@fedify/fedify 2.5.0-dev.2448 → 2.5.0-dev.2494

package/dist/{middleware-P-AZEQMn.js → middleware-CId6efsJ.js}

@@ -2,21 +2,22 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as getVerifiedKeyOwnerEvidence, A as compactJsonLd, At as getRawCanonicalPortableId, B as verifyCompactJsonLdDetailed, C as verifyPortableObjectProofWithRoot, Ct as observeAttempt, D as InvalidContextReferenceError, Dt as getCanonicalPortableId, E as normalizeOutgoingActivityJsonLd, Et as getAuthenticationOrigin, F as hasSignatureLike, Ft as isPortableUri, I as isClearlyMalformedContextReference, It as isSameObjectId, L as isInvalidUrlTypeError, M as detachSignature, Mt as isCompatibleKeyId, N as getNormalizationContextLoader, Nt as isPortableId, O as assertSafeJsonLd, Ot as getGatewayKeyBase, P as hasSignature, Pt as isPortableKeyId, Q as MAX_PORTABLE_KEY_TTL, R as markEffectiveContextLoader, Rt as name, S as verifyPortableObjectProofPolicy, Tt as verificationObservation, U as wrapContextLoaderForJsonLd, W as exportJwk, X as validateCryptoKey, Y as importJwk, _ as signObject, _t as registerQueueDepthGauge, at as isAbortError, b as verifyObjectDetailed, c as verifyRequestDetailed, ct as recordCollectionPageItems, d as InvalidPortableObjectIdError, f as classifyFep2277CoreType, ft as recordFanoutRecipients, g as preparePortableObjectProofPolicy, gt as recordWebFingerHandle, h as hasProofLike, ht as recordOutboxEnqueue, i as selectRequestSignature, it as instrumentDocumentLoader, jt as hasPortableActor, kt as getPortableDid, lt as recordCollectionRequest, m as getProofSigner, mt as recordOutboxActivity, n as listRequestSignatures, nt as getFederationMetrics, o as validateMaxSignatures, ot as recordCircuitBreakerStateChange, pt as recordInboxActivity, r as parseRfc9421SignatureInput, rt as getRemoteHost, s as verifyRequest, st as recordCollectionDispatchDuration, t as doubleKnock, tt as getDurationMs, ut as recordCollectionTotalItems, v as verifyMapLocalProof, vt as preloadedOnlyDocumentLoader, w as verifyPreparedPortableObjectProofPolicy, wt as snapshotKey, x as verifyPortableObjectProof, y as verifyObject, yt as formatAcceptSignature, z as signJsonLd, zt as version } from "./http-BBr-VLil.js";
-import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-_S2_MeLF.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-DUlQ3s2M.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-U7uz5nx4.js";
+import { $ as getVerifiedKeyOwnerEvidence, A as compactJsonLd, At as getRawCanonicalPortableId, B as verifyCompactJsonLdDetailed, C as verifyPortableObjectProofWithRoot, Ct as observeAttempt, D as InvalidContextReferenceError, Dt as getCanonicalPortableId, E as normalizeOutgoingActivityJsonLd, Et as getAuthenticationOrigin, F as hasSignatureLike, Ft as isPortableUri, I as isClearlyMalformedContextReference, It as isSameObjectId, L as isInvalidUrlTypeError, M as detachSignature, Mt as isCompatibleKeyId, N as getNormalizationContextLoader, Nt as isPortableId, O as assertSafeJsonLd, Ot as getGatewayKeyBase, P as hasSignature, Pt as isPortableKeyId, Q as MAX_PORTABLE_KEY_TTL, R as markEffectiveContextLoader, Rt as name, S as verifyPortableObjectProofPolicy, Tt as verificationObservation, U as wrapContextLoaderForJsonLd, W as exportJwk, X as validateCryptoKey, Y as importJwk, _ as signObject, _t as registerQueueDepthGauge, at as isAbortError, b as verifyObjectDetailed, c as verifyRequestDetailed, ct as recordCollectionPageItems, d as InvalidPortableObjectIdError, f as classifyFep2277CoreType, ft as recordFanoutRecipients, g as preparePortableObjectProofPolicy, gt as recordWebFingerHandle, h as hasProofLike, ht as recordOutboxEnqueue, i as selectRequestSignature, it as instrumentDocumentLoader, jt as hasPortableActor, kt as getPortableDid, lt as recordCollectionRequest, m as getProofSigner, mt as recordOutboxActivity, n as listRequestSignatures, nt as getFederationMetrics, o as validateMaxSignatures, ot as recordCircuitBreakerStateChange, pt as recordInboxActivity, r as parseRfc9421SignatureInput, rt as getRemoteHost, s as verifyRequest, st as recordCollectionDispatchDuration, t as doubleKnockScoped, tt as getDurationMs, ut as recordCollectionTotalItems, v as verifyMapLocalProof, vt as preloadedOnlyDocumentLoader, w as verifyPreparedPortableObjectProofPolicy, wt as snapshotKey, x as verifyPortableObjectProof, y as verifyObject, yt as formatAcceptSignature, z as signJsonLd, zt as version } from "./http-CrYxBKqG.js";
+import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-DUjZb4i6.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-2jn_4V7Y.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DbgFe35y.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, PUBLIC_COLLECTION, Tombstone, getTypeId, isActor, lookupObject, lookupObserver, traverseCollection } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
-import { FetchError, UrlError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, preloadedContexts, resolveDocumentLoaderTimeout, toCompatibleEf61Id, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, preloadedContexts, resolveDocumentLoaderTimeout, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { getPortableGatewayCandidates, isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { encodeHex } from "byte-encodings/hex";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import { uniq } from "es-toolkit";
 import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
+import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { DataPointType, MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 import { parse, stringifyAsync } from "devalue";
@@ -4315,9 +4316,10 @@ function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
 *
 * @param parameters The parameters for sending the activity.
 *                   See also {@link SendActivityParameters}.
+* @param deps The dependencies, for tests.
 * @throws {Error} If the activity fails to send.
 */
-function sendActivity(options) {
+function sendActivity(options, deps = {}) {
 	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
 	return tracerProvider.getTracer(name, version).startActiveSpan("activitypub.send_activity", {
 		kind: SpanKind.CLIENT,
@@ -4333,7 +4335,7 @@ function sendActivity(options) {
 			}, () => sendActivityInternal({
 				...options,
 				tracerProvider
-			}, span));
+			}, span, deps));
 		} catch (e) {
 			span.setStatus({
 				code: SpanStatusCode.ERROR,
@@ -4418,13 +4420,14 @@ async function readLimitedResponseBody(response, maxBytes) {
 			totalBytes += value.length;
 		}
 	} finally {
+		if (truncated) reader.cancel().catch(() => {});
 		reader.releaseLock();
 	}
 	let result = chunks.join("");
 	if (truncated) result += "… (truncated)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span, deps) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -4433,9 +4436,11 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 	const federationMetrics = getFederationMetrics(meterProvider);
 	const started = performance.now();
 	let deliverySuccess = false;
-	async function validateUrl(url) {
-		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
+	const openUnvalidatedHop = deps.openHop ?? (allowPrivateAddress ? openDirectFetch : (url) => openPublicFetch(url));
+	async function openHop(url) {
+		let session;
+		try {
+			session = await openUnvalidatedHop(url);
 		} catch (error) {
 			if (error instanceof UrlError && error.reason === "dns") {
 				logger.error("DNS resolution failed for URL: {url}", {
@@ -4452,82 +4457,90 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 			});
 			throw error;
 		}
+		return session;
 	}
+	let initialSession;
 	try {
-		await validateUrl(inbox.href);
+		initialSession = await openHop(inbox.href);
 	} catch (error) {
 		if (error instanceof FetchError) federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
 		throw error;
 	}
-	headers = new Headers(headers);
-	headers.set("Content-Type", "application/activity+json");
-	const request = new Request(inbox, {
-		method: "POST",
-		headers,
-		body: JSON.stringify(activity),
-		redirect: "manual"
-	});
-	let rsaKey = null;
-	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		rsaKey = key;
-		break;
-	}
-	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
-		activityId,
-		inbox: inbox.href
-	});
-	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
-		inbox: inbox.href,
-		keys: keys.map((pair) => ({
-			keyId: pair.keyId.href,
-			privateKey: pair.privateKey
-		}))
-	});
-	let response;
+	let initialPending = true;
+	const openDeliveryHop = (url) => {
+		if (initialPending) {
+			initialPending = false;
+			return Promise.resolve(initialSession);
+		}
+		return openHop(url);
+	};
 	try {
-		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await doubleKnock(request, rsaKey, {
-			tracerProvider,
-			specDeterminer,
-			validateRedirect: validateUrl
+		headers = new Headers(headers);
+		headers.set("Content-Type", "application/activity+json");
+		const request = new Request(inbox, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(activity),
+			redirect: "manual"
 		});
-	} catch (error) {
-		const failure = error instanceof FetchError || error instanceof UrlError ? error : createFetchError(inbox.href, error);
-		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
+		let rsaKey = null;
+		for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
+			rsaKey = key;
+			break;
+		}
+		if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
 			activityId,
+			inbox: inbox.href
+		});
+		else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 			inbox: inbox.href,
-			error: failure
+			keys: keys.map((pair) => ({
+				keyId: pair.keyId.href,
+				privateKey: pair.privateKey
+			}))
 		});
-		federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
-		throw failure;
-	}
-	try {
-		if (!response.ok) {
-			let error;
-			try {
-				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
-			} catch (_) {
-				error = "";
-			}
-			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+		let outcome;
+		try {
+			outcome = rsaKey == null ? await fetchWithValidatedRedirects(request, openDeliveryHop, (response) => consumeSendActivityResponse(response, inbox)) : await doubleKnockScoped(request, rsaKey, {
+				tracerProvider,
+				specDeterminer
+			}, openDeliveryHop, (response) => consumeSendActivityResponse(response, inbox));
+		} catch (error) {
+			const failure = error instanceof FetchError || error instanceof UrlError ? error : createFetchError(inbox.href, error);
+			logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
 				activityId,
 				inbox: inbox.href,
-				status: response.status,
-				statusText: response.statusText,
-				error
+				error: failure
 			});
-			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
+			federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
+			throw failure;
+		}
+		try {
+			if (!outcome.ok) {
+				const { status, statusText, error, responseHeaders } = outcome;
+				logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+					activityId,
+					inbox: inbox.href,
+					status,
+					statusText,
+					error
+				});
+				throw new SendActivityError(inbox, status, `Failed to send activity ${activityId} to ${inbox.href} (${status} ${statusText}):\n${error}`, error, responseHeaders);
+			}
+			deliverySuccess = true;
+			const eventAttributes = {
+				"activitypub.inbox.url": inbox.href,
+				"activitypub.activity.id": activityId ?? ""
+			};
+			if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
+			const actorId = getActivityActorId(activity);
+			if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
+			span.addEvent("activitypub.activity.sent", eventAttributes);
+		} finally {
+			federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
 		}
-		deliverySuccess = true;
-		const eventAttributes = {
-			"activitypub.inbox.url": inbox.href,
-			"activitypub.activity.id": activityId ?? ""
-		};
-		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
-		const actorId = getActivityActorId(activity);
-		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
-		span.addEvent("activitypub.activity.sent", eventAttributes);
 	} finally {
-		federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
+		if (initialPending) await initialSession.close();
 	}
 }
 function createFetchError(url, cause) {
@@ -4535,10 +4548,75 @@ function createFetchError(url, cause) {
 	error.cause = cause;
 	return error;
 }
-async function fetchWithValidatedRedirects(request, validateUrl) {
+/**
+* Starts cancelling the body of a response without waiting for it to settle.
+* The cancellation of a branch of a tee (e.g., a body cloned by a fetch mock)
+* settles only after the other branch is cancelled too, per the Streams
+* standard, so awaiting it could block forever.  Failures are only logged.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		getLogger([
+			"fedify",
+			"federation",
+			"outbox"
+		]).debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
+		});
+	});
+}
+/**
+* Reads what is needed from the final response of a delivery while its
+* session is open: the body of a successful response is cancelled, and at
+* most 1 KiB of an error response body is read.
+*/
+async function consumeSendActivityResponse(response, inbox) {
+	if (response.ok) {
+		cancelResponseBody(response, response.url || inbox.href);
+		return { ok: true };
+	}
+	let error;
+	try {
+		error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
+	} catch (_) {
+		error = "";
+	}
+	return {
+		ok: false,
+		status: response.status,
+		statusText: response.statusText,
+		error,
+		responseHeaders: new Headers(response.headers)
+	};
+}
+/**
+* Sends a request without signing it, following redirects manually like the
+* Fetch standard does.  Every hop is opened with `openHop()`, which validates
+* the destination, after the previous hop is closed.  The final response is
+* passed to `consume()`, and its session is closed after that.
+* This is exported only for tests; it is not exported from any entry point.
+* @param request The request to send.
+* @param openHop The function to open a session for each hop.
+* @param consume The function to consume the final response.
+* @returns The value returned by `consume`.
+*/
+async function fetchWithValidatedRedirects(request, openHop, consume) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"outbox"
+	]);
 	let body = await request.clone().text();
 	for (let redirects = 0;; redirects++) {
-		const response = await fetch(request, { redirect: "manual" });
+		const session = await openHop(request.url);
+		let response;
+		try {
+			response = await session.fetch(request, { redirect: "manual" });
+		} catch (error) {
+			await closeAfterError(session, logger);
+			throw error;
+		}
 		const location = response.headers.get("Location");
 		if (![
 			301,
@@ -4546,11 +4624,21 @@ async function fetchWithValidatedRedirects(request, validateUrl) {
 			303,
 			307,
 			308
-		].includes(response.status) || location == null) return response;
-		await response.body?.cancel();
+		].includes(response.status) || location == null) try {
+			return await consume(response);
+		} catch (error) {
+			logger.debug("Failed to consume the response from {url}; closing the session: {error}", {
+				url: request.url,
+				error
+			});
+			throw error;
+		} finally {
+			await session.close();
+		}
+		cancelResponseBody(response, request.url);
+		await session.close();
 		if (redirects >= 20) throw new TypeError("Too many redirects");
 		const url = new URL(location, request.url);
-		await validateUrl(url.href);
 		const headers = new Headers(request.headers);
 		if (url.origin !== new URL(request.url).origin) {
 			headers.delete("Authorization");
@@ -4578,6 +4666,16 @@ async function fetchWithValidatedRedirects(request, validateUrl) {
 		});
 	}
 }
+async function closeAfterError(session, logger) {
+	try {
+		await session.close();
+	} catch (error) {
+		logger.debug("Failed to close the session for {url}: {error}", {
+			url: session.url.href,
+			error
+		});
+	}
+}
 /**
 * An error that is thrown when an activity fails to send to a remote inbox.
 * It contains structured information about the failure, including the HTTP
@@ -10804,7 +10902,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		onNotAcceptable ??= notAcceptable;
 		onUnauthorized ??= unauthorized;
 		const url = new URL(request.url);
-		const route = this.router.route(url.pathname);
+		const route = this.router.route(url.pathname, { allowUnencodedColon: true });
 		if (route == null) {
 			const media = this.hashlinkMediaDispatcher == null ? null : parseHashlinkGatewayRequest(url);
 			if (media != null) return await this.#fetchHashlinkMedia(request, media, {
@@ -12623,52 +12721,92 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 		if (object instanceof Tombstone && !(object instanceof cls) && options?.tombstone !== "passthrough") return null;
 		return object;
 	}
-	#signedKey = void 0;
+	#signedKey = null;
+	#signedKeyOwner = null;
+	#signatureChecks = /* @__PURE__ */ new WeakMap();
+	#getSignatureCheck(documentLoader, contextLoader) {
+		let checks = this.#signatureChecks.get(documentLoader);
+		if (checks == null) {
+			checks = /* @__PURE__ */ new WeakMap();
+			this.#signatureChecks.set(documentLoader, checks);
+		}
+		let check = checks.get(contextLoader);
+		if (check == null) {
+			check = {};
+			checks.set(contextLoader, check);
+		}
+		return check;
+	}
 	async getSignedKey(options = {}) {
 		if (this.#signedKey != null) return this.#signedKey;
-		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
-			documentLoader: options.documentLoader ?? this.documentLoader,
-			contextLoader: options.contextLoader ?? this.contextLoader,
+		const documentLoader = options.documentLoader ?? this.documentLoader;
+		const contextLoader = options.contextLoader ?? this.contextLoader;
+		const check = this.#getSignatureCheck(documentLoader, contextLoader);
+		if (check.key != null) return check.key;
+		const keyCache = documentLoader === this.documentLoader && contextLoader === this.contextLoader ? new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
+			documentLoader,
+			contextLoader,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			keyTtl: this.federation.publicKeyTtl
-		});
-		return this.#signedKey = await verifyRequest(this.request, {
+		}) : void 0;
+		const promise = verifyRequest(this.request, {
 			...this,
-			contextLoader: options.contextLoader ?? this.contextLoader,
-			documentLoader: options.documentLoader ?? this.documentLoader,
+			contextLoader,
+			documentLoader,
 			timeWindow: this.federation.signatureTimeWindow,
 			maxSignatures: this.federation.maxHttpSignatures,
+			keyCache,
 			meterProvider: this.meterProvider,
-			tracerProvider: options.tracerProvider ?? this.tracerProvider,
-			keyCache
+			tracerProvider: options.tracerProvider ?? this.tracerProvider
+		}).then((key) => {
+			if (key != null) this.#signedKey ??= key;
+			return key;
+		}).catch((error) => {
+			if (check.key === promise) check.key = void 0;
+			throw error;
 		});
+		check.key = promise;
+		return await promise;
 	}
-	#signedKeyOwner = void 0;
 	async getSignedKeyOwner(options = {}) {
 		if (this.#signedKeyOwner != null) return this.#signedKeyOwner;
-		const key = await this.getSignedKey(options);
-		if (key == null) return this.#signedKeyOwner = null;
-		try {
-			return this.#signedKeyOwner = await getKeyOwner(key, {
-				contextLoader: options.contextLoader ?? this.contextLoader,
-				documentLoader: options.documentLoader ?? this.documentLoader,
-				tracerProvider: options.tracerProvider ?? this.tracerProvider
-			});
-		} catch (error) {
-			if (error instanceof FetchError) {
-				getLogger([
-					"fedify",
-					"federation",
-					"actor"
-				]).warn("Failed to fetch the key owner {keyOwner} of {keyId} while verifying the request signature; treating the request as unauthenticated: {error}", {
-					keyId: key.id?.href,
-					keyOwner: error.url.href,
-					error
-				});
-				return this.#signedKeyOwner = null;
+		const normalizedOptions = {
+			documentLoader: options.documentLoader ?? this.documentLoader,
+			contextLoader: options.contextLoader ?? this.contextLoader,
+			tracerProvider: options.tracerProvider ?? this.tracerProvider
+		};
+		const check = this.#getSignatureCheck(normalizedOptions.documentLoader, normalizedOptions.contextLoader);
+		if (check.owner != null) return check.owner;
+		const promise = this.getSignedKey(normalizedOptions).then(async (key) => {
+			if (key == null) {
+				if (check.owner === promise) check.owner = void 0;
+				return null;
 			}
+			try {
+				const owner = await getKeyOwner(key, normalizedOptions);
+				if (owner != null) this.#signedKeyOwner ??= owner;
+				return owner;
+			} catch (error) {
+				if (error instanceof FetchError) {
+					getLogger([
+						"fedify",
+						"federation",
+						"actor"
+					]).warn("Failed to fetch the key owner {keyOwner} of {keyId} while verifying the request signature; treating the request as unauthenticated: {error}", {
+						keyId: key.id?.href,
+						keyOwner: error.url.href,
+						error
+					});
+					return null;
+				}
+				throw error;
+			}
+		}).catch((error) => {
+			if (check.owner === promise) check.owner = void 0;
 			throw error;
-		}
+		});
+		check.owner = promise;
+		return await promise;
 	}
 	async isSignedByAudience(object, options = {}) {
 		return await isInAudience(object, null) || await isInAudience(object, await this.getSignedKeyOwner(options), options);

package/dist/{mod-DvWOv2Ho.d.cts → mod-6TQ4UQZb.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Et as ActorHandleMapper, Qt as WebFingerLinksDispatcher, Tt as ActorDispatcher, p as RequestContext, wt as ActorAliasMapper } from "./context-BazwQrHn.cjs";
+import { Et as ActorHandleMapper, Qt as WebFingerLinksDispatcher, Tt as ActorDispatcher, p as RequestContext, wt as ActorAliasMapper } from "./context-DSuL3YWx.cjs";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 

package/dist/{mod-BHQE-7WQ.d.ts → mod-B4kBw1-8.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { B as VerifyPortableObjectProofOptions, z as VerifyPortableObjectProofFailureReason } from "./key-DhsBxxZN.js";
+import { B as VerifyPortableObjectProofOptions, z as VerifyPortableObjectProofFailureReason } from "./key-DbLNT-vA.js";
 import { Multikey } from "@fedify/vocab";
 import { PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
 

package/dist/{mod-DkhfZC1u.d.ts → mod-B7j30IQf.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { b as HttpMessageSignaturesSpecDeterminer } from "./key-DhsBxxZN.js";
+import { b as HttpMessageSignaturesSpecDeterminer } from "./key-DbLNT-vA.js";
 import { n as KvStore, t as KvKey } from "./kv-B2mzK5tl.js";
 import { t as DocumentFetchKind } from "./metrics-DoRtI0qU.js";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
@@ -46,14 +46,7 @@ interface GetAuthenticatedDocumentLoaderOptions extends DocumentLoaderFactoryOpt
 declare function getAuthenticatedDocumentLoader(identity: {
   keyId: URL;
   privateKey: CryptoKey;
-}, {
-  allowPrivateAddress,
-  maxRedirection,
-  userAgent,
-  specDeterminer,
-  timeout,
-  tracerProvider
-}?: GetAuthenticatedDocumentLoaderOptions): DocumentLoader;
+}, options?: GetAuthenticatedDocumentLoaderOptions): DocumentLoader;
 //#endregion
 //#region src/utils/kv-cache.d.ts
 /**

package/dist/{mod-B2783_3v.d.cts → mod-C1nT74IG.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { B as VerifyPortableObjectProofOptions, z as VerifyPortableObjectProofFailureReason } from "./key-nYGY4QB9.cjs";
+import { B as VerifyPortableObjectProofOptions, z as VerifyPortableObjectProofFailureReason } from "./key-DlHT4R6k.cjs";
 import { Multikey } from "@fedify/vocab";
 import { PortableObjectVerifierOptions } from "@fedify/vocab-runtime";
 

package/dist/{mod-DjZfJj9R.d.ts → mod-CIeBgsOC.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Et as ActorHandleMapper, Qt as WebFingerLinksDispatcher, Tt as ActorDispatcher, p as RequestContext, wt as ActorAliasMapper } from "./context-GlHrzdSP.js";
+import { Et as ActorHandleMapper, Qt as WebFingerLinksDispatcher, Tt as ActorDispatcher, p as RequestContext, wt as ActorAliasMapper } from "./context-DQJE9YfH.js";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 

package/dist/{mod-B5-wdzmJ.d.cts → mod-YvA4Rk8J.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { b as HttpMessageSignaturesSpecDeterminer } from "./key-nYGY4QB9.cjs";
+import { b as HttpMessageSignaturesSpecDeterminer } from "./key-DlHT4R6k.cjs";
 import { n as KvStore, t as KvKey } from "./kv-B2mzK5tl.cjs";
 import { t as DocumentFetchKind } from "./metrics-DVKYY6K1.cjs";
 import { DocumentLoader, DocumentLoaderFactoryOptions } from "@fedify/vocab-runtime";
@@ -46,14 +46,7 @@ interface GetAuthenticatedDocumentLoaderOptions extends DocumentLoaderFactoryOpt
 declare function getAuthenticatedDocumentLoader(identity: {
   keyId: URL;
   privateKey: CryptoKey;
-}, {
-  allowPrivateAddress,
-  maxRedirection,
-  userAgent,
-  specDeterminer,
-  timeout,
-  tracerProvider
-}?: GetAuthenticatedDocumentLoaderOptions): DocumentLoader;
+}, options?: GetAuthenticatedDocumentLoaderOptions): DocumentLoader;
 //#endregion
 //#region src/utils/kv-cache.d.ts
 /**

package/dist/mod.cjs

@@ -3,11 +3,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-CAl7Num5.cjs");
-const require_federation = require("./federation-D8YexkP1.cjs");
-const require_types = require("./types-poIao40f.cjs");
-const require_portable_collection = require("./portable-collection-TC-kvkVI.cjs");
-const require_kv_cache = require("./kv-cache-CjgCOz3i.cjs");
+const require_http = require("./http-2SwIR4b-.cjs");
+const require_federation = require("./federation-CFaTsSMN.cjs");
+const require_types = require("./types-hKCCjii0.cjs");
+const require_portable_collection = require("./portable-collection-BeS88JJp.cjs");
+const require_kv_cache = require("./kv-cache-Cd8xKv-x.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
 require("./sig/mod.cjs");

package/dist/mod.d.cts

@@ -1,13 +1,13 @@
 /// <reference lib="esnext.temporal" />
-import { a as InboundService, c as OutboundService, d as Software, f as Usage, i as parseNodeInfo, l as Protocol, n as ParseNodeInfoOptions, o as JsonValue, p as nodeInfoToJson, r as getNodeInfo, s as NodeInfo, t as GetNodeInfoOptions, u as Services } from "./client-D-XP_Ccb.cjs";
-import { A as AcceptSignatureParameters, B as VerifyPortableObjectProofOptions, C as VerifyRequestDetailedResult, D as verifyRequest, E as signRequest, F as validateAcceptSignature, G as signObject, H as VerifyProofOptions, I as CreateProofOptions, J as verifyProof, K as verifyObject, L as SignObjectOptions, M as formatAcceptSignature, N as fulfillAcceptSignature, O as verifyRequestDetailed, P as parseAcceptSignature, R as VerifyObjectOptions, S as SignRequestOptions, T as VerifyRequestOptions, U as createProof, V as VerifyPortableObjectProofResult, W as hasProofLike, _ as InboxVerificationKey, a as KeyCache, b as HttpMessageSignaturesSpecDeterminer, c as fetchKeyDetailed, d as InboxProofPolicyFailureReason, f as InboxSignatureCheck, g as InboxVerificationFailureReason, h as InboxVerificationAttempt, i as FetchKeyResult, j as FulfillAcceptSignatureResult, k as AcceptSignatureMember, l as generateCryptoKeyPair, m as InboxSignatureIdentity, n as FetchKeyErrorResult, o as exportJwk, p as InboxSignatureFailureReason, q as verifyPortableObjectProof, r as FetchKeyOptions, s as fetchKey, t as FetchKeyDetailedResult, u as importJwk, w as VerifyRequestFailureReason, x as Rfc9421SignRequestOptions, y as HttpMessageSignaturesSpec, z as VerifyPortableObjectProofFailureReason } from "./key-nYGY4QB9.cjs";
-import { a as VerifySignatureOptions, c as detachSignature, d as verifyJsonLd, f as verifySignature, g as getKeyOwner, h as doesActorOwnKey, i as VerifyJsonLdOptions, l as hasSignatureLike, m as GetKeyOwnerOptions, o as attachSignature, p as DoesActorOwnKeyOptions, r as SignJsonLdOptions, s as createSignature, t as CreateSignatureOptions, u as signJsonLd } from "./ld-Cel1RRZ5.cjs";
-import { $ as respondWithObject, $t as SendActivityError, A as InboxChallengePolicy, At as CollectionCursor, B as createFederation, Bt as NodeInfoDispatcher, C as FederationBenchmarkOptions, Ct as parseCircuitBreakerKvState, D as FederationStartQueueOptions, Dt as ActorKeyPairsDispatcher, E as FederationOptions, Et as ActorHandleMapper, F as PortableInboxForwardingOptions, Ft as HashlinkMediaDispatcher, G as TaskEnqueueOptions, Gt as OutboxListenerErrorHandler, H as createFederationBuilder, Ht as ObjectDispatcher, I as Rfc6570Expression, It as HashlinkMediaRequest, J as CreateExponentialBackoffPolicyOptions, Jt as PortableCollectionOwnerMapper, K as TaskHandler, Kt as OutboxPermanentFailureHandler, L as FederationKvPrefixes, Lt as InboxErrorHandler, M as MediaUploaderSetters, Mt as CustomCollectionCounter, N as ObjectCallbackSetters, Nt as CustomCollectionCursor, O as IdempotencyKeyCallback, Ot as AuthorizePredicate, P as OutboxListenerSetters, Pt as CustomCollectionDispatcher, Q as RespondWithObjectOptions, Qt as WebFingerLinksDispatcher, R as FederationOrigin, Rt as InboxListener, S as Federation, St as normalizeCircuitBreakerOptions, T as FederationFetchOptions, Tt as ActorDispatcher, U as TaskDefinition, Ut as OutboxErrorHandler, V as Message, Vt as ObjectAuthorizePredicate, W as TaskDefinitionOptions, Wt as OutboxListener, X as RetryPolicy, Xt as UnverifiedActivityHandler, Y as RetryContext, Yt as SharedInboxKeyDispatcher, Z as createExponentialBackoffPolicy, Zt as UnverifiedActivityReason, _ as ActorCallbackSetters, _t as CircuitBreakerKvState, a as GetObjectOptions, an as InboxAuthentication, at as InProcessMessageQueue, b as CustomCollectionCallbackSetters, bt as CircuitBreakerStateChange, c as IsSignedByAudienceOptions, cn as InboxRequestOutcome, ct as MessageQueueDepth, d as ParseUriResult, dt as ParallelMessageQueue, en as SenderKeyPair, et as respondWithObjectIfAcceptable, f as PortableRequest, ft as CircuitBreaker, g as SendActivityOptionsForCollection, gt as CircuitBreakerFailurePolicy, h as SendActivityOptions, ht as CircuitBreakerCreateOptions, i as GetActorOptions, in as ActivityTransformer, it as isActorAuthenticated, j as InboxListenerSetters, jt as CollectionDispatcher, k as IdempotencyStrategy, kt as CollectionCounter, l as OutboxContext, ln as InboxRequestReport, lt as MessageQueueEnqueueOptions, m as RouteActivityOptions, mt as CircuitBreakerBeforeSendDecision, n as Context, nn as buildCollectionSynchronizationHeader, nt as InboxPrincipal, o as GetSignedKeyOptions, on as InboxJsonValue, ot as InProcessMessageQueueOptions, p as RequestContext, pt as CircuitBreakerActivityDrop, q as TaskRegistry, qt as PortableActorIdMapper, r as ForwardActivityOptions, rn as digest, rt as IsActorAuthenticatedOptions, s as InboxContext, sn as InboxRequestFinishedHandler, st as MessageQueue, t as ActorKeyPair, tn as PageItems, tt as InboxAuthenticationEvidence, u as ParseUriOptions, un as InboxListenerOptions, ut as MessageQueueListenOptions, v as CollectionCallbackSetters, vt as CircuitBreakerOptions, w as FederationBuilder, wt as ActorAliasMapper, x as Federatable, xt as NormalizedCircuitBreakerOptions, y as ConstructorWithTypeId, yt as CircuitBreakerState, z as FederationQueueOptions, zt as MediaUploaderCallback } from "./context-BazwQrHn.cjs";
+import { a as InboundService, c as OutboundService, d as Software, f as Usage, i as parseNodeInfo, l as Protocol, n as ParseNodeInfoOptions, o as JsonValue, p as nodeInfoToJson, r as getNodeInfo, s as NodeInfo, t as GetNodeInfoOptions, u as Services } from "./client-3InDZbba.cjs";
+import { A as AcceptSignatureParameters, B as VerifyPortableObjectProofOptions, C as VerifyRequestDetailedResult, D as verifyRequest, E as signRequest, F as validateAcceptSignature, G as signObject, H as VerifyProofOptions, I as CreateProofOptions, J as verifyProof, K as verifyObject, L as SignObjectOptions, M as formatAcceptSignature, N as fulfillAcceptSignature, O as verifyRequestDetailed, P as parseAcceptSignature, R as VerifyObjectOptions, S as SignRequestOptions, T as VerifyRequestOptions, U as createProof, V as VerifyPortableObjectProofResult, W as hasProofLike, _ as InboxVerificationKey, a as KeyCache, b as HttpMessageSignaturesSpecDeterminer, c as fetchKeyDetailed, d as InboxProofPolicyFailureReason, f as InboxSignatureCheck, g as InboxVerificationFailureReason, h as InboxVerificationAttempt, i as FetchKeyResult, j as FulfillAcceptSignatureResult, k as AcceptSignatureMember, l as generateCryptoKeyPair, m as InboxSignatureIdentity, n as FetchKeyErrorResult, o as exportJwk, p as InboxSignatureFailureReason, q as verifyPortableObjectProof, r as FetchKeyOptions, s as fetchKey, t as FetchKeyDetailedResult, u as importJwk, w as VerifyRequestFailureReason, x as Rfc9421SignRequestOptions, y as HttpMessageSignaturesSpec, z as VerifyPortableObjectProofFailureReason } from "./key-DlHT4R6k.cjs";
+import { a as VerifySignatureOptions, c as detachSignature, d as verifyJsonLd, f as verifySignature, g as getKeyOwner, h as doesActorOwnKey, i as VerifyJsonLdOptions, l as hasSignatureLike, m as GetKeyOwnerOptions, o as attachSignature, p as DoesActorOwnKeyOptions, r as SignJsonLdOptions, s as createSignature, t as CreateSignatureOptions, u as signJsonLd } from "./ld-CWVpo_NM.cjs";
+import { $ as respondWithObject, $t as SendActivityError, A as InboxChallengePolicy, At as CollectionCursor, B as createFederation, Bt as NodeInfoDispatcher, C as FederationBenchmarkOptions, Ct as parseCircuitBreakerKvState, D as FederationStartQueueOptions, Dt as ActorKeyPairsDispatcher, E as FederationOptions, Et as ActorHandleMapper, F as PortableInboxForwardingOptions, Ft as HashlinkMediaDispatcher, G as TaskEnqueueOptions, Gt as OutboxListenerErrorHandler, H as createFederationBuilder, Ht as ObjectDispatcher, I as Rfc6570Expression, It as HashlinkMediaRequest, J as CreateExponentialBackoffPolicyOptions, Jt as PortableCollectionOwnerMapper, K as TaskHandler, Kt as OutboxPermanentFailureHandler, L as FederationKvPrefixes, Lt as InboxErrorHandler, M as MediaUploaderSetters, Mt as CustomCollectionCounter, N as ObjectCallbackSetters, Nt as CustomCollectionCursor, O as IdempotencyKeyCallback, Ot as AuthorizePredicate, P as OutboxListenerSetters, Pt as CustomCollectionDispatcher, Q as RespondWithObjectOptions, Qt as WebFingerLinksDispatcher, R as FederationOrigin, Rt as InboxListener, S as Federation, St as normalizeCircuitBreakerOptions, T as FederationFetchOptions, Tt as ActorDispatcher, U as TaskDefinition, Ut as OutboxErrorHandler, V as Message, Vt as ObjectAuthorizePredicate, W as TaskDefinitionOptions, Wt as OutboxListener, X as RetryPolicy, Xt as UnverifiedActivityHandler, Y as RetryContext, Yt as SharedInboxKeyDispatcher, Z as createExponentialBackoffPolicy, Zt as UnverifiedActivityReason, _ as ActorCallbackSetters, _t as CircuitBreakerKvState, a as GetObjectOptions, an as InboxAuthentication, at as InProcessMessageQueue, b as CustomCollectionCallbackSetters, bt as CircuitBreakerStateChange, c as IsSignedByAudienceOptions, cn as InboxRequestOutcome, ct as MessageQueueDepth, d as ParseUriResult, dt as ParallelMessageQueue, en as SenderKeyPair, et as respondWithObjectIfAcceptable, f as PortableRequest, ft as CircuitBreaker, g as SendActivityOptionsForCollection, gt as CircuitBreakerFailurePolicy, h as SendActivityOptions, ht as CircuitBreakerCreateOptions, i as GetActorOptions, in as ActivityTransformer, it as isActorAuthenticated, j as InboxListenerSetters, jt as CollectionDispatcher, k as IdempotencyStrategy, kt as CollectionCounter, l as OutboxContext, ln as InboxRequestReport, lt as MessageQueueEnqueueOptions, m as RouteActivityOptions, mt as CircuitBreakerBeforeSendDecision, n as Context, nn as buildCollectionSynchronizationHeader, nt as InboxPrincipal, o as GetSignedKeyOptions, on as InboxJsonValue, ot as InProcessMessageQueueOptions, p as RequestContext, pt as CircuitBreakerActivityDrop, q as TaskRegistry, qt as PortableActorIdMapper, r as ForwardActivityOptions, rn as digest, rt as IsActorAuthenticatedOptions, s as InboxContext, sn as InboxRequestFinishedHandler, st as MessageQueue, t as ActorKeyPair, tn as PageItems, tt as InboxAuthenticationEvidence, u as ParseUriOptions, un as InboxListenerOptions, ut as MessageQueueListenOptions, v as CollectionCallbackSetters, vt as CircuitBreakerOptions, w as FederationBuilder, wt as ActorAliasMapper, x as Federatable, xt as NormalizedCircuitBreakerOptions, y as ConstructorWithTypeId, yt as CircuitBreakerState, z as FederationQueueOptions, zt as MediaUploaderCallback } from "./context-DSuL3YWx.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-B2mzK5tl.cjs";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.cjs";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-DvWOv2Ho.cjs";
-import { i as verifyPortableObject, n as VerifyPortableObjectOptions, r as VerifyPortableObjectResult, t as VerifyPortableObjectFailureReason } from "./mod-B2783_3v.cjs";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-B5-wdzmJ.cjs";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-6TQ4UQZb.cjs";
+import { i as verifyPortableObject, n as VerifyPortableObjectOptions, r as VerifyPortableObjectResult, t as VerifyPortableObjectFailureReason } from "./mod-C1nT74IG.cjs";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-YvA4Rk8J.cjs";
 export * from "@fedify/vocab-runtime";
 
 //#region src/mod.d.ts