@fedify/fedify 2.0.0-dev.1566 → 2.0.0-dev.158

package/dist/{federation-CMX7WzeL.js → federation-BbZwNNWj.js}

@@ -1,7 +1,7 @@
 
-      import { Temporal } from "@js-temporal/polyfill";
-      import { URLPattern } from "urlpattern-polyfill";
-    
+          import { Temporal } from "@js-temporal/polyfill";
+          import { URLPattern } from "urlpattern-polyfill";
+        
 import { isEqual } from "es-toolkit";
 
 //#region src/federation/kv.ts
@@ -67,6 +67,28 @@ var MemoryKvStore = class {
 		this.#values[encodedKey] = [newValue, expiration];
 		return Promise.resolve(true);
 	}
+	/**
+	* {@inheritDoc KvStore.list}
+	*/
+	async *list(prefix) {
+		const now = Temporal.Now.instant();
+		for (const [encodedKey, entry] of Object.entries(this.#values)) {
+			const key = JSON.parse(encodedKey);
+			if (prefix != null) {
+				if (key.length < prefix.length) continue;
+				if (!prefix.every((p, i) => key[i] === p)) continue;
+			}
+			const [value, expiration] = entry;
+			if (expiration != null && now.until(expiration).sign < 0) {
+				delete this.#values[encodedKey];
+				continue;
+			}
+			yield {
+				key,
+				value
+			};
+		}
+	}
 };
 
 //#endregion
@@ -97,12 +119,12 @@ var InProcessMessageQueue = class {
 		this.#pollIntervalMs = Temporal.Duration.from(options.pollInterval ?? { seconds: 5 }).total("millisecond");
 	}
 	enqueue(message, options) {
-		const delay$1 = options?.delay == null ? 0 : Math.max(options.delay.total("millisecond"), 0);
-		if (delay$1 > 0) {
+		const delay = options?.delay == null ? 0 : Math.max(options.delay.total("millisecond"), 0);
+		if (delay > 0) {
 			setTimeout(() => this.enqueue(message, {
 				...options,
 				delay: void 0
-			}), delay$1);
+			}), delay);
 			return Promise.resolve();
 		}
 		this.#messages.push(message);
@@ -111,12 +133,12 @@ var InProcessMessageQueue = class {
 	}
 	enqueueMany(messages, options) {
 		if (messages.length === 0) return Promise.resolve();
-		const delay$1 = options?.delay == null ? 0 : Math.max(options.delay.total("millisecond"), 0);
-		if (delay$1 > 0) {
+		const delay = options?.delay == null ? 0 : Math.max(options.delay.total("millisecond"), 0);
+		if (delay > 0) {
 			setTimeout(() => this.enqueueMany(messages, {
 				...options,
 				delay: void 0
-			}), delay$1);
+			}), delay);
 			return Promise.resolve();
 		}
 		this.#messages.push(...messages);

package/dist/{http-Cdjyj7h1.js → http-BizGfAHd.js}

@@ -1,17 +1,377 @@
 
-      import { Temporal } from "@js-temporal/polyfill";
-      import { URLPattern } from "urlpattern-polyfill";
-    
-import { deno_default } from "./docloader-4XS4XdXc.js";
-import { CryptographicKey } from "./actor-BKxX_F1w.js";
-import { fetchKey, validateCryptoKey } from "./key-C2_QSigr.js";
+          import { Temporal } from "@js-temporal/polyfill";
+          import { URLPattern } from "urlpattern-polyfill";
+        
 import { getLogger } from "@logtape/logtape";
-import { SpanStatusCode, trace } from "@opentelemetry/api";
-import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
+import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
+import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { encodeHex } from "byte-encodings/hex";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
+import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { Item, decodeDict, encodeItem } from "structured-field-values";
+import { getDocumentLoader } from "@fedify/vocab-runtime";
+
+//#region deno.json
+var name = "@fedify/fedify";
+var version = "2.0.0-dev.158+628cd89e";
+var license = "MIT";
+var exports = {
+	".": "./src/mod.ts",
+	"./compat": "./src/compat/mod.ts",
+	"./federation": "./src/federation/mod.ts",
+	"./nodeinfo": "./src/nodeinfo/mod.ts",
+	"./otel": "./src/otel/mod.ts",
+	"./sig": "./src/sig/mod.ts",
+	"./utils": "./src/utils/mod.ts"
+};
+var imports = {
+	"@multiformats/base-x": "npm:@multiformats/base-x@^4.0.1",
+	"@opentelemetry/core": "npm:@opentelemetry/core@^2.0.0",
+	"@opentelemetry/sdk-trace-base": "npm:@opentelemetry/sdk-trace-base@^2.0.0",
+	"@opentelemetry/semantic-conventions": "npm:@opentelemetry/semantic-conventions@^1.27.0",
+	"@std/assert": "jsr:@std/assert@^0.226.0",
+	"@std/url": "jsr:@std/url@^0.225.1",
+	"asn1js": "npm:asn1js@^3.0.7",
+	"fast-check": "npm:fast-check@^3.22.0",
+	"fetch-mock": "npm:fetch-mock@^12.5.2",
+	"json-canon": "npm:json-canon@^1.0.1",
+	"jsonld": "npm:jsonld@^9.0.0",
+	"multicodec": "npm:multicodec@^3.2.1",
+	"pkijs": "npm:pkijs@^3.3.3",
+	"structured-field-values": "npm:structured-field-values@^2.0.4",
+	"uri-template-router": "npm:uri-template-router@^1.0.0",
+	"url-template": "npm:url-template@^3.1.1"
+};
+var exclude = [
+	".test-report.xml",
+	"apidoc/",
+	"dist/",
+	"node_modules/",
+	"npm/",
+	"pnpm-lock.yaml",
+	"src/cfworkers/dist/",
+	"src/cfworkers/fixtures/",
+	"src/cfworkers/imports.ts",
+	"src/cfworkers/README.md",
+	"src/cfworkers/server.ts",
+	"src/cfworkers/server.js",
+	"src/cfworkers/server.js.map"
+];
+var publish = { "exclude": ["**/*.test.ts", "src/testing/"] };
+var tasks = {
+	"codegen": "deno task -f @fedify/vocab compile",
+	"cache": {
+		"command": "deno cache src/mod.ts",
+		"dependencies": ["codegen"]
+	},
+	"check": {
+		"command": "deno fmt --check && deno lint && deno check src/**/*.ts",
+		"dependencies": ["codegen"]
+	},
+	"test": {
+		"command": "deno test --check --doc --allow-read --allow-write --allow-env --unstable-kv --trace-leaks --parallel",
+		"dependencies": ["codegen"]
+	},
+	"coverage": "deno task test --clean --coverage && deno coverage --html coverage",
+	"bench": {
+		"command": "deno bench --allow-read --allow-write --allow-net --allow-env --allow-run --unstable-kv",
+		"dependencies": ["codegen"]
+	},
+	"apidoc": {
+		"command": "deno doc --html --name=Fedify --output=apidoc/ src/mod.ts",
+		"dependencies": ["codegen"]
+	},
+	"publish": {
+		"command": "deno publish",
+		"dependencies": ["codegen"]
+	},
+	"pnpm:install": "pnpm install --silent",
+	"pnpm:build": {
+		"command": "pnpm exec tsdown",
+		"dependencies": ["pnpm:build-vocab"]
+	},
+	"test:node": {
+		"command": "cd dist/ && node --test",
+		"dependencies": ["pnpm:build"]
+	},
+	"test:bun": {
+		"command": "cd dist/ && bun test --timeout 60000",
+		"dependencies": ["pnpm:build"]
+	},
+	"test:cfworkers": {
+		"command": "pnpm exec wrangler deploy --dry-run --outdir src/cfworkers && node --import=tsx src/cfworkers/client.ts",
+		"dependencies": ["pnpm:build"]
+	},
+	"test-all": { "dependencies": [
+		"check",
+		"test",
+		"test:node",
+		"test:bun",
+		"test:cfworkers"
+	] }
+};
+var deno_default = {
+	name,
+	version,
+	license,
+	exports,
+	imports,
+	exclude,
+	publish,
+	tasks
+};
+
+//#endregion
+//#region src/sig/key.ts
+/**
+* Checks if the given key is valid and supported.  No-op if the key is valid,
+* otherwise throws an error.
+* @param key The key to check.
+* @param type Which type of key to check.  If not specified, the key can be
+*             either public or private.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+function validateCryptoKey(key, type) {
+	if (type != null && key.type !== type) throw new TypeError(`The key is not a ${type} key.`);
+	if (!key.extractable) throw new TypeError("The key is not extractable.");
+	if (key.algorithm.name !== "RSASSA-PKCS1-v1_5" && key.algorithm.name !== "Ed25519") throw new TypeError("Currently only RSASSA-PKCS1-v1_5 and Ed25519 keys are supported.  More algorithms will be added in the future!");
+	if (key.algorithm.name === "RSASSA-PKCS1-v1_5") {
+		const algorithm = key.algorithm;
+		if (algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
+	}
+}
+/**
+* Generates a key pair which is appropriate for Fedify.
+* @param algorithm The algorithm to use.  Currently only RSASSA-PKCS1-v1_5 and
+*                  Ed25519 are supported.
+* @returns The generated key pair.
+* @throws {TypeError} If the algorithm is unsupported.
+*/
+function generateCryptoKeyPair(algorithm) {
+	if (algorithm == null) getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]).warn("No algorithm specified.  Using RSASSA-PKCS1-v1_5 by default, but it is recommended to specify the algorithm explicitly as the parameter will be required in the future.");
+	if (algorithm == null || algorithm === "RSASSA-PKCS1-v1_5") return crypto.subtle.generateKey({
+		name: "RSASSA-PKCS1-v1_5",
+		modulusLength: 4096,
+		publicExponent: new Uint8Array([
+			1,
+			0,
+			1
+		]),
+		hash: "SHA-256"
+	}, true, ["sign", "verify"]);
+	else if (algorithm === "Ed25519") return crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+	throw new TypeError("Unsupported algorithm: " + algorithm);
+}
+/**
+* Exports a key in JWK format.
+* @param key The key to export.  Either public or private key.
+* @returns The exported key in JWK format.  The key is suitable for
+*          serialization and storage.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+async function exportJwk(key) {
+	validateCryptoKey(key);
+	const jwk = await crypto.subtle.exportKey("jwk", key);
+	if (jwk.crv === "Ed25519") jwk.alg = "Ed25519";
+	return jwk;
+}
+/**
+* Imports a key from JWK format.
+* @param jwk The key in JWK format.
+* @param type Which type of key to import, either `"public"` or `"private"`.
+* @returns The imported key.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+async function importJwk(jwk, type) {
+	let key;
+	if (jwk.kty === "RSA" && jwk.alg === "RS256") key = await crypto.subtle.importKey("jwk", jwk, {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, true, type === "public" ? ["verify"] : ["sign"]);
+	else if (jwk.kty === "OKP" && jwk.crv === "Ed25519") {
+		if (navigator?.userAgent === "Cloudflare-Workers") {
+			jwk = { ...jwk };
+			delete jwk.alg;
+		}
+		key = await crypto.subtle.importKey("jwk", jwk, "Ed25519", true, type === "public" ? ["verify"] : ["sign"]);
+	} else throw new TypeError("Unsupported JWK format.");
+	validateCryptoKey(key, type);
+	return key;
+}
+/**
+* Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
+* If the given URL contains an {@link Actor} object, it tries to find
+* the corresponding key in the `publicKey` or `assertionMethod` property.
+* @template T The type of the key to fetch.  Either {@link CryptographicKey}
+*              or {@link Multikey}.
+* @param keyId The URL of the key.
+* @param cls The class of the key to fetch.  Either {@link CryptographicKey}
+*            or {@link Multikey}.
+* @param options Options for fetching the key.  See {@link FetchKeyOptions}.
+* @returns The fetched key or `null` if the key is not found.
+* @since 1.3.0
+*/
+function fetchKey(keyId, cls, options = {}) {
+	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+	const tracer = tracerProvider.getTracer(deno_default.name, deno_default.version);
+	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
+	return tracer.startActiveSpan("activitypub.fetch_key", {
+		kind: SpanKind.CLIENT,
+		attributes: {
+			"http.method": "GET",
+			"url.full": keyId.href,
+			"url.scheme": keyId.protocol.replace(/:$/, ""),
+			"url.domain": keyId.hostname,
+			"url.path": keyId.pathname,
+			"url.query": keyId.search.replace(/^\?/, ""),
+			"url.fragment": keyId.hash.replace(/^#/, "")
+		}
+	}, async (span) => {
+		try {
+			const result = await fetchKeyInternal(keyId, cls, options);
+			span.setAttribute("activitypub.actor.key.cached", result.cached);
+			return result;
+		} catch (e) {
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(e)
+			});
+			throw e;
+		} finally {
+			span.end();
+		}
+	});
+}
+async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider } = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const cacheKey = typeof keyId === "string" ? new URL(keyId) : keyId;
+	keyId = typeof keyId === "string" ? keyId : keyId.href;
+	if (keyCache != null) {
+		const cachedKey = await keyCache.get(cacheKey);
+		if (cachedKey instanceof cls && cachedKey.publicKey != null) {
+			logger.debug("Key {keyId} found in cache.", { keyId });
+			return {
+				key: cachedKey,
+				cached: true
+			};
+		} else if (cachedKey === null) {
+			logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
+			return {
+				key: null,
+				cached: true
+			};
+		}
+	}
+	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
+	let document;
+	try {
+		const remoteDocument = await (documentLoader ?? getDocumentLoader())(keyId);
+		document = remoteDocument.document;
+	} catch (_) {
+		logger.debug("Failed to fetch key {keyId}.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		});
+	} catch (e) {
+		if (!(e instanceof TypeError)) throw e;
+		try {
+			object = await cls.fromJsonLd(document, {
+				documentLoader,
+				contextLoader,
+				tracerProvider
+			});
+		} catch (e$1) {
+			if (e$1 instanceof TypeError) {
+				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+				await keyCache?.set(cacheKey, null);
+				return {
+					key: null,
+					cached: false
+				};
+			}
+			throw e$1;
+		}
+	}
+	let key = null;
+	if (object instanceof cls) key = object;
+	else if (isActor(object)) {
+		const keys = cls === CryptographicKey ? object.getPublicKeys({
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		}) : object.getAssertionMethods({
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		});
+		let length = 0;
+		let lastKey = null;
+		for await (const k of keys) {
+			length++;
+			lastKey = k;
+			if (k.id?.href === keyId) {
+				key = k;
+				break;
+			}
+		}
+		const keyIdUrl = new URL(keyId);
+		if (key == null && keyIdUrl.hash === "" && length === 1) key = lastKey;
+		if (key == null) {
+			logger.debug("Failed to verify; object {keyId} returned an {actorType}, but has no key matching {keyId}.", {
+				keyId,
+				actorType: object.constructor.name
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	} else {
+		logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	if (key.publicKey == null) {
+		logger.debug("Failed to verify; key {keyId} has no publicKeyPem field.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	if (keyCache != null) {
+		await keyCache.set(cacheKey, key);
+		logger.debug("Key {keyId} cached.", { keyId });
+	}
+	return {
+		key,
+		cached: false
+	};
+}
 
+//#endregion
 //#region src/sig/http.ts
 /**
 * Signs a request using the given private key.
@@ -35,7 +395,7 @@ async function signRequest(request, privateKey, keyId, options = {}) {
 			if (span.isRecording()) {
 				span.setAttribute(ATTR_HTTP_REQUEST_METHOD, signed.method);
 				span.setAttribute(ATTR_URL_FULL, signed.url);
-				for (const [name, value] of signed.headers) span.setAttribute(ATTR_HTTP_REQUEST_HEADER(name), value);
+				for (const [name$1, value] of signed.headers) span.setAttribute(ATTR_HTTP_REQUEST_HEADER(name$1), value);
 				span.setAttribute("http_signatures.key_id", keyId.href);
 			}
 			return signed;
@@ -63,8 +423,8 @@ async function signRequestDraft(request, privateKey, keyId, span, currentTime, b
 	}
 	if (!headers.has("Date")) headers.set("Date", currentTime == null ? (/* @__PURE__ */ new Date()).toUTCString() : new Date(currentTime.toString()).toUTCString());
 	const serialized = [["(request-target)", `${request.method.toLowerCase()} ${url.pathname}`], ...headers];
-	const headerNames = serialized.map(([name]) => name);
-	const message = serialized.map(([name, value]) => `${name}: ${value.trim()}`).join("\n");
+	const headerNames = serialized.map(([name$1]) => name$1);
+	const message = serialized.map(([name$1, value]) => `${name$1}: ${value.trim()}`).join("\n");
 	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, new TextEncoder().encode(message));
 	const sigHeader = `keyId="${keyId.href}",algorithm="rsa-sha256",headers="${headerNames.join(" ")}",signature="${encodeBase64(signature)}"`;
 	headers.set("Signature", sigHeader);
@@ -259,7 +619,7 @@ async function verifyRequest(request, options = {}) {
 		if (span.isRecording()) {
 			span.setAttribute(ATTR_HTTP_REQUEST_METHOD, request.method);
 			span.setAttribute(ATTR_URL_FULL, request.url);
-			for (const [name, value] of request.headers) span.setAttribute(ATTR_HTTP_REQUEST_HEADER(name), value);
+			for (const [name$1, value] of request.headers) span.setAttribute(ATTR_HTTP_REQUEST_HEADER(name$1), value);
 		}
 		try {
 			let spec = options.spec;
@@ -442,7 +802,7 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 		logger.debug("Failed to verify; required headers missing in the Signature header: {headers}.", { headers });
 		return null;
 	}
-	const message = headerNames.map((name) => `${name}: ` + (name === "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name === "(created)" ? sigValues.created ?? "" : name === "(expires)" ? sigValues.expires ?? "" : name === "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
+	const message = headerNames.map((name$1) => `${name$1}: ` + (name$1 === "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name$1 === "(created)" ? sigValues.created ?? "" : name$1 === "(expires)" ? sigValues.expires ?? "" : name$1 === "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name$1))).join("\n");
 	const sig = decodeBase64(signature);
 	span?.setAttribute("http_signatures.signature", encodeHex(sig));
 	const verified = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message));
@@ -658,7 +1018,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
 		span?.setAttribute("http_signatures.signature", encodeHex(sigBytes));
 		try {
-			const verified = await crypto.subtle.verify(algorithm, key.publicKey, sigBytes, signatureBaseBytes);
+			const verified = await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes);
 			if (verified) {
 				validKey = key;
 				break;
@@ -805,4 +1165,4 @@ function timingSafeEqual(a, b) {
 }
 
 //#endregion
-export { doubleKnock, signRequest, verifyRequest };
+export { deno_default, doubleKnock, exportJwk, fetchKey, generateCryptoKeyPair, importJwk, signRequest, validateCryptoKey, verifyRequest };

package/dist/{http-BE2S7wC2.js → http-CXG5ZFqn.js}

@@ -3,9 +3,10 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { CryptographicKey, deno_default } from "./type-B7_rMIU9.js";
-import { fetchKey, validateCryptoKey } from "./key-q4xxkABj.js";
+import { deno_default } from "./deno-CQV858ip.js";
+import { fetchKey, validateCryptoKey } from "./key-C27c_yHR.js";
 import { getLogger } from "@logtape/logtape";
+import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
@@ -658,7 +659,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
 		span?.setAttribute("http_signatures.signature", encodeHex(sigBytes));
 		try {
-			const verified = await crypto.subtle.verify(algorithm, key.publicKey, sigBytes, signatureBaseBytes);
+			const verified = await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes);
 			if (verified) {
 				validKey = key;
 				break;