@fedify/fedify 1.6.9 → 1.6.11

package/dist/federation/send.test.js

@@ -3,30 +3,30 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { assertEquals } from "../assert_equals-CTYbeopb.js";
-import { assert } from "../assert-DmFG7ppO.js";
-import "../assert_instance_of-CF09JHYM.js";
-import "../docloader-UqcHJRjL.js";
-import "../url-kTAI6_KP.js";
-import "../multibase-DeCHcK8L.js";
-import { Activity, Application, Endpoints, Group, Person, Service } from "../vocab-Cs9KbJAx.js";
+import { assertEquals } from "../assert_equals-B44MxcIj.js";
+import { assert } from "../assert-LOEeCUK5.js";
+import "../assert_instance_of-XtuFevV_.js";
+import "../docloader-BYgIBZvh.js";
+import "../url-C2xuoQD1.js";
+import "../multibase-CnLHszip.js";
+import { Activity, Application, Endpoints, Group, Person, Service } from "../vocab-lzEJg2bH.js";
 import "../langstr-DbWheeIS.js";
-import "../lookup-DEN8lvde.js";
-import "../type-D2s5lmbZ.js";
-import "../actor-qNVQigMJ.js";
-import "../key-CUEyp_yz.js";
-import { verifyRequest } from "../http-DjFoawa6.js";
-import { doesActorOwnKey } from "../owner-lYBh2f5Z.js";
-import { extractInboxes, sendActivity } from "../send-CrbpYrfD.js";
-import { test } from "../testing-BZ0dJ4qn.js";
-import "../std__assert-vp0TKMS1.js";
-import { assertFalse, assertRejects } from "../assert_rejects-C-sxEMM5.js";
-import "../assert_is_error-nrwA1GeT.js";
-import { assertNotEquals } from "../assert_not_equals-Dc7y-V5Q.js";
-import "../assert_throws-Cn9C6Jur.js";
+import "../lookup-Cutk-FXA.js";
+import "../type-CFuiGLz9.js";
+import "../actor-KrOvzFz1.js";
+import "../key-BTcmhZp7.js";
+import { verifyRequest } from "../http-Dc8RIaDE.js";
+import { doesActorOwnKey } from "../owner-c-Zzpacz.js";
+import { extractInboxes, sendActivity } from "../send-SniNSIKd.js";
+import { test } from "../testing-DLyvtiiW.js";
+import "../std__assert-o_r9vqm1.js";
+import { assertFalse, assertRejects } from "../assert_rejects-DWQ4jaf9.js";
+import "../assert_is_error-BTlryvT0.js";
+import { assertNotEquals } from "../assert_not_equals-C685gKx6.js";
+import "../assert_throws-YetpVSc-.js";
 import { mockDocumentLoader } from "../docloader-09nVWLAZ.js";
-import { ed25519Multikey, ed25519PrivateKey, rsaPrivateKey2, rsaPublicKey2 } from "../keys-Dd_v3HDs.js";
-import { esm_default } from "../esm-Db4De7AS.js";
+import { ed25519Multikey, ed25519PrivateKey, rsaPrivateKey2, rsaPublicKey2 } from "../keys-pbGG00jU.js";
+import { esm_default } from "../esm-DO9PrujO.js";
 
 //#region federation/send.test.ts
 test("extractInboxes()", () => {

package/dist/{federation-3B6BDKCK.js → federation-DyRlaC4X.js}

@@ -159,8 +159,7 @@ var ParallelMessageQueue = class ParallelMessageQueue {
 	}
 	async enqueueMany(messages, options) {
 		if (this.queue.enqueueMany == null) {
-			const results = await Promise.allSettled(messages.map((message) => this.queue.enqueue(message, options)));
-			const errors = results.filter((r) => r.status === "rejected").map((r) => r.reason);
+			const errors = (await Promise.allSettled(messages.map((message) => this.queue.enqueue(message, options)))).filter((r) => r.status === "rejected").map((r) => r.reason);
 			if (errors.length > 1) throw new AggregateError(errors, "Failed to enqueue messages.");
 			else if (errors.length === 1) throw errors[0];
 			return;

package/dist/fixtures/oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd.json

@@ -0,0 +1,24 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "https://w3id.org/security/v1"
+  ],
+  "id": "https://oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd",
+  "type": "Person",
+  "preferredUsername": "hongminhee",
+  "name": "洪兔",
+  "inbox": "https://oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd/inbox",
+  "outbox": "https://oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd/outbox",
+  "publicKey": {
+    "id": "https://oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd#main-key",
+    "owner": "https://oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd",
+    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAowJfOzpA/nAYyL0bVDTm\niCAOlhFCIBnqwk1jvGrbkDhMzxlsgyoDqUSlmcJdKaPwu24YdFajDtJIgto27Ju7\nIC3hB7OFchnZ4JZrdYFo7CJABOzK58o12sdmmkCdY5hXWf1604E+mzyIdBAJ1FFJ\nL8vP07VEUsZ7yo9x0iVNg7HpCOK+y6BqI2GHS2dq9qkqQEIhC2TKHXn/RQVXwYB6\nG+YQmVUtcsbCVKdcWyTKhItLRGnepu3BqBSbieLxV27B1O9NFSoPu8xiBUnYwMoe\nsUQCE5tGcqxc75HzcVCbq7PqVqHZ1NW9RYssaSUqi4FYcjXxQrR08DrAl8rR4eXT\n4QIDAQAB\n-----END PUBLIC KEY-----\n"
+  },
+  "endpoints": {
+    "type": "as:Endpoints",
+    "sharedInbox": "https://oeee.cafe/inbox"
+  },
+  "followers": "https://oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd/followers",
+  "manuallyApprovesFollowers": false,
+  "url": "https://oeee.cafe/@hongminhee"
+}

package/dist/{http-DjFoawa6.js → http-Dc8RIaDE.js}

@@ -3,9 +3,9 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { deno_default } from "./docloader-UqcHJRjL.js";
-import { CryptographicKey } from "./vocab-Cs9KbJAx.js";
-import { fetchKey, validateCryptoKey } from "./key-CUEyp_yz.js";
+import { deno_default } from "./docloader-BYgIBZvh.js";
+import { CryptographicKey } from "./vocab-lzEJg2bH.js";
+import { fetchKey, validateCryptoKey } from "./key-BTcmhZp7.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
@@ -25,9 +25,7 @@ import { Item, decodeDict, encodeItem } from "structured-field-values";
 */
 async function signRequest(request, privateKey, keyId, options = {}) {
 	validateCryptoKey(privateKey, "private");
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("http_signatures.sign", async (span) => {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version).startActiveSpan("http_signatures.sign", async (span) => {
 		try {
 			const spec = options.spec ?? "draft-cavage-http-signatures-12";
 			let signed;
@@ -254,9 +252,7 @@ const supportedHashAlgorithms = {
 *          could not be verified.
 */
 async function verifyRequest(request, options = {}) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("http_signatures.verify", async (span) => {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version).startActiveSpan("http_signatures.verify", async (span) => {
 		if (span.isRecording()) {
 			span.setAttribute(ATTR_HTTP_REQUEST_METHOD, request.method);
 			span.setAttribute(ATTR_URL_FULL, request.url);
@@ -367,7 +363,7 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 			return null;
 		}
 	}
-	const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)="([^"]*)"\s*$/)).filter((m) => m != null).map((m) => m.slice(1, 3)));
+	const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)=(?:"([^"]*)"|(\d+))\s*$/)).filter((m) => m != null).map((m) => [m[1], m[2] ?? m[3]]));
 	if (!("keyId" in sigValues)) {
 		logger.debug("Failed to verify; no keyId field found in the Signature header.", { signature: sigHeader });
 		return null;
@@ -378,6 +374,52 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 		logger.debug("Failed to verify; no signature field found in the Signature header.", { signature: sigHeader });
 		return null;
 	}
+	if ("expires" in sigValues) {
+		const expiresSeconds = parseInt(sigValues.expires);
+		if (!Number.isInteger(expiresSeconds)) {
+			logger.debug("Failed to verify; invalid expires field in the Signature header: {expires}.", {
+				expires: sigValues.expires,
+				signature: sigHeader
+			});
+			return null;
+		}
+		const expires = Temporal.Instant.fromEpochMilliseconds(expiresSeconds * 1e3);
+		if (Temporal.Instant.compare(now, expires) > 0) {
+			logger.debug("Failed to verify; signature expired at {expires} (now: {now}).", {
+				expires: expires.toString(),
+				now: now.toString(),
+				signature: sigHeader
+			});
+			return null;
+		}
+	}
+	if ("created" in sigValues) {
+		const createdSeconds = parseInt(sigValues.created);
+		if (!Number.isInteger(createdSeconds)) {
+			logger.debug("Failed to verify; invalid created field in the Signature header: {created}.", {
+				created: sigValues.created,
+				signature: sigHeader
+			});
+			return null;
+		}
+		if (timeWindow !== false) {
+			const created = Temporal.Instant.fromEpochMilliseconds(createdSeconds * 1e3);
+			const tw = timeWindow ?? { minutes: 1 };
+			if (Temporal.Instant.compare(created, now.add(tw)) > 0) {
+				logger.debug("Failed to verify; created is too far in the future.", {
+					created: created.toString(),
+					now: now.toString()
+				});
+				return null;
+			} else if (Temporal.Instant.compare(created, now.subtract(tw)) < 0) {
+				logger.debug("Failed to verify; created is too far in the past.", {
+					created: created.toString(),
+					now: now.toString()
+				});
+				return null;
+			}
+		}
+	}
 	const { keyId, headers, signature } = sigValues;
 	span?.setAttribute("http_signatures.key_id", keyId);
 	if ("algorithm" in sigValues) span?.setAttribute("http_signatures.algorithm", sigValues.algorithm);
@@ -397,11 +439,10 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 		logger.debug("Failed to verify; required headers missing in the Signature header: {headers}.", { headers });
 		return null;
 	}
-	const message = headerNames.map((name) => `${name}: ` + (name == "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name == "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
+	const message = headerNames.map((name) => `${name}: ` + (name === "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name === "(created)" ? sigValues.created ?? "" : name === "(expires)" ? sigValues.expires ?? "" : name === "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
 	const sig = decodeBase64(signature);
 	span?.setAttribute("http_signatures.signature", encodeHex(sig));
-	const verified = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message));
-	if (!verified) {
+	if (!await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message))) {
 		if (cached) {
 			logger.debug("Failed to verify with the cached key {keyId}; signature {signature} is invalid.  Retrying with the freshly fetched key...", {
 				keyId,
@@ -566,8 +607,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				continue;
 			}
 			const body = await request.arrayBuffer();
-			const digestValid = await verifyRfc9421ContentDigest(contentDigestHeader, body);
-			if (!digestValid) {
+			if (!await verifyRfc9421ContentDigest(contentDigestHeader, body)) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
 				continue;
 			}
@@ -613,8 +653,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
 		span?.setAttribute("http_signatures.signature", encodeHex(sigBytes));
 		try {
-			const verified = await crypto.subtle.verify(algorithm, key.publicKey, sigBytes, signatureBaseBytes);
-			if (verified) {
+			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes, signatureBaseBytes)) {
 				validKey = key;
 				break;
 			} else if (cached) {

package/dist/{http-XWz7prGl.js → http-LsE7i_Zq.js}

@@ -2,9 +2,9 @@
       import { Temporal } from "@js-temporal/polyfill";
       import { URLPattern } from "urlpattern-polyfill";
     
-import { deno_default } from "./docloader-NmruKwBX.js";
-import { CryptographicKey } from "./actor-DY_ediuQ.js";
-import { fetchKey, validateCryptoKey } from "./key-B4UFmNvL.js";
+import { deno_default } from "./docloader-DOrb0fRp.js";
+import { CryptographicKey } from "./actor-CxnKxfwH.js";
+import { fetchKey, validateCryptoKey } from "./key-Bg_PKGpe.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
@@ -24,9 +24,7 @@ import { Item, decodeDict, encodeItem } from "structured-field-values";
 */
 async function signRequest(request, privateKey, keyId, options = {}) {
 	validateCryptoKey(privateKey, "private");
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("http_signatures.sign", async (span) => {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version).startActiveSpan("http_signatures.sign", async (span) => {
 		try {
 			const spec = options.spec ?? "draft-cavage-http-signatures-12";
 			let signed;
@@ -253,9 +251,7 @@ const supportedHashAlgorithms = {
 *          could not be verified.
 */
 async function verifyRequest(request, options = {}) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("http_signatures.verify", async (span) => {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version).startActiveSpan("http_signatures.verify", async (span) => {
 		if (span.isRecording()) {
 			span.setAttribute(ATTR_HTTP_REQUEST_METHOD, request.method);
 			span.setAttribute(ATTR_URL_FULL, request.url);
@@ -366,7 +362,7 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 			return null;
 		}
 	}
-	const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)="([^"]*)"\s*$/)).filter((m) => m != null).map((m) => m.slice(1, 3)));
+	const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)=(?:"([^"]*)"|(\d+))\s*$/)).filter((m) => m != null).map((m) => [m[1], m[2] ?? m[3]]));
 	if (!("keyId" in sigValues)) {
 		logger.debug("Failed to verify; no keyId field found in the Signature header.", { signature: sigHeader });
 		return null;
@@ -377,6 +373,52 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 		logger.debug("Failed to verify; no signature field found in the Signature header.", { signature: sigHeader });
 		return null;
 	}
+	if ("expires" in sigValues) {
+		const expiresSeconds = parseInt(sigValues.expires);
+		if (!Number.isInteger(expiresSeconds)) {
+			logger.debug("Failed to verify; invalid expires field in the Signature header: {expires}.", {
+				expires: sigValues.expires,
+				signature: sigHeader
+			});
+			return null;
+		}
+		const expires = Temporal.Instant.fromEpochMilliseconds(expiresSeconds * 1e3);
+		if (Temporal.Instant.compare(now, expires) > 0) {
+			logger.debug("Failed to verify; signature expired at {expires} (now: {now}).", {
+				expires: expires.toString(),
+				now: now.toString(),
+				signature: sigHeader
+			});
+			return null;
+		}
+	}
+	if ("created" in sigValues) {
+		const createdSeconds = parseInt(sigValues.created);
+		if (!Number.isInteger(createdSeconds)) {
+			logger.debug("Failed to verify; invalid created field in the Signature header: {created}.", {
+				created: sigValues.created,
+				signature: sigHeader
+			});
+			return null;
+		}
+		if (timeWindow !== false) {
+			const created = Temporal.Instant.fromEpochMilliseconds(createdSeconds * 1e3);
+			const tw = timeWindow ?? { minutes: 1 };
+			if (Temporal.Instant.compare(created, now.add(tw)) > 0) {
+				logger.debug("Failed to verify; created is too far in the future.", {
+					created: created.toString(),
+					now: now.toString()
+				});
+				return null;
+			} else if (Temporal.Instant.compare(created, now.subtract(tw)) < 0) {
+				logger.debug("Failed to verify; created is too far in the past.", {
+					created: created.toString(),
+					now: now.toString()
+				});
+				return null;
+			}
+		}
+	}
 	const { keyId, headers, signature } = sigValues;
 	span?.setAttribute("http_signatures.key_id", keyId);
 	if ("algorithm" in sigValues) span?.setAttribute("http_signatures.algorithm", sigValues.algorithm);
@@ -396,11 +438,10 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 		logger.debug("Failed to verify; required headers missing in the Signature header: {headers}.", { headers });
 		return null;
 	}
-	const message = headerNames.map((name) => `${name}: ` + (name == "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name == "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
+	const message = headerNames.map((name) => `${name}: ` + (name === "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name === "(created)" ? sigValues.created ?? "" : name === "(expires)" ? sigValues.expires ?? "" : name === "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
 	const sig = decodeBase64(signature);
 	span?.setAttribute("http_signatures.signature", encodeHex(sig));
-	const verified = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message));
-	if (!verified) {
+	if (!await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message))) {
 		if (cached) {
 			logger.debug("Failed to verify with the cached key {keyId}; signature {signature} is invalid.  Retrying with the freshly fetched key...", {
 				keyId,
@@ -565,8 +606,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				continue;
 			}
 			const body = await request.arrayBuffer();
-			const digestValid = await verifyRfc9421ContentDigest(contentDigestHeader, body);
-			if (!digestValid) {
+			if (!await verifyRfc9421ContentDigest(contentDigestHeader, body)) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
 				continue;
 			}
@@ -612,8 +652,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
 		span?.setAttribute("http_signatures.signature", encodeHex(sigBytes));
 		try {
-			const verified = await crypto.subtle.verify(algorithm, key.publicKey, sigBytes, signatureBaseBytes);
-			if (verified) {
+			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes, signatureBaseBytes)) {
 				validKey = key;
 				break;
 			} else if (cached) {

package/dist/{inbox-eAHML3xw.js → inbox-BVwejjm8.js}

@@ -3,9 +3,9 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { deno_default } from "./docloader-UqcHJRjL.js";
-import { Activity } from "./vocab-Cs9KbJAx.js";
-import { getTypeId } from "./type-D2s5lmbZ.js";
+import { deno_default } from "./docloader-BYgIBZvh.js";
+import { Activity } from "./vocab-lzEJg2bH.js";
+import { getTypeId } from "./type-CFuiGLz9.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
 
@@ -55,8 +55,7 @@ async function routeActivity({ context: ctx, json, activity, recipient, inboxLis
 		activity.id.href
 	];
 	if (cacheKey != null) {
-		const cached = await kv.get(cacheKey);
-		if (cached === true) {
+		if (await kv.get(cacheKey) === true) {
 			logger.debug("Activity {activityId} has already been processed.", {
 				activityId: activity.id?.href,
 				activity: json,
@@ -113,8 +112,7 @@ async function routeActivity({ context: ctx, json, activity, recipient, inboxLis
 		return "enqueued";
 	}
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("activitypub.dispatch_inbox_listener", { kind: SpanKind.INTERNAL }, async (span$1) => {
+	return await tracerProvider.getTracer(deno_default.name, deno_default.version).startActiveSpan("activitypub.dispatch_inbox_listener", { kind: SpanKind.INTERNAL }, async (span$1) => {
 		const dispatched = inboxListeners?.dispatchWithClass(activity);
 		if (dispatched == null) {
 			logger.error("Unsupported activity type:\n{activity}", {

package/dist/key-BP-Oky5H.js

@@ -0,0 +1,16 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+      globalThis.addEventListener = () => {};
+    
+import "./docloader-BYgIBZvh.js";
+import "./url-C2xuoQD1.js";
+import "./multibase-CnLHszip.js";
+import "./vocab-lzEJg2bH.js";
+import "./langstr-DbWheeIS.js";
+import "./lookup-Cutk-FXA.js";
+import "./type-CFuiGLz9.js";
+import "./actor-KrOvzFz1.js";
+import { exportJwk, fetchKey, generateCryptoKeyPair, importJwk, validateCryptoKey } from "./key-BTcmhZp7.js";
+
+export { validateCryptoKey };

package/dist/{key-CUEyp_yz.js → key-BTcmhZp7.js}

@@ -3,9 +3,9 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { deno_default, getDocumentLoader } from "./docloader-UqcHJRjL.js";
-import { CryptographicKey, Object as Object$1 } from "./vocab-Cs9KbJAx.js";
-import { isActor } from "./actor-qNVQigMJ.js";
+import { deno_default, getDocumentLoader } from "./docloader-BYgIBZvh.js";
+import { CryptographicKey, Object as Object$1 } from "./vocab-lzEJg2bH.js";
+import { isActor } from "./actor-KrOvzFz1.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 
@@ -23,8 +23,7 @@ function validateCryptoKey(key, type) {
 	if (!key.extractable) throw new TypeError("The key is not extractable.");
 	if (key.algorithm.name !== "RSASSA-PKCS1-v1_5" && key.algorithm.name !== "Ed25519") throw new TypeError("Currently only RSASSA-PKCS1-v1_5 and Ed25519 keys are supported.  More algorithms will be added in the future!");
 	if (key.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		const algorithm = key.algorithm;
-		if (algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
+		if (key.algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
 	}
 }
 /**
@@ -103,8 +102,7 @@ async function importJwk(jwk, type) {
 * @since 1.3.0
 */
 function fetchKey(keyId, cls, options = {}) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
+	const tracer = (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version);
 	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
 	return tracer.startActiveSpan("activitypub.fetch_key", {
 		kind: SpanKind.CLIENT,
@@ -160,8 +158,7 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 	let document;
 	try {
-		const remoteDocument = await (documentLoader ?? getDocumentLoader())(keyId);
-		document = remoteDocument.document;
+		document = (await (documentLoader ?? getDocumentLoader())(keyId)).document;
 	} catch (_) {
 		logger.debug("Failed to fetch key {keyId}.", { keyId });
 		await keyCache?.set(cacheKey, null);

package/dist/{key-B4UFmNvL.js → key-Bg_PKGpe.js}

@@ -2,8 +2,8 @@
       import { Temporal } from "@js-temporal/polyfill";
       import { URLPattern } from "urlpattern-polyfill";
     
-import { deno_default, getDocumentLoader } from "./docloader-NmruKwBX.js";
-import { CryptographicKey, Object as Object$1, isActor } from "./actor-DY_ediuQ.js";
+import { deno_default, getDocumentLoader } from "./docloader-DOrb0fRp.js";
+import { CryptographicKey, Object as Object$1, isActor } from "./actor-CxnKxfwH.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 
@@ -21,8 +21,7 @@ function validateCryptoKey(key, type) {
 	if (!key.extractable) throw new TypeError("The key is not extractable.");
 	if (key.algorithm.name !== "RSASSA-PKCS1-v1_5" && key.algorithm.name !== "Ed25519") throw new TypeError("Currently only RSASSA-PKCS1-v1_5 and Ed25519 keys are supported.  More algorithms will be added in the future!");
 	if (key.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		const algorithm = key.algorithm;
-		if (algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
+		if (key.algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
 	}
 }
 /**
@@ -101,8 +100,7 @@ async function importJwk(jwk, type) {
 * @since 1.3.0
 */
 function fetchKey(keyId, cls, options = {}) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
+	const tracer = (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version);
 	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
 	return tracer.startActiveSpan("activitypub.fetch_key", {
 		kind: SpanKind.CLIENT,
@@ -158,8 +156,7 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 	let document;
 	try {
-		const remoteDocument = await (documentLoader ?? getDocumentLoader())(keyId);
-		document = remoteDocument.document;
+		document = (await (documentLoader ?? getDocumentLoader())(keyId)).document;
 	} catch (_) {
 		logger.debug("Failed to fetch key {keyId}.", { keyId });
 		await keyCache?.set(cacheKey, null);

package/dist/{key-C1UhN1LT.js → key-DxKqQgGm.js}

@@ -2,9 +2,9 @@
       import { Temporal } from "@js-temporal/polyfill";
       import { URLPattern } from "urlpattern-polyfill";
     
-import "./docloader-NmruKwBX.js";
-import "./actor-DY_ediuQ.js";
-import "./lookup-DHlMvC3Q.js";
-import { exportJwk, fetchKey, generateCryptoKeyPair, importJwk, validateCryptoKey } from "./key-B4UFmNvL.js";
+import "./docloader-DOrb0fRp.js";
+import "./actor-CxnKxfwH.js";
+import "./lookup-DrAS097Q.js";
+import { exportJwk, fetchKey, generateCryptoKeyPair, importJwk, validateCryptoKey } from "./key-Bg_PKGpe.js";
 
 export { validateCryptoKey };

package/dist/{keycache-YqFJn7EL.js → keycache-BnCTs9sG.js}

@@ -3,7 +3,7 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { CryptographicKey, Multikey } from "./vocab-Cs9KbJAx.js";
+import { CryptographicKey, Multikey } from "./vocab-lzEJg2bH.js";
 
 //#region federation/keycache.ts
 var KvKeyCache = class {
@@ -28,7 +28,7 @@ var KvKeyCache = class {
 				return await Multikey.fromJsonLd(serialized, this.options);
 			} catch {
 				await this.kv.delete([...this.prefix, keyId.href]);
-				return void 0;
+				return;
 			}
 		}
 	}

package/dist/{keys-Dd_v3HDs.js → keys-pbGG00jU.js}

@@ -3,7 +3,7 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { CryptographicKey, Multikey, importSpki } from "./vocab-Cs9KbJAx.js";
+import { CryptographicKey, Multikey, importSpki } from "./vocab-lzEJg2bH.js";
 
 //#region testing/keys.ts
 const rsaPublicKey1 = new CryptographicKey({

package/dist/{ld-D8WCx-VU.js → ld-n_kUCeXG.js}

@@ -3,10 +3,10 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { deno_default, getDocumentLoader } from "./docloader-UqcHJRjL.js";
-import { Activity, CryptographicKey, Object as Object$1 } from "./vocab-Cs9KbJAx.js";
-import { getTypeId } from "./type-D2s5lmbZ.js";
-import { fetchKey, validateCryptoKey } from "./key-CUEyp_yz.js";
+import { deno_default, getDocumentLoader } from "./docloader-BYgIBZvh.js";
+import { Activity, CryptographicKey, Object as Object$1 } from "./vocab-lzEJg2bH.js";
+import { getTypeId } from "./type-CFuiGLz9.js";
+import { fetchKey, validateCryptoKey } from "./key-BTcmhZp7.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
@@ -57,8 +57,7 @@ async function createSignature(jsonLd, privateKey, keyId, { contextLoader, creat
 	const optionsHash = await hashJsonLd(options, contextLoader);
 	const docHash = await hashJsonLd(jsonLd, contextLoader);
 	const message = optionsHash + docHash;
-	const encoder = new TextEncoder();
-	const messageBytes = encoder.encode(message);
+	const messageBytes = new TextEncoder().encode(message);
 	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, messageBytes);
 	return {
 		...options,
@@ -80,9 +79,7 @@ async function createSignature(jsonLd, privateKey, keyId, { contextLoader, creat
 * @since 1.0.0
 */
 async function signJsonLd(jsonLd, privateKey, keyId, options) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("ld_signatures.sign", { attributes: { "ld_signatures.key_id": keyId.href } }, async (span) => {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version).startActiveSpan("ld_signatures.sign", { attributes: { "ld_signatures.key_id": keyId.href } }, async (span) => {
 		try {
 			const signature = await createSignature(jsonLd, privateKey, keyId, options);
 			if (span.isRecording()) {
@@ -184,8 +181,7 @@ async function verifySignature(jsonLd, options = {}) {
 	const encoder = new TextEncoder();
 	const message = sigOptsHash + docHash;
 	const messageBytes = encoder.encode(message);
-	const verified = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature, messageBytes);
-	if (verified) return key;
+	if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, signature.slice(), messageBytes)) return key;
 	if (cached) {
 		logger.debug("Failed to verify with the cached key {keyId}; signature {signatureValue} is invalid.  Retrying with the freshly fetched key...", {
 			keyId: sig.creator,
@@ -199,8 +195,7 @@ async function verifySignature(jsonLd, options = {}) {
 			}
 		});
 		if (key$1 == null) return null;
-		const verified$1 = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key$1.publicKey, signature, messageBytes);
-		return verified$1 ? key$1 : null;
+		return await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key$1.publicKey, signature.slice(), messageBytes) ? key$1 : null;
 	}
 	logger.debug("Failed to verify with the fetched key {keyId}; signature {signatureValue} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
 		keyId: sig.creator,
@@ -219,9 +214,7 @@ async function verifySignature(jsonLd, options = {}) {
 * @returns `true` if the document is authentic; `false` otherwise.
 */
 async function verifyJsonLd(jsonLd, options = {}) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("ld_signatures.verify", async (span) => {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version).startActiveSpan("ld_signatures.verify", async (span) => {
 		try {
 			const object = await Object$1.fromJsonLd(jsonLd, options);
 			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);