@fedify/cli 2.3.0-dev.994 → 2.3.0

package/dist/bench/action.js

@@ -0,0 +1,469 @@
+import "@js-temporal/polyfill";
+import { describeError } from "../utils.js";
+import { getContextLoader, getDocumentLoader } from "../docloader.js";
+import { buildFleet } from "./actor/fleet.js";
+import { convertUrlIfHandle } from "../webfinger/lib.js";
+import { discoverInbox, selectInbox } from "./discovery/discover.js";
+import { actorUrlsFromRecipients, objectUrlsFromSource } from "./scenarios/object-discovery.js";
+import { validateExpectBlock } from "./result/expect/evaluate.js";
+import { buildReport, buildScenarioResult, configHash, detectEnvironment } from "./result/build.js";
+import { probeBenchmarkMode } from "./discovery/probe.js";
+import { renderReport } from "./render/index.js";
+import { loadSuiteFile, renderSuiteTemplates } from "./scenario/load.js";
+import { normalizeSuite } from "./scenario/normalize.js";
+import { validateSuite } from "./scenario/validate.js";
+import { UnsafeTargetError, assertInboxDestinationAllowed, assertTargetAllowed, assertUnsafeOverrideAllowed } from "./safety/gate.js";
+import { classifyResolvedTarget } from "./safety/tiers.js";
+import { resolveAdvertiseHost, spawnSyntheticServer } from "./server/synthetic.js";
+import { runnerFor } from "./scenarios/registry.js";
+import process from "node:process";
+import { writeFile } from "node:fs/promises";
+//#region src/bench/action.ts
+/**
+* Runs the `fedify bench` command: load and validate the suite, gate the
+* target, run each scenario, and render the report.  The process exits 0 when
+* every `expect` gate passes and 1 otherwise; configuration and safety errors
+* exit 2.
+* @param command The parsed `bench` command options.
+* @param deps Injectable dependencies for testing.
+*/
+async function runBench(command, deps = {}) {
+	const exit = deps.exit ?? ((code) => {
+		process.exitCode = code;
+	});
+	const writeOutput = deps.writeOutput ?? defaultWriteOutput;
+	const log = deps.log ?? ((message) => process.stderr.write(`${message}\n`));
+	const signal = deps.signal;
+	const fetchImpl = withUserAgent(withAbortSignal(deps.fetch ?? fetch, signal), command.userAgent);
+	const explicitCliTarget = command.explicitCliTarget ?? command.target != null;
+	throwIfAborted(signal);
+	let validated;
+	let suite;
+	try {
+		validated = validateSuite(renderSuiteTemplates(await loadSuiteFile(command.scenario), command.target), command.scenario);
+		suite = normalizeSuite(validated, { target: command.target });
+	} catch (error) {
+		log(describeError(error));
+		exit(2);
+		return;
+	}
+	throwIfAborted(signal);
+	let runners;
+	try {
+		runners = suite.scenarios.map((scenario) => {
+			const runner = runnerFor(scenario.type);
+			runner.validate?.(scenario, { scenarios: suite.scenarios });
+			validateExpectBlock(scenario.expect);
+			return runner;
+		});
+		if (command.advertiseHost != null) resolveAdvertiseHost(command.advertiseHost);
+	} catch (error) {
+		log(describeError(error));
+		exit(2);
+		return;
+	}
+	throwIfAborted(signal);
+	const tier = await classifyResolvedTarget(suite.target, deps.resolveTargetAddresses);
+	throwIfAborted(signal);
+	const probe = await probeBenchmarkMode(suite.target, fetchImpl);
+	throwIfAborted(signal);
+	try {
+		if (!command.dryRun) assertUnsafeOverrideAllowed({
+			tier,
+			benchmarkMode: probe.benchmarkMode,
+			allowUnsafe: command.allowUnsafeTarget,
+			explicitCliTarget,
+			scenarios: unsafeOverrideScenarios(validated)
+		});
+		assertTargetAllowed({
+			tier,
+			benchmarkMode: probe.benchmarkMode,
+			allowUnsafe: command.allowUnsafeTarget,
+			dryRun: command.dryRun
+		});
+	} catch (error) {
+		if (error instanceof UnsafeTargetError) {
+			log(error.message);
+			exit(2);
+			return;
+		}
+		throw error;
+	}
+	const allowPrivateAddress = tier !== "public";
+	const documentLoader = await getDocumentLoader({
+		allowPrivateAddress,
+		userAgent: command.userAgent
+	});
+	const contextLoader = await getContextLoader({
+		allowPrivateAddress,
+		userAgent: command.userAgent
+	});
+	const assertDestinationAllowed = async (url, scenario) => {
+		const destinationTier = url.origin === suite.target.origin ? tier : await classifyResolvedTarget(url, deps.resolveTargetAddresses);
+		assertInboxDestinationAllowed(url, {
+			targetOrigin: suite.target.origin,
+			targetTier: tier,
+			destinationTier,
+			targetBenchmarkMode: probe.benchmarkMode,
+			allowUnsafe: command.allowUnsafeTarget,
+			advertised: command.advertiseHost != null
+		});
+		assertPublicDestinationOverrideAllowed(url, scenario, {
+			targetOrigin: suite.target.origin,
+			targetBenchmarkMode: probe.benchmarkMode,
+			allowUnsafe: command.allowUnsafeTarget,
+			explicitCliTarget,
+			destinationTier,
+			defaults: validated.defaults
+		});
+	};
+	const assertDestinationWithoutSyntheticServerAllowed = async (url, scenario, loadDescription) => {
+		const sameOrigin = url.origin === suite.target.origin;
+		const destinationTier = sameOrigin ? tier : await classifyResolvedTarget(url, deps.resolveTargetAddresses);
+		const inheritsTargetGate = sameOrigin && probe.benchmarkMode;
+		if (destinationTier === "public" && !inheritsTargetGate && !command.allowUnsafeTarget) throw new UnsafeTargetError(`Refusing to send ${loadDescription} to ${url.href}: it is public and not part of the benchmarked target.  Pass --allow-unsafe-target to override.`);
+		assertPublicDestinationOverrideAllowed(url, scenario, {
+			targetOrigin: suite.target.origin,
+			targetBenchmarkMode: probe.benchmarkMode,
+			allowUnsafe: command.allowUnsafeTarget,
+			explicitCliTarget,
+			destinationTier,
+			defaults: validated.defaults
+		});
+	};
+	const assertReadDestinationAllowed = (url, scenario) => assertDestinationWithoutSyntheticServerAllowed(url, scenario, "benchmark read load");
+	const assertActorlessDestinationAllowed = (url, scenario) => assertDestinationWithoutSyntheticServerAllowed(url, scenario, "benchmark load");
+	if (command.dryRun) try {
+		await writeOutput(await renderPlan(suite, {
+			documentLoader,
+			contextLoader,
+			allowPrivateAddress,
+			fetch: fetchImpl,
+			assertDestinationAllowed,
+			assertReadDestinationAllowed
+		}), command.output);
+		exit(0);
+		return;
+	} catch (error) {
+		log(describeError(error));
+		exit(2);
+		return;
+	}
+	if (tier !== "loopback" && command.advertiseHost == null && suite.scenarios.some((scenario) => scenarioNeedsReachableLocalServer(scenario, suite.scenarios))) {
+		log("Some scenarios need benchmark-owned local servers to be reachable from the target.  A loopback target reaches them automatically; for a non-loopback target, pass --advertise-host with an address the target can reach, or use a scenario that does not need local benchmark servers such as webfinger.");
+		exit(2);
+		return;
+	}
+	let fleet;
+	const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+	try {
+		throwIfAborted(signal);
+		if (suite.scenarios.some((scenario) => scenarioNeedsSyntheticServer(scenario, suite.scenarios))) fleet = await spawnSyntheticServer(await buildFleet(suite.actors), { advertiseHost: command.advertiseHost });
+		const results = [];
+		for (let i = 0; i < suite.scenarios.length; i++) {
+			const scenario = suite.scenarios[i];
+			const measurements = [];
+			for (let run = 1; run <= scenario.runs; run++) {
+				throwIfAborted(signal);
+				const suffix = scenario.runs === 1 ? "" : ` run ${run}/${scenario.runs}`;
+				log(`Running scenario "${scenario.name}" (${scenario.type})${suffix}…`);
+				measurements.push(await runners[i].run({
+					scenario,
+					scenarios: suite.scenarios,
+					target: suite.target,
+					documentLoader,
+					contextLoader,
+					allowPrivateAddress,
+					fleet: fleet ?? null,
+					advertiseHost: command.advertiseHost,
+					fetch: fetchImpl,
+					assertDestinationAllowed: (url, gateScenario) => assertDestinationAllowed(url, gateScenario ?? scenario),
+					assertReadDestinationAllowed: (url, gateScenario) => assertReadDestinationAllowed(url, gateScenario ?? scenario),
+					assertActorlessDestinationAllowed: (url, gateScenario) => assertActorlessDestinationAllowed(url, gateScenario ?? scenario),
+					signal
+				}));
+				throwIfAborted(signal);
+			}
+			results.push(buildScenarioResult(scenario, measurements));
+		}
+		const report = buildReport({
+			scenarios: results,
+			environment: detectEnvironment(),
+			target: {
+				url: suite.target.href,
+				fedifyVersion: probe.fedifyVersion,
+				statsAvailable: probe.benchmarkMode
+			},
+			startedAt,
+			finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			suite: { configHash: configHash({
+				suite: validated,
+				target: suite.target.href
+			}) }
+		});
+		await writeOutput(renderReport(report, command.format), command.output);
+		exit(report.passed ? 0 : 1);
+		return;
+	} catch (error) {
+		if (error instanceof UnsafeTargetError) {
+			log(error.message);
+			exit(2);
+			return;
+		}
+		throw error;
+	} finally {
+		await fleet?.close();
+	}
+}
+/**
+* Wraps a fetch implementation so every request carries the given User-Agent,
+* unless the caller already set one.  A prebuilt {@link Request} (the signed
+* inbox delivery, a WebFinger GET) is mutated in place rather than recloned, so
+* an already-signed body and its digest are left untouched; the User-Agent is
+* not part of the signed header set, so adding it does not affect verification.
+* @param fetchImpl The underlying fetch implementation.
+* @param userAgent The User-Agent header value to apply.
+* @returns A fetch implementation that injects the User-Agent.
+*/
+function withUserAgent(fetchImpl, userAgent) {
+	return ((input, init) => {
+		if (input instanceof Request && init === void 0) {
+			if (input.headers.has("user-agent")) return fetchImpl(input);
+			try {
+				input.headers.set("user-agent", userAgent);
+				return fetchImpl(input);
+			} catch {
+				const headers = new Headers(input.headers);
+				headers.set("user-agent", userAgent);
+				return fetchImpl(new Request(input, { headers }));
+			}
+		}
+		const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
+		if (!headers.has("user-agent")) headers.set("user-agent", userAgent);
+		return fetchImpl(input, {
+			...init,
+			headers
+		});
+	});
+}
+function withAbortSignal(fetchImpl, signal) {
+	if (signal == null) return fetchImpl;
+	return ((input, init) => {
+		if (signal.aborted) return Promise.reject(abortReason(signal));
+		return fetchImpl(input, {
+			...init,
+			signal
+		});
+	});
+}
+function throwIfAborted(signal) {
+	if (signal?.aborted) throw abortReason(signal);
+}
+function abortReason(signal) {
+	return signal.reason ?? /* @__PURE__ */ new Error("Benchmark run aborted.");
+}
+async function defaultWriteOutput(content, outputPath) {
+	if (outputPath == null) {
+		process.stdout.write(content.endsWith("\n") ? content : `${content}\n`);
+		return;
+	}
+	await writeFile(outputPath, content, { encoding: "utf-8" });
+}
+async function renderPlan(suite, context) {
+	const lines = [
+		"Fedify benchmark plan (dry run)",
+		"",
+		`Target: ${suite.target.href}`,
+		""
+	];
+	for (const scenario of suite.scenarios) {
+		lines.push(`- ${scenario.name} (${scenario.type}): ${describePlan(scenario)}`);
+		lines.push(...await describeDiscoveryPlan(scenario, suite, context));
+	}
+	lines.push("", "No benchmark load was sent.  Discovery and stats probe requests may have been sent.");
+	return `${lines.join("\n")}\n`;
+}
+function describePlan(scenario) {
+	const load = scenario.load.kind === "open" ? `open-loop ${scenario.load.ratePerSec}/s ${scenario.load.arrival}` : `closed-loop concurrency ${scenario.load.concurrency}`;
+	const totalDurationMs = scenario.durationMs * scenario.runs;
+	const volume = describePlannedRequestVolume(scenario);
+	return [
+		load,
+		`duration ${scenario.durationMs}ms`,
+		`runs ${scenario.runs}`,
+		`total duration ${totalDurationMs}ms`,
+		...volume == null ? [] : [volume],
+		`signing ${scenario.signing}`
+	].join(", ");
+}
+function describePlannedRequestVolume(scenario) {
+	if (scenario.load.kind !== "open") return null;
+	return `estimated scheduled requests ${formatPlanNumber(scenario.load.ratePerSec * (scenario.durationMs / 1e3) * scenario.runs)}`;
+}
+function formatPlanNumber(value) {
+	if (Number.isInteger(value)) return String(value);
+	const formatted = value.toFixed(2).replace(/\.?0+$/, "");
+	return formatted === "" ? "0" : formatted;
+}
+async function describeDiscoveryPlan(scenario, suite, context) {
+	switch (scenario.type) {
+		case "inbox": return await describeInboxDiscoveryPlan(scenario, context);
+		case "webfinger": return describeWebFingerPlan(scenario, suite.target);
+		case "actor": return await describeActorPlan(scenario, suite, context);
+		case "object": return await describeObjectPlan(scenario, suite, context);
+		case "mixed": return describeMixedPlan(scenario);
+		default: return ["  discovery: not available for this scenario type"];
+	}
+}
+async function describeInboxDiscoveryPlan(scenario, context) {
+	const lines = [];
+	for (const recipient of scenario.recipients) {
+		let discovered;
+		try {
+			discovered = await discoverInbox(recipient, {
+				documentLoader: context.documentLoader,
+				contextLoader: context.contextLoader,
+				allowPrivateAddress: context.allowPrivateAddress
+			});
+		} catch (error) {
+			lines.push(`  recipient ${recipient}: discovery failed (${describeError(error)})`);
+			continue;
+		}
+		const inbox = selectInbox(discovered, scenario.inbox);
+		lines.push(`  recipient ${recipient}: actor ${discovered.actorUri.href}, inbox ${inbox.href}`);
+		lines.push(`  destination safety: ${await describeDestinationSafety(inbox, scenario, context)}`);
+	}
+	return lines;
+}
+function describeWebFingerPlan(scenario, target) {
+	return (scenario.recipients.length > 0 ? scenario.recipients : [target.href]).map((recipient) => {
+		const resource = convertUrlIfHandle(recipient).href;
+		const url = new URL("/.well-known/webfinger", target);
+		url.searchParams.set("resource", resource);
+		return `  webfinger ${resource}: GET ${url.href}`;
+	});
+}
+async function describeActorPlan(scenario, suite, context) {
+	try {
+		const urls = await actorUrlsFromRecipients(scenario.recipients, {
+			target: suite.target,
+			fetch: context.fetch
+		});
+		const lines = [];
+		for (const url of urls) {
+			lines.push(`  actor: GET ${url.href}`);
+			lines.push(`  destination safety: ${await describeDestinationSafety(url, scenario, context)}`);
+		}
+		return lines;
+	} catch (error) {
+		return [`  actor discovery failed (${describeError(error)})`];
+	}
+}
+async function describeObjectPlan(scenario, suite, context) {
+	try {
+		const urls = await objectUrlsFromSource({
+			source: scenario.source,
+			target: suite.target,
+			fetch: context.fetch,
+			assertReadDestinationAllowed: (url) => context.assertReadDestinationAllowed(url, scenario)
+		});
+		const lines = [`  objects: ${urls.length} URL(s) resolved`];
+		for (const url of urls.slice(0, 10)) {
+			lines.push(`  object: GET ${url.href}`);
+			lines.push(`  destination safety: ${await describeDestinationSafety(url, scenario, context)}`);
+		}
+		if (urls.length > 10) lines.push(`  ... ${urls.length - 10} more`);
+		return lines;
+	} catch (error) {
+		return [`  object discovery failed (${describeError(error)})`];
+	}
+}
+function describeMixedPlan(scenario) {
+	const entries = scenario.raw.mix ?? [];
+	if (entries.length < 1) return ["  mix: no child scenarios"];
+	return entries.map((entry) => `  mix: ${entry.scenario} weight ${entry.weight}`);
+}
+async function describeDestinationSafety(url, scenario, context) {
+	try {
+		if (usesReadDestinationGate(scenario)) await context.assertReadDestinationAllowed(url, scenario);
+		else await context.assertDestinationAllowed(url, scenario);
+		return "allowed";
+	} catch (error) {
+		if (error instanceof UnsafeTargetError) return `would be refused: ${error.message}`;
+		throw error;
+	}
+}
+function usesReadDestinationGate(scenario) {
+	return (scenario.type === "actor" || scenario.type === "object") && !scenario.authenticated;
+}
+function assertPublicDestinationOverrideAllowed(url, scenario, context) {
+	const inheritsTargetGate = url.origin === context.targetOrigin && context.targetBenchmarkMode;
+	if (context.destinationTier !== "public" || inheritsTargetGate || !context.allowUnsafe) return;
+	assertUnsafeOverrideAllowed({
+		tier: "public",
+		benchmarkMode: false,
+		allowUnsafe: true,
+		explicitCliTarget: context.explicitCliTarget,
+		scenarios: [unsafeOverrideScenario(scenario, context.defaults)]
+	});
+}
+function unsafeOverrideScenarios(suite) {
+	return suite.scenarios.map((scenario) => unsafeOverrideScenario(scenario, suite.defaults));
+}
+function unsafeOverrideScenario(scenario, defaults) {
+	const defaultDuration = defaults?.duration != null;
+	const defaultLoad = hasExplicitLoad(defaults?.load);
+	const defaultRuns = defaults?.runs != null;
+	const raw = "raw" in scenario ? scenario.raw : scenario;
+	return {
+		name: scenario.name,
+		explicitDuration: raw.duration != null || defaultDuration,
+		explicitLoad: hasExplicitLoad(raw.load) || defaultLoad,
+		explicitRuns: raw.runs != null || defaultRuns
+	};
+}
+function hasExplicitLoad(load) {
+	return load != null && typeof load === "object" && ("rate" in load && load.rate != null || "concurrency" in load && load.concurrency != null);
+}
+function scenarioNeedsSyntheticServer(scenario, scenarios, seen = /* @__PURE__ */ new Set()) {
+	if (seen.has(scenario.name)) return false;
+	const nextSeen = new Set(seen).add(scenario.name);
+	switch (scenario.type) {
+		case "inbox": return true;
+		case "actor":
+		case "object": return scenario.authenticated;
+		case "failure": return failureFaultsOf(scenario).some(isInboundFailureFault);
+		case "mixed": return mixedChildrenOf(scenario, scenarios).some((child) => scenarioNeedsSyntheticServer(child, scenarios, nextSeen));
+		default: return false;
+	}
+}
+function scenarioNeedsReachableLocalServer(scenario, scenarios, seen = /* @__PURE__ */ new Set()) {
+	if (scenario.type === "fanout") return scenario.raw.sinkBase == null;
+	if (scenario.type === "failure") {
+		const faults = failureFaultsOf(scenario);
+		return faults.includes("invalid-signature") || scenario.raw.sinkBase == null && faults.some(isRemoteFailureFault);
+	}
+	if (scenario.type === "mixed") {
+		if (seen.has(scenario.name)) return false;
+		const nextSeen = new Set(seen).add(scenario.name);
+		return mixedChildrenOf(scenario, scenarios).some((child) => scenarioNeedsReachableLocalServer(child, scenarios, nextSeen));
+	}
+	return scenarioNeedsSyntheticServer(scenario, scenarios, seen);
+}
+function failureFaultsOf(scenario) {
+	return scenario.faults.length < 1 ? ["remote-404"] : scenario.faults;
+}
+function mixedChildrenOf(scenario, scenarios) {
+	return (scenario.raw.mix ?? []).flatMap((entry) => {
+		const child = scenarios.find((candidate) => candidate.name === entry.scenario);
+		return child == null ? [] : [child];
+	});
+}
+function isInboundFailureFault(fault) {
+	return fault === "invalid-signature" || fault === "missing-actor";
+}
+function isRemoteFailureFault(fault) {
+	return fault === "remote-404" || fault === "remote-410" || fault === "slow-inbox" || fault === "network-error";
+}
+//#endregion
+export { runBench as default };

package/dist/bench/actor/documents.js

@@ -0,0 +1,39 @@
+import "@js-temporal/polyfill";
+import { Application, CryptographicKey, Multikey } from "@fedify/vocab";
+//#region src/bench/actor/documents.ts
+/**
+* Building the ActivityPub actor documents the synthetic key server serves.
+*
+* The target dereferences a signature's `keyId` during verification; serving a
+* normal actor document with an embedded `publicKey` (RSA, for HTTP and LD
+* Signatures) and `assertionMethod` (Ed25519 Multikey, for FEP-8b32) is exactly
+* what a real actor exposes, so verification resolves the key the same way.
+* @since 2.3.0
+* @module
+*/
+/**
+* Renders a synthetic actor as a compact JSON-LD actor document.
+* @param actor The synthetic actor, with its URLs and keys.
+* @param options The context loader used to compact the document.
+* @returns The JSON-LD actor document.
+*/
+async function actorDocument(actor, options) {
+	return await new Application({
+		id: actor.id,
+		preferredUsername: `bench-${actor.index}`,
+		name: actor.name ?? `Benchmark actor ${actor.index}`,
+		inbox: new URL(`${actor.id.href}/inbox`),
+		publicKey: actor.keys.rsa == null ? void 0 : new CryptographicKey({
+			id: actor.rsaKeyId,
+			owner: actor.id,
+			publicKey: actor.keys.rsa.publicKey
+		}),
+		assertionMethods: actor.keys.ed25519 == null ? [] : [new Multikey({
+			id: actor.ed25519KeyId,
+			controller: actor.id,
+			publicKey: actor.keys.ed25519.publicKey
+		})]
+	}).toJsonLd({ contextLoader: options.contextLoader });
+}
+//#endregion
+export { actorDocument };

package/dist/bench/actor/fleet.js

@@ -0,0 +1,39 @@
+import "@js-temporal/polyfill";
+import { generateActorKeys } from "./keys.js";
+//#region src/bench/actor/fleet.ts
+function httpStandardOf(standards) {
+	const http = standards.filter((s) => s === "draft-cavage-http-signatures-12" || s === "rfc9421");
+	if (http.length === 0) throw new TypeError("Every actor group must declare exactly one HTTP request signature standard.");
+	if (http.length > 1) throw new TypeError(`Every actor group must declare exactly one HTTP request signature standard, but multiple were given: ${http.join(", ")}.`);
+	return http[0];
+}
+/**
+* Builds the fleet from the suite's actor groups, generating each actor's keys.
+* When no groups are declared, a single default actor using
+* `draft-cavage-http-signatures-12` is created.
+* @param groups The suite's actor groups.
+* @returns The fleet members, with keys generated.
+*/
+async function buildFleet(groups) {
+	const effective = groups.length > 0 ? groups : [{ signatureStandards: ["draft-cavage-http-signatures-12"] }];
+	const members = [];
+	let index = 0;
+	for (const group of effective) {
+		const count = group.count ?? 1;
+		const standards = group.signatureStandards;
+		const httpStandard = httpStandardOf(standards);
+		for (let i = 0; i < count; i++) {
+			members.push({
+				index,
+				name: group.name,
+				standards,
+				keys: await generateActorKeys(standards),
+				httpStandard
+			});
+			index++;
+		}
+	}
+	return members;
+}
+//#endregion
+export { buildFleet };

package/dist/bench/actor/keys.js

@@ -0,0 +1,35 @@
+import "@js-temporal/polyfill";
+import { generateCryptoKeyPair } from "@fedify/fedify";
+//#region src/bench/actor/keys.ts
+/**
+* Key-pair generation for synthetic benchmark actors.
+*
+* An author picks signature standards, not key algorithms; the key set is
+* derived from the chosen standards, mirroring how a real Fedify actor exposes
+* keys.  HTTP request signatures and LD Signatures share one RSA key pair;
+* FEP-8b32 object integrity proofs use an Ed25519 key pair.
+* @since 2.3.0
+* @module
+*/
+/** Whether a set of standards needs an RSA key pair. */
+function needsRsa(standards) {
+	return standards.some((s) => s === "draft-cavage-http-signatures-12" || s === "rfc9421" || s === "ld-signatures");
+}
+/** Whether a set of standards needs an Ed25519 key pair. */
+function needsEd25519(standards) {
+	return standards.includes("fep8b32");
+}
+/**
+* Generates the key pairs an actor needs for its signature standards.
+* @param standards The actor's signature standards.
+* @returns The derived key pairs.
+*/
+async function generateActorKeys(standards) {
+	const [rsa, ed25519] = await Promise.all([needsRsa(standards) ? generateCryptoKeyPair("RSASSA-PKCS1-v1_5") : Promise.resolve(void 0), needsEd25519(standards) ? generateCryptoKeyPair("Ed25519") : Promise.resolve(void 0)]);
+	return {
+		rsa,
+		ed25519
+	};
+}
+//#endregion
+export { generateActorKeys };

package/dist/bench/command.js

@@ -0,0 +1,72 @@
+import "@js-temporal/polyfill";
+import { configContext } from "../config.js";
+import { userAgentOption } from "../options.js";
+import { argument, choice, command, constant, flag, group, merge, message, object, option, optional, or, string, withDefault } from "@optique/core";
+import { bindConfig } from "@optique/config";
+//#region src/bench/command.ts
+const formatOption = bindConfig(option("-f", "--format", choice([
+	"text",
+	"json",
+	"markdown"
+], { metavar: "FORMAT" }), { description: message`The output format for the benchmark report.` }), {
+	context: configContext,
+	key: (config) => config.bench?.format ?? "text",
+	default: "text"
+});
+const allowUnsafeTarget = withDefault(flag("--allow-unsafe-target", { description: message`Allow benchmarking a public target that does not advertise \
+benchmark mode.  Must be given on the command line for each run; it cannot be \
+set in a configuration file.` }), false);
+const outputOption = optional(option("-o", "--output", string({ metavar: "OUTPUT_PATH" }), { description: message`Write the report to a file instead of standard output.` }));
+const targetOption = optional(option("-t", "--target", string({ metavar: "URL" }), { description: message`Override the target URL declared in the suite.` }));
+const advertiseHostOption = optional(option("--advertise-host", string({ metavar: "HOST" }), { description: message`Host (name or IP) a non-loopback target can reach the \
+benchmark's synthetic actor server at.  Required for signed scenarios against a \
+non-loopback target; binds the synthetic server on all interfaces and uses this \
+host in the actor and key URLs the target dereferences.` }));
+const runParser = merge("Benchmark options", object({
+	command: constant("bench"),
+	mode: constant("run"),
+	scenario: group("Arguments", argument(string({ metavar: "SCENARIO_FILE" }), { description: message`Path to the benchmark suite file (YAML or JSON).` })),
+	target: targetOption,
+	format: formatOption,
+	output: outputOption,
+	dryRun: withDefault(flag("--dry-run", { description: message`Resolve discovery and print the benchmark plan without \
+sending load.` }), false),
+	advertiseHost: advertiseHostOption,
+	allowUnsafeTarget
+}), userAgentOption);
+const benchOptions = or(command("compare", merge("Compare options", object({
+	command: constant("bench"),
+	mode: constant("compare"),
+	base: option("--base", string({ metavar: "REF" }), { description: message`The base git ref to benchmark.` }),
+	head: option("--head", string({ metavar: "REF" }), { description: message`The head git ref to benchmark.` }),
+	file: option("--file", string({ metavar: "SCENARIO_FILE" }), { description: message`Path to the benchmark suite file (YAML or JSON).` }),
+	startCommand: option("--start-command", string({ metavar: "COMMAND" }), { description: message`Shell command that starts the target application in each \
+checked-out worktree.` }),
+	readyUrl: option("--ready-url", string({ metavar: "URL" }), { description: message`URL that returns success when the started target is ready.` }),
+	readyTimeout: withDefault(option("--ready-timeout", string({ metavar: "DURATION" }), { description: message`How long to wait for --ready-url.` }), "30s"),
+	maxRegression: option("--max-regression", string({ metavar: "PERCENT" }), { description: message`Maximum regression tolerated after the measured noise band.` }),
+	target: targetOption,
+	format: formatOption,
+	output: outputOption,
+	dryRun: constant(false),
+	advertiseHost: advertiseHostOption,
+	allowUnsafeTarget
+}), userAgentOption), {
+	brief: message`Compare base and head benchmark runs.`,
+	description: message`Run the same benchmark suite against two git revisions on the \
+same runner, then fail when the head revision regresses beyond the configured \
+tolerance and measured noise band.`
+}), runParser);
+const benchMetadata = {
+	brief: message`Benchmark a Fedify federation workload.`,
+	description: message`Run an ActivityPub-specific load benchmark against a \
+cooperative Fedify target running in benchmark mode.
+
+The suite file declares the target, actors, and scenarios.  This version \
+executes the \`inbox\`, \`webfinger\`, \`actor\`, \`object\`, \`fanout\`, \
+\`failure\`, and \`mixed\` scenario types; \`collection\` remains reserved by \
+the suite format.`
+};
+command("bench", benchOptions, benchMetadata);
+//#endregion
+export { benchMetadata, benchOptions };

package/dist/bench/compare/schema.js

@@ -0,0 +1,16 @@
+import "@js-temporal/polyfill";
+//#region src/bench/compare/schema.ts
+/**
+* The embedded JSON Schema (draft 2020-12) for benchmark comparison output.
+*
+* The comparison report embeds the two benchmark reports it compares; this
+* schema validates the comparison envelope and checks that the embedded reports
+* look like current benchmark reports without duplicating the complete report
+* schema in two published files.
+* @since 2.3.0
+* @module
+*/
+/** The hosted URL that serves the comparison report schema. */
+const COMPARE_REPORT_SCHEMA_ID = "https://json-schema.fedify.dev/bench/compare-report-v1.json";
+//#endregion
+export { COMPARE_REPORT_SCHEMA_ID };