@fedify/fedify 2.5.0-dev.2446 → 2.5.0-dev.2492

package/dist/{http-BfW3wyQ4.cjs → http-kv1LZw-r.cjs}

@@ -17,7 +17,7 @@ json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.5.0-dev.2446+2014cb03";
+var version = "2.5.0-dev.2492+4648c04e";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -5184,6 +5184,7 @@ async function fetchActorDocumentInternal(actorId, options, propagateContextFetc
 			actorId: actorId.href,
 			error
 		});
+		if (propagateContextFetchErrors) throw new KeyContextFetchError(error);
 		return null;
 	}
 	let object;
@@ -6130,8 +6131,26 @@ function createMemoizedDocumentLoader(documentLoader) {
 		return cloneRemoteDocument(await remoteDocument);
 	};
 }
+const effectiveContextLoaderPolicies = /* @__PURE__ */ new WeakMap();
+/**
+* Marks a context loader as the *effective* loader of a policy, i.e., one
+* that already applies what {@link wrapContextLoaderForJsonLd} (`"standard"`)
+* or {@link getNormalizationContextLoader} (`"normalization"`) would add.
+* Those functions return a marked loader as is instead of wrapping it again,
+* so that a caller can observe every response a parse actually uses,
+* including Fedify's own baseline contexts.
+* @param loader The effective context loader.
+* @param policy The policy the loader already applies.
+* @returns The given loader.
+* @internal
+*/
+function markEffectiveContextLoader(loader, policy) {
+	effectiveContextLoaderPolicies.set(loader, policy);
+	return loader;
+}
 /** @internal */
 function wrapContextLoaderForJsonLd(contextLoader) {
+	if (contextLoader != null && effectiveContextLoaderPolicies.has(contextLoader)) return contextLoader;
 	const loader = contextLoader ?? builtInContextLoader;
 	return async (url, options) => {
 		try {
@@ -6145,6 +6164,7 @@ function wrapContextLoaderForJsonLd(contextLoader) {
 }
 /** @internal */
 function getNormalizationContextLoader(contextLoader) {
+	if (contextLoader != null && effectiveContextLoaderPolicies.get(contextLoader) === "normalization") return contextLoader;
 	const loader = wrapContextLoaderForJsonLd(contextLoader);
 	return createMemoizedDocumentLoader(async (url, options) => {
 		if (URL.canParse(url)) {
@@ -6597,10 +6617,17 @@ function getLdSignatureObject(jsonLd) {
 * @returns `true` if the document is authentic; `false` otherwise.
 */
 async function verifyJsonLd(jsonLd, options = {}) {
-	return await verifyJsonLdInternal(jsonLd, options, true);
+	return (await verifyJsonLdInternal(jsonLd, options, true)).verified;
 }
-/** @internal */
-async function verifyCompactJsonLd(jsonLd, options = {}) {
+/**
+* Same as {@link verifyCompactJsonLd}, but also returns the key that verified
+* the signature, whose `owner` {@link fetchKey} has confirmed.
+* @param jsonLd The compacted JSON-LD document to verify.
+* @param options Options for verifying the JSON-LD document.
+* @returns The result.
+* @internal
+*/
+async function verifyCompactJsonLdDetailed(jsonLd, options = {}) {
 	return await verifyJsonLdInternal(jsonLd, options, false);
 }
 async function verifyJsonLdInternal(jsonLd, options, compact) {
@@ -6610,7 +6637,7 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 	}, "linkedData", (observation) => verifyJsonLdInternal(jsonLd, {
 		...options,
 		[verificationObservation]: observation
-	}, compact), (value) => value);
+	}, compact), (value) => value.verified);
 	const observation = options[verificationObservation];
 	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("ld_signatures.verify", async (span) => {
 		const start = performance.now();
@@ -6642,12 +6669,18 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 			const key = await verifySignature(compacted, verificationOptions);
 			if (key == null) {
 				if (observation?.attempt != null && !hasLdSignatureProperty(jsonLd)) observation.attempt.reason = { type: "noSignature" };
-				return false;
+				return {
+					verified: false,
+					key: null
+				};
 			}
 			if (key.ownerId == null) {
 				if (observation?.attempt != null) observation.attempt.reason = { type: "missingOwner" };
 				logger$4.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
-				return false;
+				return {
+					verified: false,
+					key: null
+				};
 			}
 			attributions.delete(key.ownerId.href);
 			if (attributions.size > 0) {
@@ -6656,10 +6689,16 @@ async function verifyJsonLdInternal(jsonLd, options, compact) {
 					attributionIds: [...attributions].map((id) => new URL(id))
 				};
 				logger$4.debug("Some attributions are not authenticated by the Linked Data Signatures: {attributions}.", { attributions: [...attributions] });
-				return false;
+				return {
+					verified: false,
+					key: null
+				};
 			}
 			verified = true;
-			return true;
+			return {
+				verified: true,
+				key
+			};
 		} catch (error) {
 			threw = true;
 			span.setStatus({
@@ -7741,6 +7780,12 @@ async function verifyProofInternal(jsonLd, proof, options, messageDigestCache, r
 			keyId: proof.verificationMethodId.href,
 			error
 		});
+		const check = options[verificationObservation]?.check;
+		if (check != null && check.reason == null) check.reason = {
+			type: "keyFetchError",
+			keyId: new URL(proof.verificationMethodId.href),
+			result: { error: error instanceof Error ? error : new Error(String(error)) }
+		};
 		return null;
 	}
 	const publicKey = fetchedKey.key;
@@ -8269,6 +8314,39 @@ async function verifyPreparedPortableObjectProof(jsonLd, prepared, options, mess
 * @since 0.10.0
 */
 async function verifyObject(cls, jsonLd, options = {}) {
+	const result = await verifyObjectDetailed(cls, jsonLd, options);
+	return result.status === "verified" ? result.object : null;
+}
+/**
+* Same as {@link verifyObject}, but also tells who signed the verified proofs,
+* and whether a failure was caused by a key that could not be obtained for
+* a retryable reason.
+* @param cls The class of the object to verify.
+* @param jsonLd The JSON-LD object to verify.
+* @param options Additional options.
+* @returns The result.
+* @throws {TypeError} If the object is invalid or unsupported.
+* @internal
+*/
+async function verifyObjectDetailed(cls, jsonLd, options = {}) {
+	const classify = (result, checks) => {
+		if (result != null) return {
+			status: "verified",
+			object: result.object,
+			signers: result.signers
+		};
+		for (const check of checks) {
+			if (check.status === "error" && (0, _fedify_vocab_runtime.isTransientFetchError)(check.error)) return {
+				status: "unavailable",
+				error: check.error
+			};
+			if (check.status === "rejected" && check.reason.type === "keyFetchError" && isRetryableKeyFetchError(check.reason.result)) return {
+				status: "unavailable",
+				error: "error" in check.reason.result ? check.reason.result.error : /* @__PURE__ */ new Error(`Fetching key ${check.reason.keyId.href} failed with ${check.reason.result.status}.`)
+			};
+		}
+		return { status: "invalid" };
+	};
 	if (options[verificationObservation]?.attempt == null) {
 		const observedOptions = {
 			...options,
@@ -8280,16 +8358,16 @@ async function verifyObject(cls, jsonLd, options = {}) {
 		return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("object_integrity_proofs.verify_object", async (span) => {
 			try {
 				return await observeAttempt(observedOptions, "objectIntegrity", async (observation) => {
-					const object = await verifyObject(cls, jsonLd, {
+					const result = await verifyObjectCore(cls, jsonLd, {
 						...options,
 						[verificationObservation]: observation
 					});
-					if (object == null) {
+					if (result == null) {
 						span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 						span.setAttribute("activitypub.verification.failure_reason", observation.attempt?.reason?.type ?? "signatureVerificationFailed");
 					}
-					return object;
-				}, (value) => value != null);
+					return classify(result, observation.attempt?.checks ?? []);
+				}, (value) => value.status === "verified");
 			} catch (error) {
 				span.setStatus({
 					code: _opentelemetry_api.SpanStatusCode.ERROR,
@@ -8301,6 +8379,15 @@ async function verifyObject(cls, jsonLd, options = {}) {
 			}
 		});
 	}
+	const checks = options[verificationObservation].attempt.checks;
+	const before = checks.length;
+	return classify(await verifyObjectCore(cls, jsonLd, options), checks.slice(before));
+}
+function isRetryableKeyFetchError(result) {
+	if ("error" in result) return (0, _fedify_vocab_runtime.isTransientFetchError)(result.error);
+	return result.status >= 500 || result.status === 408 || result.status === 429;
+}
+async function verifyObjectCore(cls, jsonLd, options) {
 	const observation = options[verificationObservation];
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
@@ -8313,6 +8400,7 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	const defaultDocumentLoader = (0, _fedify_vocab_runtime.getDocumentLoader)();
 	const proofContextLoader = options.contextLoader ?? defaultDocumentLoader;
 	const attributions = new Set(object.attributionIds.map((uri) => uri.href));
+	const signers = [];
 	if (object instanceof _fedify_vocab.Activity) for (const uri of object.actorIds) attributions.add(uri.href);
 	const rawProofValues = isJsonLdNode(jsonLd) ? await getRawProofValues(jsonLd, proofContextLoader) : [];
 	const rawProofCandidates = isJsonLdNode(jsonLd) ? await parseRawProofCandidates(jsonLd, rawProofValues, options, proofContextLoader) : [];
@@ -8371,6 +8459,11 @@ async function verifyObject(cls, jsonLd, options = {}) {
 			continue;
 		}
 		deleteAuthenticatedAttribution(attributions, key.controllerId, proof.verificationMethodId);
+		const signer = getAuthenticatedController(key.controllerId, proof.verificationMethodId);
+		if (signer != null && !signers.some((s) => s.kind === signer.kind && s.id.href === signer.id.href && s.keyId.href === proof.verificationMethodId.href)) signers.push({
+			...signer,
+			keyId: proof.verificationMethodId
+		});
 	}
 	if (acceptedPortableProofs < loadedPortableProofs) {
 		logger.debug("Some portable proof references could not be dereferenced.");
@@ -8384,7 +8477,41 @@ async function verifyObject(cls, jsonLd, options = {}) {
 		logger.debug("Some attributions are not authenticated by the proofs: {attributions}.", { attributions: [...attributions] });
 		return null;
 	}
-	return object;
+	return {
+		object,
+		signers
+	};
+}
+/**
+* Tells whom a key that verified an Object Integrity Proof authenticates.
+* @param key The key, i.e., the proof's verification method.
+* @returns The signer, or `null` if the key authenticates nobody.
+* @internal
+*/
+function getProofSigner(key) {
+	if (key.id == null || key.controllerId == null) return null;
+	const signer = getAuthenticatedController(key.controllerId, key.id);
+	return signer == null ? null : {
+		...signer,
+		keyId: key.id
+	};
+}
+/**
+* Tells whom a verified proof authenticates: the key's controller if it is an
+* ordinary actor, or the DID of a portable controller if the verification
+* method belongs to the same DID.
+*/
+function getAuthenticatedController(controllerId, verificationMethodId) {
+	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) return {
+		kind: "actor",
+		id: controllerId
+	};
+	const did = getPortableDid(controllerId);
+	if (did == null || !hasCryptographicOrigin(verificationMethodId.href) || getPortableDid(verificationMethodId) !== did || !URL.canParse(did)) return null;
+	return {
+		kind: "portableAuthority",
+		id: new URL(did)
+	};
 }
 function deleteAuthenticatedAttribution(attributions, controllerId, verificationMethodId) {
 	if (!hasCryptographicOrigin(controllerId.href) && !isPortableId(controllerId)) {
@@ -10038,10 +10165,10 @@ async function createRedirectRequest(request, location, body, validateRedirect)
 		cache: request.cache
 	});
 }
-async function fetchDoubleKnockRequest(request, signedRequest, signal) {
+async function fetchDoubleKnockRequest(session, request, signedRequest, signal) {
 	const maxAttempts = request.method === "GET" || request.method === "HEAD" ? 2 : 1;
 	for (let attempt = 1;; attempt++) try {
-		return await fetch(signedRequest, {
+		return await session.fetch(signedRequest, {
 			redirect: "manual",
 			signal
 		});
@@ -10092,125 +10219,194 @@ function getAbortReason(signal) {
 	return signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
 }
 /**
-* Performs a double-knock request to the given URL.  For the details of
-* double-knocking, see
-* <https://swicg.github.io/activitypub-http-signature/#how-to-upgrade-supported-versions>.
+* Performs a double-knock request like {@link doubleKnock}, opening a session
+* for every hop with the given function, and passes the final response to
+* the given function.  The final session is closed after `consume` settles,
+* so `consume` must read or cancel the response body before it returns.
+* This is not exported from any entry point.
 * @param request The request to send.
 * @param identity The identity to use for signing the request.
 * @param options The options for double-knock requests.
-* @returns The response to the request.
-* @since 1.6.0
+* @param openHop The function to open a session for each hop.  The session of
+*                a hop is closed before the next hop is opened.
+* @param consume The function to consume the final response.
+* @returns The value returned by `consume`.
+*/
+async function doubleKnockScoped(request, identity, options, openHop, consume) {
+	const { response, session } = await doubleKnockCore(request, identity, options, openHop);
+	try {
+		return await consume(response);
+	} catch (error) {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"sig",
+			"http"
+		]).debug("Failed to consume the response from {url}; closing the session: {error}", {
+			url: request.url,
+			error
+		});
+		throw error;
+	} finally {
+		await session.close();
+	}
+}
+function isRedirectResponse(response) {
+	return response.status >= 300 && response.status < 400 && response.headers.has("Location");
+}
+/**
+* Starts cancelling the body of a response that is not passed to the caller,
+* without waiting for it to settle.  The cancellation of a branch of a tee
+* (e.g., a body cloned by a fetch mock) settles only after the other branch
+* is cancelled too, per the Streams standard, so awaiting it could block
+* forever.  Failures are only logged.
 */
-async function doubleKnock(request, identity, options = {}) {
-	return await doubleKnockInternal(request, identity, options);
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"sig",
+			"http"
+		]).debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
+		});
+	});
 }
-async function doubleKnockInternal(request, identity, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
+async function doubleKnockCore(request, identity, options, openHop) {
 	const { specDeterminer, log, tracerProvider, signal } = options;
 	signal?.throwIfAborted();
 	const maximumRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
-	visited.add(request.url);
-	const origin = new URL(request.url).origin;
-	const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
-	signal?.throwIfAborted();
+	const visited = /* @__PURE__ */ new Set();
 	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
-	let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
-		spec: firstTrySpec,
-		tracerProvider,
-		body
-	});
-	signal?.throwIfAborted();
-	log?.(signedRequest);
-	let response = await fetchDoubleKnockRequest(request, signedRequest, signal);
-	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-		if (redirected >= maximumRedirection) throw new _fedify_vocab_runtime.FetchError(request.url, `Too many redirections (${redirected + 1})`);
-		const redirectRequest = await createRedirectRequest(request, response.headers.get("Location"), body, options.validateRedirect);
-		if (visited.has(redirectRequest.url)) throw new _fedify_vocab_runtime.FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
-		return doubleKnockInternal(redirectRequest, identity, {
-			...options,
-			body
-		}, redirected + 1, visited);
-	} else if (response.status === 400 || response.status === 401 || response.status > 401) {
-		const logger = (0, _logtape_logtape.getLogger)([
-			"fedify",
-			"sig",
-			"http"
-		]);
-		const acceptSigHeader = response.headers.get("Accept-Signature");
-		if (acceptSigHeader != null) {
-			const entries = validateAcceptSignature(parseAcceptSignature(acceptSigHeader));
-			const localKeyId = identity.keyId.href;
-			const localAlg = "rsa-v1_5-sha256";
-			let fulfilled = false;
-			let challengeRequest;
-			for (const entry of entries) {
-				signal?.throwIfAborted();
-				const rfc9421 = fulfillAcceptSignature(entry, localKeyId, localAlg);
-				if (rfc9421 == null) continue;
-				logger.debug("Received Accept-Signature challenge; accumulating label {label} and components {components}.", {
-					label: rfc9421.label,
-					components: rfc9421.components
-				});
-				try {
-					challengeRequest = await signRequest(challengeRequest ?? request, identity.privateKey, identity.keyId, {
-						spec: "rfc9421",
-						tracerProvider,
-						body,
-						rfc9421
+	let session = await openHop(request.url);
+	try {
+		for (let redirected = 0;; redirected++) {
+			visited.add(request.url);
+			const origin = new URL(request.url).origin;
+			const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
+			signal?.throwIfAborted();
+			let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+				spec: firstTrySpec,
+				tracerProvider,
+				body
+			});
+			signal?.throwIfAborted();
+			log?.(signedRequest);
+			let response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+			const firstRedirected = isRedirectResponse(response);
+			if (!firstRedirected && (response.status === 400 || response.status === 401 || response.status > 401)) {
+				const logger = (0, _logtape_logtape.getLogger)([
+					"fedify",
+					"sig",
+					"http"
+				]);
+				const acceptSigHeader = response.headers.get("Accept-Signature");
+				if (acceptSigHeader != null) {
+					const entries = validateAcceptSignature(parseAcceptSignature(acceptSigHeader));
+					const localKeyId = identity.keyId.href;
+					const localAlg = "rsa-v1_5-sha256";
+					let fulfilled = false;
+					let challengeRequest;
+					for (const entry of entries) {
+						signal?.throwIfAborted();
+						const rfc9421 = fulfillAcceptSignature(entry, localKeyId, localAlg);
+						if (rfc9421 == null) continue;
+						logger.debug("Received Accept-Signature challenge; accumulating label {label} and components {components}.", {
+							label: rfc9421.label,
+							components: rfc9421.components
+						});
+						try {
+							challengeRequest = await signRequest(challengeRequest ?? request, identity.privateKey, identity.keyId, {
+								spec: "rfc9421",
+								tracerProvider,
+								body,
+								rfc9421
+							});
+							fulfilled = true;
+						} catch (error) {
+							logger.debug("Failed to fulfill Accept-Signature challenge entry {label}: {error}", {
+								label: entry.label,
+								error
+							});
+						}
+					}
+					if (fulfilled && challengeRequest != null) {
+						signal?.throwIfAborted();
+						cancelResponseBody(response, request.url);
+						signedRequest = challengeRequest;
+						log?.(signedRequest);
+						response = await session.fetch(signedRequest, {
+							redirect: "manual",
+							signal
+						});
+					}
+					if (fulfilled && !isRedirectResponse(response)) {
+						if (response.status < 300) {
+							await specDeterminer?.rememberSpec(origin, "rfc9421");
+							return {
+								response,
+								session
+							};
+						}
+						if (response.status !== 400 && response.status !== 401) return {
+							response,
+							session
+						};
+					}
+				}
+				if (!isRedirectResponse(response)) {
+					const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
+					(0, _logtape_logtape.getLogger)([
+						"fedify",
+						"sig",
+						"http"
+					]).debug("Failed to verify with the spec {spec} ({status} {statusText}); retrying with spec {secondSpec}... (double-knocking)", {
+						spec: firstTrySpec,
+						secondSpec: spec,
+						status: response.status,
+						statusText: response.statusText
 					});
-					fulfilled = true;
-				} catch (error) {
-					logger.debug("Failed to fulfill Accept-Signature challenge entry {label}: {error}", {
-						label: entry.label,
-						error
+					cancelResponseBody(response, request.url);
+					signal?.throwIfAborted();
+					signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+						spec,
+						tracerProvider,
+						body
 					});
+					signal?.throwIfAborted();
+					log?.(signedRequest);
+					response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+					if (!isRedirectResponse(response) && response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
 				}
-			}
-			if (fulfilled && challengeRequest != null) {
-				signal?.throwIfAborted();
-				signedRequest = challengeRequest;
-				log?.(signedRequest);
-				response = await fetch(signedRequest, {
-					redirect: "manual",
-					signal
-				});
-				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) return doubleKnock(await createRedirectRequest(request, response.headers.get("Location"), body, options.validateRedirect), identity, {
-					...options,
-					body
-				});
-			}
-			if (fulfilled && response.status < 300) {
-				await specDeterminer?.rememberSpec(origin, "rfc9421");
-				return response;
-			}
-			if (fulfilled && response.status !== 400 && response.status !== 401) return response;
-		}
-		const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
-		logger.debug("Failed to verify with the spec {spec} ({status} {statusText}); retrying with spec {secondSpec}... (double-knocking)", {
-			spec: firstTrySpec,
-			secondSpec: spec,
-			status: response.status,
-			statusText: response.statusText
-		});
-		signal?.throwIfAborted();
-		signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
-			spec,
-			tracerProvider,
-			body
-		});
-		signal?.throwIfAborted();
-		log?.(signedRequest);
-		response = await fetchDoubleKnockRequest(request, signedRequest, signal);
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+			} else if (!firstRedirected) await specDeterminer?.rememberSpec(origin, firstTrySpec);
+			if (!isRedirectResponse(response)) return {
+				response,
+				session
+			};
+			cancelResponseBody(response, request.url);
+			await session.close();
 			if (redirected >= maximumRedirection) throw new _fedify_vocab_runtime.FetchError(request.url, `Too many redirections (${redirected + 1})`);
-			const redirectRequest = await createRedirectRequest(request, response.headers.get("Location"), body, options.validateRedirect);
+			const location = response.headers.get("Location");
+			const redirectRequest = await createRedirectRequest(request, location, body, options.validateRedirect);
 			if (visited.has(redirectRequest.url)) throw new _fedify_vocab_runtime.FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
-			return doubleKnockInternal(redirectRequest, identity, {
-				...options,
-				body
-			}, redirected + 1, visited);
-		} else if (response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
-	} else await specDeterminer?.rememberSpec(origin, firstTrySpec);
-	return response;
+			request = redirectRequest;
+			session = await openHop(request.url);
+		}
+	} catch (error) {
+		try {
+			await session.close();
+		} catch (closeError) {
+			(0, _logtape_logtape.getLogger)([
+				"fedify",
+				"sig",
+				"http"
+			]).debug("Failed to close the session for {url}: {error}", {
+				url: request.url,
+				error: closeError
+			});
+		}
+		throw error;
+	}
 }
 /**
 * Performs a timing-safe equality comparison between two `Uint8Array` values.
@@ -10306,10 +10502,10 @@ Object.defineProperty(exports, "detachSignature", {
 		return detachSignature;
 	}
 });
-Object.defineProperty(exports, "doubleKnock", {
+Object.defineProperty(exports, "doubleKnockScoped", {
 	enumerable: true,
 	get: function() {
-		return doubleKnock;
+		return doubleKnockScoped;
 	}
 });
 Object.defineProperty(exports, "exportJwk", {
@@ -10402,6 +10598,12 @@ Object.defineProperty(exports, "getPortableDid", {
 		return getPortableDid;
 	}
 });
+Object.defineProperty(exports, "getProofSigner", {
+	enumerable: true,
+	get: function() {
+		return getProofSigner;
+	}
+});
 Object.defineProperty(exports, "getRawCanonicalPortableId", {
 	enumerable: true,
 	get: function() {
@@ -10516,6 +10718,12 @@ Object.defineProperty(exports, "listRequestSignatures", {
 		return listRequestSignatures;
 	}
 });
+Object.defineProperty(exports, "markEffectiveContextLoader", {
+	enumerable: true,
+	get: function() {
+		return markEffectiveContextLoader;
+	}
+});
 Object.defineProperty(exports, "name", {
 	enumerable: true,
 	get: function() {
@@ -10696,10 +10904,10 @@ Object.defineProperty(exports, "verificationObservation", {
 		return verificationObservation;
 	}
 });
-Object.defineProperty(exports, "verifyCompactJsonLd", {
+Object.defineProperty(exports, "verifyCompactJsonLdDetailed", {
 	enumerable: true,
 	get: function() {
-		return verifyCompactJsonLd;
+		return verifyCompactJsonLdDetailed;
 	}
 });
 Object.defineProperty(exports, "verifyJsonLd", {
@@ -10726,6 +10934,12 @@ Object.defineProperty(exports, "verifyObject", {
 		return verifyObject;
 	}
 });
+Object.defineProperty(exports, "verifyObjectDetailed", {
+	enumerable: true,
+	get: function() {
+		return verifyObjectDetailed;
+	}
+});
 Object.defineProperty(exports, "verifyPortableObjectProof", {
 	enumerable: true,
 	get: function() {