@fedify/fedify 2.4.0-dev.2159 → 2.4.0-dev.2169

package/dist/{http-nTZuTacw.js → http-BGpexPO7.js}

@@ -14,7 +14,7 @@ import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2159+bb072eda";
+var version = "2.4.0-dev.2169+0a45df07";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -1181,6 +1181,108 @@ function getDurationMs(start) {
 	return Math.max(0, performance.now() - start);
 }
 //#endregion
+//#region src/sig/key-owner-evidence.ts
+/**
+* How long a key of an [FEP-ef61] portable actor is trusted after its actor's
+* signed document vouched for it, however long the proof of the document is
+* valid.  The actor can drop the key or the gateway from its document at any
+* time, so the key is looked up again at least this often.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+const MAX_PORTABLE_KEY_TTL = Temporal.Duration.from({ hours: 1 });
+const candidates = /* @__PURE__ */ new WeakMap();
+const verified = /* @__PURE__ */ new WeakMap();
+/**
+* Attaches to a key that was just resolved the evidence of the portable actor
+* that owns it.  The evidence is not used until the key verifies
+* a signature; see {@link promoteKeyOwnerEvidence}.
+*
+* Nothing is attached unless the document, the key's owner, and the actor
+* the key ID belongs to agree on the actor's canonical portable ID.
+* @param key The key, whose owner the document vouched for.
+* @param document The expanded root node of the actor's verified document.
+* @param expires When the evidence must not be used anymore.
+* @returns Whether the evidence was attached.
+* @internal
+*/
+function attachKeyOwnerEvidence(key, document, expires) {
+	if (!(key instanceof CryptographicKey) || key.id == null || key.ownerId == null || key.publicKey == null || document == null || typeof document !== "object" || Array.isArray(document)) return false;
+	const rawId = document["@id"];
+	if (typeof rawId !== "string") return false;
+	const keyBase = new URL(key.id.href);
+	keyBase.hash = "";
+	const ownerId = getCanonicalPortableId(key.ownerId);
+	if (ownerId == null || getRawCanonicalPortableId(rawId) !== ownerId || getCanonicalPortableId(keyBase) !== ownerId) return false;
+	candidates.set(key, {
+		keyId: key.id.href,
+		keyOwner: key.ownerId.href,
+		publicKey: key.publicKey,
+		ownerId,
+		document: structuredClone(document),
+		expires
+	});
+	return true;
+}
+/**
+* Makes the evidence attached to a key usable, as the key has just verified
+* an HTTP Signature.  Nothing happens if the key has no evidence.
+* @param key The key that verified a signature.
+* @internal
+*/
+function promoteKeyOwnerEvidence(key) {
+	const evidence = candidates.get(key);
+	if (evidence == null) return;
+	candidates.delete(key);
+	verified.set(key, evidence);
+}
+/**
+* Gets the evidence of the portable actor that owns a key HTTP Signature
+* verification returned.
+* @param key The key.
+* @param now The current time.
+* @returns The evidence, or `undefined` if the key was not returned by HTTP
+*          Signature verification, if it has no evidence, if the evidence
+*          expired, or if the key has been changed since.
+* @internal
+*/
+function getVerifiedKeyOwnerEvidence(key, now = Temporal.Now.instant()) {
+	const evidence = verified.get(key);
+	if (evidence == null) return void 0;
+	if (Temporal.Instant.compare(now, evidence.expires) >= 0) {
+		verified.delete(key);
+		return;
+	}
+	if (key.id?.href !== evidence.keyId || key.ownerId?.href !== evidence.keyOwner || key.publicKey !== evidence.publicKey) return;
+	return evidence;
+}
+/**
+* Parses the actor from the evidence, i.e., from the expansion of its
+* document whose proof was verified.  Every call returns a new object.
+* @param evidence The evidence.
+* @param options Options for parsing the document.
+* @returns The actor, or `null` if the document is not the actor that
+*          the evidence is about, or the evidence expired meanwhile.
+* @internal
+*/
+async function parseKeyOwnerEvidence(evidence, options = {}) {
+	const refuse = (url) => Promise.reject(/* @__PURE__ */ new Error(`Refusing to fetch ${url}.`));
+	let actor;
+	try {
+		actor = await Object$1.fromJsonLd(structuredClone(evidence.document), {
+			documentLoader: refuse,
+			contextLoader: options.contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return null;
+	}
+	if (!isPortableActorDocument(actor) || getCanonicalPortableId(actor.id) !== evidence.ownerId || Temporal.Instant.compare(Temporal.Now.instant(), evidence.expires) >= 0) return null;
+	return actor;
+}
+//#endregion
 //#region src/sig/key.ts
 /**
 * Checks if the given key is valid and supported.  No-op if the key is valid,
@@ -1403,6 +1505,7 @@ function bypassKeyCacheReads(keyCache) {
 		const scoped = cache.compatibleKeyScope(scope);
 		return {
 			get: () => Promise.resolve(void 0),
+			getEntry: () => Promise.resolve(void 0),
 			set: async (keyId, key, options) => await scoped.set(keyId, key, options),
 			delete: async (keyId) => await scoped.delete(keyId)
 		};
@@ -1570,6 +1673,49 @@ function checkCachedKeyHit(cachedKey, keyId, cls, logger) {
 	}
 	return null;
 }
+/**
+* Looks up a key at a compatible identifier, or at an `ap:` or `ap+ef61:`
+* URI, in the cache namespace of a purpose, like {@link getCachedFetchKey}.
+* A key that the verified document of its portable actor was cached with
+* gets the actor's evidence attached from the same entry; see
+* {@link attachKeyOwnerEvidence}.
+*/
+async function getCachedCompatibleKey(cacheKey, keyId, cls, scopedCache, logger) {
+	if (scopedCache?.getEntry == null) return await getCachedFetchKey(cacheKey, keyId, cls, scopedCache, logger);
+	const entry = await scopedCache.getEntry(cacheKey);
+	if (entry === void 0) return null;
+	if (entry === null) {
+		logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
+		return {
+			key: null,
+			cached: true
+		};
+	}
+	const hit = checkCachedKeyHit(entry.key, keyId, cls, logger);
+	if (hit?.key instanceof CryptographicKey && entry.owner != null) attachKeyOwnerEvidence(hit.key, entry.owner, entry.expires);
+	return hit;
+}
+/**
+* Attaches the evidence of the portable actor whose document has just
+* vouched for a key to the key.  The evidence expires with the cache entry
+* of the key, so that it is never trusted longer than the key is cached.
+* Without a cache, it expires with the proof of the document, but no later
+* than {@link MAX_PORTABLE_KEY_TTL}, as a cache entry would.
+* @param resolution The resolution of the key.
+* @param scopedCache The cache namespace the key was stored in, if any.
+* @param cached When the cache entry expires, if the cache stored one.
+*/
+function attachResolvedKeyOwnerEvidence(resolution, scopedCache, cached) {
+	let expires;
+	if (scopedCache != null) {
+		if (cached == null) return;
+		expires = cached;
+	} else {
+		expires = Temporal.Now.instant().add(MAX_PORTABLE_KEY_TTL);
+		if (resolution.expires != null && Temporal.Instant.compare(resolution.expires, expires) < 0) expires = resolution.expires;
+	}
+	attachKeyOwnerEvidence(resolution.key, resolution.document, expires);
+}
 async function clearFetchErrorMetadata(keyId, keyCache) {
 	await keyCache?.setFetchError?.(keyId, null);
 }
@@ -1694,7 +1840,10 @@ async function resolveFetchedKey(document, cacheKey, documentUrl, keyId, cls, {
 				cached: false
 			};
 		}
-		await scopedCache?.set(cacheKey, resolution.key, { expires: resolution.expires });
+		attachResolvedKeyOwnerEvidence(resolution, scopedCache, await scopedCache?.set(cacheKey, resolution.key, {
+			expires: resolution.expires,
+			owner: resolution.document
+		}));
 		return {
 			key: resolution.key,
 			cached: false
@@ -1915,7 +2064,7 @@ async function fetchCompatibleKey(cacheKey, cls, options, onCachedUnavailable, o
 	const keyId = cacheKey.href;
 	const sharedCache = options.keyCache;
 	const scopedCache = sharedCache?.compatibleKeyScope?.(getCompatibleKeyScope(cls, options));
-	const cached = await getCachedFetchKey(cacheKey, keyId, cls, scopedCache, logger);
+	const cached = await getCachedCompatibleKey(cacheKey, keyId, cls, scopedCache, logger);
 	if (cached != null) return {
 		result: cached,
 		outcome: { result: "hit" }
@@ -1979,7 +2128,7 @@ async function fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable
 	}
 	const sharedCache = options.keyCache;
 	const scopedCache = sharedCache?.compatibleKeyScope?.("httpSignature");
-	const cached = await getCachedFetchKey(cacheKey, keyId, cls, scopedCache, logger);
+	const cached = await getCachedCompatibleKey(cacheKey, keyId, cls, scopedCache, logger);
 	if (cached != null) return {
 		result: cached,
 		outcome: { result: "hit" }
@@ -1994,7 +2143,10 @@ async function fetchPortableActorKey(cacheKey, cls, options, onCachedUnavailable
 	logger.debug("Resolving key {keyId} to verify signature...", { keyId });
 	const resolution = await resolvers.actorKey(cacheKey);
 	if (resolution.type === "verified") {
-		await scopedCache?.set(cacheKey, resolution.key, { expires: resolution.expires });
+		attachResolvedKeyOwnerEvidence(resolution, scopedCache, await scopedCache?.set(cacheKey, resolution.key, {
+			expires: resolution.expires,
+			owner: resolution.document
+		}));
 		return {
 			result: {
 				key: resolution.key,
@@ -4334,6 +4486,7 @@ async function verifyPortableKeyDocument(document, actor, keyId, isGatewayKey, o
 		type: "verified",
 		actor,
 		key,
+		document: root,
 		...expires == null ? {} : { expires }
 	};
 }
@@ -4380,6 +4533,21 @@ async function fetchPortableGatewayKey(keyId, options = {}) {
 	});
 }
 /**
+* The maximum number of `@gateway` location hints followed for one `ap:` or
+* `ap+ef61:` key ID.  Whoever made a signature chooses the hints of its key
+* ID, so fewer of them are followed than when dereferencing objects, which
+* bounds the gateways one signature can make Fedify ask.  Further hints are
+* ignored.
+*/
+const MAX_KEY_ID_GATEWAY_HINTS = 3;
+/**
+* The default of {@link PortableActorKeyOptions.lookupTimeout}, in
+* milliseconds.
+*/
+const DEFAULT_KEY_ID_LOOKUP_TIMEOUT = 1e4;
+/** The longest delay that `setTimeout()` supports, in milliseconds. */
+const MAX_TIMEOUT = 2 ** 31 - 1;
+/**
 * Resolves a key of a portable actor at an `ap:` or `ap+ef61:` key ID, e.g.,
 * `ap://did:key:z6Mk…/actor#main-key`.  Such a key ID names no gateway, so
 * the actor's document, i.e., the key ID without its fragment, is fetched
@@ -4407,12 +4575,25 @@ async function fetchPortableGatewayKey(keyId, options = {}) {
 * unreachable gateway would have served, so the result is an `unavailable`
 * that is not cacheable.
 *
+* Only the first {@link MAX_KEY_ID_GATEWAY_HINTS} location hints are
+* followed, and all the gateways share one timeout, see
+* {@link PortableActorKeyOptions.lookupTimeout}.  A gateway that does not
+* serve the document in time failed to serve it, like an unreachable one,
+* with an error that has no HTTP status.  A gateway whose document could not
+* be processed in time, and the gateways left untried, make the result an
+* `unavailable` that is not cacheable.  A result that arrives after
+* the timeout is ignored, even if it vouches for the key.
+*
 * @param keyId The key ID, which must be an `ap:` or `ap+ef61:` URI.
-* @param options Loaders and telemetry providers.
+* @param options Loaders, telemetry providers, and the timeout.
 * @returns The resolution, which is never `legacy`.
+* @throws {RangeError} If the timeout is not a non-negative number of
+*                      milliseconds that `setTimeout()` supports.
 * @internal
 */
 async function resolvePortableActorKey(keyId, options = {}) {
+	const lookupTimeout = options.lookupTimeout ?? DEFAULT_KEY_ID_LOOKUP_TIMEOUT;
+	if (!Number.isFinite(lookupTimeout) || lookupTimeout < 0 || lookupTimeout > MAX_TIMEOUT) throw new RangeError(`The lookup timeout must be between 0 and ${MAX_TIMEOUT} ms: ${lookupTimeout}`);
 	const documentLoader = options.documentLoader ?? getDocumentLoader();
 	const contextLoader = options.contextLoader ?? getDocumentLoader();
 	let formattedKeyId = keyId.href;
@@ -4431,75 +4612,67 @@ async function resolvePortableActorKey(keyId, options = {}) {
 	if (keyId.hash === "" || keyId.hash === "#") return reject("The key ID has no fragment; only keys embedded in actor documents are supported.");
 	const actorUrl = new URL(keyId.href);
 	actorUrl.hash = "";
+	const gateways = getPortableGatewayCandidates(actorUrl);
+	if (gateways.length > MAX_KEY_ID_GATEWAY_HINTS) logger.debug("Following only the first {max} location hints of key {keyId}.", {
+		keyId: formattedKeyId,
+		max: MAX_KEY_ID_GATEWAY_HINTS
+	});
 	const requestUrls = [];
-	for (const gateway of getPortableGatewayCandidates(actorUrl)) try {
+	for (const gateway of gateways.slice(0, MAX_KEY_ID_GATEWAY_HINTS)) try {
 		requestUrls.push(toCompatibleEf61Id(actorUrl, gateway).href);
 	} catch (error) {
 		if (!(error instanceof TypeError)) throw error;
 		return reject(`The key ID cannot be fetched from gateways: ${error}`);
 	}
 	if (requestUrls.length < 1) requestUrls.push(formatIri(actorUrl));
+	const controller = new AbortController();
+	const timeoutError = new DOMException(`Timed out looking up the actor of key ${formattedKeyId} after ${lookupTimeout} ms.`, "TimeoutError");
+	let timer;
+	if (lookupTimeout > 0) timer = setTimeout(() => controller.abort(timeoutError), lookupTimeout);
+	else controller.abort(timeoutError);
+	const { signal } = controller;
+	const attemptOptions = {
+		...options,
+		documentLoader: withDeadline(documentLoader, signal),
+		contextLoader: withDeadline(contextLoader, signal),
+		signal,
+		formattedKeyId
+	};
 	const attempts = [];
-	for (const url of requestUrls) {
-		let remoteDocument;
-		try {
-			remoteDocument = await documentLoader(url);
-		} catch (error) {
-			logger.debug("Failed to fetch the actor of key {keyId} from {url}: {error}", {
-				keyId: formattedKeyId,
-				url,
-				error
-			});
-			attempts.push({
-				type: "retrievalFailed",
-				error
-			});
-			continue;
-		}
-		let resolution;
-		try {
-			const object = await Object$1.fromJsonLd(remoteDocument.document, {
-				documentLoader,
-				contextLoader,
-				tracerProvider: options.tracerProvider
-			});
-			resolution = isPortableActorDocument(object) ? await verifyPortableKeyDocument(remoteDocument.document, object, keyId, false, {
-				...options,
-				documentLoader,
-				contextLoader
-			}) : {
-				type: "rejected",
-				reason: "The document is not a portable actor."
-			};
-		} catch (error) {
-			if (error instanceof TypeError) resolution = {
-				type: "rejected",
-				reason: `The document is malformed: ${error.message}`
-			};
-			else {
-				logger.debug("Failed to process the actor of key {keyId} served from {url}: {error}", {
+	try {
+		for (const url of requestUrls) {
+			if (signal.aborted) {
+				logger.debug("Ran out of time looking up the actor of key {keyId}; gateways from {url} on were not tried.", {
 					keyId: formattedKeyId,
-					url,
-					error
+					url
 				});
 				attempts.push({
 					type: "indeterminate",
-					error
+					error: signal.reason
+				});
+				break;
+			}
+			const state = { processing: false };
+			let attempt;
+			try {
+				attempt = await raceAbort(attemptGateway(url, keyId, attemptOptions, state), signal);
+			} catch (error) {
+				if (!signal.aborted) throw error;
+				logger.debug("Ran out of time looking up the actor of key {keyId} at {url}.", {
+					keyId: formattedKeyId,
+					url
+				});
+				attempts.push({
+					type: state.processing ? "indeterminate" : "retrievalFailed",
+					error: signal.reason
 				});
 				continue;
 			}
+			if (attempt.type === "verified") return attempt;
+			attempts.push(attempt);
 		}
-		if (resolution.type === "verified") return resolution;
-		const reason = resolution.type === "rejected" ? resolution.reason : "The document is not a portable actor.";
-		logger.debug("The actor document served from {url} does not vouch for key {keyId}: {reason}", {
-			keyId: formattedKeyId,
-			url,
-			reason
-		});
-		attempts.push({
-			type: "rejected",
-			reason
-		});
+	} finally {
+		clearTimeout(timer);
 	}
 	const rejections = attempts.flatMap((a) => a.type === "rejected" ? [a.reason] : []);
 	if (rejections.length === attempts.length) return reject(rejections.join(" "));
@@ -4520,6 +4693,139 @@ async function resolvePortableActorKey(keyId, options = {}) {
 	};
 }
 /**
+* Fetches the actor's document of a key at an `ap:` or `ap+ef61:` key ID from
+* one gateway, and tells whether it vouches for the key.  It never rejects;
+* the caller races it against the lookup's timeout, and ignores what it
+* resolves to after the timeout.
+*/
+async function attemptGateway(url, keyId, options, state) {
+	const { documentLoader, contextLoader, signal, formattedKeyId } = options;
+	let remoteDocument;
+	try {
+		remoteDocument = await documentLoader(url);
+	} catch (error) {
+		logger.debug("Failed to fetch the actor of key {keyId} from {url}: {error}", {
+			keyId: formattedKeyId,
+			url,
+			error
+		});
+		return {
+			type: "retrievalFailed",
+			error
+		};
+	}
+	if (signal.aborted) return {
+		type: "indeterminate",
+		error: signal.reason
+	};
+	state.processing = true;
+	let resolution;
+	try {
+		const object = await Object$1.fromJsonLd(remoteDocument.document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+		signal.throwIfAborted();
+		resolution = isPortableActorDocument(object) ? await verifyPortableKeyDocument(remoteDocument.document, object, keyId, false, options) : {
+			type: "rejected",
+			reason: "The document is not a portable actor."
+		};
+	} catch (error) {
+		if (error instanceof TypeError && !signal.aborted) resolution = {
+			type: "rejected",
+			reason: `The document is malformed: ${error.message}`
+		};
+		else {
+			logger.debug("Failed to process the actor of key {keyId} served from {url}: {error}", {
+				keyId: formattedKeyId,
+				url,
+				error
+			});
+			return {
+				type: "indeterminate",
+				error
+			};
+		}
+	}
+	if (resolution.type === "verified") return resolution;
+	const reason = resolution.type === "rejected" ? resolution.reason : "The document is not a portable actor.";
+	logger.debug("The actor document served from {url} does not vouch for key {keyId}: {reason}", {
+		keyId: formattedKeyId,
+		url,
+		reason
+	});
+	return {
+		type: "rejected",
+		reason
+	};
+}
+/**
+* Wraps a document loader so that it gives up when the given signal aborts,
+* as well as when the signal in its own options does.  The wrapped loader is
+* passed a signal that aborts in either case, but in case it ignores that
+* signal, what it resolves to after the abort is ignored, and the wrapper
+* rejects with the reason of the abort at once.  After the abort, the wrapped
+* loader is not called at all.
+*/
+function withDeadline(loader, signal) {
+	return (url, options) => {
+		const combined = combineSignals(signal, options?.signal);
+		return raceAbort(combined.signal.aborted ? Promise.reject(combined.signal.reason) : new Promise((resolve) => resolve(loader(url, {
+			...options,
+			signal: combined.signal
+		}))), combined.signal).finally(combined.dispose);
+	};
+}
+/**
+* Makes a signal that aborts when either of the given signals does, with
+* the reason of the one that aborted first.  `AbortSignal.any()` is not
+* available on every supported runtime, e.g., Bun before 1.1.4.
+* @returns The signal, and a function that stops listening to the given
+*          signals.
+*/
+function combineSignals(signal, other) {
+	if (other == null || other === signal) return {
+		signal,
+		dispose() {}
+	};
+	const controller = new AbortController();
+	const sources = [signal, other];
+	const dispose = () => {
+		for (const source of sources) source.removeEventListener("abort", onAbort);
+	};
+	function onAbort() {
+		dispose();
+		controller.abort(this.reason);
+	}
+	const aborted = sources.find((source) => source.aborted);
+	if (aborted == null) for (const source of sources) source.addEventListener("abort", onAbort);
+	else controller.abort(aborted.reason);
+	return {
+		signal: controller.signal,
+		dispose
+	};
+}
+/**
+* Waits for the given promise unless the given signal aborts first, in which
+* case it rejects with the reason of the abort.  If the signal has aborted by
+* the time the promise settles, the abort wins as well, so that nothing that
+* settles after it counts.
+*/
+function raceAbort(promise, signal) {
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(signal.reason);
+		const settle = (settled) => {
+			signal.removeEventListener("abort", onAbort);
+			if (signal.aborted) onAbort();
+			else settled();
+		};
+		promise.then((value) => settle(() => resolve(value)), (error) => settle(() => reject(error)));
+		if (signal.aborted) onAbort();
+		else signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/**
 * Finds the nodes that stand for the key with the given canonical portable
 * ID.  A node whose ID is an `ap:` or `ap+ef61:` URI stands for the key
 * itself, e.g., Mitra lists the keys of portable actors that way while
@@ -5010,7 +5316,8 @@ async function verifyRequestDetailed(request, options = {}) {
 			if (spec === "rfc9421") result = await verifyRequestRfc9421(request, span, metricsContext, options);
 			else result = await verifyRequestDraft(request, span, metricsContext, options);
 			recordVerificationResult(span, result);
-			if (!result.verified) span.setStatus({ code: SpanStatusCode.ERROR });
+			if (result.verified) promoteKeyOwnerEvidence(result.key);
+			else span.setStatus({ code: SpanStatusCode.ERROR });
 			return result;
 		} catch (error) {
 			threw = true;
@@ -5721,4 +6028,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { recordCollectionPageItems as $, hasSignatureLike as A, fetchKey as B, assertSafeJsonLd as C, isSamePublicKey as Ct, detachSignature as D, createSignature as E, verifyJsonLd as F, verifyKeyOwnership as G, generateCryptoKeyPair as H, verifySignature as I, getRemoteHost as J, getDurationMs as K, wrapContextLoaderForJsonLd as L, isInvalidUrlTypeError as M, signJsonLd as N, getNormalizationContextLoader as O, verifyCompactJsonLd as P, recordCollectionDispatchDuration as Q, exportJwk as R, InvalidContextReferenceError as S, isPortableUri as St, compactJsonLd as T, version as Tt, importJwk as U, fetchKeyDetailed as V, validateCryptoKey as W, isAbortError$1 as X, instrumentDocumentLoader as Y, recordCircuitBreakerStateChange as Z, verifyPortableObjectProof as _, getRawCanonicalPortableId as _t, signRequest as a, recordOutboxActivity as at, verifyProof as b, isPortableId as bt, fetchPortableGatewayKey as c, registerQueueDepthGauge as ct, classifyFep2277CoreType as d, fulfillAcceptSignature as dt, recordCollectionRequest as et, createProof as f, parseAcceptSignature as ft, verifyObject as g, getPortableDid as gt, verifyMapLocalProof as h, getGatewayKeyBase as ht, selectRequestSignature as i, recordInboxActivity as it, isClearlyMalformedContextReference as j, hasSignature as k, resolvePortableActorKey as l, preloadedOnlyDocumentLoader as lt, signObject as m, getCanonicalPortableId as mt, listRequestSignatures as n, recordDocumentCache as nt, verifyRequest as o, recordOutboxEnqueue as ot, hasProofLike as p, validateAcceptSignature as pt, getFederationMetrics as q, parseRfc9421SignatureInput as r, recordFanoutRecipients as rt, verifyRequestDetailed as s, recordWebFingerHandle as st, doubleKnock as t, recordCollectionTotalItems as tt, InvalidPortableObjectIdError as u, formatAcceptSignature as ut, verifyPortableObjectProofPolicy as v, hasPortableActor as vt, attachSignature as w, name as wt, normalizeOutgoingActivityJsonLd as x, isPortableKeyId as xt, verifyPortableObjectProofWithRoot as y, isCompatibleKeyId as yt, fetchActorDocument as z };
+export { isAbortError$1 as $, hasSignatureLike as A, fetchKey as B, assertSafeJsonLd as C, isPortableId as Ct, detachSignature as D, name as Dt, createSignature as E, isSamePublicKey as Et, verifyJsonLd as F, verifyKeyOwnership as G, generateCryptoKeyPair as H, verifySignature as I, parseKeyOwnerEvidence as J, MAX_PORTABLE_KEY_TTL as K, wrapContextLoaderForJsonLd as L, isInvalidUrlTypeError as M, signJsonLd as N, getNormalizationContextLoader as O, version as Ot, verifyCompactJsonLd as P, instrumentDocumentLoader as Q, exportJwk as R, InvalidContextReferenceError as S, isCompatibleKeyId as St, compactJsonLd as T, isPortableUri as Tt, importJwk as U, fetchKeyDetailed as V, validateCryptoKey as W, getFederationMetrics as X, getDurationMs as Y, getRemoteHost as Z, verifyPortableObjectProof as _, getCanonicalPortableId as _t, signRequest as a, recordDocumentCache as at, verifyProof as b, getRawCanonicalPortableId as bt, fetchPortableGatewayKey as c, recordOutboxActivity as ct, classifyFep2277CoreType as d, registerQueueDepthGauge as dt, recordCircuitBreakerStateChange as et, createProof as f, preloadedOnlyDocumentLoader as ft, verifyObject as g, validateAcceptSignature as gt, verifyMapLocalProof as h, parseAcceptSignature as ht, selectRequestSignature as i, recordCollectionTotalItems as it, isClearlyMalformedContextReference as j, hasSignature as k, resolvePortableActorKey as l, recordOutboxEnqueue as lt, signObject as m, fulfillAcceptSignature as mt, listRequestSignatures as n, recordCollectionPageItems as nt, verifyRequest as o, recordFanoutRecipients as ot, hasProofLike as p, formatAcceptSignature as pt, getVerifiedKeyOwnerEvidence as q, parseRfc9421SignatureInput as r, recordCollectionRequest as rt, verifyRequestDetailed as s, recordInboxActivity as st, doubleKnock as t, recordCollectionDispatchDuration as tt, InvalidPortableObjectIdError as u, recordWebFingerHandle as ut, verifyPortableObjectProofPolicy as v, getGatewayKeyBase as vt, attachSignature as w, isPortableKeyId as wt, normalizeOutgoingActivityJsonLd as x, hasPortableActor as xt, verifyPortableObjectProofWithRoot as y, getPortableDid as yt, fetchActorDocument as z };

package/dist/{http-DV_yW4dv.mjs → http-Bd6rZlJX.mjs}

@@ -1,12 +1,13 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CE_s0yQb.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-ByOQOHHS.mjs";
+import { n as version, t as name } from "./deno-DU8dvnWk.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-jUDFfVgi.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
 import { f as parseKeyIdString } from "./portable-key-id-Bg259c4Z.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-C6jnekFI.mjs";
-import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-BXsVLSMa.mjs";
+import { a as promoteKeyOwnerEvidence } from "./key-owner-evidence-Bo3yaeL5.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-gIhVZO3p.mjs";
+import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-DyF5AnZo.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -474,7 +475,8 @@ async function verifyRequestDetailed(request, options = {}) {
 			if (spec === "rfc9421") result = await verifyRequestRfc9421(request, span, metricsContext, options);
 			else result = await verifyRequestDraft(request, span, metricsContext, options);
 			recordVerificationResult(span, result);
-			if (!result.verified) span.setStatus({ code: SpanStatusCode.ERROR });
+			if (result.verified) promoteKeyOwnerEvidence(result.key);
+			else span.setStatus({ code: SpanStatusCode.ERROR });
 			return result;
 		} catch (error) {
 			threw = true;

package/dist/{http-C-x_OLSp.d.ts → http-Cok5-vIC.d.ts}

@@ -24,6 +24,11 @@ type PortableGatewayKeyResolution = {
     publicKey: CryptoKey;
   };
   /**
+  * The expanded root node of the actor's document whose proof was
+  * verified, from which {@link actor} was parsed.
+  */
+  readonly document: Record<string, unknown>;
+  /**
   * When the proof of the actor's document expires, if it does.  The
   * document does not vouch for the key after that.
   */

package/dist/{http-CjezPjFX.d.cts → http-DC1cqAQ2.d.cts}

@@ -24,6 +24,11 @@ type PortableGatewayKeyResolution = {
     publicKey: CryptoKey;
   };
   /**
+  * The expanded root node of the actor's document whose proof was
+  * verified, from which {@link actor} was parsed.
+  */
+  readonly document: Record<string, unknown>;
+  /**
   * When the proof of the actor's document expires, if it does.  The
   * document does not vouch for the key after that.
   */