@fedify/fedify 1.6.0-dev.810 → 1.6.0-dev.812

package/CHANGES.md

@@ -34,6 +34,8 @@ To be released.
      -  Added `HttpMessageSignaturesSpecDeterminer` interface.
      -  Added `--first-knock` option to `fedify lookup` command.
 
+ -  The minimum supported version of Node.js is now 22.0.0.
+
 [RFC 9421]: https://www.rfc-editor.org/rfc/rfc9421
 [#208]: https://github.com/fedify-dev/fedify/issues/208
 [#227]: https://github.com/fedify-dev/fedify/issues/227

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "@fedify/fedify",
-    "version": "1.6.0-dev.810+66f5c864",
+    "version": "1.6.0-dev.812+f522d042",
     "license": "MIT",
     "exports": {
         ".": "./mod.ts",
@@ -18,7 +18,6 @@ export default {
     },
     "imports": {
         "@cfworker/json-schema": "npm:@cfworker/json-schema@^2.0.1",
-        "@david/which-runtime": "jsr:@david/which-runtime@^0.2.1",
         "@deno/dnt": "jsr:@deno/dnt@0.41.3",
         "@es-toolkit/es-toolkit": "jsr:@es-toolkit/es-toolkit@^1.38.0",
         "@hugoalh/http-header-link": "jsr:@hugoalh/http-header-link@^1.0.2",
@@ -26,14 +25,12 @@ export default {
         "@opentelemetry/semantic-conventions": "npm:@opentelemetry/semantic-conventions@^1.27.0",
         "@phensley/language-tag": "npm:@phensley/language-tag@^1.9.0",
         "@std/assert": "jsr:@std/assert@^0.226.0",
-        "@std/bytes": "jsr:@std/bytes@^1.0.2",
-        "@std/crypto": "jsr:@std/crypto@^1.0.4",
-        "@std/encoding": "jsr:@std/encoding@1.0.7",
         "@std/http": "jsr:@std/http@^1.0.6",
         "@std/testing": "jsr:@std/testing@^0.224.0",
         "@std/url": "jsr:@std/url@^0.225.1",
         "@std/yaml": "jsr:@std/yaml@^0.224.3",
         "asn1js": "npm:asn1js@^3.0.5",
+        "byte-encodings": "npm:byte-encodings@^1.0.11",
         "fast-check": "npm:fast-check@^3.22.0",
         "json-canon": "npm:json-canon@^1.0.1",
         "jsonld": "npm:jsonld@^8.3.2",

package/esm/federation/collection.js

@@ -1,5 +1,5 @@
 import * as dntShim from "../_dnt.shims.js";
-import { encodeHex } from "../deps/jsr.io/@std/encoding/1.0.7/hex.js";
+import { encodeHex } from "byte-encodings/hex";
 /**
  * Calculates the [partial follower collection digest][1].
  *

package/esm/runtime/docloader.js

@@ -1,5 +1,4 @@
 import * as dntShim from "../_dnt.shims.js";
-import { isDeno, isNode } from "../deps/jsr.io/@david/which-runtime/0.2.1/mod.js";
 import { HTTPHeaderLink } from "@hugoalh/http-header-link";
 import { getLogger } from "@logtape/logtape";
 import process from "node:process";
@@ -328,12 +327,20 @@ export function kvCache({ loader, kv, prefix, rules }) {
  */
 export function getUserAgent({ software, url } = {}) {
     const fedify = `Fedify/${metadata.version}`;
-    const runtime = isDeno ? `Deno/${dntShim.Deno.version.deno}` : "Bun" in dntShim.dntGlobalThis
-        // @ts-ignore: `Bun` is a global variable in Bun
-        ? `Bun/${Bun.version}`
-        : isNode
-            ? `Node.js/${process.version}`
-            : null;
+    const runtime = // dnt-shim-ignore
+     
+    // deno-lint-ignore no-explicit-any
+    globalThis.Deno?.version?.deno != null
+        ? `Deno/${dntShim.Deno.version.deno}`
+        // dnt-shim-ignore
+        // deno-lint-ignore no-explicit-any
+        : globalThis.process?.versions?.bun != null
+            ? `Bun/${process.versions.bun}`
+            // dnt-shim-ignore
+            // deno-lint-ignore no-explicit-any
+            : globalThis.process?.versions?.node != null
+                ? `Node.js/${process.versions.node}`
+                : null;
     const userAgent = software == null ? [fedify] : [software, fedify];
     if (runtime != null)
         userAgent.push(runtime);

package/esm/runtime/key.js

@@ -1,13 +1,12 @@
 import * as dntShim from "../_dnt.shims.js";
-import { concat } from "../deps/jsr.io/@std/bytes/1.0.6/concat.js";
-import { decodeBase64, encodeBase64 } from "../deps/jsr.io/@std/encoding/1.0.7/base64.js";
-import { decodeBase64Url } from "../deps/jsr.io/@std/encoding/1.0.7/base64url.js";
-import { decodeHex } from "../deps/jsr.io/@std/encoding/1.0.7/hex.js";
 import { Integer, Sequence } from "asn1js";
-import { decode, encode } from "./multibase/index.js";
+import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
+import { decodeBase64Url } from "byte-encodings/base64url";
+import { decodeHex } from "byte-encodings/hex";
 import { addPrefix, getCodeFromData, rmPrefix } from "multicodec";
 import { createPublicKey } from "node:crypto";
 import { PublicKeyInfo } from "pkijs";
+import { decode, encode } from "./multibase/index.js";
 import { validateCryptoKey } from "../sig/key.js";
 const algorithms = {
     "1.2.840.113549.1.1.1": { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
@@ -124,7 +123,9 @@ export async function exportMultibaseKey(key) {
         key.algorithm.hash.name ===
             "SHA-256") {
         const jwk = await dntShim.crypto.subtle.exportKey("jwk", key);
-        const n = concat([new Uint8Array([0]), decodeBase64Url(jwk.n)]);
+        const decodedN = decodeBase64Url(jwk.n);
+        const n = new Uint8Array(decodedN.length + 1);
+        n.set(decodedN, 1);
         const sequence = new Sequence({
             value: [
                 new Integer({

package/esm/sig/http.js

@@ -2,9 +2,8 @@ import * as dntShim from "../_dnt.shims.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace, } from "@opentelemetry/api";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL, } from "@opentelemetry/semantic-conventions";
-import { timingSafeEqual } from "../deps/jsr.io/@std/crypto/1.0.5/timing_safe_equal.js";
-import { decodeBase64, encodeBase64 } from "../deps/jsr.io/@std/encoding/1.0.7/base64.js";
-import { encodeHex } from "../deps/jsr.io/@std/encoding/1.0.7/hex.js";
+import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
+import { encodeHex } from "byte-encodings/hex";
 import { decodeDict, encodeItem, Item, } from "structured-field-values";
 import metadata from "../deno.js";
 import { CryptographicKey } from "../vocab/vocab.js";
@@ -808,4 +807,39 @@ export async function doubleKnock(request, identity, options = {}) {
     }
     return response;
 }
+/**
+ * Performs a timing-safe equality comparison between two `Uint8Array` values.
+ *
+ * This function is designed to take a constant amount of time to execute,
+ * dependent only on the length of the longer of the two arrays,
+ * regardless of where the first difference in bytes occurs. This helps
+ * prevent timing attacks.
+ *
+ * @param a The first bytes.
+ * @param b The second bytes.
+ * @returns `true` if the arrays are of the same length and contain the same
+ *          bytes, `false` otherwise.
+ * @since 1.6.0
+ */
+export function timingSafeEqual(a, b) {
+    const lenA = a.length;
+    const lenB = b.length;
+    const commonLength = Math.max(lenA, lenB);
+    let result = 0;
+    // Perform byte-wise XOR comparison for the length of the longer array.
+    // If one array is shorter, its out-of-bounds "bytes" are treated as 0 for the comparison.
+    // All byte differences are accumulated into the `result` using bitwise OR.
+    for (let i = 0; i < commonLength; i++) {
+        const byteA = i < lenA ? a[i] : 0;
+        const byteB = i < lenB ? b[i] : 0;
+        result |= byteA ^ byteB;
+    }
+    // Incorporate the length difference into the result.
+    // If lengths are different, (lenA ^ lenB) will be non-zero, making `result` non-zero.
+    // This ensures that arrays are only considered equal if both their contents
+    // (up to their respective lengths) and their lengths are identical.
+    result |= lenA ^ lenB;
+    // `result` will be 0 if and only if all XORed byte pairs were 0 AND lengths were equal.
+    return result === 0;
+}
 // cSpell: ignore keyid

package/esm/sig/ld.js

@@ -1,8 +1,8 @@
 import * as dntShim from "../_dnt.shims.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
-import { decodeBase64, encodeBase64 } from "../deps/jsr.io/@std/encoding/1.0.7/base64.js";
-import { encodeHex } from "../deps/jsr.io/@std/encoding/1.0.7/hex.js";
+import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
+import { encodeHex } from "byte-encodings/hex";
 // @ts-ignore TS7016
 import jsonld from "jsonld";
 import metadata from "../deno.js";

package/esm/sig/proof.js

@@ -1,7 +1,7 @@
 import * as dntShim from "../_dnt.shims.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
-import { encodeHex } from "../deps/jsr.io/@std/encoding/1.0.7/hex.js";
+import { encodeHex } from "byte-encodings/hex";
 // @ts-ignore: json-canon is not typed
 import serialize from "json-canon";
 import metadata from "../deno.js";