@fedify/fedify 2.4.0-dev.2159 → 2.4.0-dev.2169

package/dist/{http-wdsia0-O.cjs → http-5CJBdU8n.cjs}

@@ -16,7 +16,7 @@ json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2159+bb072eda";
+var version = "2.4.0-dev.2169+0a45df07";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -3760,7 +3760,7 @@ const Now = /*@__PURE__*/ Object.defineProperties({}, {
 		}
 	})
 });
-const Temporal$3 = /*@__PURE__*/ Object.defineProperties({}, {
+const Temporal$5 = /*@__PURE__*/ Object.defineProperties({}, {
 	...createStringTagDescriptors("Temporal"),
 	...createPropDescriptors({
 		PlainYearMonth,
@@ -3776,7 +3776,7 @@ const Temporal$3 = /*@__PURE__*/ Object.defineProperties({}, {
 });
 //#endregion
 //#region ../../node_modules/.pnpm/temporal-polyfill@1.0.1/node_modules/temporal-polyfill/index.js
-const Temporal$2 = NativeTemporal || Temporal$3;
+const Temporal$4 = NativeTemporal || Temporal$5;
 NativeTemporal && Date.prototype.toTemporalInstant;
 //#endregion
 //#region src/sig/accept.ts
@@ -4747,7 +4747,111 @@ function getDurationMs(start) {
 	return Math.max(0, performance.now() - start);
 }
 //#endregion
+//#region src/sig/key-owner-evidence.ts
+const Temporal$3 = Temporal$4;
+/**
+* How long a key of an [FEP-ef61] portable actor is trusted after its actor's
+* signed document vouched for it, however long the proof of the document is
+* valid.  The actor can drop the key or the gateway from its document at any
+* time, so the key is looked up again at least this often.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+const MAX_PORTABLE_KEY_TTL = Temporal$3.Duration.from({ hours: 1 });
+const candidates = /* @__PURE__ */ new WeakMap();
+const verified = /* @__PURE__ */ new WeakMap();
+/**
+* Attaches to a key that was just resolved the evidence of the portable actor
+* that owns it.  The evidence is not used until the key verifies
+* a signature; see {@link promoteKeyOwnerEvidence}.
+*
+* Nothing is attached unless the document, the key's owner, and the actor
+* the key ID belongs to agree on the actor's canonical portable ID.
+* @param key The key, whose owner the document vouched for.
+* @param document The expanded root node of the actor's verified document.
+* @param expires When the evidence must not be used anymore.
+* @returns Whether the evidence was attached.
+* @internal
+*/
+function attachKeyOwnerEvidence(key, document, expires) {
+	if (!(key instanceof _fedify_vocab.CryptographicKey) || key.id == null || key.ownerId == null || key.publicKey == null || document == null || typeof document !== "object" || Array.isArray(document)) return false;
+	const rawId = document["@id"];
+	if (typeof rawId !== "string") return false;
+	const keyBase = new URL(key.id.href);
+	keyBase.hash = "";
+	const ownerId = getCanonicalPortableId(key.ownerId);
+	if (ownerId == null || getRawCanonicalPortableId(rawId) !== ownerId || getCanonicalPortableId(keyBase) !== ownerId) return false;
+	candidates.set(key, {
+		keyId: key.id.href,
+		keyOwner: key.ownerId.href,
+		publicKey: key.publicKey,
+		ownerId,
+		document: structuredClone(document),
+		expires
+	});
+	return true;
+}
+/**
+* Makes the evidence attached to a key usable, as the key has just verified
+* an HTTP Signature.  Nothing happens if the key has no evidence.
+* @param key The key that verified a signature.
+* @internal
+*/
+function promoteKeyOwnerEvidence(key) {
+	const evidence = candidates.get(key);
+	if (evidence == null) return;
+	candidates.delete(key);
+	verified.set(key, evidence);
+}
+/**
+* Gets the evidence of the portable actor that owns a key HTTP Signature
+* verification returned.
+* @param key The key.
+* @param now The current time.
+* @returns The evidence, or `undefined` if the key was not returned by HTTP
+*          Signature verification, if it has no evidence, if the evidence
+*          expired, or if the key has been changed since.
+* @internal
+*/
+function getVerifiedKeyOwnerEvidence(key, now = Temporal$3.Now.instant()) {
+	const evidence = verified.get(key);
+	if (evidence == null) return void 0;
+	if (Temporal$3.Instant.compare(now, evidence.expires) >= 0) {
+		verified.delete(key);
+		return;
+	}
+	if (key.id?.href !== evidence.keyId || key.ownerId?.href !== evidence.keyOwner || key.publicKey !== evidence.publicKey) return;
+	return evidence;
+}
+/**
+* Parses the actor from the evidence, i.e., from the expansion of its
+* document whose proof was verified.  Every call returns a new object.
+* @param evidence The evidence.
+* @param options Options for parsing the document.
+* @returns The actor, or `null` if the document is not the actor that
+*          the evidence is about, or the evidence expired meanwhile.
+* @internal
+*/
+async function parseKeyOwnerEvidence(evidence, options = {}) {
+	const refuse = (url) => Promise.reject(/* @__PURE__ */ new Error(`Refusing to fetch ${url}.`));
+	let actor;
+	try {
+		actor = await _fedify_vocab.Object.fromJsonLd(structuredClone(evidence.document), {
+			documentLoader: refuse,
+			contextLoader: options.contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return null;
+	}
+	if (!isPortableActorDocument(actor) || getCanonicalPortableId(actor.id) !== evidence.ownerId || Temporal$3.Instant.compare(Temporal$3.Now.instant(), evidence.expires) >= 0) return null;
+	return actor;
+}
+//#endregion
 //#region src/sig/key.ts
+const Temporal$2 = Temporal$4;
 /**
 * Checks if the given key is valid and supported.  No-op if the key is valid,
 * otherwise throws an error.
@@ -4969,6 +5073,7 @@ function bypassKeyCacheReads(keyCache) {
 		const scoped = cache.compatibleKeyScope(scope);
 		return {
 			get: () => Promise.resolve(void 0),
+			getEntry: () => Promise.resolve(void 0),
 			set: async (keyId, key, options) => await scoped.set(keyId, key, options),
 			delete: async (keyId) => await scoped.delete(keyId)
 		};
@@ -5136,6 +5241,49 @@ function checkCachedKeyHit(cachedKey, keyId, cls, logger) {
 	}
 	return null;
 }
+/**
+* Looks up a key at a compatible identifier, or at an `ap:` or `ap+ef61:`
+* URI, in the cache namespace of a purpose, like {@link getCachedFetchKey}.
+* A key that the verified document of its portable actor was cached with
+* gets the actor's evidence attached from the same entry; see
+* {@link attachKeyOwnerEvidence}.
+*/
+async function getCachedCompatibleKey(cacheKey, keyId, cls, scopedCache, logger) {
+	if (scopedCache?.getEntry == null) return await getCachedFetchKey(cacheKey, keyId, cls, scopedCache, logger);
+	const entry = await scopedCache.getEntry(cacheKey);
+	if (entry === void 0) return null;
+	if (entry === null) {
+		logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
+		return {
+			key: null,
+			cached: true
+		};
+	}
+	const hit = checkCachedKeyHit(entry.key, keyId, cls, logger);
+	if (hit?.key instanceof _fedify_vocab.CryptographicKey && entry.owner != null) attachKeyOwnerEvidence(hit.key, entry.owner, entry.expires);
+	return hit;
+}
+/**
+* Attaches the evidence of the portable actor whose document has just
+* vouched for a key to the key.  The evidence expires with the cache entry
+* of the key, so that it is never trusted longer than the key is cached.
+* Without a cache, it expires with the proof of the document, but no later
+* than {@link MAX_PORTABLE_KEY_TTL}, as a cache entry would.
+* @param resolution The resolution of the key.
+* @param scopedCache The cache namespace the key was stored in, if any.
+* @param cached When the cache entry expires, if the cache stored one.
+*/
+function attachResolvedKeyOwnerEvidence(resolution, scopedCache, cached) {
+	let expires;
+	if (scopedCache != null) {
+		if (cached == null) return;
+		expires = cached;
+	} else {
+		expires = Temporal$2.Now.instant().add(MAX_PORTABLE_KEY_TTL);
+		if (resolution.expires != null && Temporal$2.Instant.compare(resolution.expires, expires) < 0) expires = resolution.expires;
+	}
+	attachKeyOwnerEvidence(resolution.key, resolution.document, expires);
+}
 async function clearFetchErrorMetadata(keyId, keyCache) {
 	await keyCache?.setFetchError?.(keyId, null);
 }
@@ -5260,7 +5408,10 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 				cached: false
 			};
 		}
-		await scopedCache?.set(cacheKey, resolution.key, { expires: resolution.expires });
+		attachResolvedKeyOwnerEvidence(resolution, scopedCache, await scopedCache?.set(cacheKey, resolution.key, {
+			expires: resolution.expires,
+			owner: resolution.document
+		}));
 		return {
 			key: resolution.key,
 			cached: false
@@ -5481,7 +5632,7 @@ async function fetchCompatibleKey(cacheKey, cls, options, onCachedUnavailable, o
 	const keyId = cacheKey.href;
 	const sharedCache = options.keyCache;
 	const scopedCache = sharedCache?.compatibleKeyScope?.(getCompatibleKeyScope(cls, options));
-	const cached = await getCachedFetchKey(cacheKey, keyId, cls, scopedCache, logger);
+	const cached = await getCachedCompatibleKey(cacheKey, keyId, cls, scopedCache, logger);
 	if (cached != null) return {
 		result: cached,
 		outcome: { result: "hit" }
@@ -5545,7 +5696,7 @@ async function fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable
 	}
 	const sharedCache = options.keyCache;
 	const scopedCache = sharedCache?.compatibleKeyScope?.("httpSignature");
-	const cached = await getCachedFetchKey(cacheKey, keyId, cls, scopedCache, logger);
+	const cached = await getCachedCompatibleKey(cacheKey, keyId, cls, scopedCache, logger);
 	if (cached != null) return {
 		result: cached,
 		outcome: { result: "hit" }
@@ -5560,7 +5711,10 @@ async function fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable
 	logger.debug("Resolving key {keyId} to verify signature...", { keyId });
 	const resolution = await resolvers.actorKey(cacheKey);
 	if (resolution.type === "verified") {
-		await scopedCache?.set(cacheKey, resolution.key, { expires: resolution.expires });
+		attachResolvedKeyOwnerEvidence(resolution, scopedCache, await scopedCache?.set(cacheKey, resolution.key, {
+			expires: resolution.expires,
+			owner: resolution.document
+		}));
 		return {
 			result: {
 				key: resolution.key,
@@ -6615,7 +6769,7 @@ async function normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, options =
 }
 //#endregion
 //#region src/sig/proof.ts
-const Temporal$1 = Temporal$2;
+const Temporal$1 = Temporal$4;
 /**
 * Known Object Integrity Proof `cryptosuite` values, used to keep
 * `object_integrity_proofs.cryptosuite` on a bounded set of spec-defined
@@ -7901,6 +8055,7 @@ async function verifyPortableKeyDocument(document, actor, keyId, isGatewayKey, o
 		type: "verified",
 		actor,
 		key,
+		document: root,
 		...expires == null ? {} : { expires }
 	};
 }
@@ -7947,6 +8102,21 @@ async function fetchPortableGatewayKey(keyId, options = {}) {
 	});
 }
 /**
+* The maximum number of `@gateway` location hints followed for one `ap:` or
+* `ap+ef61:` key ID.  Whoever made a signature chooses the hints of its key
+* ID, so fewer of them are followed than when dereferencing objects, which
+* bounds the gateways one signature can make Fedify ask.  Further hints are
+* ignored.
+*/
+const MAX_KEY_ID_GATEWAY_HINTS = 3;
+/**
+* The default of {@link PortableActorKeyOptions.lookupTimeout}, in
+* milliseconds.
+*/
+const DEFAULT_KEY_ID_LOOKUP_TIMEOUT = 1e4;
+/** The longest delay that `setTimeout()` supports, in milliseconds. */
+const MAX_TIMEOUT = 2 ** 31 - 1;
+/**
 * Resolves a key of a portable actor at an `ap:` or `ap+ef61:` key ID, e.g.,
 * `ap://did:key:z6Mk…/actor#main-key`.  Such a key ID names no gateway, so
 * the actor's document, i.e., the key ID without its fragment, is fetched
@@ -7974,12 +8144,25 @@ async function fetchPortableGatewayKey(keyId, options = {}) {
 * unreachable gateway would have served, so the result is an `unavailable`
 * that is not cacheable.
 *
+* Only the first {@link MAX_KEY_ID_GATEWAY_HINTS} location hints are
+* followed, and all the gateways share one timeout, see
+* {@link PortableActorKeyOptions.lookupTimeout}.  A gateway that does not
+* serve the document in time failed to serve it, like an unreachable one,
+* with an error that has no HTTP status.  A gateway whose document could not
+* be processed in time, and the gateways left untried, make the result an
+* `unavailable` that is not cacheable.  A result that arrives after
+* the timeout is ignored, even if it vouches for the key.
+*
 * @param keyId The key ID, which must be an `ap:` or `ap+ef61:` URI.
-* @param options Loaders and telemetry providers.
+* @param options Loaders, telemetry providers, and the timeout.
 * @returns The resolution, which is never `legacy`.
+* @throws {RangeError} If the timeout is not a non-negative number of
+*                      milliseconds that `setTimeout()` supports.
 * @internal
 */
 async function resolvePortableActorKey(keyId, options = {}) {
+	const lookupTimeout = options.lookupTimeout ?? DEFAULT_KEY_ID_LOOKUP_TIMEOUT;
+	if (!Number.isFinite(lookupTimeout) || lookupTimeout < 0 || lookupTimeout > MAX_TIMEOUT) throw new RangeError(`The lookup timeout must be between 0 and ${MAX_TIMEOUT} ms: ${lookupTimeout}`);
 	const documentLoader = options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
 	const contextLoader = options.contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)();
 	let formattedKeyId = keyId.href;
@@ -7998,75 +8181,67 @@ async function resolvePortableActorKey(keyId, options = {}) {
 	if (keyId.hash === "" || keyId.hash === "#") return reject("The key ID has no fragment; only keys embedded in actor documents are supported.");
 	const actorUrl = new URL(keyId.href);
 	actorUrl.hash = "";
+	const gateways = (0, _fedify_vocab_runtime_internal_portable_dereference.getPortableGatewayCandidates)(actorUrl);
+	if (gateways.length > MAX_KEY_ID_GATEWAY_HINTS) logger.debug("Following only the first {max} location hints of key {keyId}.", {
+		keyId: formattedKeyId,
+		max: MAX_KEY_ID_GATEWAY_HINTS
+	});
 	const requestUrls = [];
-	for (const gateway of (0, _fedify_vocab_runtime_internal_portable_dereference.getPortableGatewayCandidates)(actorUrl)) try {
+	for (const gateway of gateways.slice(0, MAX_KEY_ID_GATEWAY_HINTS)) try {
 		requestUrls.push((0, _fedify_vocab_runtime.toCompatibleEf61Id)(actorUrl, gateway).href);
 	} catch (error) {
 		if (!(error instanceof TypeError)) throw error;
 		return reject(`The key ID cannot be fetched from gateways: ${error}`);
 	}
 	if (requestUrls.length < 1) requestUrls.push((0, _fedify_vocab_runtime.formatIri)(actorUrl));
+	const controller = new AbortController();
+	const timeoutError = new DOMException(`Timed out looking up the actor of key ${formattedKeyId} after ${lookupTimeout} ms.`, "TimeoutError");
+	let timer;
+	if (lookupTimeout > 0) timer = setTimeout(() => controller.abort(timeoutError), lookupTimeout);
+	else controller.abort(timeoutError);
+	const { signal } = controller;
+	const attemptOptions = {
+		...options,
+		documentLoader: withDeadline(documentLoader, signal),
+		contextLoader: withDeadline(contextLoader, signal),
+		signal,
+		formattedKeyId
+	};
 	const attempts = [];
-	for (const url of requestUrls) {
-		let remoteDocument;
-		try {
-			remoteDocument = await documentLoader(url);
-		} catch (error) {
-			logger.debug("Failed to fetch the actor of key {keyId} from {url}: {error}", {
-				keyId: formattedKeyId,
-				url,
-				error
-			});
-			attempts.push({
-				type: "retrievalFailed",
-				error
-			});
-			continue;
-		}
-		let resolution;
-		try {
-			const object = await _fedify_vocab.Object.fromJsonLd(remoteDocument.document, {
-				documentLoader,
-				contextLoader,
-				tracerProvider: options.tracerProvider
-			});
-			resolution = isPortableActorDocument(object) ? await verifyPortableKeyDocument(remoteDocument.document, object, keyId, false, {
-				...options,
-				documentLoader,
-				contextLoader
-			}) : {
-				type: "rejected",
-				reason: "The document is not a portable actor."
-			};
-		} catch (error) {
-			if (error instanceof TypeError) resolution = {
-				type: "rejected",
-				reason: `The document is malformed: ${error.message}`
-			};
-			else {
-				logger.debug("Failed to process the actor of key {keyId} served from {url}: {error}", {
+	try {
+		for (const url of requestUrls) {
+			if (signal.aborted) {
+				logger.debug("Ran out of time looking up the actor of key {keyId}; gateways from {url} on were not tried.", {
 					keyId: formattedKeyId,
-					url,
-					error
+					url
 				});
 				attempts.push({
 					type: "indeterminate",
-					error
+					error: signal.reason
+				});
+				break;
+			}
+			const state = { processing: false };
+			let attempt;
+			try {
+				attempt = await raceAbort(attemptGateway(url, keyId, attemptOptions, state), signal);
+			} catch (error) {
+				if (!signal.aborted) throw error;
+				logger.debug("Ran out of time looking up the actor of key {keyId} at {url}.", {
+					keyId: formattedKeyId,
+					url
+				});
+				attempts.push({
+					type: state.processing ? "indeterminate" : "retrievalFailed",
+					error: signal.reason
 				});
 				continue;
 			}
+			if (attempt.type === "verified") return attempt;
+			attempts.push(attempt);
 		}
-		if (resolution.type === "verified") return resolution;
-		const reason = resolution.type === "rejected" ? resolution.reason : "The document is not a portable actor.";
-		logger.debug("The actor document served from {url} does not vouch for key {keyId}: {reason}", {
-			keyId: formattedKeyId,
-			url,
-			reason
-		});
-		attempts.push({
-			type: "rejected",
-			reason
-		});
+	} finally {
+		clearTimeout(timer);
 	}
 	const rejections = attempts.flatMap((a) => a.type === "rejected" ? [a.reason] : []);
 	if (rejections.length === attempts.length) return reject(rejections.join(" "));
@@ -8087,6 +8262,139 @@ async function resolvePortableActorKey(keyId, options = {}) {
 	};
 }
 /**
+* Fetches the actor's document of a key at an `ap:` or `ap+ef61:` key ID from
+* one gateway, and tells whether it vouches for the key.  It never rejects;
+* the caller races it against the lookup's timeout, and ignores what it
+* resolves to after the timeout.
+*/
+async function attemptGateway(url, keyId, options, state) {
+	const { documentLoader, contextLoader, signal, formattedKeyId } = options;
+	let remoteDocument;
+	try {
+		remoteDocument = await documentLoader(url);
+	} catch (error) {
+		logger.debug("Failed to fetch the actor of key {keyId} from {url}: {error}", {
+			keyId: formattedKeyId,
+			url,
+			error
+		});
+		return {
+			type: "retrievalFailed",
+			error
+		};
+	}
+	if (signal.aborted) return {
+		type: "indeterminate",
+		error: signal.reason
+	};
+	state.processing = true;
+	let resolution;
+	try {
+		const object = await _fedify_vocab.Object.fromJsonLd(remoteDocument.document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+		signal.throwIfAborted();
+		resolution = isPortableActorDocument(object) ? await verifyPortableKeyDocument(remoteDocument.document, object, keyId, false, options) : {
+			type: "rejected",
+			reason: "The document is not a portable actor."
+		};
+	} catch (error) {
+		if (error instanceof TypeError && !signal.aborted) resolution = {
+			type: "rejected",
+			reason: `The document is malformed: ${error.message}`
+		};
+		else {
+			logger.debug("Failed to process the actor of key {keyId} served from {url}: {error}", {
+				keyId: formattedKeyId,
+				url,
+				error
+			});
+			return {
+				type: "indeterminate",
+				error
+			};
+		}
+	}
+	if (resolution.type === "verified") return resolution;
+	const reason = resolution.type === "rejected" ? resolution.reason : "The document is not a portable actor.";
+	logger.debug("The actor document served from {url} does not vouch for key {keyId}: {reason}", {
+		keyId: formattedKeyId,
+		url,
+		reason
+	});
+	return {
+		type: "rejected",
+		reason
+	};
+}
+/**
+* Wraps a document loader so that it gives up when the given signal aborts,
+* as well as when the signal in its own options does.  The wrapped loader is
+* passed a signal that aborts in either case, but in case it ignores that
+* signal, what it resolves to after the abort is ignored, and the wrapper
+* rejects with the reason of the abort at once.  After the abort, the wrapped
+* loader is not called at all.
+*/
+function withDeadline(loader, signal) {
+	return (url, options) => {
+		const combined = combineSignals(signal, options?.signal);
+		return raceAbort(combined.signal.aborted ? Promise.reject(combined.signal.reason) : new Promise((resolve) => resolve(loader(url, {
+			...options,
+			signal: combined.signal
+		}))), combined.signal).finally(combined.dispose);
+	};
+}
+/**
+* Makes a signal that aborts when either of the given signals does, with
+* the reason of the one that aborted first.  `AbortSignal.any()` is not
+* available on every supported runtime, e.g., Bun before 1.1.4.
+* @returns The signal, and a function that stops listening to the given
+*          signals.
+*/
+function combineSignals(signal, other) {
+	if (other == null || other === signal) return {
+		signal,
+		dispose() {}
+	};
+	const controller = new AbortController();
+	const sources = [signal, other];
+	const dispose = () => {
+		for (const source of sources) source.removeEventListener("abort", onAbort);
+	};
+	function onAbort() {
+		dispose();
+		controller.abort(this.reason);
+	}
+	const aborted = sources.find((source) => source.aborted);
+	if (aborted == null) for (const source of sources) source.addEventListener("abort", onAbort);
+	else controller.abort(aborted.reason);
+	return {
+		signal: controller.signal,
+		dispose
+	};
+}
+/**
+* Waits for the given promise unless the given signal aborts first, in which
+* case it rejects with the reason of the abort.  If the signal has aborted by
+* the time the promise settles, the abort wins as well, so that nothing that
+* settles after it counts.
+*/
+function raceAbort(promise, signal) {
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(signal.reason);
+		const settle = (settled) => {
+			signal.removeEventListener("abort", onAbort);
+			if (signal.aborted) onAbort();
+			else settled();
+		};
+		promise.then((value) => settle(() => resolve(value)), (error) => settle(() => reject(error)));
+		if (signal.aborted) onAbort();
+		else signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/**
 * Finds the nodes that stand for the key with the given canonical portable
 * ID.  A node whose ID is an `ap:` or `ap+ef61:` URI stands for the key
 * itself, e.g., Mitra lists the keys of portable actors that way while
@@ -8119,7 +8427,7 @@ function isReference(node) {
 }
 //#endregion
 //#region src/sig/http.ts
-const Temporal = Temporal$2;
+const Temporal = Temporal$4;
 const DEFAULT_MAX_REDIRECTION = 20;
 const DOUBLE_KNOCK_TRANSPORT_RETRY_DELAY_MS = 100;
 /**
@@ -8578,7 +8886,8 @@ async function verifyRequestDetailed(request, options = {}) {
 			if (spec === "rfc9421") result = await verifyRequestRfc9421(request, span, metricsContext, options);
 			else result = await verifyRequestDraft(request, span, metricsContext, options);
 			recordVerificationResult(span, result);
-			if (!result.verified) span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
+			if (result.verified) promoteKeyOwnerEvidence(result.key);
+			else span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 			return result;
 		} catch (error) {
 			threw = true;
@@ -9301,10 +9610,16 @@ Object.defineProperty(exports, "InvalidPortableObjectIdError", {
 		return InvalidPortableObjectIdError;
 	}
 });
+Object.defineProperty(exports, "MAX_PORTABLE_KEY_TTL", {
+	enumerable: true,
+	get: function() {
+		return MAX_PORTABLE_KEY_TTL;
+	}
+});
 Object.defineProperty(exports, "Temporal", {
 	enumerable: true,
 	get: function() {
-		return Temporal$2;
+		return Temporal$4;
 	}
 });
 Object.defineProperty(exports, "assertSafeJsonLd", {
@@ -9451,6 +9766,12 @@ Object.defineProperty(exports, "getRemoteHost", {
 		return getRemoteHost;
 	}
 });
+Object.defineProperty(exports, "getVerifiedKeyOwnerEvidence", {
+	enumerable: true,
+	get: function() {
+		return getVerifiedKeyOwnerEvidence;
+	}
+});
 Object.defineProperty(exports, "hasPortableActor", {
 	enumerable: true,
 	get: function() {
@@ -9559,6 +9880,12 @@ Object.defineProperty(exports, "parseAcceptSignature", {
 		return parseAcceptSignature;
 	}
 });
+Object.defineProperty(exports, "parseKeyOwnerEvidence", {
+	enumerable: true,
+	get: function() {
+		return parseKeyOwnerEvidence;
+	}
+});
 Object.defineProperty(exports, "parseRfc9421SignatureInput", {
 	enumerable: true,
 	get: function() {