@fedify/fedify 1.7.10 → 1.7.12

package/dist/federation/mod.js

@@ -3,16 +3,16 @@
       import { URLPattern } from "urlpattern-polyfill";
     
 import "../transformers-ghwJuzGY.js";
-import "../docloader-BK2Fp3AJ.js";
-import "../actor-m_MgQ1Da.js";
-import { Router, RouterError, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, respondWithObject, respondWithObjectIfAcceptable } from "../middleware-R0UobiAQ.js";
-import "../lookup-DJgGrigh.js";
-import "../key-C6phFgFq.js";
-import "../http-CwQqD0nE.js";
-import "../proof-BKV4HiE8.js";
-import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue } from "../federation-BRIQn-GV.js";
-import "../types-DBIKpLqH.js";
-import "../authdocloader-cdK4XSRT.js";
-import "../vocab-F6vbRsQh.js";
+import "../docloader-DJxET2fN.js";
+import "../actor-GZRoTRqg.js";
+import { Router, RouterError, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, respondWithObject, respondWithObjectIfAcceptable } from "../middleware-DlDXugwZ.js";
+import "../lookup-CSngxuWm.js";
+import "../key-DmqJj57e.js";
+import "../http-vqMAvOVs.js";
+import "../proof-DlI7QNdn.js";
+import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue } from "../federation-B0aljx0V.js";
+import "../types-CmVV9LT1.js";
+import "../authdocloader-BopfyipD.js";
+import "../vocab-BebR0kAy.js";
 
 export { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mq.test.js

@@ -3,15 +3,15 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { assertEquals } from "../assert_equals-CTYbeopb.js";
-import { assert } from "../assert-DmFG7ppO.js";
-import "../assert_instance_of-CF09JHYM.js";
-import { test } from "../testing-BZ0dJ4qn.js";
-import { assertGreater, assertGreaterOrEqual } from "../std__assert-vp0TKMS1.js";
-import { assertFalse } from "../assert_rejects-C-sxEMM5.js";
-import "../assert_is_error-nrwA1GeT.js";
-import "../assert_not_equals-Dc7y-V5Q.js";
-import "../assert_throws-Cn9C6Jur.js";
+import { assertEquals } from "../assert_equals-B44MxcIj.js";
+import { assert } from "../assert-LOEeCUK5.js";
+import "../assert_instance_of-XtuFevV_.js";
+import { test } from "../testing-DLyvtiiW.js";
+import { assertGreater, assertGreaterOrEqual } from "../std__assert-o_r9vqm1.js";
+import { assertFalse } from "../assert_rejects-DWQ4jaf9.js";
+import "../assert_is_error-BTlryvT0.js";
+import "../assert_not_equals-C685gKx6.js";
+import "../assert_throws-YetpVSc-.js";
 import { delay } from "@es-toolkit/es-toolkit";
 
 //#region federation/mq.ts
@@ -136,8 +136,7 @@ var ParallelMessageQueue = class ParallelMessageQueue {
 	}
 	async enqueueMany(messages, options) {
 		if (this.queue.enqueueMany == null) {
-			const results = await Promise.allSettled(messages.map((message) => this.queue.enqueue(message, options)));
-			const errors = results.filter((r) => r.status === "rejected").map((r) => r.reason);
+			const errors = (await Promise.allSettled(messages.map((message) => this.queue.enqueue(message, options)))).filter((r) => r.status === "rejected").map((r) => r.reason);
 			if (errors.length > 1) throw new AggregateError(errors, "Failed to enqueue messages.");
 			else if (errors.length === 1) throw errors[0];
 			return;

package/dist/federation/retry.test.js

@@ -3,10 +3,10 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { AssertionError, assertEquals } from "../assert_equals-CTYbeopb.js";
+import { AssertionError, assertEquals } from "../assert_equals-B44MxcIj.js";
 import { createExponentialBackoffPolicy } from "../retry-BiIhZWgD.js";
-import { test } from "../testing-BZ0dJ4qn.js";
-import { assertNotEquals } from "../assert_not_equals-Dc7y-V5Q.js";
+import { test } from "../testing-DLyvtiiW.js";
+import { assertNotEquals } from "../assert_not_equals-C685gKx6.js";
 
 //#region federation/retry.test.ts
 test("createExponentialBackoffPolicy()", () => {

package/dist/federation/router.test.js

@@ -3,16 +3,16 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { assertEquals } from "../assert_equals-CTYbeopb.js";
-import { assert } from "../assert-DmFG7ppO.js";
-import "../assert_instance_of-CF09JHYM.js";
+import { assertEquals } from "../assert_equals-B44MxcIj.js";
+import { assert } from "../assert-LOEeCUK5.js";
+import "../assert_instance_of-XtuFevV_.js";
 import { Router, RouterError } from "../router-D_aVZZUc.js";
-import { test } from "../testing-BZ0dJ4qn.js";
-import "../std__assert-vp0TKMS1.js";
-import { assertFalse } from "../assert_rejects-C-sxEMM5.js";
-import "../assert_is_error-nrwA1GeT.js";
-import "../assert_not_equals-Dc7y-V5Q.js";
-import { assertThrows } from "../assert_throws-Cn9C6Jur.js";
+import { test } from "../testing-DLyvtiiW.js";
+import "../std__assert-o_r9vqm1.js";
+import { assertFalse } from "../assert_rejects-DWQ4jaf9.js";
+import "../assert_is_error-BTlryvT0.js";
+import "../assert_not_equals-C685gKx6.js";
+import { assertThrows } from "../assert_throws-YetpVSc-.js";
 
 //#region federation/router.test.ts
 function setUp(options = {}) {

package/dist/federation/send.test.js

@@ -3,30 +3,30 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { assertEquals } from "../assert_equals-CTYbeopb.js";
-import { assert } from "../assert-DmFG7ppO.js";
-import "../assert_instance_of-CF09JHYM.js";
-import "../docloader-CgkbWVNz.js";
-import "../url-kTAI6_KP.js";
-import "../multibase-DeCHcK8L.js";
-import { Activity, Application, Endpoints, Group, Person, Service } from "../vocab-BOerhowX.js";
+import { assertEquals } from "../assert_equals-B44MxcIj.js";
+import { assert } from "../assert-LOEeCUK5.js";
+import "../assert_instance_of-XtuFevV_.js";
+import "../docloader-bgBm1Hd1.js";
+import "../url-C2xuoQD1.js";
+import "../multibase-CnLHszip.js";
+import { Activity, Application, Endpoints, Group, Person, Service } from "../vocab-DFlq4Wa6.js";
 import "../langstr-DbWheeIS.js";
-import "../lookup-ChtUDlB-.js";
-import "../type-D2s5lmbZ.js";
-import "../actor-C9RnX-Fl.js";
-import "../key-DtQ4rLnr.js";
-import { verifyRequest } from "../http-D1IBucdD.js";
-import { doesActorOwnKey } from "../owner-Ces3Cs3s.js";
-import { extractInboxes, sendActivity } from "../send-aAmnTqe8.js";
-import { test } from "../testing-BZ0dJ4qn.js";
-import "../std__assert-vp0TKMS1.js";
-import { assertFalse, assertRejects } from "../assert_rejects-C-sxEMM5.js";
-import "../assert_is_error-nrwA1GeT.js";
-import { assertNotEquals } from "../assert_not_equals-Dc7y-V5Q.js";
-import "../assert_throws-Cn9C6Jur.js";
+import "../lookup-DL62q3Xh.js";
+import "../type-CFuiGLz9.js";
+import "../actor-TYqJGdVq.js";
+import "../key-KVhaUM92.js";
+import { verifyRequest } from "../http-D2DkwsjA.js";
+import { doesActorOwnKey } from "../owner-81ey_76X.js";
+import { extractInboxes, sendActivity } from "../send-DdxfTHo6.js";
+import { test } from "../testing-DLyvtiiW.js";
+import "../std__assert-o_r9vqm1.js";
+import { assertFalse, assertRejects } from "../assert_rejects-DWQ4jaf9.js";
+import "../assert_is_error-BTlryvT0.js";
+import { assertNotEquals } from "../assert_not_equals-C685gKx6.js";
+import "../assert_throws-YetpVSc-.js";
 import { mockDocumentLoader } from "../docloader-09nVWLAZ.js";
-import { ed25519Multikey, ed25519PrivateKey, rsaPrivateKey2, rsaPublicKey2 } from "../keys-BgLpfFXK.js";
-import { esm_default } from "../esm-Db4De7AS.js";
+import { ed25519Multikey, ed25519PrivateKey, rsaPrivateKey2, rsaPublicKey2 } from "../keys-C4XQHW5_.js";
+import { esm_default } from "../esm-DO9PrujO.js";
 
 //#region federation/send.test.ts
 test("extractInboxes()", () => {

package/dist/{federation-BRIQn-GV.js → federation-B0aljx0V.js}

@@ -170,8 +170,7 @@ var ParallelMessageQueue = class ParallelMessageQueue {
 	}
 	async enqueueMany(messages, options) {
 		if (this.queue.enqueueMany == null) {
-			const results = await Promise.allSettled(messages.map((message) => this.queue.enqueue(message, options)));
-			const errors = results.filter((r) => r.status === "rejected").map((r) => r.reason);
+			const errors = (await Promise.allSettled(messages.map((message) => this.queue.enqueue(message, options)))).filter((r) => r.status === "rejected").map((r) => r.reason);
 			if (errors.length > 1) throw new AggregateError(errors, "Failed to enqueue messages.");
 			else if (errors.length === 1) throw errors[0];
 			return;

package/dist/fixtures/oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd.json

@@ -0,0 +1,24 @@
+{
+  "@context": [
+    "https://www.w3.org/ns/activitystreams",
+    "https://w3id.org/security/v1"
+  ],
+  "id": "https://oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd",
+  "type": "Person",
+  "preferredUsername": "hongminhee",
+  "name": "洪兔",
+  "inbox": "https://oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd/inbox",
+  "outbox": "https://oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd/outbox",
+  "publicKey": {
+    "id": "https://oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd#main-key",
+    "owner": "https://oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd",
+    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAowJfOzpA/nAYyL0bVDTm\niCAOlhFCIBnqwk1jvGrbkDhMzxlsgyoDqUSlmcJdKaPwu24YdFajDtJIgto27Ju7\nIC3hB7OFchnZ4JZrdYFo7CJABOzK58o12sdmmkCdY5hXWf1604E+mzyIdBAJ1FFJ\nL8vP07VEUsZ7yo9x0iVNg7HpCOK+y6BqI2GHS2dq9qkqQEIhC2TKHXn/RQVXwYB6\nG+YQmVUtcsbCVKdcWyTKhItLRGnepu3BqBSbieLxV27B1O9NFSoPu8xiBUnYwMoe\nsUQCE5tGcqxc75HzcVCbq7PqVqHZ1NW9RYssaSUqi4FYcjXxQrR08DrAl8rR4eXT\n4QIDAQAB\n-----END PUBLIC KEY-----\n"
+  },
+  "endpoints": {
+    "type": "as:Endpoints",
+    "sharedInbox": "https://oeee.cafe/inbox"
+  },
+  "followers": "https://oeee.cafe/ap/users/3609fd4e-d51d-4db8-9f04-4189815864dd/followers",
+  "manuallyApprovesFollowers": false,
+  "url": "https://oeee.cafe/@hongminhee"
+}

package/dist/{http-D1IBucdD.js → http-D2DkwsjA.js}

@@ -3,9 +3,9 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { deno_default } from "./docloader-CgkbWVNz.js";
-import { CryptographicKey } from "./vocab-BOerhowX.js";
-import { fetchKey, validateCryptoKey } from "./key-DtQ4rLnr.js";
+import { deno_default } from "./docloader-bgBm1Hd1.js";
+import { CryptographicKey } from "./vocab-DFlq4Wa6.js";
+import { fetchKey, validateCryptoKey } from "./key-KVhaUM92.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
@@ -25,9 +25,7 @@ import { Item, decodeDict, encodeItem } from "structured-field-values";
 */
 async function signRequest(request, privateKey, keyId, options = {}) {
 	validateCryptoKey(privateKey, "private");
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("http_signatures.sign", async (span) => {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version).startActiveSpan("http_signatures.sign", async (span) => {
 		try {
 			const spec = options.spec ?? "draft-cavage-http-signatures-12";
 			let signed;
@@ -254,9 +252,7 @@ const supportedHashAlgorithms = {
 *          could not be verified.
 */
 async function verifyRequest(request, options = {}) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("http_signatures.verify", async (span) => {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version).startActiveSpan("http_signatures.verify", async (span) => {
 		if (span.isRecording()) {
 			span.setAttribute(ATTR_HTTP_REQUEST_METHOD, request.method);
 			span.setAttribute(ATTR_URL_FULL, request.url);
@@ -367,7 +363,7 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 			return null;
 		}
 	}
-	const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)="([^"]*)"\s*$/)).filter((m) => m != null).map((m) => m.slice(1, 3)));
+	const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)=(?:"([^"]*)"|(\d+))\s*$/)).filter((m) => m != null).map((m) => [m[1], m[2] ?? m[3]]));
 	if (!("keyId" in sigValues)) {
 		logger.debug("Failed to verify; no keyId field found in the Signature header.", { signature: sigHeader });
 		return null;
@@ -378,6 +374,52 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 		logger.debug("Failed to verify; no signature field found in the Signature header.", { signature: sigHeader });
 		return null;
 	}
+	if ("expires" in sigValues) {
+		const expiresSeconds = parseInt(sigValues.expires);
+		if (!Number.isInteger(expiresSeconds)) {
+			logger.debug("Failed to verify; invalid expires field in the Signature header: {expires}.", {
+				expires: sigValues.expires,
+				signature: sigHeader
+			});
+			return null;
+		}
+		const expires = Temporal.Instant.fromEpochMilliseconds(expiresSeconds * 1e3);
+		if (Temporal.Instant.compare(now, expires) > 0) {
+			logger.debug("Failed to verify; signature expired at {expires} (now: {now}).", {
+				expires: expires.toString(),
+				now: now.toString(),
+				signature: sigHeader
+			});
+			return null;
+		}
+	}
+	if ("created" in sigValues) {
+		const createdSeconds = parseInt(sigValues.created);
+		if (!Number.isInteger(createdSeconds)) {
+			logger.debug("Failed to verify; invalid created field in the Signature header: {created}.", {
+				created: sigValues.created,
+				signature: sigHeader
+			});
+			return null;
+		}
+		if (timeWindow !== false) {
+			const created = Temporal.Instant.fromEpochMilliseconds(createdSeconds * 1e3);
+			const tw = timeWindow ?? { minutes: 1 };
+			if (Temporal.Instant.compare(created, now.add(tw)) > 0) {
+				logger.debug("Failed to verify; created is too far in the future.", {
+					created: created.toString(),
+					now: now.toString()
+				});
+				return null;
+			} else if (Temporal.Instant.compare(created, now.subtract(tw)) < 0) {
+				logger.debug("Failed to verify; created is too far in the past.", {
+					created: created.toString(),
+					now: now.toString()
+				});
+				return null;
+			}
+		}
+	}
 	const { keyId, headers, signature } = sigValues;
 	span?.setAttribute("http_signatures.key_id", keyId);
 	if ("algorithm" in sigValues) span?.setAttribute("http_signatures.algorithm", sigValues.algorithm);
@@ -397,11 +439,10 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 		logger.debug("Failed to verify; required headers missing in the Signature header: {headers}.", { headers });
 		return null;
 	}
-	const message = headerNames.map((name) => `${name}: ` + (name == "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name == "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
+	const message = headerNames.map((name) => `${name}: ` + (name === "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name === "(created)" ? sigValues.created ?? "" : name === "(expires)" ? sigValues.expires ?? "" : name === "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
 	const sig = decodeBase64(signature);
 	span?.setAttribute("http_signatures.signature", encodeHex(sig));
-	const verified = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message));
-	if (!verified) {
+	if (!await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message))) {
 		if (cached) {
 			logger.debug("Failed to verify with the cached key {keyId}; signature {signature} is invalid.  Retrying with the freshly fetched key...", {
 				keyId,
@@ -566,8 +607,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				continue;
 			}
 			const body = await request.arrayBuffer();
-			const digestValid = await verifyRfc9421ContentDigest(contentDigestHeader, body);
-			if (!digestValid) {
+			if (!await verifyRfc9421ContentDigest(contentDigestHeader, body)) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
 				continue;
 			}
@@ -613,8 +653,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
 		span?.setAttribute("http_signatures.signature", encodeHex(sigBytes));
 		try {
-			const verified = await crypto.subtle.verify(algorithm, key.publicKey, sigBytes, signatureBaseBytes);
-			if (verified) {
+			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes)) {
 				validKey = key;
 				break;
 			} else if (cached) {

package/dist/{http-CwQqD0nE.js → http-vqMAvOVs.js}

@@ -2,9 +2,9 @@
       import { Temporal } from "@js-temporal/polyfill";
       import { URLPattern } from "urlpattern-polyfill";
     
-import { deno_default } from "./docloader-BK2Fp3AJ.js";
-import { CryptographicKey } from "./actor-m_MgQ1Da.js";
-import { fetchKey, validateCryptoKey } from "./key-C6phFgFq.js";
+import { deno_default } from "./docloader-DJxET2fN.js";
+import { CryptographicKey } from "./actor-GZRoTRqg.js";
+import { fetchKey, validateCryptoKey } from "./key-DmqJj57e.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
@@ -24,9 +24,7 @@ import { Item, decodeDict, encodeItem } from "structured-field-values";
 */
 async function signRequest(request, privateKey, keyId, options = {}) {
 	validateCryptoKey(privateKey, "private");
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("http_signatures.sign", async (span) => {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version).startActiveSpan("http_signatures.sign", async (span) => {
 		try {
 			const spec = options.spec ?? "draft-cavage-http-signatures-12";
 			let signed;
@@ -253,9 +251,7 @@ const supportedHashAlgorithms = {
 *          could not be verified.
 */
 async function verifyRequest(request, options = {}) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("http_signatures.verify", async (span) => {
+	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version).startActiveSpan("http_signatures.verify", async (span) => {
 		if (span.isRecording()) {
 			span.setAttribute(ATTR_HTTP_REQUEST_METHOD, request.method);
 			span.setAttribute(ATTR_URL_FULL, request.url);
@@ -366,7 +362,7 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 			return null;
 		}
 	}
-	const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)="([^"]*)"\s*$/)).filter((m) => m != null).map((m) => m.slice(1, 3)));
+	const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)=(?:"([^"]*)"|(\d+))\s*$/)).filter((m) => m != null).map((m) => [m[1], m[2] ?? m[3]]));
 	if (!("keyId" in sigValues)) {
 		logger.debug("Failed to verify; no keyId field found in the Signature header.", { signature: sigHeader });
 		return null;
@@ -377,6 +373,52 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 		logger.debug("Failed to verify; no signature field found in the Signature header.", { signature: sigHeader });
 		return null;
 	}
+	if ("expires" in sigValues) {
+		const expiresSeconds = parseInt(sigValues.expires);
+		if (!Number.isInteger(expiresSeconds)) {
+			logger.debug("Failed to verify; invalid expires field in the Signature header: {expires}.", {
+				expires: sigValues.expires,
+				signature: sigHeader
+			});
+			return null;
+		}
+		const expires = Temporal.Instant.fromEpochMilliseconds(expiresSeconds * 1e3);
+		if (Temporal.Instant.compare(now, expires) > 0) {
+			logger.debug("Failed to verify; signature expired at {expires} (now: {now}).", {
+				expires: expires.toString(),
+				now: now.toString(),
+				signature: sigHeader
+			});
+			return null;
+		}
+	}
+	if ("created" in sigValues) {
+		const createdSeconds = parseInt(sigValues.created);
+		if (!Number.isInteger(createdSeconds)) {
+			logger.debug("Failed to verify; invalid created field in the Signature header: {created}.", {
+				created: sigValues.created,
+				signature: sigHeader
+			});
+			return null;
+		}
+		if (timeWindow !== false) {
+			const created = Temporal.Instant.fromEpochMilliseconds(createdSeconds * 1e3);
+			const tw = timeWindow ?? { minutes: 1 };
+			if (Temporal.Instant.compare(created, now.add(tw)) > 0) {
+				logger.debug("Failed to verify; created is too far in the future.", {
+					created: created.toString(),
+					now: now.toString()
+				});
+				return null;
+			} else if (Temporal.Instant.compare(created, now.subtract(tw)) < 0) {
+				logger.debug("Failed to verify; created is too far in the past.", {
+					created: created.toString(),
+					now: now.toString()
+				});
+				return null;
+			}
+		}
+	}
 	const { keyId, headers, signature } = sigValues;
 	span?.setAttribute("http_signatures.key_id", keyId);
 	if ("algorithm" in sigValues) span?.setAttribute("http_signatures.algorithm", sigValues.algorithm);
@@ -396,11 +438,10 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 		logger.debug("Failed to verify; required headers missing in the Signature header: {headers}.", { headers });
 		return null;
 	}
-	const message = headerNames.map((name) => `${name}: ` + (name == "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name == "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
+	const message = headerNames.map((name) => `${name}: ` + (name === "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name === "(created)" ? sigValues.created ?? "" : name === "(expires)" ? sigValues.expires ?? "" : name === "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
 	const sig = decodeBase64(signature);
 	span?.setAttribute("http_signatures.signature", encodeHex(sig));
-	const verified = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message));
-	if (!verified) {
+	if (!await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message))) {
 		if (cached) {
 			logger.debug("Failed to verify with the cached key {keyId}; signature {signature} is invalid.  Retrying with the freshly fetched key...", {
 				keyId,
@@ -565,8 +606,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				continue;
 			}
 			const body = await request.arrayBuffer();
-			const digestValid = await verifyRfc9421ContentDigest(contentDigestHeader, body);
-			if (!digestValid) {
+			if (!await verifyRfc9421ContentDigest(contentDigestHeader, body)) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
 				continue;
 			}
@@ -612,8 +652,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
 		span?.setAttribute("http_signatures.signature", encodeHex(sigBytes));
 		try {
-			const verified = await crypto.subtle.verify(algorithm, key.publicKey, sigBytes, signatureBaseBytes);
-			if (verified) {
+			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes)) {
 				validKey = key;
 				break;
 			} else if (cached) {

package/dist/{inbox-BrMkm2b5.js → inbox-DAAZZl2k.js}

@@ -3,9 +3,9 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { deno_default } from "./docloader-CgkbWVNz.js";
-import { Activity } from "./vocab-BOerhowX.js";
-import { getTypeId } from "./type-D2s5lmbZ.js";
+import { deno_default } from "./docloader-bgBm1Hd1.js";
+import { Activity } from "./vocab-DFlq4Wa6.js";
+import { getTypeId } from "./type-CFuiGLz9.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
 
@@ -55,8 +55,7 @@ async function routeActivity({ context: ctx, json, activity, recipient, inboxLis
 		activity.id.href
 	];
 	if (cacheKey != null) {
-		const cached = await kv.get(cacheKey);
-		if (cached === true) {
+		if (await kv.get(cacheKey) === true) {
 			logger.debug("Activity {activityId} has already been processed.", {
 				activityId: activity.id?.href,
 				activity: json,
@@ -113,8 +112,7 @@ async function routeActivity({ context: ctx, json, activity, recipient, inboxLis
 		return "enqueued";
 	}
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
-	return await tracer.startActiveSpan("activitypub.dispatch_inbox_listener", { kind: SpanKind.INTERNAL }, async (span$1) => {
+	return await tracerProvider.getTracer(deno_default.name, deno_default.version).startActiveSpan("activitypub.dispatch_inbox_listener", { kind: SpanKind.INTERNAL }, async (span$1) => {
 		const dispatched = inboxListeners?.dispatchWithClass(activity);
 		if (dispatched == null) {
 			logger.error("Unsupported activity type:\n{activity}", {

package/dist/key-5ssHQ67E.js

@@ -0,0 +1,16 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+      globalThis.addEventListener = () => {};
+    
+import "./docloader-bgBm1Hd1.js";
+import "./url-C2xuoQD1.js";
+import "./multibase-CnLHszip.js";
+import "./vocab-DFlq4Wa6.js";
+import "./langstr-DbWheeIS.js";
+import "./lookup-DL62q3Xh.js";
+import "./type-CFuiGLz9.js";
+import "./actor-TYqJGdVq.js";
+import { exportJwk, fetchKey, generateCryptoKeyPair, importJwk, validateCryptoKey } from "./key-KVhaUM92.js";
+
+export { validateCryptoKey };

package/dist/{key-Do-Pud3s.js → key-DSJGnD10.js}

@@ -2,9 +2,9 @@
       import { Temporal } from "@js-temporal/polyfill";
       import { URLPattern } from "urlpattern-polyfill";
     
-import "./docloader-BK2Fp3AJ.js";
-import "./actor-m_MgQ1Da.js";
-import "./lookup-DJgGrigh.js";
-import { exportJwk, fetchKey, generateCryptoKeyPair, importJwk, validateCryptoKey } from "./key-C6phFgFq.js";
+import "./docloader-DJxET2fN.js";
+import "./actor-GZRoTRqg.js";
+import "./lookup-CSngxuWm.js";
+import { exportJwk, fetchKey, generateCryptoKeyPair, importJwk, validateCryptoKey } from "./key-DmqJj57e.js";
 
 export { validateCryptoKey };

package/dist/{key-C6phFgFq.js → key-DmqJj57e.js}

@@ -2,8 +2,8 @@
       import { Temporal } from "@js-temporal/polyfill";
       import { URLPattern } from "urlpattern-polyfill";
     
-import { deno_default, getDocumentLoader } from "./docloader-BK2Fp3AJ.js";
-import { CryptographicKey, Object as Object$1, isActor } from "./actor-m_MgQ1Da.js";
+import { deno_default, getDocumentLoader } from "./docloader-DJxET2fN.js";
+import { CryptographicKey, Object as Object$1, isActor } from "./actor-GZRoTRqg.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 
@@ -21,8 +21,7 @@ function validateCryptoKey(key, type) {
 	if (!key.extractable) throw new TypeError("The key is not extractable.");
 	if (key.algorithm.name !== "RSASSA-PKCS1-v1_5" && key.algorithm.name !== "Ed25519") throw new TypeError("Currently only RSASSA-PKCS1-v1_5 and Ed25519 keys are supported.  More algorithms will be added in the future!");
 	if (key.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		const algorithm = key.algorithm;
-		if (algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
+		if (key.algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
 	}
 }
 /**
@@ -101,8 +100,7 @@ async function importJwk(jwk, type) {
 * @since 1.3.0
 */
 function fetchKey(keyId, cls, options = {}) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
+	const tracer = (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version);
 	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
 	return tracer.startActiveSpan("activitypub.fetch_key", {
 		kind: SpanKind.CLIENT,
@@ -158,8 +156,7 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 	let document;
 	try {
-		const remoteDocument = await (documentLoader ?? getDocumentLoader())(keyId);
-		document = remoteDocument.document;
+		document = (await (documentLoader ?? getDocumentLoader())(keyId)).document;
 	} catch (_) {
 		logger.debug("Failed to fetch key {keyId}.", { keyId });
 		await keyCache?.set(cacheKey, null);

package/dist/{key-DtQ4rLnr.js → key-KVhaUM92.js}

@@ -3,9 +3,9 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { deno_default, getDocumentLoader } from "./docloader-CgkbWVNz.js";
-import { CryptographicKey, Object as Object$1 } from "./vocab-BOerhowX.js";
-import { isActor } from "./actor-C9RnX-Fl.js";
+import { deno_default, getDocumentLoader } from "./docloader-bgBm1Hd1.js";
+import { CryptographicKey, Object as Object$1 } from "./vocab-DFlq4Wa6.js";
+import { isActor } from "./actor-TYqJGdVq.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 
@@ -23,8 +23,7 @@ function validateCryptoKey(key, type) {
 	if (!key.extractable) throw new TypeError("The key is not extractable.");
 	if (key.algorithm.name !== "RSASSA-PKCS1-v1_5" && key.algorithm.name !== "Ed25519") throw new TypeError("Currently only RSASSA-PKCS1-v1_5 and Ed25519 keys are supported.  More algorithms will be added in the future!");
 	if (key.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		const algorithm = key.algorithm;
-		if (algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
+		if (key.algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
 	}
 }
 /**
@@ -103,8 +102,7 @@ async function importJwk(jwk, type) {
 * @since 1.3.0
 */
 function fetchKey(keyId, cls, options = {}) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
+	const tracer = (options.tracerProvider ?? trace.getTracerProvider()).getTracer(deno_default.name, deno_default.version);
 	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
 	return tracer.startActiveSpan("activitypub.fetch_key", {
 		kind: SpanKind.CLIENT,
@@ -160,8 +158,7 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 	let document;
 	try {
-		const remoteDocument = await (documentLoader ?? getDocumentLoader())(keyId);
-		document = remoteDocument.document;
+		document = (await (documentLoader ?? getDocumentLoader())(keyId)).document;
 	} catch (_) {
 		logger.debug("Failed to fetch key {keyId}.", { keyId });
 		await keyCache?.set(cacheKey, null);

package/dist/{keycache-B_99o7Nj.js → keycache-C1pEuRyQ.js}

@@ -3,7 +3,7 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { CryptographicKey, Multikey } from "./vocab-BOerhowX.js";
+import { CryptographicKey, Multikey } from "./vocab-DFlq4Wa6.js";
 
 //#region federation/keycache.ts
 var KvKeyCache = class {
@@ -28,7 +28,7 @@ var KvKeyCache = class {
 				return await Multikey.fromJsonLd(serialized, this.options);
 			} catch {
 				await this.kv.delete([...this.prefix, keyId.href]);
-				return void 0;
+				return;
 			}
 		}
 	}

package/dist/{keys-BgLpfFXK.js → keys-C4XQHW5_.js}

@@ -3,7 +3,7 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { CryptographicKey, Multikey, importSpki } from "./vocab-BOerhowX.js";
+import { CryptographicKey, Multikey, importSpki } from "./vocab-DFlq4Wa6.js";
 
 //#region testing/keys.ts
 const rsaPublicKey1 = new CryptographicKey({