EAI_AGAIN",
+			"UND_ERR_CONNECT_TIMEOUT",
+			"UND_ERR_HEADERS_TIMEOUT",
+			"UND_ERR_BODY_TIMEOUT",
+			"UND_ERR_SOCKET"
+		].includes(code) || /^(fetch failed|Failed to fetch|error sending request|error reading a body from connection|Unable to connect|ConnectionRefused|Network connection lost|The socket connection was closed unexpectedly)/.test(cause.message)) return "fetch";
+	}
+	throw cause;
+}
+/** Carries a context transport failure through the key decoding boundary. */
+var KeyContextFetchError = class extends Error {
+	error;
+	constructor(error) {
+		super("Failed to fetch a key's JSON-LD context.", { cause: error });
+		this.error = error;
+	}
+};
+function contextFetchError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	while (error instanceof Error && !seen.has(error)) {
+		seen.add(error);
+		const details = error.details;
+		if (!error.name.startsWith("jsonld.") || details?.code !== "loading remote context failed") break;
+		error = "cause" in details ? details.cause : error.cause;
+	}
+	return new KeyContextFetchError(error);
+}
 /**
 * Checks if the given key is valid and supported.  No-op if the key is valid,
 * otherwise throws an error.
@@ -1054,6 +1113,9 @@ async function importJwk(jwk, type) {
 * @internal
 */
 async function fetchActorDocument(actorId, options = {}) {
+	return await fetchActorDocumentInternal(actorId, options, false);
+}
+async function fetchActorDocumentInternal(actorId, options, propagateContextFetchErrors) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -1084,9 +1146,12 @@ async function fetchActorDocument(actorId, options = {}) {
 			baseUrl: documentUrl
 		});
 	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+		const failure = classifyKeyJsonLdError(error);
+		if (failure === "fetch" && propagateContextFetchErrors) throw contextFetchError(error);
+		if (failure == null && !(error instanceof TypeError)) throw error;
+		logger.debug("Failed to decode the actor document at {documentUrl}: {error}", {
 			documentUrl: documentUrl.href,
+			failure: failure ?? "invalid",
 			error
 		});
 		return null;
@@ -1125,6 +1190,9 @@ async function fetchActorDocument(actorId, options = {}) {
 * @internal
 */
 async function verifyKeyOwnership(key, options = {}) {
+	return await verifyKeyOwnershipInternal(key, options, false);
+}
+async function verifyKeyOwnershipInternal(key, options, propagateContextFetchErrors) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -1134,7 +1202,7 @@ async function verifyKeyOwnership(key, options = {}) {
 	if (keyId == null) return null;
 	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
 	if (claimedOwnerId == null) return null;
-	const owner = await fetchActorDocument(claimedOwnerId, options);
+	const owner = await fetchActorDocumentInternal(claimedOwnerId, options, propagateContextFetchErrors);
 	if (owner == null) {
 		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
 			keyId: keyId.href,
@@ -1286,6 +1354,21 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 			tracerProvider
 		});
 	} catch (e) {
+		const failure = classifyKeyJsonLdError(e);
+		if (failure === "fetch") throw contextFetchError(e);
+		if (failure != null) {
+			logger.debug("Failed to decode key {keyId}: {error}", {
+				keyId,
+				failure,
+				error: e
+			});
+			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
+			return {
+				key: null,
+				cached: false
+			};
+		}
 		if (!(e instanceof TypeError)) throw e;
 		try {
 			object = await cls.fromJsonLd(document, {
@@ -1294,8 +1377,14 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 				tracerProvider
 			});
 		} catch (e) {
-			if (e instanceof TypeError) {
-				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+			const failure = classifyKeyJsonLdError(e);
+			if (failure === "fetch") throw contextFetchError(e);
+			if (failure != null || e instanceof TypeError) {
+				logger.debug("Failed to decode key {keyId}: {error}", {
+					keyId,
+					failure: failure ?? "invalid",
+					error: e
+				});
 				await keyCache?.set(cacheKey, null);
 				await clearFetchErrorMetadata(cacheKey, keyCache);
 				return {
@@ -1387,16 +1476,17 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
 	if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
 	else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
-		if (await verifyKeyOwnership(key, {
+		if (await verifyKeyOwnershipInternal(key, {
 			documentLoader,
 			contextLoader,
 			tracerProvider
-		}) == null) {
+		}, true) == null) {
 			logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
 				keyId,
 				claimedOwnerId: claimedOwnerId.href
 			});
 			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
 			return {
 				key: null,
 				cached: false
@@ -1447,9 +1537,17 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 			outcome = classified;
 			return errored;
 		}
-		const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
-		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
-		return resolved;
+		try {
+			const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
+			outcome = { result: resolved.key != null ? "fetched" : "invalid" };
+			return resolved;
+		} catch (error) {
+			if (!(error instanceof KeyContextFetchError)) throw error;
+			const classified = classifyFetchError(error.error);
+			const errored = await onFetchError(error.error, cacheKey, keyId, keyCache, logger);
+			outcome = classified;
+			return errored;
+		}
 	} finally {
 		recordKeyLookup(options.meterProvider, {
 			durationMs: getDurationMs(start),

package/dist/inbox-BzOuCPLY.mjs

@@ -0,0 +1,180 @@
+import { Temporal } from "@js-temporal/polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { n as version, t as name } from "./deno-XpcjbHwj.mjs";
+import { g as recordInboxActivity, n as getDurationMs, r as getFederationMetrics } from "./metrics-62qolVUY.mjs";
+import { getLogger } from "@logtape/logtape";
+import { getTypeId } from "@fedify/vocab";
+import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
+//#region src/federation/inbox.ts
+/**
+* Checks whether an activity's ID and all of its actor IDs have the same
+* non-opaque origin.  Activities without an ID have no origin to authenticate.
+*
+* The caller is responsible for rejecting a missing primary actor ID before
+* relying on this check.
+* @internal
+*/
+function actorsHaveSameOrigin(activity) {
+	if (activity.id == null) return true;
+	const origin = activity.id.origin;
+	return origin !== "null" && activity.actorIds.every((actor) => actor.origin === origin);
+}
+async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	if (activity.actorId == null) {
+		logger.error("Missing actor.", { activity: json });
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: "Missing actor."
+		});
+		recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+		return "missingActor";
+	}
+	let cacheKey = null;
+	if (activity.id != null) {
+		const inboxContext = inboxContextFactory(recipient, json, activity.id?.href, getTypeId(activity).href);
+		const strategy = idempotencyStrategy ?? "per-inbox";
+		let keyString;
+		if (typeof strategy === "function") keyString = await strategy(inboxContext, activity);
+		else switch (strategy) {
+			case "global":
+				keyString = activity.id.href;
+				break;
+			case "per-origin":
+				keyString = `${ctx.origin}\n${activity.id.href}`;
+				break;
+			case "per-inbox":
+				keyString = `${ctx.origin}\n${activity.id.href}\n${recipient == null ? "sharedInbox" : `inbox\n${recipient}`}`;
+				break;
+			default: keyString = `${ctx.origin}\n${activity.id.href}`;
+		}
+		if (keyString != null) cacheKey = [...kvPrefixes.activityIdempotence, keyString];
+	}
+	if (cacheKey != null) {
+		if (await kv.get(cacheKey) === true) {
+			logger.debug("Activity {activityId} has already been processed.", {
+				activityId: activity.id?.href,
+				activity: json,
+				recipient
+			});
+			span.setStatus({
+				code: SpanStatusCode.UNSET,
+				message: `Activity ${activity.id?.href} has already been processed.`
+			});
+			recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+			return "alreadyProcessed";
+		}
+	}
+	span.setAttribute("activitypub.actor.id", activity.actorId.href);
+	if (queue != null) {
+		const carrier = {};
+		propagation.inject(context.active(), carrier);
+		try {
+			await queue.enqueue({
+				type: "inbox",
+				id: crypto.randomUUID(),
+				baseUrl: ctx.origin,
+				activity: originalJson ?? json,
+				...normalizedActivity == null ? {} : { normalizedActivity },
+				...ldSignatureVerified == null ? {} : { ldSignatureVerified },
+				identifier: recipient,
+				attempt: 0,
+				started: (/* @__PURE__ */ new Date()).toISOString(),
+				traceContext: carrier
+			});
+		} catch (error) {
+			logger.error("Failed to enqueue the incoming activity {activityId}:\n{error}", {
+				error,
+				activityId: activity.id?.href,
+				activity: json,
+				recipient
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: `Failed to enqueue the incoming activity ${activity.id?.href}.`
+			});
+			throw error;
+		}
+		getFederationMetrics(meterProvider).recordQueueTaskEnqueued({
+			role: "inbox",
+			queue,
+			activityType: getTypeId(activity).href
+		}, 0);
+		recordInboxActivity(meterProvider, "queued", getTypeId(activity).href);
+		logger.info("Activity {activityId} is enqueued.", {
+			activityId: activity.id?.href,
+			activity: json,
+			recipient
+		});
+		return "enqueued";
+	}
+	tracerProvider = tracerProvider ?? trace.getTracerProvider();
+	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.dispatch_inbox_listener", { kind: SpanKind.INTERNAL }, async (span) => {
+		const dispatched = inboxListeners?.dispatchWithClass(activity);
+		if (dispatched == null) {
+			logger.error("Unsupported activity type:\n{activity}", {
+				activity: json,
+				recipient
+			});
+			span.setStatus({
+				code: SpanStatusCode.UNSET,
+				message: `Unsupported activity type: ${getTypeId(activity).href}`
+			});
+			recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+			span.end();
+			return "unsupportedActivity";
+		}
+		const { class: cls, listener } = dispatched;
+		span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
+		try {
+			const activityType = getTypeId(activity).href;
+			const started = performance.now();
+			try {
+				const contextFactory = listenerInboxContextFactory ?? inboxContextFactory;
+				await listener(contextFactory(recipient, contextFactory === inboxContextFactory ? json : originalJson ?? json, activity.id?.href, activityType), activity);
+			} finally {
+				getFederationMetrics(meterProvider).recordInboxProcessingDuration(activityType, getDurationMs(started));
+			}
+		} catch (error) {
+			try {
+				await inboxErrorHandler?.(ctx, error);
+			} catch (error) {
+				logger.error("An unexpected error occurred in inbox error handler:\n{error}", {
+					error,
+					activityId: activity.id?.href,
+					activity: json,
+					recipient
+				});
+			}
+			logger.error("Failed to process the incoming activity {activityId}:\n{error}", {
+				error,
+				activityId: activity.id?.href,
+				activity: json,
+				recipient
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			recordInboxActivity(meterProvider, "rejected", getTypeId(activity).href);
+			span.end();
+			return "error";
+		}
+		recordInboxActivity(meterProvider, "processed", getTypeId(activity).href);
+		if (cacheKey != null) await kv.set(cacheKey, true, { ttl: Temporal.Duration.from({ days: 1 }) });
+		logger.info("Activity {activityId} has been processed.", {
+			activityId: activity.id?.href,
+			activity: json,
+			recipient
+		});
+		span.end();
+		return "success";
+	});
+}
+//#endregion
+export { routeActivity as n, actorsHaveSameOrigin as t };

package/dist/{key-vnmAGZ3_.mjs → key-PdEu1lDF.mjs}

@@ -1,13 +1,72 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DSS6EkPl.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-Z0UkrR_1.mjs";
+import { n as version, t as name } from "./deno-XpcjbHwj.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-62qolVUY.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
-import { FetchError, getDocumentLoader } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
 //#region src/sig/key.ts
+/** Classifies decoding failures without hiding unexpected loader errors. */
+function classifyKeyJsonLdError(error, seen = /* @__PURE__ */ new Set()) {
+	if (!(error instanceof Error) || !error.name.startsWith("jsonld.")) return null;
+	if (seen.has(error)) throw error;
+	seen.add(error);
+	const details = error.details;
+	if (typeof details?.code !== "string") return null;
+	if (details.code !== "loading remote context failed" || !("cause" in details) && !("cause" in error)) return "invalid";
+	const cause = "cause" in details ? details.cause : error.cause;
+	const nestedFailure = classifyKeyJsonLdError(cause, seen);
+	if (nestedFailure != null) return nestedFailure;
+	if (cause instanceof SyntaxError) return "invalid";
+	if (cause instanceof FetchError || cause instanceof UrlError) return "fetch";
+	if (cause instanceof Error && [
+		"AbortError",
+		"TimeoutError",
+		"NetworkError"
+	].includes(cause.name)) return "fetch";
+	if (cause instanceof TypeError) {
+		const urlCode = cause.code;
+		if (cause.name === "InvalidContextReferenceError") return "invalid";
+		if (urlCode === "ERR_INVALID_URL" || cause.message === "Invalid URL string." || /^Invalid URL(?::|$)/.test(cause.message) || / cannot be parsed as a URL\.?$/.test(cause.message)) return typeof details.url === "string" && /^[A-Za-z][A-Za-z0-9+.-]*:/.test(details.url) && !URL.canParse(details.url) ? "invalid" : "fetch";
+		const networkCause = cause.cause;
+		const code = cause.code ?? networkCause?.code;
+		if (typeof code === "string" && [
+			"ECONNREFUSED",
+			"ECONNRESET",
+			"ECONNABORTED",
+			"ETIMEDOUT",
+			"EHOSTUNREACH",
+			"ENETUNREACH",
+			"ENOTFOUND",
+			"EAI_AGAIN",
+			"UND_ERR_CONNECT_TIMEOUT",
+			"UND_ERR_HEADERS_TIMEOUT",
+			"UND_ERR_BODY_TIMEOUT",
+			"UND_ERR_SOCKET"
+		].includes(code) || /^(fetch failed|Failed to fetch|error sending request|error reading a body from connection|Unable to connect|ConnectionRefused|Network connection lost|The socket connection was closed unexpectedly)/.test(cause.message)) return "fetch";
+	}
+	throw cause;
+}
+/** Carries a context transport failure through the key decoding boundary. */
+var KeyContextFetchError = class extends Error {
+	error;
+	constructor(error) {
+		super("Failed to fetch a key's JSON-LD context.", { cause: error });
+		this.error = error;
+	}
+};
+function contextFetchError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	while (error instanceof Error && !seen.has(error)) {
+		seen.add(error);
+		const details = error.details;
+		if (!error.name.startsWith("jsonld.") || details?.code !== "loading remote context failed") break;
+		error = "cause" in details ? details.cause : error.cause;
+	}
+	return new KeyContextFetchError(error);
+}
 /**
 * Checks if the given key is valid and supported.  No-op if the key is valid,
 * otherwise throws an error.
@@ -102,6 +161,9 @@ async function importJwk(jwk, type) {
 * @internal
 */
 async function fetchActorDocument(actorId, options = {}) {
+	return await fetchActorDocumentInternal(actorId, options, false);
+}
+async function fetchActorDocumentInternal(actorId, options, propagateContextFetchErrors) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -132,9 +194,12 @@ async function fetchActorDocument(actorId, options = {}) {
 			baseUrl: documentUrl
 		});
 	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+		const failure = classifyKeyJsonLdError(error);
+		if (failure === "fetch" && propagateContextFetchErrors) throw contextFetchError(error);
+		if (failure == null && !(error instanceof TypeError)) throw error;
+		logger.debug("Failed to decode the actor document at {documentUrl}: {error}", {
 			documentUrl: documentUrl.href,
+			failure: failure ?? "invalid",
 			error
 		});
 		return null;
@@ -173,6 +238,9 @@ async function fetchActorDocument(actorId, options = {}) {
 * @internal
 */
 async function verifyKeyOwnership(key, options = {}) {
+	return await verifyKeyOwnershipInternal(key, options, false);
+}
+async function verifyKeyOwnershipInternal(key, options, propagateContextFetchErrors) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -182,7 +250,7 @@ async function verifyKeyOwnership(key, options = {}) {
 	if (keyId == null) return null;
 	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
 	if (claimedOwnerId == null) return null;
-	const owner = await fetchActorDocument(claimedOwnerId, options);
+	const owner = await fetchActorDocumentInternal(claimedOwnerId, options, propagateContextFetchErrors);
 	if (owner == null) {
 		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
 			keyId: keyId.href,
@@ -334,6 +402,21 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 			tracerProvider
 		});
 	} catch (e) {
+		const failure = classifyKeyJsonLdError(e);
+		if (failure === "fetch") throw contextFetchError(e);
+		if (failure != null) {
+			logger.debug("Failed to decode key {keyId}: {error}", {
+				keyId,
+				failure,
+				error: e
+			});
+			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
+			return {
+				key: null,
+				cached: false
+			};
+		}
 		if (!(e instanceof TypeError)) throw e;
 		try {
 			object = await cls.fromJsonLd(document, {
@@ -342,8 +425,14 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 				tracerProvider
 			});
 		} catch (e) {
-			if (e instanceof TypeError) {
-				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+			const failure = classifyKeyJsonLdError(e);
+			if (failure === "fetch") throw contextFetchError(e);
+			if (failure != null || e instanceof TypeError) {
+				logger.debug("Failed to decode key {keyId}: {error}", {
+					keyId,
+					failure: failure ?? "invalid",
+					error: e
+				});
 				await keyCache?.set(cacheKey, null);
 				await clearFetchErrorMetadata(cacheKey, keyCache);
 				return {
@@ -435,16 +524,17 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
 	if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
 	else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
-		if (await verifyKeyOwnership(key, {
+		if (await verifyKeyOwnershipInternal(key, {
 			documentLoader,
 			contextLoader,
 			tracerProvider
-		}) == null) {
+		}, true) == null) {
 			logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
 				keyId,
 				claimedOwnerId: claimedOwnerId.href
 			});
 			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
 			return {
 				key: null,
 				cached: false
@@ -495,9 +585,17 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 			outcome = classified;
 			return errored;
 		}
-		const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
-		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
-		return resolved;
+		try {
+			const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
+			outcome = { result: resolved.key != null ? "fetched" : "invalid" };
+			return resolved;
+		} catch (error) {
+			if (!(error instanceof KeyContextFetchError)) throw error;
+			const classified = classifyFetchError(error.error);
+			const errored = await onFetchError(error.error, cacheKey, keyId, keyCache, logger);
+			outcome = classified;
+			return errored;
+		}
 	} finally {
 		recordKeyLookup(options.meterProvider, {
 			durationMs: getDurationMs(start),

package/dist/{kv-cache-Dz7_SbVI.js → kv-cache-BmqdF048.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { T as recordDocumentCache, f as validateCryptoKey, t as doubleKnock } from "./http-LMsqGo8j.js";
+import { T as recordDocumentCache, f as validateCryptoKey, t as doubleKnock } from "./http-GHVGCeb5.js";
 import { getLogger } from "@logtape/logtape";
 import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";
@@ -57,6 +57,8 @@ function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedi
 		});
 	}
 	async function validateUrl(url) {
+		const protocol = new URL(url).protocol;
+		if (protocol !== "http:" && protocol !== "https:") throw new UrlError(`Unsupported protocol: ${protocol}`);
 		if (!allowPrivateAddress) try {
 			await validatePublicUrl(url);
 		} catch (error) {

package/dist/{kv-cache-CQuscHxa.mjs → kv-cache-Clx3SwMp.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-Z0UkrR_1.mjs";
+import { p as recordDocumentCache } from "./metrics-62qolVUY.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-ClCz-B0L.cjs → kv-cache-poF6Tqnz.cjs}

@@ -1,7 +1,7 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 require("./chunk-DDcVe30Y.cjs");
-const require_http = require("./http-DdaLQHim.cjs");
+const require_http = require("./http-DwPnG87d.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");
@@ -58,6 +58,8 @@ function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedi
 		});
 	}
 	async function validateUrl(url) {
+		const protocol = new URL(url).protocol;
+		if (protocol !== "http:" && protocol !== "https:") throw new _fedify_vocab_runtime.UrlError(`Unsupported protocol: ${protocol}`);
 		if (!allowPrivateAddress) try {
 			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
 		} catch (error) {

package/dist/{ld-BRqKkOSf.mjs → ld-D6UlzNnG.mjs}

@@ -1,9 +1,9 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DSS6EkPl.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-Z0UkrR_1.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-vnmAGZ3_.mjs";
+import { n as version, t as name } from "./deno-XpcjbHwj.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-62qolVUY.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-PdEu1lDF.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-Z0UkrR_1.mjs → metrics-62qolVUY.mjs}

@@ -1,7 +1,7 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DSS6EkPl.mjs";
+import { n as version, t as name } from "./deno-XpcjbHwj.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-C_kPmXE6.mjs → middleware-C3Q3CoR8.mjs}

@@ -1,5 +1,5 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-RTcKhytV.mjs";
+import { n as FederationImpl } from "./middleware-CfbFdEO-.mjs";
 export { FederationImpl };