@fedify/fedify 2.4.0-dev.1962 → 2.4.0-dev.1988

package/dist/{federation-CIeDMHxZ.cjs → federation-DzPUG_AP.cjs}

@@ -1,17 +1,17 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-C3kkrvAE.cjs");
-const require_proof = require("./proof-CYdLcTFg.cjs");
-const require_types = require("./types-RXm5YxpC.cjs");
-const require_kv_cache = require("./kv-cache-DCItgZUM.cjs");
+const require_http = require("./http-Z3anvCd-.cjs");
+const require_types = require("./types-Be2zbyeG.cjs");
+const require_proof = require("./proof-DHu5zI0Z.cjs");
+const require_kv_cache = require("./kv-cache-BM2-w-Wq.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
 let byte_encodings_hex = require("byte-encodings/hex");
-let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let es_toolkit = require("es-toolkit");
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 let _fedify_vocab_runtime_jsonld = require("@fedify/vocab-runtime/jsonld");
 _fedify_vocab_runtime_jsonld = require_rolldown_runtime.__toESM(_fedify_vocab_runtime_jsonld, 1);
@@ -1458,6 +1458,7 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 //#endregion
 //#region src/federation/keycache.ts
 const Temporal$8 = require_http.Temporal;
+const KEY_CACHE_GENERATION = "2";
 var KvKeyCache = class {
 	kv;
 	prefix;
@@ -1480,13 +1481,20 @@ var KvKeyCache = class {
 			keyId.href
 		];
 	}
+	#entryKey(keyId) {
+		return [
+			...this.prefix,
+			KEY_CACHE_GENERATION,
+			keyId.href
+		];
+	}
 	async get(keyId) {
 		const negativeExpiration = this.nullKeys.get(keyId.href);
 		if (negativeExpiration != null) {
 			if (Temporal$8.Now.instant().until(negativeExpiration).sign >= 0) return null;
 			this.nullKeys.delete(keyId.href);
 		}
-		const serialized = await this.kv.get([...this.prefix, keyId.href]);
+		const serialized = await this.kv.get(this.#entryKey(keyId));
 		if (serialized === void 0) return void 0;
 		if (serialized === null) {
 			this.nullKeys.set(keyId.href, Temporal$8.Now.instant().add(this.unavailableKeyTtl));
@@ -1498,7 +1506,7 @@ var KvKeyCache = class {
 			try {
 				return await _fedify_vocab.Multikey.fromJsonLd(serialized, this.options);
 			} catch {
-				await this.kv.delete([...this.prefix, keyId.href]);
+				await this.kv.delete(this.#entryKey(keyId));
 				return;
 			}
 		}
@@ -1506,12 +1514,12 @@ var KvKeyCache = class {
 	async set(keyId, key) {
 		if (key == null) {
 			this.nullKeys.set(keyId.href, Temporal$8.Now.instant().add(this.unavailableKeyTtl));
-			await this.kv.set([...this.prefix, keyId.href], null, { ttl: this.unavailableKeyTtl });
+			await this.kv.set(this.#entryKey(keyId), null, { ttl: this.unavailableKeyTtl });
 			return;
 		}
 		this.nullKeys.delete(keyId.href);
 		const serialized = await key.toJsonLd(this.options);
-		await this.kv.set([...this.prefix, keyId.href], serialized, { ttl: this.keyTtl });
+		await this.kv.set(this.#entryKey(keyId), serialized, { ttl: this.keyTtl });
 	}
 	async getFetchError(keyId) {
 		const cached = await this.kv.get(this.#getFetchErrorKey(keyId));
@@ -2516,8 +2524,16 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	let json;
 	try {
-		json = await request.clone().json();
+		json = JSON.parse(await require_types.readBoundedText(request.clone(), require_types.MAX_BODY_SIZE, request.url));
 	} catch (error) {
+		if (error instanceof require_types.BodyTooLargeError) {
+			request.body?.cancel(error).catch(() => {});
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			return new Response("Inbox body too large.", { status: 413 });
+		}
 		logger.error("Failed to parse JSON:\n{error}", {
 			recipient,
 			error
@@ -3737,7 +3753,7 @@ async function readLimitedResponseBody(response, maxBytes) {
 	if (truncated) result += "… (truncated)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, headers, specDeterminer, meterProvider, tracerProvider }, span) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
@@ -3746,12 +3762,25 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 	const federationMetrics = require_http.getFederationMetrics(meterProvider);
 	const started = performance.now();
 	let deliverySuccess = false;
+	async function validateUrl(url) {
+		if (!allowPrivateAddress) try {
+			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
+		} catch (error) {
+			if (error instanceof _fedify_vocab_runtime.UrlError) logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	await validateUrl(inbox.href);
 	headers = new Headers(headers);
 	headers.set("Content-Type", "application/activity+json");
 	const request = new Request(inbox, {
 		method: "POST",
 		headers,
-		body: JSON.stringify(activity)
+		body: JSON.stringify(activity),
+		redirect: "manual"
 	});
 	let rsaKey = null;
 	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
@@ -3767,19 +3796,20 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 	});
 	let response;
 	try {
-		response = rsaKey == null ? await fetch(request) : await require_http.doubleKnock(request, rsaKey, {
+		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await require_http.doubleKnock(request, rsaKey, {
 			tracerProvider,
-			specDeterminer
+			specDeterminer,
+			validateRedirect: validateUrl
 		});
 	} catch (error) {
-		const transportError = error instanceof _fedify_vocab_runtime.FetchError ? error : createFetchError(inbox.href, error);
+		const failure = error instanceof _fedify_vocab_runtime.FetchError || error instanceof _fedify_vocab_runtime.UrlError ? error : createFetchError(inbox.href, error);
 		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
 			activityId,
 			inbox: inbox.href,
-			error: transportError
+			error: failure
 		});
 		federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), false, activityType);
-		throw transportError;
+		throw failure;
 	}
 	try {
 		if (!response.ok) {
@@ -3816,6 +3846,49 @@ function createFetchError(url, cause) {
 	error.cause = cause;
 	return error;
 }
+async function fetchWithValidatedRedirects(request, validateUrl) {
+	let body = await request.clone().text();
+	for (let redirects = 0;; redirects++) {
+		const response = await fetch(request, { redirect: "manual" });
+		const location = response.headers.get("Location");
+		if (![
+			301,
+			302,
+			303,
+			307,
+			308
+		].includes(response.status) || location == null) return response;
+		await response.body?.cancel();
+		if (redirects >= 20) throw new TypeError("Too many redirects");
+		const url = new URL(location, request.url);
+		await validateUrl(url.href);
+		const headers = new Headers(request.headers);
+		if (url.origin !== new URL(request.url).origin) {
+			headers.delete("Authorization");
+			headers.delete("Proxy-Authorization");
+			headers.delete("Cookie");
+			headers.delete("Host");
+		}
+		let method = request.method;
+		if ((response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD") {
+			method = "GET";
+			body = void 0;
+			for (const name of [
+				"Content-Encoding",
+				"Content-Language",
+				"Content-Length",
+				"Content-Location",
+				"Content-Type"
+			]) headers.delete(name);
+		}
+		request = new Request(url, {
+			method,
+			headers,
+			body,
+			redirect: "manual"
+		});
+	}
+}
 /**
 * An error that is thrown when an activity fails to send to a remote inbox.
 * It contains structured information about the failure, including the HTTP
@@ -5309,6 +5382,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				if (decision.stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, decision.stateChange);
 			}
 			await sendActivity({
+				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: message.activity,
 				activityId: message.activityId,
@@ -5930,6 +6004,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			const promises = [];
 			for (const inbox in inboxes) promises.push(sendActivity({
+				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: jsonLd,
 				activityId: activity.id?.href,
@@ -7264,6 +7339,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 		else logger.debug("Forwarding activity immediately without queue since queue is not set.");
 		const promises = [];
 		for (const inbox in inboxes) promises.push(sendActivity({
+			allowPrivateAddress: ctx.federation.allowPrivateAddress,
 			keys,
 			activity: ctx.activity,
 			activityId: ctx.activityId,

package/dist/{http-6TI0tI03.d.cts → http-65PYi9jY.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
-import { CryptographicKey, Multikey } from "@fedify/vocab";
-import { DocumentLoader } from "@fedify/vocab-runtime";
+import { Actor, CryptographicKey, Multikey } from "@fedify/vocab";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
+import { DocumentLoader } from "@fedify/vocab-runtime";
 
 //#region src/sig/key.d.ts
 /**
@@ -59,6 +59,38 @@ interface FetchKeyOptions {
   * @since 2.3.0
   */
   meterProvider?: MeterProvider;
+  /**
+  * An assertion by the caller that it has already bound this key's id to
+  * whoever the key will be treated as speaking for, by means of its own that
+  * key resolution cannot see.
+  *
+  * Key resolution normally settles ownership itself: it dereferences the
+  * `owner`/`controller` a key claims and requires that actor's own document
+  * to link back to the key, because the claim and the key document come from
+  * the same host and so the claim proves nothing on its own.  See
+  * GHSA-q9f8-5hc7-898f.
+  *
+  * That check presumes the ActivityPub shape of ownership, where the owner
+  * is an actor carrying a `publicKey`/`assertionMethod` list.  It does not
+  * fit every caller.  Portable objects (FEP-ef61) bind a key to an object
+  * structurally instead: {@link verifyPortableObjectProof} requires the
+  * verification method's FEP-ef34 origin to equal the object id's own
+  * authority, so the signer is pinned by the identifier being verified,
+  * before any key is fetched.  Demanding the ActivityPub check as well would
+  * be impossible rather than merely redundant, since a DID dereferences to
+  * a DID document, which is not an actor.
+  *
+  * This is not a way to accept whatever a key says about itself.  The claim
+  * still has to be corroborated, just from the key id rather than from
+  * a second document: a key may name an owner only when the key id is that
+  * owner's own (a `did:…#fragment` belongs to the DID it is a fragment of,
+  * exactly as a key embedded in an actor document belongs to that actor).
+  * A key naming anyone else falls back to the ordinary check and is rejected
+  * if it cannot pass it, so a key admitted here is as sound as any other and
+  * is cached like any other.
+  * @internal
+  */
+  keyIdBoundByCaller?: boolean;
 }
 /**
 * The result of {@link fetchKey}.

package/dist/{http-CdrSn2ip.d.ts → http-CP-7OdSq.d.cts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
-import { CryptographicKey, Multikey } from "@fedify/vocab";
-import { MeterProvider, TracerProvider } from "@opentelemetry/api";
+import { Actor, CryptographicKey, Multikey } from "@fedify/vocab";
 import { DocumentLoader } from "@fedify/vocab-runtime";
+import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 
 //#region src/sig/key.d.ts
 /**
@@ -59,6 +59,38 @@ interface FetchKeyOptions {
   * @since 2.3.0
   */
   meterProvider?: MeterProvider;
+  /**
+  * An assertion by the caller that it has already bound this key's id to
+  * whoever the key will be treated as speaking for, by means of its own that
+  * key resolution cannot see.
+  *
+  * Key resolution normally settles ownership itself: it dereferences the
+  * `owner`/`controller` a key claims and requires that actor's own document
+  * to link back to the key, because the claim and the key document come from
+  * the same host and so the claim proves nothing on its own.  See
+  * GHSA-q9f8-5hc7-898f.
+  *
+  * That check presumes the ActivityPub shape of ownership, where the owner
+  * is an actor carrying a `publicKey`/`assertionMethod` list.  It does not
+  * fit every caller.  Portable objects (FEP-ef61) bind a key to an object
+  * structurally instead: {@link verifyPortableObjectProof} requires the
+  * verification method's FEP-ef34 origin to equal the object id's own
+  * authority, so the signer is pinned by the identifier being verified,
+  * before any key is fetched.  Demanding the ActivityPub check as well would
+  * be impossible rather than merely redundant, since a DID dereferences to
+  * a DID document, which is not an actor.
+  *
+  * This is not a way to accept whatever a key says about itself.  The claim
+  * still has to be corroborated, just from the key id rather than from
+  * a second document: a key may name an owner only when the key id is that
+  * owner's own (a `did:…#fragment` belongs to the DID it is a fragment of,
+  * exactly as a key embedded in an actor document belongs to that actor).
+  * A key naming anyone else falls back to the ordinary check and is rejected
+  * if it cannot pass it, so a key admitted here is as sound as any other and
+  * is cached like any other.
+  * @internal
+  */
+  keyIdBoundByCaller?: boolean;
 }
 /**
 * The result of {@link fetchKey}.

package/dist/{http-DWZZicb2.js → http-CgwqtxAy.js}

@@ -4,13 +4,13 @@ import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, metrics, trace } from "@opentelemetry/api";
 import { encodeHex } from "byte-encodings/hex";
-import { Item, decodeDict, encodeDict, encodeItem } from "structured-field-values";
 import { FetchError, getDocumentLoader, parseDidKeyVerificationMethod } from "@fedify/vocab-runtime";
+import { Item, decodeDict, encodeDict, encodeItem } from "structured-field-values";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.1962+8aaa5348";
+var version = "2.4.0-dev.1988+c5c9d617";
 //#endregion
 //#region src/sig/accept.ts
 /**
@@ -1040,6 +1040,118 @@ async function importJwk(jwk, type) {
 	validateCryptoKey(key, type);
 	return key;
 }
+/**
+* Fetches the document that the given actor URI dereferences to, and returns
+* the actor only if the host that served the document is authoritative for
+* the id the document claims.
+*
+* Only the origin that serves an actor id can speak for it.  Without that
+* rule any host could serve a document describing somebody else's actor—and
+* listing its own keys as that actor's.
+*
+* @param actorId The URI of the actor to fetch.
+* @param options Options for fetching the document.
+* @returns The actor, or `null` if the document cannot be fetched, is not an
+*          actor, or belongs to another origin.
+* @internal
+*/
+async function fetchActorDocument(actorId, options = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	const { tracerProvider } = options;
+	let document;
+	let documentUrl = actorId;
+	try {
+		const remoteDocument = await documentLoader(actorId.href);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", actorId);
+	} catch (error) {
+		logger.debug("Failed to fetch the actor {actorId}: {error}", {
+			actorId: actorId.href,
+			error
+		});
+		return null;
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider,
+			baseUrl: documentUrl
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+			documentUrl: documentUrl.href,
+			error
+		});
+		return null;
+	}
+	if (!isActor(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
+	return object;
+}
+/**
+* Resolves the owner that the given key claims, and returns it only if the
+* claim holds.
+*
+* The `owner` of a {@link CryptographicKey}, like the `controller` of
+* a {@link Multikey}, proves nothing on its own: the key document and the
+* claim inside it are served by the same host, so anyone able to serve a key
+* document can name any actor in the world as its owner.  The claim becomes
+* meaningful only once the named actor's own document is fetched and turns
+* out to link back to the key.  This function performs that mutual-link
+* check, which is the only sound way to learn a fetched key's owner.
+*
+* The claimed owner is always dereferenced, never read out of the key
+* document: an owner embedded there is written by whoever wrote the key.
+*
+* @param key The key whose ownership claim is to be verified.  It must carry
+*            an `id`, as that is what the owner has to link back to.
+* @param options Options for fetching the claimed owner.
+* @returns The verified owner, or `null` if the key claims no owner, the
+*          owner cannot be fetched, or the owner does not link back to
+*          the key.
+* @internal
+*/
+async function verifyKeyOwnership(key, options = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const keyId = key.id;
+	if (keyId == null) return null;
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (claimedOwnerId == null) return null;
+	const owner = await fetchActorDocument(claimedOwnerId, options);
+	if (owner == null) {
+		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
+			keyId: keyId.href,
+			claimedOwnerId: claimedOwnerId.href
+		});
+		return null;
+	}
+	const linkedKeyIds = key instanceof CryptographicKey ? owner.publicKeyIds : owner.assertionMethodIds;
+	for (const linkedKeyId of linkedKeyIds) if (linkedKeyId.href === keyId.href) return owner;
+	logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims does not list the key as its own.", {
+		keyId: keyId.href,
+		claimedOwnerId: claimedOwnerId.href
+	});
+	return null;
+}
 async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
 	tracerProvider ??= trace.getTracerProvider();
 	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
@@ -1173,6 +1285,18 @@ function checkCachedKeyHit(cachedKey, keyId, cls, logger) {
 async function clearFetchErrorMetadata(keyId, keyCache) {
 	await keyCache?.setFetchError?.(keyId, null);
 }
+/**
+* Returns the identifier a fragment-bearing DID URL is a fragment of, or
+* `null` if the URL is not a DID URL.  `did:web:example.com#key` is thereby
+* traced back to `did:web:example.com`, the DID that resolving the key went
+* through in the first place.
+*/
+function stripFragment(keyId) {
+	if (keyId.protocol !== "did:") return null;
+	const did = new URL(keyId.href);
+	did.hash = "";
+	return did;
+}
 function isDidKeyUrl(keyId) {
 	return keyId.protocol === "did:" && keyId.pathname.startsWith("key:");
 }
@@ -1228,7 +1352,7 @@ async function resolveDidKey(cacheKey, cls, keyCache, logger) {
 		cached: false
 	};
 }
-async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
+async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider, keyIdBoundByCaller }, logger) {
 	let object;
 	try {
 		object = await Object$1.fromJsonLd(document, {
@@ -1258,8 +1382,22 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 		}
 	}
 	let key = null;
-	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object;
+	let ownerDocument = null;
+	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
 	else if (isActor(object)) {
+		if (object.id == null || object.id.origin !== documentUrl.origin) {
+			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
+				keyId,
+				documentUrl: documentUrl.href,
+				actorId: object.id?.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		ownerDocument = object;
 		const keys = cls === CryptographicKey ? object.getPublicKeys({
 			documentLoader,
 			contextLoader,
@@ -1321,6 +1459,27 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 			cached: false
 		};
 	}
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (!(keyIdBoundByCaller && claimedOwnerId != null && claimedOwnerId.href === stripFragment(cacheKey)?.href)) {
+		if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
+		else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
+			if (await verifyKeyOwnership(key, {
+				documentLoader,
+				contextLoader,
+				tracerProvider
+			}) == null) {
+				logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
+					keyId,
+					claimedOwnerId: claimedOwnerId.href
+				});
+				await keyCache?.set(cacheKey, null);
+				return {
+					key: null,
+					cached: false
+				};
+			}
+		}
+	}
 	if (keyCache != null) {
 		await keyCache.set(cacheKey, key);
 		logger.debug("Key {keyId} cached.", { keyId });
@@ -1359,15 +1518,18 @@ async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, o
 		}
 		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 		let document;
+		let documentUrl = cacheKey;
 		try {
-			document = (await (options.documentLoader ?? getDocumentLoader())(keyId)).document;
+			const remoteDocument = await (options.documentLoader ?? getDocumentLoader())(keyId);
+			document = remoteDocument.document;
+			documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
 		} catch (error) {
 			const classified = classifyFetchError(error);
 			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
 			outcome = classified;
 			return errored;
 		}
-		const resolved = await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
+		const resolved = await resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, options, logger);
 		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
 		return resolved;
 	} finally {
@@ -2482,4 +2644,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { formatAcceptSignature as A, recordDocumentCache as C, recordOutboxEnqueue as D, recordOutboxActivity as E, version as F, parseAcceptSignature as M, validateAcceptSignature as N, recordWebFingerHandle as O, name as P, recordCollectionTotalItems as S, recordInboxActivity as T, measureSignatureKeyFetch as _, verifyRequestDetailed as a, recordCollectionPageItems as b, fetchKeyDetailed as c, validateCryptoKey as d, getDurationMs as f, isAbortError$1 as g, instrumentDocumentLoader as h, verifyRequest as i, fulfillAcceptSignature as j, registerQueueDepthGauge as k, generateCryptoKeyPair as l, getRemoteHost as m, parseRfc9421SignatureInput as n, exportJwk as o, getFederationMetrics as p, signRequest as r, fetchKey as s, doubleKnock as t, importJwk as u, recordCircuitBreakerStateChange as v, recordFanoutRecipients as w, recordCollectionRequest as x, recordCollectionDispatchDuration as y };
+export { recordWebFingerHandle as A, recordCollectionRequest as C, recordInboxActivity as D, recordFanoutRecipients as E, validateAcceptSignature as F, name as I, version as L, formatAcceptSignature as M, fulfillAcceptSignature as N, recordOutboxActivity as O, parseAcceptSignature as P, recordCollectionPageItems as S, recordDocumentCache as T, instrumentDocumentLoader as _, verifyRequestDetailed as a, recordCircuitBreakerStateChange as b, fetchKey as c, importJwk as d, validateCryptoKey as f, getRemoteHost as g, getFederationMetrics as h, verifyRequest as i, registerQueueDepthGauge as j, recordOutboxEnqueue as k, fetchKeyDetailed as l, getDurationMs as m, parseRfc9421SignatureInput as n, exportJwk as o, verifyKeyOwnership as p, signRequest as r, fetchActorDocument as s, doubleKnock as t, generateCryptoKeyPair as u, isAbortError$1 as v, recordCollectionTotalItems as w, recordCollectionDispatchDuration as x, measureSignatureKeyFetch as y };

package/dist/{http-BR190IDB.mjs → http-CtidZS_t.mjs}

@@ -1,10 +1,10 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CfLMX4HF.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-Dkyzq7ml.mjs";
+import { n as version, t as name } from "./deno-BgMEefEr.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CrqsHP0l.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
-import { o as validateCryptoKey, r as fetchKeyDetailed } from "./key-BcA-AzPp.mjs";
+import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-Cwbg5ggV.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";