@fedify/fedify 2.0.0-dev.1726 → 2.0.0-dev.1750

package/dist/{http-BmbMWfmh.cjs → http-CPqfuthT.cjs}

@@ -3,16 +3,266 @@
           const { URLPattern } = require("urlpattern-polyfill");
         
 const require_chunk = require('./chunk-DqRYRqnO.cjs');
-const require_docloader = require('./docloader-Buh0Ah9G.cjs');
-const require_actor = require('./actor-Bn2RCpws.cjs');
-const require_key = require('./key-BR1W25rw.cjs');
+const require_lookup = require('./lookup-Doq5XdGY.cjs');
+const require_actor = require('./actor-JG822JBi.cjs');
 const __logtape_logtape = require_chunk.__toESM(require("@logtape/logtape"));
 const __opentelemetry_api = require_chunk.__toESM(require("@opentelemetry/api"));
-const byte_encodings_base64 = require_chunk.__toESM(require("byte-encodings/base64"));
+const __fedify_vocab_runtime = require_chunk.__toESM(require("@fedify/vocab-runtime"));
 const byte_encodings_hex = require_chunk.__toESM(require("byte-encodings/hex"));
 const __opentelemetry_semantic_conventions = require_chunk.__toESM(require("@opentelemetry/semantic-conventions"));
+const byte_encodings_base64 = require_chunk.__toESM(require("byte-encodings/base64"));
 const structured_field_values = require_chunk.__toESM(require("structured-field-values"));
 
+//#region src/sig/key.ts
+/**
+* Checks if the given key is valid and supported.  No-op if the key is valid,
+* otherwise throws an error.
+* @param key The key to check.
+* @param type Which type of key to check.  If not specified, the key can be
+*             either public or private.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+function validateCryptoKey(key, type) {
+	if (type != null && key.type !== type) throw new TypeError(`The key is not a ${type} key.`);
+	if (!key.extractable) throw new TypeError("The key is not extractable.");
+	if (key.algorithm.name !== "RSASSA-PKCS1-v1_5" && key.algorithm.name !== "Ed25519") throw new TypeError("Currently only RSASSA-PKCS1-v1_5 and Ed25519 keys are supported.  More algorithms will be added in the future!");
+	if (key.algorithm.name === "RSASSA-PKCS1-v1_5") {
+		const algorithm = key.algorithm;
+		if (algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
+	}
+}
+/**
+* Generates a key pair which is appropriate for Fedify.
+* @param algorithm The algorithm to use.  Currently only RSASSA-PKCS1-v1_5 and
+*                  Ed25519 are supported.
+* @returns The generated key pair.
+* @throws {TypeError} If the algorithm is unsupported.
+*/
+function generateCryptoKeyPair(algorithm) {
+	if (algorithm == null) (0, __logtape_logtape.getLogger)([
+		"fedify",
+		"sig",
+		"key"
+	]).warn("No algorithm specified.  Using RSASSA-PKCS1-v1_5 by default, but it is recommended to specify the algorithm explicitly as the parameter will be required in the future.");
+	if (algorithm == null || algorithm === "RSASSA-PKCS1-v1_5") return crypto.subtle.generateKey({
+		name: "RSASSA-PKCS1-v1_5",
+		modulusLength: 4096,
+		publicExponent: new Uint8Array([
+			1,
+			0,
+			1
+		]),
+		hash: "SHA-256"
+	}, true, ["sign", "verify"]);
+	else if (algorithm === "Ed25519") return crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+	throw new TypeError("Unsupported algorithm: " + algorithm);
+}
+/**
+* Exports a key in JWK format.
+* @param key The key to export.  Either public or private key.
+* @returns The exported key in JWK format.  The key is suitable for
+*          serialization and storage.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+async function exportJwk(key) {
+	validateCryptoKey(key);
+	const jwk = await crypto.subtle.exportKey("jwk", key);
+	if (jwk.crv === "Ed25519") jwk.alg = "Ed25519";
+	return jwk;
+}
+/**
+* Imports a key from JWK format.
+* @param jwk The key in JWK format.
+* @param type Which type of key to import, either `"public"` or `"private"`.
+* @returns The imported key.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+async function importJwk(jwk, type) {
+	let key;
+	if (jwk.kty === "RSA" && jwk.alg === "RS256") key = await crypto.subtle.importKey("jwk", jwk, {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, true, type === "public" ? ["verify"] : ["sign"]);
+	else if (jwk.kty === "OKP" && jwk.crv === "Ed25519") {
+		if (navigator?.userAgent === "Cloudflare-Workers") {
+			jwk = { ...jwk };
+			delete jwk.alg;
+		}
+		key = await crypto.subtle.importKey("jwk", jwk, "Ed25519", true, type === "public" ? ["verify"] : ["sign"]);
+	} else throw new TypeError("Unsupported JWK format.");
+	validateCryptoKey(key, type);
+	return key;
+}
+/**
+* Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
+* If the given URL contains an {@link Actor} object, it tries to find
+* the corresponding key in the `publicKey` or `assertionMethod` property.
+* @template T The type of the key to fetch.  Either {@link CryptographicKey}
+*              or {@link Multikey}.
+* @param keyId The URL of the key.
+* @param cls The class of the key to fetch.  Either {@link CryptographicKey}
+*            or {@link Multikey}.
+* @param options Options for fetching the key.  See {@link FetchKeyOptions}.
+* @returns The fetched key or `null` if the key is not found.
+* @since 1.3.0
+*/
+function fetchKey(keyId, cls, options = {}) {
+	const tracerProvider = options.tracerProvider ?? __opentelemetry_api.trace.getTracerProvider();
+	const tracer = tracerProvider.getTracer(require_lookup.deno_default.name, require_lookup.deno_default.version);
+	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
+	return tracer.startActiveSpan("activitypub.fetch_key", {
+		kind: __opentelemetry_api.SpanKind.CLIENT,
+		attributes: {
+			"http.method": "GET",
+			"url.full": keyId.href,
+			"url.scheme": keyId.protocol.replace(/:$/, ""),
+			"url.domain": keyId.hostname,
+			"url.path": keyId.pathname,
+			"url.query": keyId.search.replace(/^\?/, ""),
+			"url.fragment": keyId.hash.replace(/^#/, "")
+		}
+	}, async (span) => {
+		try {
+			const result = await fetchKeyInternal(keyId, cls, options);
+			span.setAttribute("activitypub.actor.key.cached", result.cached);
+			return result;
+		} catch (e) {
+			span.setStatus({
+				code: __opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(e)
+			});
+			throw e;
+		} finally {
+			span.end();
+		}
+	});
+}
+async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider } = {}) {
+	const logger = (0, __logtape_logtape.getLogger)([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const cacheKey = typeof keyId === "string" ? new URL(keyId) : keyId;
+	keyId = typeof keyId === "string" ? keyId : keyId.href;
+	if (keyCache != null) {
+		const cachedKey = await keyCache.get(cacheKey);
+		if (cachedKey instanceof cls && cachedKey.publicKey != null) {
+			logger.debug("Key {keyId} found in cache.", { keyId });
+			return {
+				key: cachedKey,
+				cached: true
+			};
+		} else if (cachedKey === null) {
+			logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
+			return {
+				key: null,
+				cached: true
+			};
+		}
+	}
+	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
+	let document;
+	try {
+		const remoteDocument = await (documentLoader ?? (0, __fedify_vocab_runtime.getDocumentLoader)())(keyId);
+		document = remoteDocument.document;
+	} catch (_) {
+		logger.debug("Failed to fetch key {keyId}.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	let object;
+	try {
+		object = await require_actor.Object.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		});
+	} catch (e) {
+		if (!(e instanceof TypeError)) throw e;
+		try {
+			object = await cls.fromJsonLd(document, {
+				documentLoader,
+				contextLoader,
+				tracerProvider
+			});
+		} catch (e$1) {
+			if (e$1 instanceof TypeError) {
+				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+				await keyCache?.set(cacheKey, null);
+				return {
+					key: null,
+					cached: false
+				};
+			}
+			throw e$1;
+		}
+	}
+	let key = null;
+	if (object instanceof cls) key = object;
+	else if (require_actor.isActor(object)) {
+		const keys = cls === require_actor.CryptographicKey ? object.getPublicKeys({
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		}) : object.getAssertionMethods({
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		});
+		let length = 0;
+		let lastKey = null;
+		for await (const k of keys) {
+			length++;
+			lastKey = k;
+			if (k.id?.href === keyId) {
+				key = k;
+				break;
+			}
+		}
+		const keyIdUrl = new URL(keyId);
+		if (key == null && keyIdUrl.hash === "" && length === 1) key = lastKey;
+		if (key == null) {
+			logger.debug("Failed to verify; object {keyId} returned an {actorType}, but has no key matching {keyId}.", {
+				keyId,
+				actorType: object.constructor.name
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	} else {
+		logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	if (key.publicKey == null) {
+		logger.debug("Failed to verify; key {keyId} has no publicKeyPem field.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	if (keyCache != null) {
+		await keyCache.set(cacheKey, key);
+		logger.debug("Key {keyId} cached.", { keyId });
+	}
+	return {
+		key,
+		cached: false
+	};
+}
+
+//#endregion
 //#region src/sig/http.ts
 /**
 * Signs a request using the given private key.
@@ -24,9 +274,9 @@ const structured_field_values = require_chunk.__toESM(require("structured-field-
 * @throws {TypeError} If the private key is invalid or unsupported.
 */
 async function signRequest(request, privateKey, keyId, options = {}) {
-	require_key.validateCryptoKey(privateKey, "private");
+	validateCryptoKey(privateKey, "private");
 	const tracerProvider = options.tracerProvider ?? __opentelemetry_api.trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(require_docloader.deno_default.name, require_docloader.deno_default.version);
+	const tracer = tracerProvider.getTracer(require_lookup.deno_default.name, require_lookup.deno_default.version);
 	return await tracer.startActiveSpan("http_signatures.sign", async (span) => {
 		try {
 			const spec = options.spec ?? "draft-cavage-http-signatures-12";
@@ -255,7 +505,7 @@ const supportedHashAlgorithms = {
 */
 async function verifyRequest(request, options = {}) {
 	const tracerProvider = options.tracerProvider ?? __opentelemetry_api.trace.getTracerProvider();
-	const tracer = tracerProvider.getTracer(require_docloader.deno_default.name, require_docloader.deno_default.version);
+	const tracer = tracerProvider.getTracer(require_lookup.deno_default.name, require_lookup.deno_default.version);
 	return await tracer.startActiveSpan("http_signatures.verify", async (span) => {
 		if (span.isRecording()) {
 			span.setAttribute(__opentelemetry_semantic_conventions.ATTR_HTTP_REQUEST_METHOD, request.method);
@@ -427,7 +677,7 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 	const { keyId, headers, signature } = sigValues;
 	span?.setAttribute("http_signatures.key_id", keyId);
 	if ("algorithm" in sigValues) span?.setAttribute("http_signatures.algorithm", sigValues.algorithm);
-	const { key, cached } = await require_key.fetchKey(new URL(keyId), require_actor.CryptographicKey, {
+	const { key, cached } = await fetchKey(new URL(keyId), require_actor.CryptographicKey, {
 		documentLoader,
 		contextLoader,
 		keyCache,
@@ -620,7 +870,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 		}
 		span?.setAttribute("http_signatures.key_id", sigInput.keyId);
 		span?.setAttribute("http_signatures.created", sigInput.created.toString());
-		const { key, cached } = await require_key.fetchKey(new URL(sigInput.keyId), require_actor.CryptographicKey, {
+		const { key, cached } = await fetchKey(new URL(sigInput.keyId), require_actor.CryptographicKey, {
 			documentLoader,
 			contextLoader,
 			keyCache,
@@ -812,12 +1062,42 @@ Object.defineProperty(exports, 'doubleKnock', {
     return doubleKnock;
   }
 });
+Object.defineProperty(exports, 'exportJwk', {
+  enumerable: true,
+  get: function () {
+    return exportJwk;
+  }
+});
+Object.defineProperty(exports, 'fetchKey', {
+  enumerable: true,
+  get: function () {
+    return fetchKey;
+  }
+});
+Object.defineProperty(exports, 'generateCryptoKeyPair', {
+  enumerable: true,
+  get: function () {
+    return generateCryptoKeyPair;
+  }
+});
+Object.defineProperty(exports, 'importJwk', {
+  enumerable: true,
+  get: function () {
+    return importJwk;
+  }
+});
 Object.defineProperty(exports, 'signRequest', {
   enumerable: true,
   get: function () {
     return signRequest;
   }
 });
+Object.defineProperty(exports, 'validateCryptoKey', {
+  enumerable: true,
+  get: function () {
+    return validateCryptoKey;
+  }
+});
 Object.defineProperty(exports, 'verifyRequest', {
   enumerable: true,
   get: function () {

package/dist/{http-Danw_xTY.js → http-DIsJckI7.js}

@@ -3,8 +3,8 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { CryptographicKey, deno_default } from "./type-D_8QzkEn.js";
-import { fetchKey, validateCryptoKey } from "./key-CIIkeide.js";
+import { CryptographicKey, deno_default } from "./lookup-CxJLpHHf.js";
+import { fetchKey, validateCryptoKey } from "./key-CcqQC_vj.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";

package/dist/{http-D-e6AFwR.d.cts → http-M8k5mKc0.d.cts}

@@ -1,5 +1,5 @@
-import { DocumentLoader } from "./docloader-D-MrRyHl.cjs";
-import { CryptographicKey, Multikey } from "./vocab-Dw1-yVGg.cjs";
+import { CryptographicKey, Multikey } from "./vocab-CeDBzu-f.cjs";
+import { DocumentLoader } from "@fedify/vocab-runtime";
 import { TracerProvider } from "@opentelemetry/api";
 
 //#region src/sig/key.d.ts

package/dist/{inbox-Blp5F74G.js → inbox-24__vIeD.js}

@@ -3,7 +3,7 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { Activity, deno_default, getTypeId } from "./type-D_8QzkEn.js";
+import { Activity, deno_default, getTypeId } from "./lookup-CxJLpHHf.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
 

package/dist/{key-CIIkeide.js → key-CcqQC_vj.js}

@@ -3,8 +3,9 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { CryptographicKey, Object as Object$1, deno_default, getDocumentLoader } from "./type-D_8QzkEn.js";
-import { isActor } from "./actor-dO7jHa6A.js";
+import { CryptographicKey, Object as Object$1, deno_default } from "./lookup-CxJLpHHf.js";
+import { isActor } from "./actor-CRS7Dbo1.js";
+import { getDocumentLoader } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 

package/dist/{keycache-Covv8lvK.js → keycache-BUF-P0-V.js}

@@ -3,7 +3,7 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { CryptographicKey, Multikey } from "./type-D_8QzkEn.js";
+import { CryptographicKey, Multikey } from "./lookup-CxJLpHHf.js";
 
 //#region src/federation/keycache.ts
 var KvKeyCache = class {

package/dist/{keys-DZ1bqhJz.js → keys-DSikT9wk.js}

@@ -3,7 +3,8 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { CryptographicKey, Multikey, importSpki } from "./type-D_8QzkEn.js";
+import { CryptographicKey, Multikey } from "./lookup-CxJLpHHf.js";
+import { importSpki } from "@fedify/vocab-runtime";
 
 //#region src/testing/keys.ts
 const rsaPublicKey1 = new CryptographicKey({

package/dist/kv-cache-CBOkGH5t.js

@@ -0,0 +1,121 @@
+
+          import { Temporal } from "@js-temporal/polyfill";
+          import { URLPattern } from "urlpattern-polyfill";
+        
+import { doubleKnock, validateCryptoKey } from "./http-BPsXiq3Y.js";
+import { getLogger } from "@logtape/logtape";
+import { UrlError, createActivityPubRequest, getDocumentLoader, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
+import { curry } from "es-toolkit";
+
+//#region src/utils/docloader.ts
+const logger$1 = getLogger([
+	"fedify",
+	"utils",
+	"docloader"
+]);
+/**
+* Gets an authenticated {@link DocumentLoader} for the given identity.
+* Note that an authenticated document loader intentionally does not cache
+* the fetched documents.
+* @param identity The identity to get the document loader for.
+*                 The actor's key pair.
+* @param options The options for the document loader.
+* @returns The authenticated document loader.
+* @throws {TypeError} If the key is invalid or unsupported.
+* @since 0.4.0
+*/
+function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, userAgent, specDeterminer, tracerProvider } = {}) {
+	validateCryptoKey(identity.privateKey);
+	async function load(url, options) {
+		if (!allowPrivateAddress) try {
+			await validatePublicUrl(url);
+		} catch (error) {
+			if (error instanceof UrlError) logger$1.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+		const originalRequest = createActivityPubRequest(url, { userAgent });
+		const response = await doubleKnock(originalRequest, identity, {
+			specDeterminer,
+			log: curry(logRequest)(logger$1),
+			tracerProvider,
+			signal: options?.signal
+		});
+		return getRemoteDocument(url, response, load);
+	}
+	return load;
+}
+const _fetchDocumentLoader = getDocumentLoader();
+const _fetchDocumentLoader_allowPrivateAddress = getDocumentLoader({ allowPrivateAddress: true });
+
+//#endregion
+//#region src/utils/kv-cache.ts
+const logger = getLogger([
+	"fedify",
+	"utils",
+	"kv-cache"
+]);
+/**
+* Decorates a {@link DocumentLoader} with a cache backed by a {@link Deno.Kv}.
+* @param parameters The parameters for the cache.
+* @returns The decorated document loader which is cache-enabled.
+*/
+function kvCache({ loader, kv, prefix, rules }) {
+	const keyPrefix = prefix ?? ["_fedify", "remoteDocument"];
+	rules ??= [[new URLPattern({}), Temporal.Duration.from({ minutes: 5 })]];
+	for (const [p, duration] of rules) if (Temporal.Duration.compare(duration, { days: 30 }) > 0) throw new TypeError("The maximum cache duration is 30 days: " + (p instanceof URLPattern ? `${p.protocol}://${p.username}:${p.password}@${p.hostname}:${p.port}/${p.pathname}?${p.search}#${p.hash}` : p.toString()));
+	return async (url, options) => {
+		if (url in preloadedContexts) {
+			logger.debug("Using preloaded context: {url}.", { url });
+			return {
+				contextUrl: null,
+				document: preloadedContexts[url],
+				documentUrl: url
+			};
+		}
+		const match = matchRule(url, rules);
+		if (match == null) return await loader(url, options);
+		const key = [...keyPrefix, url];
+		let cache = void 0;
+		try {
+			cache = await kv.get(key);
+		} catch (error) {
+			if (error instanceof Error) logger.warn("Failed to get the document of {url} from the KV cache: {error}", {
+				url,
+				error
+			});
+		}
+		if (cache == null) {
+			const remoteDoc = await loader(url, options);
+			try {
+				await kv.set(key, remoteDoc, { ttl: match });
+			} catch (error) {
+				logger.warn("Failed to save the document of {url} to the KV cache: {error}", {
+					url,
+					error
+				});
+			}
+			return remoteDoc;
+		}
+		return cache;
+	};
+}
+function matchRule(url, rules) {
+	for (const [pattern, duration] of rules) {
+		if (typeof pattern === "string") {
+			if (url === pattern) return duration;
+			continue;
+		}
+		if (pattern instanceof URL) {
+			if (pattern.href == url) return duration;
+			continue;
+		}
+		if (pattern.test(url)) return duration;
+	}
+	return null;
+}
+
+//#endregion
+export { getAuthenticatedDocumentLoader, kvCache };

package/dist/kv-cache-gyMh96Y-.cjs

@@ -0,0 +1,133 @@
+
+          const { Temporal } = require("@js-temporal/polyfill");
+          const { URLPattern } = require("urlpattern-polyfill");
+        
+const require_chunk = require('./chunk-DqRYRqnO.cjs');
+const require_http = require('./http-CPqfuthT.cjs');
+const __logtape_logtape = require_chunk.__toESM(require("@logtape/logtape"));
+const __fedify_vocab_runtime = require_chunk.__toESM(require("@fedify/vocab-runtime"));
+const es_toolkit = require_chunk.__toESM(require("es-toolkit"));
+
+//#region src/utils/docloader.ts
+const logger$1 = (0, __logtape_logtape.getLogger)([
+	"fedify",
+	"utils",
+	"docloader"
+]);
+/**
+* Gets an authenticated {@link DocumentLoader} for the given identity.
+* Note that an authenticated document loader intentionally does not cache
+* the fetched documents.
+* @param identity The identity to get the document loader for.
+*                 The actor's key pair.
+* @param options The options for the document loader.
+* @returns The authenticated document loader.
+* @throws {TypeError} If the key is invalid or unsupported.
+* @since 0.4.0
+*/
+function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, userAgent, specDeterminer, tracerProvider } = {}) {
+	require_http.validateCryptoKey(identity.privateKey);
+	async function load(url, options) {
+		if (!allowPrivateAddress) try {
+			await (0, __fedify_vocab_runtime.validatePublicUrl)(url);
+		} catch (error) {
+			if (error instanceof __fedify_vocab_runtime.UrlError) logger$1.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+		const originalRequest = (0, __fedify_vocab_runtime.createActivityPubRequest)(url, { userAgent });
+		const response = await require_http.doubleKnock(originalRequest, identity, {
+			specDeterminer,
+			log: (0, es_toolkit.curry)(__fedify_vocab_runtime.logRequest)(logger$1),
+			tracerProvider,
+			signal: options?.signal
+		});
+		return (0, __fedify_vocab_runtime.getRemoteDocument)(url, response, load);
+	}
+	return load;
+}
+const _fetchDocumentLoader = (0, __fedify_vocab_runtime.getDocumentLoader)();
+const _fetchDocumentLoader_allowPrivateAddress = (0, __fedify_vocab_runtime.getDocumentLoader)({ allowPrivateAddress: true });
+
+//#endregion
+//#region src/utils/kv-cache.ts
+const logger = (0, __logtape_logtape.getLogger)([
+	"fedify",
+	"utils",
+	"kv-cache"
+]);
+/**
+* Decorates a {@link DocumentLoader} with a cache backed by a {@link Deno.Kv}.
+* @param parameters The parameters for the cache.
+* @returns The decorated document loader which is cache-enabled.
+*/
+function kvCache({ loader, kv, prefix, rules }) {
+	const keyPrefix = prefix ?? ["_fedify", "remoteDocument"];
+	rules ??= [[new URLPattern({}), Temporal.Duration.from({ minutes: 5 })]];
+	for (const [p, duration] of rules) if (Temporal.Duration.compare(duration, { days: 30 }) > 0) throw new TypeError("The maximum cache duration is 30 days: " + (p instanceof URLPattern ? `${p.protocol}://${p.username}:${p.password}@${p.hostname}:${p.port}/${p.pathname}?${p.search}#${p.hash}` : p.toString()));
+	return async (url, options) => {
+		if (url in __fedify_vocab_runtime.preloadedContexts) {
+			logger.debug("Using preloaded context: {url}.", { url });
+			return {
+				contextUrl: null,
+				document: __fedify_vocab_runtime.preloadedContexts[url],
+				documentUrl: url
+			};
+		}
+		const match = matchRule(url, rules);
+		if (match == null) return await loader(url, options);
+		const key = [...keyPrefix, url];
+		let cache = void 0;
+		try {
+			cache = await kv.get(key);
+		} catch (error) {
+			if (error instanceof Error) logger.warn("Failed to get the document of {url} from the KV cache: {error}", {
+				url,
+				error
+			});
+		}
+		if (cache == null) {
+			const remoteDoc = await loader(url, options);
+			try {
+				await kv.set(key, remoteDoc, { ttl: match });
+			} catch (error) {
+				logger.warn("Failed to save the document of {url} to the KV cache: {error}", {
+					url,
+					error
+				});
+			}
+			return remoteDoc;
+		}
+		return cache;
+	};
+}
+function matchRule(url, rules) {
+	for (const [pattern, duration] of rules) {
+		if (typeof pattern === "string") {
+			if (url === pattern) return duration;
+			continue;
+		}
+		if (pattern instanceof URL) {
+			if (pattern.href == url) return duration;
+			continue;
+		}
+		if (pattern.test(url)) return duration;
+	}
+	return null;
+}
+
+//#endregion
+Object.defineProperty(exports, 'getAuthenticatedDocumentLoader', {
+  enumerable: true,
+  get: function () {
+    return getAuthenticatedDocumentLoader;
+  }
+});
+Object.defineProperty(exports, 'kvCache', {
+  enumerable: true,
+  get: function () {
+    return kvCache;
+  }
+});