@fedify/fedify 2.4.0-dev.2164 → 2.4.0-dev.2190

package/dist/{http-Baovr6xq.js → http-BqN5kyUf.js}

@@ -14,7 +14,7 @@ import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2164+db2b8571";
+var version = "2.4.0-dev.2190+be3a8be0";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -115,6 +115,50 @@ function getCanonicalPortableId(id) {
 	}
 }
 /**
+* Gets the [FEP-fe34] origin of an ID for same-origin checks.  The origin of
+* an `ap:` or `ap+ef61:` URI, or of a compatible identifier on any gateway,
+* is the DID of its canonical portable ID, as FEP-ef61 treats a compatible
+* identifier as the portable ID it stands for; unlike `getFe34Origin()`,
+* which gives a compatible identifier the web origin of its gateway.  The
+* origin of any other HTTP(S) URL is its web origin, and that of a DID URL
+* is its DID.
+*
+* Only the parsed `URL` is validated, so dot segments that URL parsing has
+* already resolved cannot be detected here.
+*
+* [FEP-fe34]: https://w3id.org/fep/fe34
+* @returns The origin, or `null` if the ID has none that is supported, or is
+*          a malformed portable ID or compatible identifier.
+* @internal
+*/
+function getAuthenticationOrigin(id) {
+	try {
+		if (isPortableId(id)) {
+			const canonical = getCanonicalPortableId(id);
+			return canonical == null ? null : getFe34Origin(canonical);
+		}
+		return getFe34Origin(id);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Checks whether two IDs identify the same object.  Two portable IDs, i.e.,
+* `ap:` or `ap+ef61:` URIs or compatible identifiers, are compared by their
+* canonical portable IDs, so that the same object on different gateways and
+* with different location hints matches.  Other IDs have to be equal as
+* they are.
+* @internal
+*/
+function isSameObjectId(a, b) {
+	const aPortable = isPortableId(a);
+	if (aPortable !== isPortableId(b)) return false;
+	if (!aPortable) return a.href === b.href;
+	const canonical = getCanonicalPortableId(a);
+	return canonical != null && canonical === getCanonicalPortableId(b);
+}
+/**
 * Gets the canonical portable ID of an `ap:` or `ap+ef61:` URI or
 * a compatible identifier as it is written, before any URL parsing.
 * Parsing an ID into a `URL` resolves dot segments in its path, which would
@@ -4533,6 +4577,21 @@ async function fetchPortableGatewayKey(keyId, options = {}) {
 	});
 }
 /**
+* The maximum number of `@gateway` location hints followed for one `ap:` or
+* `ap+ef61:` key ID.  Whoever made a signature chooses the hints of its key
+* ID, so fewer of them are followed than when dereferencing objects, which
+* bounds the gateways one signature can make Fedify ask.  Further hints are
+* ignored.
+*/
+const MAX_KEY_ID_GATEWAY_HINTS = 3;
+/**
+* The default of {@link PortableActorKeyOptions.lookupTimeout}, in
+* milliseconds.
+*/
+const DEFAULT_KEY_ID_LOOKUP_TIMEOUT = 1e4;
+/** The longest delay that `setTimeout()` supports, in milliseconds. */
+const MAX_TIMEOUT = 2 ** 31 - 1;
+/**
 * Resolves a key of a portable actor at an `ap:` or `ap+ef61:` key ID, e.g.,
 * `ap://did:key:z6Mk…/actor#main-key`.  Such a key ID names no gateway, so
 * the actor's document, i.e., the key ID without its fragment, is fetched
@@ -4560,12 +4619,25 @@ async function fetchPortableGatewayKey(keyId, options = {}) {
 * unreachable gateway would have served, so the result is an `unavailable`
 * that is not cacheable.
 *
+* Only the first {@link MAX_KEY_ID_GATEWAY_HINTS} location hints are
+* followed, and all the gateways share one timeout, see
+* {@link PortableActorKeyOptions.lookupTimeout}.  A gateway that does not
+* serve the document in time failed to serve it, like an unreachable one,
+* with an error that has no HTTP status.  A gateway whose document could not
+* be processed in time, and the gateways left untried, make the result an
+* `unavailable` that is not cacheable.  A result that arrives after
+* the timeout is ignored, even if it vouches for the key.
+*
 * @param keyId The key ID, which must be an `ap:` or `ap+ef61:` URI.
-* @param options Loaders and telemetry providers.
+* @param options Loaders, telemetry providers, and the timeout.
 * @returns The resolution, which is never `legacy`.
+* @throws {RangeError} If the timeout is not a non-negative number of
+*                      milliseconds that `setTimeout()` supports.
 * @internal
 */
 async function resolvePortableActorKey(keyId, options = {}) {
+	const lookupTimeout = options.lookupTimeout ?? DEFAULT_KEY_ID_LOOKUP_TIMEOUT;
+	if (!Number.isFinite(lookupTimeout) || lookupTimeout < 0 || lookupTimeout > MAX_TIMEOUT) throw new RangeError(`The lookup timeout must be between 0 and ${MAX_TIMEOUT} ms: ${lookupTimeout}`);
 	const documentLoader = options.documentLoader ?? getDocumentLoader();
 	const contextLoader = options.contextLoader ?? getDocumentLoader();
 	let formattedKeyId = keyId.href;
@@ -4584,75 +4656,67 @@ async function resolvePortableActorKey(keyId, options = {}) {
 	if (keyId.hash === "" || keyId.hash === "#") return reject("The key ID has no fragment; only keys embedded in actor documents are supported.");
 	const actorUrl = new URL(keyId.href);
 	actorUrl.hash = "";
+	const gateways = getPortableGatewayCandidates(actorUrl);
+	if (gateways.length > MAX_KEY_ID_GATEWAY_HINTS) logger.debug("Following only the first {max} location hints of key {keyId}.", {
+		keyId: formattedKeyId,
+		max: MAX_KEY_ID_GATEWAY_HINTS
+	});
 	const requestUrls = [];
-	for (const gateway of getPortableGatewayCandidates(actorUrl)) try {
+	for (const gateway of gateways.slice(0, MAX_KEY_ID_GATEWAY_HINTS)) try {
 		requestUrls.push(toCompatibleEf61Id(actorUrl, gateway).href);
 	} catch (error) {
 		if (!(error instanceof TypeError)) throw error;
 		return reject(`The key ID cannot be fetched from gateways: ${error}`);
 	}
 	if (requestUrls.length < 1) requestUrls.push(formatIri(actorUrl));
+	const controller = new AbortController();
+	const timeoutError = new DOMException(`Timed out looking up the actor of key ${formattedKeyId} after ${lookupTimeout} ms.`, "TimeoutError");
+	let timer;
+	if (lookupTimeout > 0) timer = setTimeout(() => controller.abort(timeoutError), lookupTimeout);
+	else controller.abort(timeoutError);
+	const { signal } = controller;
+	const attemptOptions = {
+		...options,
+		documentLoader: withDeadline(documentLoader, signal),
+		contextLoader: withDeadline(contextLoader, signal),
+		signal,
+		formattedKeyId
+	};
 	const attempts = [];
-	for (const url of requestUrls) {
-		let remoteDocument;
-		try {
-			remoteDocument = await documentLoader(url);
-		} catch (error) {
-			logger.debug("Failed to fetch the actor of key {keyId} from {url}: {error}", {
-				keyId: formattedKeyId,
-				url,
-				error
-			});
-			attempts.push({
-				type: "retrievalFailed",
-				error
-			});
-			continue;
-		}
-		let resolution;
-		try {
-			const object = await Object$1.fromJsonLd(remoteDocument.document, {
-				documentLoader,
-				contextLoader,
-				tracerProvider: options.tracerProvider
-			});
-			resolution = isPortableActorDocument(object) ? await verifyPortableKeyDocument(remoteDocument.document, object, keyId, false, {
-				...options,
-				documentLoader,
-				contextLoader
-			}) : {
-				type: "rejected",
-				reason: "The document is not a portable actor."
-			};
-		} catch (error) {
-			if (error instanceof TypeError) resolution = {
-				type: "rejected",
-				reason: `The document is malformed: ${error.message}`
-			};
-			else {
-				logger.debug("Failed to process the actor of key {keyId} served from {url}: {error}", {
+	try {
+		for (const url of requestUrls) {
+			if (signal.aborted) {
+				logger.debug("Ran out of time looking up the actor of key {keyId}; gateways from {url} on were not tried.", {
 					keyId: formattedKeyId,
-					url,
-					error
+					url
 				});
 				attempts.push({
 					type: "indeterminate",
-					error
+					error: signal.reason
+				});
+				break;
+			}
+			const state = { processing: false };
+			let attempt;
+			try {
+				attempt = await raceAbort(attemptGateway(url, keyId, attemptOptions, state), signal);
+			} catch (error) {
+				if (!signal.aborted) throw error;
+				logger.debug("Ran out of time looking up the actor of key {keyId} at {url}.", {
+					keyId: formattedKeyId,
+					url
+				});
+				attempts.push({
+					type: state.processing ? "indeterminate" : "retrievalFailed",
+					error: signal.reason
 				});
 				continue;
 			}
+			if (attempt.type === "verified") return attempt;
+			attempts.push(attempt);
 		}
-		if (resolution.type === "verified") return resolution;
-		const reason = resolution.type === "rejected" ? resolution.reason : "The document is not a portable actor.";
-		logger.debug("The actor document served from {url} does not vouch for key {keyId}: {reason}", {
-			keyId: formattedKeyId,
-			url,
-			reason
-		});
-		attempts.push({
-			type: "rejected",
-			reason
-		});
+	} finally {
+		clearTimeout(timer);
 	}
 	const rejections = attempts.flatMap((a) => a.type === "rejected" ? [a.reason] : []);
 	if (rejections.length === attempts.length) return reject(rejections.join(" "));
@@ -4673,6 +4737,139 @@ async function resolvePortableActorKey(keyId, options = {}) {
 	};
 }
 /**
+* Fetches the actor's document of a key at an `ap:` or `ap+ef61:` key ID from
+* one gateway, and tells whether it vouches for the key.  It never rejects;
+* the caller races it against the lookup's timeout, and ignores what it
+* resolves to after the timeout.
+*/
+async function attemptGateway(url, keyId, options, state) {
+	const { documentLoader, contextLoader, signal, formattedKeyId } = options;
+	let remoteDocument;
+	try {
+		remoteDocument = await documentLoader(url);
+	} catch (error) {
+		logger.debug("Failed to fetch the actor of key {keyId} from {url}: {error}", {
+			keyId: formattedKeyId,
+			url,
+			error
+		});
+		return {
+			type: "retrievalFailed",
+			error
+		};
+	}
+	if (signal.aborted) return {
+		type: "indeterminate",
+		error: signal.reason
+	};
+	state.processing = true;
+	let resolution;
+	try {
+		const object = await Object$1.fromJsonLd(remoteDocument.document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+		signal.throwIfAborted();
+		resolution = isPortableActorDocument(object) ? await verifyPortableKeyDocument(remoteDocument.document, object, keyId, false, options) : {
+			type: "rejected",
+			reason: "The document is not a portable actor."
+		};
+	} catch (error) {
+		if (error instanceof TypeError && !signal.aborted) resolution = {
+			type: "rejected",
+			reason: `The document is malformed: ${error.message}`
+		};
+		else {
+			logger.debug("Failed to process the actor of key {keyId} served from {url}: {error}", {
+				keyId: formattedKeyId,
+				url,
+				error
+			});
+			return {
+				type: "indeterminate",
+				error
+			};
+		}
+	}
+	if (resolution.type === "verified") return resolution;
+	const reason = resolution.type === "rejected" ? resolution.reason : "The document is not a portable actor.";
+	logger.debug("The actor document served from {url} does not vouch for key {keyId}: {reason}", {
+		keyId: formattedKeyId,
+		url,
+		reason
+	});
+	return {
+		type: "rejected",
+		reason
+	};
+}
+/**
+* Wraps a document loader so that it gives up when the given signal aborts,
+* as well as when the signal in its own options does.  The wrapped loader is
+* passed a signal that aborts in either case, but in case it ignores that
+* signal, what it resolves to after the abort is ignored, and the wrapper
+* rejects with the reason of the abort at once.  After the abort, the wrapped
+* loader is not called at all.
+*/
+function withDeadline(loader, signal) {
+	return (url, options) => {
+		const combined = combineSignals(signal, options?.signal);
+		return raceAbort(combined.signal.aborted ? Promise.reject(combined.signal.reason) : new Promise((resolve) => resolve(loader(url, {
+			...options,
+			signal: combined.signal
+		}))), combined.signal).finally(combined.dispose);
+	};
+}
+/**
+* Makes a signal that aborts when either of the given signals does, with
+* the reason of the one that aborted first.  `AbortSignal.any()` is not
+* available on every supported runtime, e.g., Bun before 1.1.4.
+* @returns The signal, and a function that stops listening to the given
+*          signals.
+*/
+function combineSignals(signal, other) {
+	if (other == null || other === signal) return {
+		signal,
+		dispose() {}
+	};
+	const controller = new AbortController();
+	const sources = [signal, other];
+	const dispose = () => {
+		for (const source of sources) source.removeEventListener("abort", onAbort);
+	};
+	function onAbort() {
+		dispose();
+		controller.abort(this.reason);
+	}
+	const aborted = sources.find((source) => source.aborted);
+	if (aborted == null) for (const source of sources) source.addEventListener("abort", onAbort);
+	else controller.abort(aborted.reason);
+	return {
+		signal: controller.signal,
+		dispose
+	};
+}
+/**
+* Waits for the given promise unless the given signal aborts first, in which
+* case it rejects with the reason of the abort.  If the signal has aborted by
+* the time the promise settles, the abort wins as well, so that nothing that
+* settles after it counts.
+*/
+function raceAbort(promise, signal) {
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(signal.reason);
+		const settle = (settled) => {
+			signal.removeEventListener("abort", onAbort);
+			if (signal.aborted) onAbort();
+			else settled();
+		};
+		promise.then((value) => settle(() => resolve(value)), (error) => settle(() => reject(error)));
+		if (signal.aborted) onAbort();
+		else signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/**
 * Finds the nodes that stand for the key with the given canonical portable
 * ID.  A node whose ID is an `ap:` or `ap+ef61:` URI stands for the key
 * itself, e.g., Mitra lists the keys of portable actors that way while
@@ -4903,16 +5100,19 @@ function parseDraftSignature(signature) {
 * Lists the HTTP Signatures that a request claims to carry, without verifying
 * any of them.  Signatures whose key IDs are not URLs are left out.
 * @param request The request.
+* @param maxSignatures The maximum number of RFC 9421 signatures to consider,
+*                      counted the same way as by {@link verifyRequest}, so
+*                      that the signatures it ignores are not listed either.
 * @returns The signatures; RFC 9421 ones if the request has
 *          a `Signature-Input` header, or a draft-cavage one otherwise.
 * @internal
 */
-function listRequestSignatures(request) {
+function listRequestSignatures(request, maxSignatures = 3) {
 	const signatureInput = request.headers.get("Signature-Input");
 	if (signatureInput != null) {
 		const signatures = [];
-		const inputs = parseRfc9421SignatureInput(signatureInput);
-		for (const [label, input] of Object.entries(inputs)) {
+		const inputs = Object.entries(parseRfc9421SignatureInput(signatureInput));
+		for (const [label, input] of inputs.slice(0, maxSignatures)) {
 			const keyId = parseKeyId(input.keyId);
 			if (keyId == null) continue;
 			signatures.push({
@@ -5040,6 +5240,18 @@ async function signRequestRfc9421(request, privateKey, keyId, span, currentTime,
 		body
 	});
 }
+/**
+* Checks that a maximum number of signatures to verify is a positive safe
+* integer or `Infinity`.
+* @param value The value to check.
+* @param name The name of the option, used in the error message.
+* @throws {RangeError} Thrown if the value is not valid.
+* @internal
+*/
+function validateMaxSignatures(value, name) {
+	if (value === Infinity || Number.isSafeInteger(value) && value >= 1) return;
+	throw new RangeError(`${name} must be a positive integer or Infinity.`);
+}
 const supportedHashAlgorithms = {
 	"sha": "SHA-1",
 	"sha-256": "SHA-256",
@@ -5132,6 +5344,8 @@ function recordVerificationResult(span, result) {
 * @param options Options for verifying the request.
 * @returns The public key of the verified signature, or `null` if the signature
 *          could not be verified.
+* @throws {RangeError} Thrown if {@link VerifyRequestOptions.maxSignatures}
+*         is not a positive integer or `Infinity`.
 */
 async function verifyRequest(request, options = {}) {
 	const result = await verifyRequestDetailed(request, options);
@@ -5144,9 +5358,12 @@ async function verifyRequest(request, options = {}) {
 * @param request The request to verify.
 * @param options Options for verifying the request.
 * @returns The verified public key, or a structured verification failure.
+* @throws {RangeError} Thrown if {@link VerifyRequestOptions.maxSignatures}
+*         is not a positive integer or `Infinity`.
 * @since 2.1.0
 */
 async function verifyRequestDetailed(request, options = {}) {
+	if (options.maxSignatures !== void 0) validateMaxSignatures(options.maxSignatures, "maxSignatures");
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("http_signatures.verify", async (span) => {
 		if (span.isRecording()) {
 			span.setAttribute(ATTR_HTTP_REQUEST_METHOD, request.method);
@@ -5455,7 +5672,100 @@ async function verifyRfc9421ContentDigest(digestHeader, body) {
 	}
 	return false;
 }
-async function verifyRequestRfc9421(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, meterProvider, tracerProvider } = {}) {
+/**
+* Verifies one RFC 9421 signature of a request with a key.
+* @param request The request, whose body may be consumed already.
+* @param sigInput The parsed `Signature-Input` member of the signature.
+* @param sigBytes The bytes of the signature.
+* @param key The public key named by the signature.
+* @param span The span to record the algorithm and the signature on.
+* @returns Whether the signature is verified, and the algorithm of the
+*          signature if it is supported.
+*/
+async function verifyRfc9421SignatureWithKey(request, sigInput, sigBytes, key, span) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"http"
+	]);
+	let alg = sigInput.alg?.toLowerCase();
+	if (alg == null) {
+		if (key.publicKey.algorithm.name === "RSASSA-PKCS1-v1_5") alg = "hash" in key.publicKey.algorithm ? key.publicKey.algorithm.hash === "SHA-512" ? "rsa-v1_5-sha512" : "rsa-v1_5-sha256" : "rsa-v1_5-sha256";
+		else if (key.publicKey.algorithm.name === "RSA-PSS") alg = "rsa-pss-sha512";
+		else if (key.publicKey.algorithm.name === "ECDSA") alg = "namedCurve" in key.publicKey.algorithm && key.publicKey.algorithm.namedCurve === "P-256" ? "ecdsa-p256-sha256" : "ecdsa-p384-sha384";
+		else if (key.publicKey.algorithm.name === "Ed25519") alg = "ed25519";
+	}
+	if (alg) span?.setAttribute("http_signatures.algorithm", alg);
+	const algorithm = alg && rfc9421AlgorithmMap[alg];
+	if (!algorithm) {
+		logger.debug("Failed to verify; unsupported algorithm: {algorithm}", {
+			algorithm: sigInput.alg,
+			supported: Object.keys(rfc9421AlgorithmMap)
+		});
+		return {
+			verified: false,
+			mismatched: false
+		};
+	}
+	const metricAlgorithm = alg;
+	let signatureBase;
+	try {
+		signatureBase = createRfc9421SignatureBase(request, sigInput.components, sigInput.parameters);
+	} catch (error) {
+		logger.debug("Failed to create signature base for verification: {error}", {
+			error,
+			signatureInput: sigInput
+		});
+		return {
+			verified: false,
+			algorithm: metricAlgorithm,
+			mismatched: false
+		};
+	}
+	const signatureBaseBytes = new TextEncoder().encode(signatureBase);
+	span?.setAttribute("http_signatures.signature", encodeHex(sigBytes));
+	const algorithmName = typeof algorithm === "string" ? algorithm : algorithm.name;
+	if (key.publicKey.algorithm.name !== algorithmName) {
+		logger.debug("Failed to verify; key {keyId} is not a key for algorithm {algorithm}.", {
+			keyId: sigInput.keyId,
+			algorithm: alg
+		});
+		return {
+			verified: false,
+			algorithm: metricAlgorithm,
+			mismatched: true
+		};
+	}
+	let verified;
+	try {
+		verified = await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes);
+	} catch (error) {
+		logger.debug("Error during signature verification: {error}", {
+			error,
+			keyId: sigInput.keyId,
+			algorithm: sigInput.alg
+		});
+		return {
+			verified: false,
+			algorithm: metricAlgorithm,
+			mismatched: false
+		};
+	}
+	if (verified) return {
+		verified: true,
+		algorithm: metricAlgorithm
+	};
+	logger.debug("Failed to verify signature with key {keyId}; signature invalid.", {
+		keyId: sigInput.keyId,
+		signatureBase
+	});
+	return {
+		verified: false,
+		algorithm: metricAlgorithm,
+		mismatched: true
+	};
+}
+async function verifyRequestRfc9421(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, maxSignatures = 3, meterProvider, tracerProvider } = {}) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -5468,7 +5778,6 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 		logger.error("Failed to verify; the request body is locked.", { url: request.url });
 		return noSignatureResult();
 	}
-	const originalRequest = request;
 	request = request.clone();
 	const signatureInputHeader = request.headers.get("Signature-Input");
 	if (!signatureInputHeader) {
@@ -5488,6 +5797,29 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 		logger.debug("Failed to verify; no valid signatures found in Signature-Input header.", { header: signatureInputHeader });
 		return invalidSignatureResult(null);
 	}
+	if (signatureNames.length > maxSignatures) {
+		logger.debug("Verifying only the first {maxSignatures} of the {count} signatures in the Signature-Input header; the rest are ignored.", {
+			maxSignatures,
+			count: signatureNames.length
+		});
+		signatureNames.splice(maxSignatures);
+	}
+	const keyLookups = /* @__PURE__ */ new Map();
+	const refreshedKeyIds = /* @__PURE__ */ new Set();
+	const lookUpKey = (keyId, keyCache) => measureSignatureKeyFetch(meterProvider, "http", () => fetchKeyDetailed(keyId, CryptographicKey, {
+		documentLoader,
+		contextLoader,
+		keyCache,
+		tracerProvider,
+		meterProvider,
+		portableKeyResolvers: createPortableKeyResolvers({
+			documentLoader,
+			contextLoader,
+			keyCache,
+			tracerProvider,
+			meterProvider
+		})
+	}));
 	let failure = noSignatureResult();
 	let failureAlgorithm;
 	const setFailure = (result, algorithm) => {
@@ -5561,94 +5893,40 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 			setFailure(invalidSignatureResult(null));
 			continue;
 		}
-		const { key, cached, fetchError } = await measureSignatureKeyFetch(meterProvider, "http", () => fetchKeyDetailed(keyId, CryptographicKey, {
-			documentLoader,
-			contextLoader,
-			keyCache,
-			tracerProvider,
-			meterProvider,
-			portableKeyResolvers: createPortableKeyResolvers({
-				documentLoader,
-				contextLoader,
-				keyCache,
-				tracerProvider,
-				meterProvider
-			})
-		}));
-		if (fetchError != null) {
-			setFailure(keyFetchErrorResult(keyId, fetchError));
-			continue;
-		}
-		if (!key) {
-			logger.debug("Failed to fetch key: {keyId}", { keyId: sigInput.keyId });
-			setFailure(invalidSignatureResult(keyId));
-			continue;
-		}
-		let alg = sigInput.alg?.toLowerCase();
-		if (alg == null) {
-			if (key.publicKey.algorithm.name === "RSASSA-PKCS1-v1_5") alg = "hash" in key.publicKey.algorithm ? key.publicKey.algorithm.hash === "SHA-512" ? "rsa-v1_5-sha512" : "rsa-v1_5-sha256" : "rsa-v1_5-sha256";
-			else if (key.publicKey.algorithm.name === "RSA-PSS") alg = "rsa-pss-sha512";
-			else if (key.publicKey.algorithm.name === "ECDSA") alg = "namedCurve" in key.publicKey.algorithm && key.publicKey.algorithm.namedCurve === "P-256" ? "ecdsa-p256-sha256" : "ecdsa-p384-sha384";
-			else if (key.publicKey.algorithm.name === "Ed25519") alg = "ed25519";
-		}
-		if (alg) span?.setAttribute("http_signatures.algorithm", alg);
-		const algorithm = alg && rfc9421AlgorithmMap[alg];
-		const candidateAlgorithm = algorithm ? alg : void 0;
-		if (!algorithm) {
-			logger.debug("Failed to verify; unsupported algorithm: {algorithm}", {
-				algorithm: sigInput.alg,
-				supported: Object.keys(rfc9421AlgorithmMap)
-			});
-			setFailure(invalidSignatureResult(keyId));
-			continue;
-		}
-		let signatureBase;
-		try {
-			signatureBase = createRfc9421SignatureBase(request, sigInput.components, sigInput.parameters);
-		} catch (error) {
-			logger.debug("Failed to create signature base for verification: {error}", {
-				error,
-				signatureInput: sigInput
-			});
-			setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
-			continue;
+		let lookup = keyLookups.get(keyId.href);
+		if (lookup == null) {
+			lookup = await lookUpKey(keyId, keyCache);
+			keyLookups.set(keyId.href, lookup);
 		}
-		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
-		span?.setAttribute("http_signatures.signature", encodeHex(sigBytes));
-		try {
-			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes)) {
-				metricsContext.algorithm = candidateAlgorithm;
+		while (true) {
+			const { key, cached, fetchError } = lookup;
+			if (fetchError != null) {
+				setFailure(keyFetchErrorResult(keyId, fetchError));
+				break;
+			}
+			if (!key) {
+				logger.debug("Failed to fetch key: {keyId}", { keyId: sigInput.keyId });
+				setFailure(invalidSignatureResult(keyId));
+				break;
+			}
+			const result = await verifyRfc9421SignatureWithKey(request, sigInput, sigBytes, key, span);
+			if (result.verified) {
+				metricsContext.algorithm = result.algorithm;
 				return {
 					verified: true,
 					key,
 					signatureLabel: sigName
 				};
-			} else if (cached) {
+			}
+			if (result.mismatched && cached && !refreshedKeyIds.has(keyId.href)) {
 				logger.debug("Failed to verify with cached key {keyId}; retrying with fresh key...", { keyId: sigInput.keyId });
-				return await verifyRequestRfc9421(originalRequest, span, metricsContext, {
-					documentLoader,
-					contextLoader,
-					timeWindow,
-					currentTime,
-					keyCache: bypassKeyCacheReads(keyCache),
-					spec: "rfc9421",
-					meterProvider,
-					tracerProvider
-				});
-			} else {
-				logger.debug("Failed to verify signature with fetched key {keyId}; signature invalid.", {
-					keyId: sigInput.keyId,
-					signatureBase
-				});
-				setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
+				refreshedKeyIds.add(keyId.href);
+				lookup = await lookUpKey(keyId, bypassKeyCacheReads(keyCache));
+				keyLookups.set(keyId.href, lookup);
+				continue;
 			}
-		} catch (error) {
-			logger.debug("Error during signature verification: {error}", {
-				error,
-				keyId: sigInput.keyId,
-				algorithm: sigInput.alg
-			});
-			setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
+			setFailure(invalidSignatureResult(keyId), result.algorithm);
+			break;
 		}
 	}
 	metricsContext.algorithm = failureAlgorithm;
@@ -5748,16 +6026,19 @@ async function doubleKnock(request, identity, options = {}) {
 }
 async function doubleKnockInternal(request, identity, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 	const { specDeterminer, log, tracerProvider, signal } = options;
+	signal?.throwIfAborted();
 	const maximumRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
 	visited.add(request.url);
 	const origin = new URL(request.url).origin;
 	const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
+	signal?.throwIfAborted();
 	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
 	let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
 		spec: firstTrySpec,
 		tracerProvider,
 		body
 	});
+	signal?.throwIfAborted();
 	log?.(signedRequest);
 	let response = await fetchDoubleKnockRequest(request, signedRequest, signal);
 	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
@@ -5782,6 +6063,7 @@ async function doubleKnockInternal(request, identity, options, redirected = 0, v
 			let fulfilled = false;
 			let challengeRequest;
 			for (const entry of entries) {
+				signal?.throwIfAborted();
 				const rfc9421 = fulfillAcceptSignature(entry, localKeyId, localAlg);
 				if (rfc9421 == null) continue;
 				logger.debug("Received Accept-Signature challenge; accumulating label {label} and components {components}.", {
@@ -5804,6 +6086,7 @@ async function doubleKnockInternal(request, identity, options, redirected = 0, v
 				}
 			}
 			if (fulfilled && challengeRequest != null) {
+				signal?.throwIfAborted();
 				signedRequest = challengeRequest;
 				log?.(signedRequest);
 				response = await fetch(signedRequest, {
@@ -5828,11 +6111,13 @@ async function doubleKnockInternal(request, identity, options, redirected = 0, v
 			status: response.status,
 			statusText: response.statusText
 		});
+		signal?.throwIfAborted();
 		signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
 			spec,
 			tracerProvider,
 			body
 		});
+		signal?.throwIfAborted();
 		log?.(signedRequest);
 		response = await fetchDoubleKnockRequest(request, signedRequest, signal);
 		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
@@ -5875,4 +6160,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { isAbortError$1 as $, hasSignatureLike as A, fetchKey as B, assertSafeJsonLd as C, isPortableId as Ct, detachSignature as D, name as Dt, createSignature as E, isSamePublicKey as Et, verifyJsonLd as F, verifyKeyOwnership as G, generateCryptoKeyPair as H, verifySignature as I, parseKeyOwnerEvidence as J, MAX_PORTABLE_KEY_TTL as K, wrapContextLoaderForJsonLd as L, isInvalidUrlTypeError as M, signJsonLd as N, getNormalizationContextLoader as O, version as Ot, verifyCompactJsonLd as P, instrumentDocumentLoader as Q, exportJwk as R, InvalidContextReferenceError as S, isCompatibleKeyId as St, compactJsonLd as T, isPortableUri as Tt, importJwk as U, fetchKeyDetailed as V, validateCryptoKey as W, getFederationMetrics as X, getDurationMs as Y, getRemoteHost as Z, verifyPortableObjectProof as _, getCanonicalPortableId as _t, signRequest as a, recordDocumentCache as at, verifyProof as b, getRawCanonicalPortableId as bt, fetchPortableGatewayKey as c, recordOutboxActivity as ct, classifyFep2277CoreType as d, registerQueueDepthGauge as dt, recordCircuitBreakerStateChange as et, createProof as f, preloadedOnlyDocumentLoader as ft, verifyObject as g, validateAcceptSignature as gt, verifyMapLocalProof as h, parseAcceptSignature as ht, selectRequestSignature as i, recordCollectionTotalItems as it, isClearlyMalformedContextReference as j, hasSignature as k, resolvePortableActorKey as l, recordOutboxEnqueue as lt, signObject as m, fulfillAcceptSignature as mt, listRequestSignatures as n, recordCollectionPageItems as nt, verifyRequest as o, recordFanoutRecipients as ot, hasProofLike as p, formatAcceptSignature as pt, getVerifiedKeyOwnerEvidence as q, parseRfc9421SignatureInput as r, recordCollectionRequest as rt, verifyRequestDetailed as s, recordInboxActivity as st, doubleKnock as t, recordCollectionDispatchDuration as tt, InvalidPortableObjectIdError as u, recordWebFingerHandle as ut, verifyPortableObjectProofPolicy as v, getGatewayKeyBase as vt, attachSignature as w, isPortableKeyId as wt, normalizeOutgoingActivityJsonLd as x, hasPortableActor as xt, verifyPortableObjectProofWithRoot as y, getPortableDid as yt, fetchActorDocument as z };
+export { instrumentDocumentLoader as $, hasSignature as A, name as At, fetchActorDocument as B, InvalidContextReferenceError as C, hasPortableActor as Ct, createSignature as D, isPortableUri as Dt, compactJsonLd as E, isPortableKeyId as Et, verifyCompactJsonLd as F, validateCryptoKey as G, fetchKeyDetailed as H, verifyJsonLd as I, getVerifiedKeyOwnerEvidence as J, verifyKeyOwnership as K, verifySignature as L, isClearlyMalformedContextReference as M, isInvalidUrlTypeError as N, detachSignature as O, isSameObjectId as Ot, signJsonLd as P, getRemoteHost as Q, wrapContextLoaderForJsonLd as R, normalizeOutgoingActivityJsonLd as S, getRawCanonicalPortableId as St, attachSignature as T, isPortableId as Tt, generateCryptoKeyPair as U, fetchKey as V, importJwk as W, getDurationMs as X, parseKeyOwnerEvidence as Y, getFederationMetrics as Z, verifyObject as _, validateAcceptSignature as _t, signRequest as a, recordCollectionTotalItems as at, verifyPortableObjectProofWithRoot as b, getGatewayKeyBase as bt, verifyRequestDetailed as c, recordInboxActivity as ct, InvalidPortableObjectIdError as d, recordWebFingerHandle as dt, isAbortError$1 as et, classifyFep2277CoreType as f, registerQueueDepthGauge as ft, verifyMapLocalProof as g, parseAcceptSignature as gt, signObject as h, fulfillAcceptSignature as ht, selectRequestSignature as i, recordCollectionRequest as it, hasSignatureLike as j, version as jt, getNormalizationContextLoader as k, isSamePublicKey as kt, fetchPortableGatewayKey as l, recordOutboxActivity as lt, hasProofLike as m, formatAcceptSignature as mt, listRequestSignatures as n, recordCollectionDispatchDuration as nt, validateMaxSignatures as o, recordDocumentCache as ot, createProof as p, preloadedOnlyDocumentLoader as pt, MAX_PORTABLE_KEY_TTL as q, parseRfc9421SignatureInput as r, recordCollectionPageItems as rt, verifyRequest as s, recordFanoutRecipients as st, doubleKnock as t, recordCircuitBreakerStateChange as tt, resolvePortableActorKey as u, recordOutboxEnqueue as ut, verifyPortableObjectProof as v, getAuthenticationOrigin as vt, assertSafeJsonLd as w, isCompatibleKeyId as wt, verifyProof as x, getPortableDid as xt, verifyPortableObjectProofPolicy as y, getCanonicalPortableId as yt, exportJwk as z };