@fedify/fedify 2.5.0-dev.2446 → 2.5.0-dev.2448

package/dist/{http-DlNxxW_5.js → http-BBr-VLil.js}

@@ -3,7 +3,7 @@ import { URLPattern } from "urlpattern-polyfill";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, PUBLIC_COLLECTION, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, metrics, trace } from "@opentelemetry/api";
-import { FetchError, UrlError, canonicalizePortableUri, encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDidKeyVerificationMethod, parseGatewayUrl, parseIri, preloadedContexts, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, canonicalizePortableUri, encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, isTransientFetchError, parseDidKeyVerificationMethod, parseGatewayUrl, parseIri, preloadedContexts, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { getPortableGatewayCandidates, isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { encodeHex } from "byte-encodings/hex";
 import jsonld from "@fedify/vocab-runtime/jsonld";
@@ -15,7 +15,7 @@ import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.5.0-dev.2446+2014cb03";
+var version = "2.5.0-dev.2448+756933d0";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -1616,6 +1616,7 @@ async function fetchActorDocumentInternal(actorId, options, propagateContextFetc
 			actorId: actorId.href,
 			error
 		});
+		if (propagateContextFetchErrors) throw new KeyContextFetchError(error);
 		return null;
 	}
 	let object;
@@ -2562,8 +2563,26 @@ function createMemoizedDocumentLoader(documentLoader) {
 		return cloneRemoteDocument(await remoteDocument);
 	};
 }
+const effectiveContextLoaderPolicies = /* @__PURE__ */ new WeakMap();
+/**
+* Marks a context loader as the *effective* loader of a policy, i.e., one
+* that already applies what {@link wrapContextLoaderForJsonLd} (`"standard"`)
+* or {@link getNormalizationContextLoader} (`"normalization"`) would add.
+* Those functions return a marked loader as is instead of wrapping it again,
+* so that a caller can observe every response a parse actually uses,
+* including Fedify's own baseline contexts.
+* @param loader The effective context loader.
+* @param policy The policy the loader already applies.
+* @returns The given loader.
+* @internal
+*/
+function markEffectiveContextLoader(loader, policy) {
+	effectiveContextLoaderPolicies.set(loader, policy);
+	return loader;
+}
 /** @internal */
 function wrapContextLoaderForJsonLd(contextLoader) {
+	if (contextLoader != null && effectiveContextLoaderPolicies.has(contextLoader)) return contextLoader;
 	const loader = contextLoader ?? builtInContextLoader;
 	return async (url, options) => {
 		try {
@@ -2577,6 +2596,7 @@ function wrapContextLoaderForJsonLd(contextLoader) {
 }
 /** @internal */
 function getNormalizationContextLoader(contextLoader) {
+	if (contextLoader != null && effectiveContextLoaderPolicies.get(contextLoader) === "normalization") return contextLoader;
 	const loader = wrapContextLoaderForJsonLd(contextLoader);
 	return createMemoizedDocumentLoader(async (url, options) => {
 		if (URL.canParse(url)) {
@@ -3029,10 +3049,17 @@ function getLdSignatureObject(jsonLd) {
 * @returns `true` if the document is authentic; `false` otherwise.
 */
 async function verifyJsonLd(jsonLd, options = {}) {
-	return await verifyJsonLdInternal(jsonLd, options, true);
+	return (await verifyJsonLdInternal(jsonLd, options, true)).verified;
 }
-/** @internal */
-async function verifyCompactJsonLd(jsonLd, options = {}) {
+/**
+* Same as {@link verifyCompactJsonLd}, but also returns the key that verified
+* the signature, whose `owner` {@link fetchKey} has confirmed.
+* @param jsonLd The compacted JSON-LD document to verify.
+* @param options Options for verifying the JSON-LD document.
+* @returns The result.
+* @internal
+*/
+async function verifyCompactJsonLdDetailed(jsonLd, options = {}) {
 	return await verifyJsonLdInternal(jsonLd, options, false);
 }
 async function verifyJsonLdInternal(jsonLd, options, compact) {
@@ -3042,7 +3069,7 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 	}, "linkedData", (observation) => verifyJsonLdInternal(jsonLd, {
 		...options,
 		[verificationObservation]: observation
-	}, compact), (value) => value);
+	}, compact), (value) => value.verified);
 	const observation = options[verificationObservation];
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
 		const start = performance.now();
@@ -3074,12 +3101,18 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 			const key = await verifySignature(compacted, verificationOptions);
 			if (key == null) {
 				if (observation?.attempt != null && !hasLdSignatureProperty(jsonLd)) observation.attempt.reason = { type: "noSignature" };
-				return false;
+				return {
+					verified: false,
+					key: null
+				};
 			}
 			if (key.ownerId == null) {
 				if (observation?.attempt != null) observation.attempt.reason = { type: "missingOwner" };
 				logger$4.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
-				return false;
+				return {
+					verified: false,
+					key: null
+				};
 			}
 			attributions.delete(key.ownerId.href);
 			if (attributions.size > 0) {
@@ -3088,10 +3121,16 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 					attributionIds: [...attributions].map((id) => new URL(id))
 				};
 				logger$4.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
-				return false;
+				return {
+					verified: false,
+					key: null
+				};
 			}
 			verified = true;
-			return true;
+			return {
+				verified: true,
+				key
+			};
 		} catch (error) {
 			threw = true;
 			span.setStatus({
@@ -4172,6 +4211,12 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 			keyId: proof.verificationMethodId.href,
 			error
 		});
+		const check = options[verificationObservation]?.check;
+		if (check != null && check.reason == null) check.reason = {
+			type: "keyFetchError",
+			keyId: new URL(proof.verificationMethodId.href),
+			result: { error: error instanceof Error ? error : new Error(String(error)) }
+		};
 		return null;
 	}
 	const publicKey = fetchedKey.key;
@@ -4700,6 +4745,39 @@ async function verifyPreparedPortableObjectProof(jsonLd, prepared, options, mess
 * @since 0.10.0
 */
 async function verifyObject(cls, jsonLd, options = {}) {
+	const result = await verifyObjectDetailed(cls, jsonLd, options);
+	return result.status === "verified" ? result.object : null;
+}
+/**
+* Same as {@link verifyObject}, but also tells who signed the verified proofs,
+* and whether a failure was caused by a key that could not be obtained for
+* a retryable reason.
+* @param cls The class of the object to verify.
+* @param jsonLd The JSON-LD object to verify.
+* @param options Additional options.
+* @returns The result.
+* @throws {TypeError} If the object is invalid or unsupported.
+* @internal
+*/
+async function verifyObjectDetailed(cls, jsonLd, options = {}) {
+	const classify = (result, checks) => {
+		if (result != null) return {
+			status: "verified",
+			object: result.object,
+			signers: result.signers
+		};
+		for (const check of checks) {
+			if (check.status === "error" && isTransientFetchError(check.error)) return {
+				status: "unavailable",
+				error: check.error
+			};
+			if (check.status === "rejected" && check.reason.type === "keyFetchError" && isRetryableKeyFetchError(check.reason.result)) return {
+				status: "unavailable",
+				error: "error" in check.reason.result ? check.reason.result.error : /* @__PURE__ */ new Error(`Fetching key ${check.reason.keyId.href} failed with ${check.reason.result.status}.`)
+			};
+		}
+		return { status: "invalid" };
+	};
 	if (options[verificationObservation]?.attempt == null) {
 		const observedOptions = {
 			...options,
@@ -4711,16 +4789,16 @@ async function verifyObject(cls, jsonLd, options = {}) {
 		return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.verify_object", async (span) => {
 			try {
 				return await observeAttempt(observedOptions, "objectIntegrity", async (observation) => {
-					const object = await verifyObject(cls, jsonLd, {
+					const result = await verifyObjectCore(cls, jsonLd, {
 						...options,
 						[verificationObservation]: observation
 					});
-					if (object == null) {
+					if (result == null) {
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						span.setAttribute("activitypub.verification.failure_reason", observation.attempt?.reason?.type ?? "signatureVerificationFailed");
 					}
-					return object;
-				}, (value) => value != null);
+					return classify(result, observation.attempt?.checks ?? []);
+				}, (value) => value.status === "verified");
 			} catch (error) {
 				span.setStatus({
 					code: SpanStatusCode.ERROR,
@@ -4732,6 +4810,15 @@ async function verifyObject(cls, jsonLd, options = {}) {
 			}
 		});
 	}
+	const checks = options[verificationObservation].attempt.checks;
+	const before = checks.length;
+	return classify(await verifyObjectCore(cls, jsonLd, options), checks.slice(before));
+}
+function isRetryableKeyFetchError(result) {
+	if ("error" in result) return isTransientFetchError(result.error);
+	return result.status >= 500 || result.status === 408 || result.status === 429;
+}
+async function verifyObjectCore(cls, jsonLd, options) {
 	const observation = options[verificationObservation];
 	const logger = getLogger([
 		"fedify",
@@ -4744,6 +4831,7 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	const defaultDocumentLoader = getDocumentLoader();
 	const proofContextLoader = options.contextLoader ?? defaultDocumentLoader;
 	const attributions = new Set(object.attributionIds.map((uri) => uri.href));
+	const signers = [];
 	if (object instanceof Activity) for (const uri of object.actorIds) attributions.add(uri.href);
 	const rawProofValues = isJsonLdNode(jsonLd) ? await getRawProofValues(jsonLd, proofContextLoader) : [];
 	const rawProofCandidates = isJsonLdNode(jsonLd) ? await parseRawProofCandidates(jsonLd, rawProofValues, options, proofContextLoader) : [];
@@ -4802,6 +4890,11 @@ async function verifyObject(cls, jsonLd, options = {}) {
 			continue;
 		}
 		deleteAuthenticatedAttribution(attributions, key.controllerId, proof.verificationMethodId);
+		const signer = getAuthenticatedController(key.controllerId, proof.verificationMethodId);
+		if (signer != null && !signers.some((s) => s.kind === signer.kind && s.id.href === signer.id.href && s.keyId.href === proof.verificationMethodId.href)) signers.push({
+			...signer,
+			keyId: proof.verificationMethodId
+		});
 	}
 	if (acceptedPortableProofs < loadedPortableProofs) {
 		logger.debug("Some portable proof references could not be dereferenced.");
@@ -4815,7 +4908,41 @@ async function verifyObject(cls, jsonLd, options = {}) {
 		logger.debug("Some attributions are not authenticated by the proofs: {attributions}.", { attributions: [...attributions] });
 		return null;
 	}
-	return object;
+	return {
+		object,
+		signers
+	};
+}
+/**
+* Tells whom a key that verified an Object Integrity Proof authenticates.
+* @param key The key, i.e., the proof's verification method.
+* @returns The signer, or `null` if the key authenticates nobody.
+* @internal
+*/
+function getProofSigner(key) {
+	if (key.id == null || key.controllerId == null) return null;
+	const signer = getAuthenticatedController(key.controllerId, key.id);
+	return signer == null ? null : {
+		...signer,
+		keyId: key.id
+	};
+}
+/**
+* Tells whom a verified proof authenticates: the key's controller if it is an
+* ordinary actor, or the DID of a portable controller if the verification
+* method belongs to the same DID.
+*/
+function getAuthenticatedController(controllerId, verificationMethodId) {
+	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) return {
+		kind: "actor",
+		id: controllerId
+	};
+	const did = getPortableDid(controllerId);
+	if (did == null || !hasCryptographicOrigin(verificationMethodId.href) || getPortableDid(verificationMethodId) !== did || !URL.canParse(did)) return null;
+	return {
+		kind: "portableAuthority",
+		id: new URL(did)
+	};
 }
 function deleteAuthenticatedAttribution(attributions, controllerId, verificationMethodId) {
 	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) {
@@ -6670,4 +6797,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { getFederationMetrics as $, detachSignature as A, isPortableId as At, wrapContextLoaderForJsonLd as B, verifyProof as C, getAuthenticationOrigin as Ct, attachSignature as D, getRawCanonicalPortableId as Dt, assertSafeJsonLd as E, getPortableDid as Et, isInvalidUrlTypeError as F, name as Ft, generateCryptoKeyPair as G, fetchActorDocument as H, signJsonLd as I, version as It, verifyKeyOwnership as J, importJwk as K, verifyCompactJsonLd as L, hasSignature as M, isPortableUri as Mt, hasSignatureLike as N, isSameObjectId as Nt, compactJsonLd as O, hasPortableActor as Ot, isClearlyMalformedContextReference as P, isSamePublicKey as Pt, getDurationMs as Q, verifyJsonLd as R, verifyPreparedPortableObjectProofPolicy as S, verificationObservation as St, InvalidContextReferenceError as T, getGatewayKeyBase as Tt, fetchKey as U, exportJwk as V, fetchKeyDetailed as W, getVerifiedKeyOwnerEvidence as X, MAX_PORTABLE_KEY_TTL as Y, parseKeyOwnerEvidence as Z, verifyMapLocalProof as _, fulfillAcceptSignature as _t, signRequest as a, recordCollectionPageItems as at, verifyPortableObjectProofPolicy as b, observeAttempt as bt, verifyRequestDetailed as c, recordDocumentCache as ct, InvalidPortableObjectIdError as d, recordOutboxActivity as dt, getRemoteHost as et, classifyFep2277CoreType as f, recordOutboxEnqueue as ft, signObject as g, formatAcceptSignature as gt, preparePortableObjectProofPolicy as h, preloadedOnlyDocumentLoader as ht, selectRequestSignature as i, recordCollectionDispatchDuration as it, getNormalizationContextLoader as j, isPortableKeyId as jt, createSignature as k, isCompatibleKeyId as kt, fetchPortableGatewayKey as l, recordFanoutRecipients as lt, hasProofLike as m, registerQueueDepthGauge as mt, listRequestSignatures as n, isAbortError$1 as nt, validateMaxSignatures as o, recordCollectionRequest as ot, createProof as p, recordWebFingerHandle as pt, validateCryptoKey as q, parseRfc9421SignatureInput as r, recordCircuitBreakerStateChange as rt, verifyRequest as s, recordCollectionTotalItems as st, doubleKnock as t, instrumentDocumentLoader as tt, resolvePortableActorKey as u, recordInboxActivity as ut, verifyObject as v, parseAcceptSignature as vt, normalizeOutgoingActivityJsonLd as w, getCanonicalPortableId as wt, verifyPortableObjectProofWithRoot as x, snapshotKey as xt, verifyPortableObjectProof as y, validateAcceptSignature as yt, verifySignature as z };
+export { getVerifiedKeyOwnerEvidence as $, compactJsonLd as A, getRawCanonicalPortableId as At, verifyCompactJsonLdDetailed as B, verifyPortableObjectProofWithRoot as C, observeAttempt as Ct, InvalidContextReferenceError as D, getCanonicalPortableId as Dt, normalizeOutgoingActivityJsonLd as E, getAuthenticationOrigin as Et, hasSignatureLike as F, isPortableUri as Ft, fetchActorDocument as G, verifySignature as H, isClearlyMalformedContextReference as I, isSameObjectId as It, generateCryptoKeyPair as J, fetchKey as K, isInvalidUrlTypeError as L, isSamePublicKey as Lt, detachSignature as M, isCompatibleKeyId as Mt, getNormalizationContextLoader as N, isPortableId as Nt, assertSafeJsonLd as O, getGatewayKeyBase as Ot, hasSignature as P, isPortableKeyId as Pt, MAX_PORTABLE_KEY_TTL as Q, markEffectiveContextLoader as R, name as Rt, verifyPortableObjectProofPolicy as S, validateAcceptSignature as St, verifyProof as T, verificationObservation as Tt, wrapContextLoaderForJsonLd as U, verifyJsonLd as V, exportJwk as W, validateCryptoKey as X, importJwk as Y, verifyKeyOwnership as Z, signObject as _, registerQueueDepthGauge as _t, signRequest as a, isAbortError$1 as at, verifyObjectDetailed as b, fulfillAcceptSignature as bt, verifyRequestDetailed as c, recordCollectionPageItems as ct, InvalidPortableObjectIdError as d, recordDocumentCache as dt, parseKeyOwnerEvidence as et, classifyFep2277CoreType as f, recordFanoutRecipients as ft, preparePortableObjectProofPolicy as g, recordWebFingerHandle as gt, hasProofLike as h, recordOutboxEnqueue as ht, selectRequestSignature as i, instrumentDocumentLoader as it, createSignature as j, hasPortableActor as jt, attachSignature as k, getPortableDid as kt, fetchPortableGatewayKey as l, recordCollectionRequest as lt, getProofSigner as m, recordOutboxActivity as mt, listRequestSignatures as n, getFederationMetrics as nt, validateMaxSignatures as o, recordCircuitBreakerStateChange as ot, createProof as p, recordInboxActivity as pt, fetchKeyDetailed as q, parseRfc9421SignatureInput as r, getRemoteHost as rt, verifyRequest as s, recordCollectionDispatchDuration as st, doubleKnock as t, getDurationMs as tt, resolvePortableActorKey as u, recordCollectionTotalItems as ut, verifyMapLocalProof as v, preloadedOnlyDocumentLoader as vt, verifyPreparedPortableObjectProofPolicy as w, snapshotKey as wt, verifyPortableObjectProof as x, parseAcceptSignature as xt, verifyObject as y, formatAcceptSignature as yt, signJsonLd as z, version as zt };

package/dist/{http-BUJ5SFh6.mjs → http-BZkyQIkb.mjs}

@@ -3,12 +3,12 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { m as parseKeyIdString } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-eNpfj4oR.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-D3LHk6Z4.mjs";
+import { n as version, t as name } from "./deno-Dpewt_jJ.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B-QxRSSR.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
 import { a as promoteKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
-import { S as fetchKeyDetailed, T as validateCryptoKey, v as bypassKeyCacheReads } from "./ld-CD2CsPxq.mjs";
-import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-DNc_flH-.mjs";
+import { D as validateCryptoKey, b as bypassKeyCacheReads, w as fetchKeyDetailed } from "./ld-CQFuiah9.mjs";
+import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-D5tFOoV-.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{http-BfW3wyQ4.cjs → http-CAl7Num5.cjs}

@@ -17,7 +17,7 @@ json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.5.0-dev.2446+2014cb03";
+var version = "2.5.0-dev.2448+756933d0";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -5184,6 +5184,7 @@ async function fetchActorDocumentInternal(actorId, options, propagateContextFetc
 			actorId: actorId.href,
 			error
 		});
+		if (propagateContextFetchErrors) throw new KeyContextFetchError(error);
 		return null;
 	}
 	let object;
@@ -6130,8 +6131,26 @@ function createMemoizedDocumentLoader(documentLoader) {
 		return cloneRemoteDocument(await remoteDocument);
 	};
 }
+const effectiveContextLoaderPolicies = /* @__PURE__ */ new WeakMap();
+/**
+* Marks a context loader as the *effective* loader of a policy, i.e., one
+* that already applies what {@link wrapContextLoaderForJsonLd} (`"standard"`)
+* or {@link getNormalizationContextLoader} (`"normalization"`) would add.
+* Those functions return a marked loader as is instead of wrapping it again,
+* so that a caller can observe every response a parse actually uses,
+* including Fedify's own baseline contexts.
+* @param loader The effective context loader.
+* @param policy The policy the loader already applies.
+* @returns The given loader.
+* @internal
+*/
+function markEffectiveContextLoader(loader, policy) {
+	effectiveContextLoaderPolicies.set(loader, policy);
+	return loader;
+}
 /** @internal */
 function wrapContextLoaderForJsonLd(contextLoader) {
+	if (contextLoader != null && effectiveContextLoaderPolicies.has(contextLoader)) return contextLoader;
 	const loader = contextLoader ?? builtInContextLoader;
 	return async (url, options) => {
 		try {
@@ -6145,6 +6164,7 @@ function wrapContextLoaderForJsonLd(contextLoader) {
 }
 /** @internal */
 function getNormalizationContextLoader(contextLoader) {
+	if (contextLoader != null && effectiveContextLoaderPolicies.get(contextLoader) === "normalization") return contextLoader;
 	const loader = wrapContextLoaderForJsonLd(contextLoader);
 	return createMemoizedDocumentLoader(async (url, options) => {
 		if (URL.canParse(url)) {
@@ -6597,10 +6617,17 @@ function getLdSignatureObject(jsonLd) {
 * @returns `true` if the document is authentic; `false` otherwise.
 */
 async function verifyJsonLd(jsonLd, options = {}) {
-	return await verifyJsonLdInternal(jsonLd, options, true);
+	return (await verifyJsonLdInternal(jsonLd, options, true)).verified;
 }
-/** @internal */
-async function verifyCompactJsonLd(jsonLd, options = {}) {
+/**
+* Same as {@link verifyCompactJsonLd}, but also returns the key that verified
+* the signature, whose `owner` {@link fetchKey} has confirmed.
+* @param jsonLd The compacted JSON-LD document to verify.
+* @param options Options for verifying the JSON-LD document.
+* @returns The result.
+* @internal
+*/
+async function verifyCompactJsonLdDetailed(jsonLd, options = {}) {
 	return await verifyJsonLdInternal(jsonLd, options, false);
 }
 async function verifyJsonLdInternal(jsonLd, options, compact) {
@@ -6610,7 +6637,7 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 	}, "linkedData", (observation) => verifyJsonLdInternal(jsonLd, {
 		...options,
 		[verificationObservation]: observation
-	}, compact), (value) => value);
+	}, compact), (value) => value.verified);
 	const observation = options[verificationObservation];
 	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
 		const start = performance.now();
@@ -6642,12 +6669,18 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 			const key = await verifySignature(compacted, verificationOptions);
 			if (key == null) {
 				if (observation?.attempt != null && !hasLdSignatureProperty(jsonLd)) observation.attempt.reason = { type: "noSignature" };
-				return false;
+				return {
+					verified: false,
+					key: null
+				};
 			}
 			if (key.ownerId == null) {
 				if (observation?.attempt != null) observation.attempt.reason = { type: "missingOwner" };
 				logger$4.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
-				return false;
+				return {
+					verified: false,
+					key: null
+				};
 			}
 			attributions.delete(key.ownerId.href);
 			if (attributions.size > 0) {
@@ -6656,10 +6689,16 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 					attributionIds: [...attributions].map((id) => new URL(id))
 				};
 				logger$4.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
-				return false;
+				return {
+					verified: false,
+					key: null
+				};
 			}
 			verified = true;
-			return true;
+			return {
+				verified: true,
+				key
+			};
 		} catch (error) {
 			threw = true;
 			span.setStatus({
@@ -7741,6 +7780,12 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 			keyId: proof.verificationMethodId.href,
 			error
 		});
+		const check = options[verificationObservation]?.check;
+		if (check != null && check.reason == null) check.reason = {
+			type: "keyFetchError",
+			keyId: new URL(proof.verificationMethodId.href),
+			result: { error: error instanceof Error ? error : new Error(String(error)) }
+		};
 		return null;
 	}
 	const publicKey = fetchedKey.key;
@@ -8269,6 +8314,39 @@ async function verifyPreparedPortableObjectProof(jsonLd, prepared, options, mess
 * @since 0.10.0
 */
 async function verifyObject(cls, jsonLd, options = {}) {
+	const result = await verifyObjectDetailed(cls, jsonLd, options);
+	return result.status === "verified" ? result.object : null;
+}
+/**
+* Same as {@link verifyObject}, but also tells who signed the verified proofs,
+* and whether a failure was caused by a key that could not be obtained for
+* a retryable reason.
+* @param cls The class of the object to verify.
+* @param jsonLd The JSON-LD object to verify.
+* @param options Additional options.
+* @returns The result.
+* @throws {TypeError} If the object is invalid or unsupported.
+* @internal
+*/
+async function verifyObjectDetailed(cls, jsonLd, options = {}) {
+	const classify = (result, checks) => {
+		if (result != null) return {
+			status: "verified",
+			object: result.object,
+			signers: result.signers
+		};
+		for (const check of checks) {
+			if (check.status === "error" && (0, _fedify_vocab_runtime.isTransientFetchError)(check.error)) return {
+				status: "unavailable",
+				error: check.error
+			};
+			if (check.status === "rejected" && check.reason.type === "keyFetchError" && isRetryableKeyFetchError(check.reason.result)) return {
+				status: "unavailable",
+				error: "error" in check.reason.result ? check.reason.result.error : /* @__PURE__ */ new Error(`Fetching key ${check.reason.keyId.href} failed with ${check.reason.result.status}.`)
+			};
+		}
+		return { status: "invalid" };
+	};
 	if (options[verificationObservation]?.attempt == null) {
 		const observedOptions = {
 			...options,
@@ -8280,16 +8358,16 @@ async function verifyObject(cls, jsonLd, options = {}) {
 		return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.verify_object", async (span) => {
 			try {
 				return await observeAttempt(observedOptions, "objectIntegrity", async (observation) => {
-					const object = await verifyObject(cls, jsonLd, {
+					const result = await verifyObjectCore(cls, jsonLd, {
 						...options,
 						[verificationObservation]: observation
 					});
-					if (object == null) {
+					if (result == null) {
 						span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 						span.setAttribute("activitypub.verification.failure_reason", observation.attempt?.reason?.type ?? "signatureVerificationFailed");
 					}
-					return object;
-				}, (value) => value != null);
+					return classify(result, observation.attempt?.checks ?? []);
+				}, (value) => value.status === "verified");
 			} catch (error) {
 				span.setStatus({
 					code: _opentelemetry_api.SpanStatusCode.ERROR,
@@ -8301,6 +8379,15 @@ async function verifyObject(cls, jsonLd, options = {}) {
 			}
 		});
 	}
+	const checks = options[verificationObservation].attempt.checks;
+	const before = checks.length;
+	return classify(await verifyObjectCore(cls, jsonLd, options), checks.slice(before));
+}
+function isRetryableKeyFetchError(result) {
+	if ("error" in result) return (0, _fedify_vocab_runtime.isTransientFetchError)(result.error);
+	return result.status >= 500 || result.status === 408 || result.status === 429;
+}
+async function verifyObjectCore(cls, jsonLd, options) {
 	const observation = options[verificationObservation];
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
@@ -8313,6 +8400,7 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	const defaultDocumentLoader = (0, _fedify_vocab_runtime.getDocumentLoader)();
 	const proofContextLoader = options.contextLoader ?? defaultDocumentLoader;
 	const attributions = new Set(object.attributionIds.map((uri) => uri.href));
+	const signers = [];
 	if (object instanceof _fedify_vocab.Activity) for (const uri of object.actorIds) attributions.add(uri.href);
 	const rawProofValues = isJsonLdNode(jsonLd) ? await getRawProofValues(jsonLd, proofContextLoader) : [];
 	const rawProofCandidates = isJsonLdNode(jsonLd) ? await parseRawProofCandidates(jsonLd, rawProofValues, options, proofContextLoader) : [];
@@ -8371,6 +8459,11 @@ async function verifyObject(cls, jsonLd, options = {}) {
 			continue;
 		}
 		deleteAuthenticatedAttribution(attributions, key.controllerId, proof.verificationMethodId);
+		const signer = getAuthenticatedController(key.controllerId, proof.verificationMethodId);
+		if (signer != null && !signers.some((s) => s.kind === signer.kind && s.id.href === signer.id.href && s.keyId.href === proof.verificationMethodId.href)) signers.push({
+			...signer,
+			keyId: proof.verificationMethodId
+		});
 	}
 	if (acceptedPortableProofs < loadedPortableProofs) {
 		logger.debug("Some portable proof references could not be dereferenced.");
@@ -8384,7 +8477,41 @@ async function verifyObject(cls, jsonLd, options = {}) {
 		logger.debug("Some attributions are not authenticated by the proofs: {attributions}.", { attributions: [...attributions] });
 		return null;
 	}
-	return object;
+	return {
+		object,
+		signers
+	};
+}
+/**
+* Tells whom a key that verified an Object Integrity Proof authenticates.
+* @param key The key, i.e., the proof's verification method.
+* @returns The signer, or `null` if the key authenticates nobody.
+* @internal
+*/
+function getProofSigner(key) {
+	if (key.id == null || key.controllerId == null) return null;
+	const signer = getAuthenticatedController(key.controllerId, key.id);
+	return signer == null ? null : {
+		...signer,
+		keyId: key.id
+	};
+}
+/**
+* Tells whom a verified proof authenticates: the key's controller if it is an
+* ordinary actor, or the DID of a portable controller if the verification
+* method belongs to the same DID.
+*/
+function getAuthenticatedController(controllerId, verificationMethodId) {
+	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) return {
+		kind: "actor",
+		id: controllerId
+	};
+	const did = getPortableDid(controllerId);
+	if (did == null || !hasCryptographicOrigin(verificationMethodId.href) || getPortableDid(verificationMethodId) !== did || !URL.canParse(did)) return null;
+	return {
+		kind: "portableAuthority",
+		id: new URL(did)
+	};
 }
 function deleteAuthenticatedAttribution(attributions, controllerId, verificationMethodId) {
 	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) {
@@ -10402,6 +10529,12 @@ Object.defineProperty(exports, "getPortableDid", {
 		return getPortableDid;
 	}
 });
+Object.defineProperty(exports, "getProofSigner", {
+	enumerable: true,
+	get: function() {
+		return getProofSigner;
+	}
+});
 Object.defineProperty(exports, "getRawCanonicalPortableId", {
 	enumerable: true,
 	get: function() {
@@ -10516,6 +10649,12 @@ Object.defineProperty(exports, "listRequestSignatures", {
 		return listRequestSignatures;
 	}
 });
+Object.defineProperty(exports, "markEffectiveContextLoader", {
+	enumerable: true,
+	get: function() {
+		return markEffectiveContextLoader;
+	}
+});
 Object.defineProperty(exports, "name", {
 	enumerable: true,
 	get: function() {
@@ -10696,10 +10835,10 @@ Object.defineProperty(exports, "verificationObservation", {
 		return verificationObservation;
 	}
 });
-Object.defineProperty(exports, "verifyCompactJsonLd", {
+Object.defineProperty(exports, "verifyCompactJsonLdDetailed", {
 	enumerable: true,
 	get: function() {
-		return verifyCompactJsonLd;
+		return verifyCompactJsonLdDetailed;
 	}
 });
 Object.defineProperty(exports, "verifyJsonLd", {
@@ -10726,6 +10865,12 @@ Object.defineProperty(exports, "verifyObject", {
 		return verifyObject;
 	}
 });
+Object.defineProperty(exports, "verifyObjectDetailed", {
+	enumerable: true,
+	get: function() {
+		return verifyObjectDetailed;
+	}
+});
 Object.defineProperty(exports, "verifyPortableObjectProof", {
 	enumerable: true,
 	get: function() {