@fedify/fedify 1.6.0-dev.810 → 1.6.0-dev.811

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "@fedify/fedify",
-    "version": "1.6.0-dev.810+66f5c864",
+    "version": "1.6.0-dev.811+a0a19612",
     "license": "MIT",
     "exports": {
         ".": "./mod.ts",
@@ -18,7 +18,6 @@ export default {
     },
     "imports": {
         "@cfworker/json-schema": "npm:@cfworker/json-schema@^2.0.1",
-        "@david/which-runtime": "jsr:@david/which-runtime@^0.2.1",
         "@deno/dnt": "jsr:@deno/dnt@0.41.3",
         "@es-toolkit/es-toolkit": "jsr:@es-toolkit/es-toolkit@^1.38.0",
         "@hugoalh/http-header-link": "jsr:@hugoalh/http-header-link@^1.0.2",
@@ -26,8 +25,6 @@ export default {
         "@opentelemetry/semantic-conventions": "npm:@opentelemetry/semantic-conventions@^1.27.0",
         "@phensley/language-tag": "npm:@phensley/language-tag@^1.9.0",
         "@std/assert": "jsr:@std/assert@^0.226.0",
-        "@std/bytes": "jsr:@std/bytes@^1.0.2",
-        "@std/crypto": "jsr:@std/crypto@^1.0.4",
         "@std/encoding": "jsr:@std/encoding@1.0.7",
         "@std/http": "jsr:@std/http@^1.0.6",
         "@std/testing": "jsr:@std/testing@^0.224.0",

package/esm/runtime/docloader.js

@@ -1,5 +1,4 @@
 import * as dntShim from "../_dnt.shims.js";
-import { isDeno, isNode } from "../deps/jsr.io/@david/which-runtime/0.2.1/mod.js";
 import { HTTPHeaderLink } from "@hugoalh/http-header-link";
 import { getLogger } from "@logtape/logtape";
 import process from "node:process";
@@ -328,12 +327,20 @@ export function kvCache({ loader, kv, prefix, rules }) {
  */
 export function getUserAgent({ software, url } = {}) {
     const fedify = `Fedify/${metadata.version}`;
-    const runtime = isDeno ? `Deno/${dntShim.Deno.version.deno}` : "Bun" in dntShim.dntGlobalThis
-        // @ts-ignore: `Bun` is a global variable in Bun
-        ? `Bun/${Bun.version}`
-        : isNode
-            ? `Node.js/${process.version}`
-            : null;
+    const runtime = // dnt-shim-ignore
+     
+    // deno-lint-ignore no-explicit-any
+    globalThis.Deno?.version?.deno != null
+        ? `Deno/${dntShim.Deno.version.deno}`
+        // dnt-shim-ignore
+        // deno-lint-ignore no-explicit-any
+        : globalThis.process?.versions?.bun != null
+            ? `Bun/${process.versions.bun}`
+            // dnt-shim-ignore
+            // deno-lint-ignore no-explicit-any
+            : globalThis.process?.versions?.node != null
+                ? `Node.js/${process.versions.node}`
+                : null;
     const userAgent = software == null ? [fedify] : [software, fedify];
     if (runtime != null)
         userAgent.push(runtime);

package/esm/runtime/key.js

@@ -1,5 +1,4 @@
 import * as dntShim from "../_dnt.shims.js";
-import { concat } from "../deps/jsr.io/@std/bytes/1.0.6/concat.js";
 import { decodeBase64, encodeBase64 } from "../deps/jsr.io/@std/encoding/1.0.7/base64.js";
 import { decodeBase64Url } from "../deps/jsr.io/@std/encoding/1.0.7/base64url.js";
 import { decodeHex } from "../deps/jsr.io/@std/encoding/1.0.7/hex.js";
@@ -124,7 +123,9 @@ export async function exportMultibaseKey(key) {
         key.algorithm.hash.name ===
             "SHA-256") {
         const jwk = await dntShim.crypto.subtle.exportKey("jwk", key);
-        const n = concat([new Uint8Array([0]), decodeBase64Url(jwk.n)]);
+        const decodedN = decodeBase64Url(jwk.n);
+        const n = new Uint8Array(decodedN.length + 1);
+        n.set(decodedN, 1);
         const sequence = new Sequence({
             value: [
                 new Integer({

package/esm/sig/http.js

@@ -2,7 +2,6 @@ import * as dntShim from "../_dnt.shims.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace, } from "@opentelemetry/api";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL, } from "@opentelemetry/semantic-conventions";
-import { timingSafeEqual } from "../deps/jsr.io/@std/crypto/1.0.5/timing_safe_equal.js";
 import { decodeBase64, encodeBase64 } from "../deps/jsr.io/@std/encoding/1.0.7/base64.js";
 import { encodeHex } from "../deps/jsr.io/@std/encoding/1.0.7/hex.js";
 import { decodeDict, encodeItem, Item, } from "structured-field-values";
@@ -808,4 +807,39 @@ export async function doubleKnock(request, identity, options = {}) {
     }
     return response;
 }
+/**
+ * Performs a timing-safe equality comparison between two `Uint8Array` values.
+ *
+ * This function is designed to take a constant amount of time to execute,
+ * dependent only on the length of the longer of the two arrays,
+ * regardless of where the first difference in bytes occurs. This helps
+ * prevent timing attacks.
+ *
+ * @param a The first bytes.
+ * @param b The second bytes.
+ * @returns `true` if the arrays are of the same length and contain the same
+ *          bytes, `false` otherwise.
+ * @since 1.6.0
+ */
+export function timingSafeEqual(a, b) {
+    const lenA = a.length;
+    const lenB = b.length;
+    const commonLength = Math.max(lenA, lenB);
+    let result = 0;
+    // Perform byte-wise XOR comparison for the length of the longer array.
+    // If one array is shorter, its out-of-bounds "bytes" are treated as 0 for the comparison.
+    // All byte differences are accumulated into the `result` using bitwise OR.
+    for (let i = 0; i < commonLength; i++) {
+        const byteA = i < lenA ? a[i] : 0;
+        const byteB = i < lenB ? b[i] : 0;
+        result |= byteA ^ byteB;
+    }
+    // Incorporate the length difference into the result.
+    // If lengths are different, (lenA ^ lenB) will be non-zero, making `result` non-zero.
+    // This ensures that arrays are only considered equal if both their contents
+    // (up to their respective lengths) and their lengths are identical.
+    result |= lenA ^ lenB;
+    // `result` will be 0 if and only if all XORed byte pairs were 0 AND lengths were equal.
+    return result === 0;
+}
 // cSpell: ignore keyid