@fedify/fedify 2.1.23 → 2.1.25

package/dist/{assert_instance_of-C4Ri6VuN.mjs → assert-BhQd8QHP.mjs}

@@ -34,4 +34,22 @@ import { l as AssertionError } from "./assert_equals-Ew3jOFa3.mjs";
 	throw new AssertionError(msg);
 }
 //#endregion
-export { assertInstanceOf as t };
+//#region ../../node_modules/.pnpm/@jsr+std__assert@0.226.0/node_modules/@jsr/std__assert/assert.js
+/**
+* Make an assertion, error will be thrown if `expr` does not have truthy value.
+*
+* @example Usage
+* ```ts no-eval
+* import { assert } from "@std/assert/assert";
+*
+* assert("hello".includes("ello")); // Doesn't throw
+* assert("hello".includes("world")); // Throws
+* ```
+*
+* @param expr The expression to test.
+* @param msg The optional message to display if the assertion fails.
+*/ function assert(expr, msg = "") {
+	if (!expr) throw new AssertionError(msg);
+}
+//#endregion
+export { assertInstanceOf as n, assert as t };

package/dist/{builder-BlCsjkrX.mjs → builder-DsBAef6b.mjs}

@@ -2,8 +2,8 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError, t as Router } from "./router-CrMLXoOr.mjs";
-import { n as version, t as name } from "./deno-B_Gwkjh7.mjs";
-import { t as InboxListenerSet } from "./inbox-BxCHIWPD.mjs";
+import { n as version, t as name } from "./deno-9AaebKOA.mjs";
+import { t as InboxListenerSet } from "./inbox-BSyjaFbo.mjs";
 import { getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";
@@ -43,7 +43,7 @@ var FederationBuilderImpl = class {
 		this.collectionTypeIds = {};
 	}
 	async build(options) {
-		const { FederationImpl } = await import("./middleware-DABFg_Xy.mjs");
+		const { FederationImpl } = await import("./middleware-DDT9ljTQ.mjs");
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();

package/dist/{client-CZWLyLmp.mjs → client-DM72NZuk.mjs}

@@ -1,8 +1,82 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";
+//#region src/utils/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
+//#endregion
 //#region src/nodeinfo/client.ts
 const logger = getLogger([
 	"fedify",
@@ -19,8 +93,8 @@ const DEFAULT_MAX_REDIRECTION = 5;
 * bounce the request to an internal address.
 * @param url The URL to fetch.
 * @param headers The request headers.
-* @returns The final response, or `null` if the URL is disallowed or there
-*          are too many redirects.
+* @returns The final response, or `null` if the URL is disallowed, its
+*          hostname cannot be resolved, or there are too many redirects.
 */
 async function fetchPublicUrl(url, headers) {
 	let current = url instanceof URL ? url : new URL(url);
@@ -30,7 +104,11 @@ async function fetchPublicUrl(url, headers) {
 			await validatePublicUrl(current.href);
 		} catch (e) {
 			if (e instanceof UrlError) {
-				logger.error("Refused to fetch a private or invalid URL {url}: {error}", {
+				if (e.reason === "dns") logger.error("DNS lookup failed for {url}: {error}", {
+					url: current.href,
+					error: e
+				});
+				else logger.error("Refused to fetch a private or invalid URL {url}: {error}", {
 					url: current.href,
 					error: e
 				});
@@ -83,7 +161,7 @@ async function getNodeInfo(url, options = {}) {
 				});
 				return;
 			}
-			const wellKnownRd = await wellKnownResponse.json();
+			const wellKnownRd = JSON.parse(await readBoundedText(wellKnownResponse, MAX_BODY_SIZE, wellKnownUrl));
 			const link = wellKnownRd?.links?.find((link) => link != null && "rel" in link && (link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.0" || link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.1") && "href" in link && link.href != null);
 			if (link == null || link.href == null) {
 				logger.error("Failed to find a NodeInfo document link from {url}: {resourceDescriptor}", {
@@ -107,7 +185,7 @@ async function getNodeInfo(url, options = {}) {
 			});
 			return;
 		}
-		const data = await response.json();
+		const data = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl));
 		if (options.parse === "none") return data;
 		return parseNodeInfo(data, { tryBestEffort: options.parse === "best-effort" }) ?? void 0;
 	} catch (error) {
@@ -311,4 +389,4 @@ function parseUsage(data, options = {}) {
 	};
 }
 //#endregion
-export { parseProtocol as a, parseUsage as c, parseOutboundService as i, parseInboundService as n, parseServices as o, parseNodeInfo as r, parseSoftware as s, getNodeInfo as t };
+export { parseProtocol as a, parseUsage as c, readBoundedText as d, parseOutboundService as i, BodyTooLargeError as l, parseInboundService as n, parseServices as o, parseNodeInfo as r, parseSoftware as s, getNodeInfo as t, MAX_BODY_SIZE as u };

package/dist/compat/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Ct as ActivityTransformer, n as Context } from "../context-o22vjzS2.cjs";
+import { Ct as ActivityTransformer, n as Context } from "../context-D4s0Wk3N.cjs";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Ct as ActivityTransformer, n as Context } from "../context-_l9t359k.js";
+import { Ct as ActivityTransformer, n as Context } from "../context-BgU5UWTx.js";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/transformers.test.mjs

@@ -2,10 +2,9 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { t as MemoryKvStore } from "../kv-tL2TOE9X.mjs";
-import { _ as autoIdAssigner, g as actorDehydrator, n as FederationImpl } from "../middleware-D2O8b03q.mjs";
+import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
+import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
+import { _ as autoIdAssigner, g as actorDehydrator, n as FederationImpl } from "../middleware-DHHRwSZH.mjs";
 import { test } from "@fedify/fixture";
 import { Follow, Person } from "@fedify/vocab";
 //#region src/compat/transformers.test.ts

package/dist/{context-_l9t359k.d.ts → context-BgU5UWTx.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { o as JsonValue, s as NodeInfo, t as GetNodeInfoOptions } from "./client-CSddvgWN.js";
-import { o as VerifyRequestFailureReason, t as HttpMessageSignaturesSpec } from "./http-BDZeS5om.js";
-import { n as GetKeyOwnerOptions } from "./owner-CnngXDNJ.js";
+import { o as VerifyRequestFailureReason, t as HttpMessageSignaturesSpec } from "./http-Dl00HXr4.js";
+import { n as GetKeyOwnerOptions } from "./owner-CiBPcC6F.js";
 import { n as KvStore, t as KvKey } from "./kv-D6hNiMTK.js";
 import { Activity, Actor, Collection, CryptographicKey, Hashtag, Link, LookupObjectOptions, Multikey, Object as Object$1, Recipient, TraverseCollectionOptions } from "@fedify/vocab";
 import { Span, Tracer, TracerProvider } from "@opentelemetry/api";
@@ -1454,7 +1454,8 @@ interface FederationOptions<TContextData> {
   */
   authenticatedDocumentLoaderFactory?: AuthenticatedDocumentLoaderFactory;
   /**
-  * Whether to allow fetching private network addresses in the document loader.
+  * Whether to allow private network addresses in the document loader and
+  * outbound activity delivery, including redirects.
   *
   * If turned on, {@link FederationOptions.documentLoader},
   * {@link FederationOptions.contextLoader}, and

package/dist/{context-o22vjzS2.d.cts → context-D4s0Wk3N.d.cts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { o as JsonValue, s as NodeInfo, t as GetNodeInfoOptions } from "./client-CAM_bQXx.cjs";
-import { o as VerifyRequestFailureReason, t as HttpMessageSignaturesSpec } from "./http-C87EWkO0.cjs";
-import { n as GetKeyOwnerOptions } from "./owner-DEvZuyOE.cjs";
+import { o as VerifyRequestFailureReason, t as HttpMessageSignaturesSpec } from "./http-DqZhyEso.cjs";
+import { n as GetKeyOwnerOptions } from "./owner-B3hNQCG8.cjs";
 import { n as KvStore, t as KvKey } from "./kv-gJ8LYbxX.cjs";
 import { Activity, Actor, Collection, CryptographicKey, Hashtag, Link, LookupObjectOptions, Multikey, Object as Object$1, Recipient, TraverseCollectionOptions } from "@fedify/vocab";
 import { AuthenticatedDocumentLoaderFactory, DocumentLoader, DocumentLoaderFactory, GetUserAgentOptions } from "@fedify/vocab-runtime";
@@ -1454,7 +1454,8 @@ interface FederationOptions<TContextData> {
   */
   authenticatedDocumentLoaderFactory?: AuthenticatedDocumentLoaderFactory;
   /**
-  * Whether to allow fetching private network addresses in the document loader.
+  * Whether to allow private network addresses in the document loader and
+  * outbound activity delivery, including redirects.
   *
   * If turned on, {@link FederationOptions.documentLoader},
   * {@link FederationOptions.contextLoader}, and

package/dist/{deno-B_Gwkjh7.mjs → deno-9AaebKOA.mjs}

@@ -3,6 +3,6 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.1.23";
+var version = "2.1.25";
 //#endregion
 export { version as n, name as t };

package/dist/docloader-DX96uPUj.mjs

@@ -0,0 +1,78 @@
+import "@js-temporal/polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { s as validateCryptoKey } from "./key-x9f-H7eO.mjs";
+import { n as doubleKnock } from "./http-B5qAeoJd.mjs";
+import { curry } from "es-toolkit";
+import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, validatePublicUrl } from "@fedify/vocab-runtime";
+import { getLogger } from "@logtape/logtape";
+//#region src/utils/docloader.ts
+const logger = getLogger([
+	"fedify",
+	"utils",
+	"docloader"
+]);
+const DEFAULT_MAX_REDIRECTION = 20;
+/**
+* Gets an authenticated {@link DocumentLoader} for the given identity.
+* Note that an authenticated document loader intentionally does not cache
+* the fetched documents.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
+* @param identity The identity to get the document loader for.
+*                 The actor's key pair.
+* @param options The options for the document loader.
+* @returns The authenticated document loader.
+* @throws {TypeError} If the key is invalid or unsupported.
+* @since 0.4.0
+*/
+function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, userAgent, specDeterminer, tracerProvider } = {}) {
+	validateCryptoKey(identity.privateKey);
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
+		options?.signal?.throwIfAborted();
+		let currentUrl = new URL(url).href;
+		await validateUrl(currentUrl);
+		visited.add(currentUrl);
+		const originalRequest = createActivityPubRequest(currentUrl, { userAgent });
+		function follow(nextUrl) {
+			options?.signal?.throwIfAborted();
+			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+			if (visited.has(nextUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
+			redirected++;
+		}
+		const response = await doubleKnock(originalRequest, identity, {
+			specDeterminer,
+			log: curry(logRequest)(logger),
+			tracerProvider,
+			signal: options?.signal,
+			validateRedirect: async (nextUrl) => {
+				follow(nextUrl);
+				await validateUrl(nextUrl);
+				visited.add(nextUrl);
+				currentUrl = nextUrl;
+			}
+		});
+		return getRemoteDocument(currentUrl, response, (alternateUrl) => {
+			follow(alternateUrl);
+			return load(alternateUrl, options, redirected, visited);
+		});
+	}
+	async function validateUrl(url) {
+		if (!allowPrivateAddress) try {
+			await validatePublicUrl(url);
+		} catch (error) {
+			if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	return (url, options) => load(url, options);
+}
+//#endregion
+export { getAuthenticatedDocumentLoader as t };

package/dist/federation/builder.test.mjs

@@ -2,10 +2,10 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import { a as assertExists } from "../std__assert-Duiq_YC9.mjs";
+import { i as assertExists } from "../std__assert-BUOJXi-Z.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
-import { t as MemoryKvStore } from "../kv-tL2TOE9X.mjs";
-import { n as createFederationBuilder } from "../builder-BlCsjkrX.mjs";
+import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
+import { n as createFederationBuilder } from "../builder-DsBAef6b.mjs";
 import { test } from "@fedify/fixture";
 import { Activity, Note, Person } from "@fedify/vocab";
 //#region src/federation/builder.test.ts

package/dist/federation/collection.test.mjs

@@ -2,8 +2,8 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-Duiq_YC9.mjs";
-import { n as digest, t as buildCollectionSynchronizationHeader } from "../collection-BD6-SZ6O.mjs";
+import "../std__assert-BUOJXi-Z.mjs";
+import { n as digest, t as buildCollectionSynchronizationHeader } from "../collection-ChgDTHLz.mjs";
 import { test } from "@fedify/fixture";
 import { decodeHex } from "byte-encodings/hex";
 //#region src/federation/collection.test.ts

package/dist/federation/handler.test.mjs

@@ -3,18 +3,20 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as createRequestContext, t as createInboxContext } from "../context-Juj6bdHC.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-Duiq_YC9.mjs";
+import "../std__assert-BUOJXi-Z.mjs";
 import { t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { r as parseAcceptSignature } from "../accept-Dd__NiUL.mjs";
-import { s as signRequest } from "../http-DIh9_s_-.mjs";
-import { a as rsaPrivateKey3, c as rsaPublicKey3, s as rsaPublicKey2 } from "../keys-BAK-tUlf.mjs";
-import { a as compactJsonLd, f as signJsonLd } from "../ld-Ch6FVq7X.mjs";
-import { t as MemoryKvStore } from "../kv-tL2TOE9X.mjs";
-import { a as createFederation, c as handleCollection, d as handleObject, f as respondWithObject, l as handleCustomCollection, p as respondWithObjectIfAcceptable, s as handleActor, u as handleInbox } from "../middleware-D2O8b03q.mjs";
-import { t as InboxListenerSet } from "../inbox-BxCHIWPD.mjs";
+import { t as assert } from "../assert-BhQd8QHP.mjs";
+import { r as parseAcceptSignature } from "../accept-BavzedPB.mjs";
+import { a as generateCryptoKeyPair } from "../key-x9f-H7eO.mjs";
+import { s as signRequest } from "../http-B5qAeoJd.mjs";
+import { a as rsaPrivateKey3, c as rsaPublicKey3, s as rsaPublicKey2 } from "../keys-CtZLJq76.mjs";
+import { a as compactJsonLd, f as signJsonLd } from "../ld-cfUwoi0C.mjs";
+import { n as signObject } from "../proof-CI4rsVLu.mjs";
+import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
+import { a as createFederation, c as handleCollection, d as handleObject, f as respondWithObject, l as handleCustomCollection, p as respondWithObjectIfAcceptable, s as handleActor, u as handleInbox } from "../middleware-DHHRwSZH.mjs";
+import { t as InboxListenerSet } from "../inbox-BSyjaFbo.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
-import { Create, Note, Person } from "@fedify/vocab";
+import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/handler.test.ts
 test("handleActor()", async () => {
@@ -3705,5 +3707,121 @@ test("handleInbox() challenge policy enabled + unverifiedActivityHandler throws
 	assertEquals(response.headers.get("Cache-Control"), "no-store", "Cache-Control: no-store must be set for challenge-response");
 	assertEquals(response.headers.get("Vary"), "Accept, Signature", "Vary header must include Accept and Signature");
 });
+test("handleInbox() rejects forged key ownership", async () => {
+	const impersonated = "https://example.com/person2";
+	const attackerKeyId = new URL("https://attacker.example/key");
+	const attackerMultikeyId = new URL("https://attacker.example/multikey");
+	const { privateKey, publicKey } = await generateCryptoKeyPair("RSASSA-PKCS1-v1_5");
+	const forgedKeyDocument = await new CryptographicKey({
+		id: attackerKeyId,
+		owner: new URL(impersonated),
+		publicKey
+	}).toJsonLd({ contextLoader: mockDocumentLoader });
+	const ed25519 = await generateCryptoKeyPair("Ed25519");
+	const forgedMultikeyDocument = await new Multikey({
+		id: attackerMultikeyId,
+		controller: new URL(impersonated),
+		publicKey: ed25519.publicKey
+	}).toJsonLd({ contextLoader: mockDocumentLoader });
+	const documentLoader = (resource) => {
+		if (resource === attackerKeyId.href) return Promise.resolve({
+			contextUrl: null,
+			documentUrl: resource,
+			document: forgedKeyDocument
+		});
+		if (resource === attackerMultikeyId.href) return Promise.resolve({
+			contextUrl: null,
+			documentUrl: resource,
+			document: forgedMultikeyDocument
+		});
+		return mockDocumentLoader(resource);
+	};
+	const federation = createFederation({ kv: new MemoryKvStore() });
+	const inboxOptions = {
+		kv: new MemoryKvStore(),
+		kvPrefixes: {
+			activityIdempotence: ["_fedify", "activityIdempotence"],
+			publicKey: ["_fedify", "publicKey"],
+			acceptSignatureNonce: ["_fedify", "acceptSignatureNonce"]
+		},
+		actorDispatcher: ((_ctx, identifier) => identifier === "someone" ? new Person({ name: "Someone" }) : null),
+		inboxListeners: new InboxListenerSet(),
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		signatureTimeWindow: { minutes: 5 },
+		skipSignatureVerification: false
+	};
+	const handle = async (request) => {
+		const context = createRequestContext({
+			federation,
+			request,
+			url: new URL(request.url),
+			data: void 0,
+			documentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		return await handleInbox(request, {
+			recipient: null,
+			context,
+			inboxContextFactory(_activity) {
+				return createInboxContext({
+					...context,
+					clone: void 0
+				});
+			},
+			...inboxOptions
+		});
+	};
+	const activity = {
+		"@context": [
+			"https://www.w3.org/ns/activitystreams",
+			"https://w3id.org/identity/v1",
+			"https://w3id.org/security/v1",
+			"https://w3id.org/security/data-integrity/v1"
+		],
+		id: "https://attacker.example/activities/1",
+		type: "Create",
+		actor: impersonated,
+		object: {
+			id: "https://attacker.example/notes/1",
+			type: "Note",
+			attributedTo: impersonated,
+			content: "Hello World!"
+		}
+	};
+	const httpSignedResponse = await handle(await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(activity)
+	}), privateKey, attackerKeyId));
+	const ldSignedResponse = await handle(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(await signJsonLd(activity, privateKey, attackerKeyId, { contextLoader: mockDocumentLoader }))
+	}));
+	const signedObject = await signObject(await Create.fromJsonLd(activity, {
+		documentLoader,
+		contextLoader: mockDocumentLoader
+	}), ed25519.privateKey, attackerMultikeyId, {
+		documentLoader,
+		contextLoader: mockDocumentLoader,
+		context: ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"]
+	});
+	const proofSignedResponse = await handle(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(await signedObject.toJsonLd({
+			format: "compact",
+			contextLoader: mockDocumentLoader,
+			context: ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"]
+		}))
+	}));
+	assertEquals([
+		httpSignedResponse.status,
+		ldSignedResponse.status,
+		proofSignedResponse.status
+	], [
+		401,
+		401,
+		401
+	]);
+	assertEquals(await httpSignedResponse.text(), "Failed to verify the request signature.");
+});
 //#endregion
 export {};

package/dist/federation/idempotency.test.mjs

@@ -2,11 +2,11 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-Duiq_YC9.mjs";
-import { n as ed25519PrivateKey, r as ed25519PublicKey, t as ed25519Multikey } from "../keys-BAK-tUlf.mjs";
-import { n as signObject } from "../proof-Dt5GV-xi.mjs";
-import { t as MemoryKvStore } from "../kv-tL2TOE9X.mjs";
-import { a as createFederation } from "../middleware-D2O8b03q.mjs";
+import "../std__assert-BUOJXi-Z.mjs";
+import { n as ed25519PrivateKey, r as ed25519PublicKey, t as ed25519Multikey } from "../keys-CtZLJq76.mjs";
+import { n as signObject } from "../proof-CI4rsVLu.mjs";
+import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
+import { a as createFederation } from "../middleware-DHHRwSZH.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, Follow, Person } from "@fedify/vocab";
 //#region src/federation/idempotency.test.ts

package/dist/federation/inbox.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
-import { t as InboxListenerSet } from "../inbox-BxCHIWPD.mjs";
+import { t as InboxListenerSet } from "../inbox-BSyjaFbo.mjs";
 import { test } from "@fedify/fixture";
 import { Activity, Create, Invite, Offer, Update } from "@fedify/vocab";
 //#region src/federation/inbox.test.ts

package/dist/federation/keycache.test.mjs

@@ -2,10 +2,9 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
-import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { t as MemoryKvStore } from "../kv-tL2TOE9X.mjs";
-import { t as KvKeyCache } from "../keycache-CCSwkQcY.mjs";
+import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
+import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
+import { t as KvKeyCache } from "../keycache-CaO7wyQA.mjs";
 import { test } from "@fedify/fixture";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 //#region src/federation/keycache.test.ts
@@ -13,25 +12,41 @@ test("KvKeyCache.set()", async () => {
 	const kv = new MemoryKvStore();
 	const cache = new KvKeyCache(kv, ["pk"]);
 	await cache.set(new URL("https://example.com/key"), new CryptographicKey({ id: new URL("https://example.com/key") }));
-	assertEquals(await kv.get(["pk", "https://example.com/key"]), {
+	assertEquals(await kv.get([
+		"pk",
+		"2",
+		"https://example.com/key"
+	]), {
 		"@context": "https://w3id.org/security/v1",
 		id: "https://example.com/key",
 		type: "CryptographicKey"
 	});
 	await cache.set(new URL("https://example.com/key2"), new Multikey({ id: new URL("https://example.com/key2") }));
-	assertEquals(await kv.get(["pk", "https://example.com/key2"]), {
+	assertEquals(await kv.get([
+		"pk",
+		"2",
+		"https://example.com/key2"
+	]), {
 		"@context": "https://w3id.org/security/multikey/v1",
 		id: "https://example.com/key2",
 		type: "Multikey"
 	});
 	await cache.set(new URL("https://example.com/null"), null);
 	assert(cache.nullKeys.has("https://example.com/null"));
-	assertEquals(await kv.get(["pk", "https://example.com/null"]), null);
+	assertEquals(await kv.get([
+		"pk",
+		"2",
+		"https://example.com/null"
+	]), null);
 });
 test("KvKeyCache.get()", async () => {
 	const kv = new MemoryKvStore();
 	const cache = new KvKeyCache(kv, ["pk"]);
-	await kv.set(["pk", "https://example.com/key"], {
+	await kv.set([
+		"pk",
+		"2",
+		"https://example.com/key"
+	], {
 		"@context": "https://w3id.org/security/v1",
 		id: "https://example.com/key",
 		type: "CryptographicKey"
@@ -39,7 +54,11 @@ test("KvKeyCache.get()", async () => {
 	const cryptoKey = await cache.get(new URL("https://example.com/key"));
 	assertInstanceOf(cryptoKey, CryptographicKey);
 	assertEquals(cryptoKey?.id?.href, "https://example.com/key");
-	await kv.set(["pk", "https://example.com/key2"], {
+	await kv.set([
+		"pk",
+		"2",
+		"https://example.com/key2"
+	], {
 		"@context": "https://w3id.org/security/multikey/v1",
 		id: "https://example.com/key2",
 		type: "Multikey"
@@ -49,7 +68,11 @@ test("KvKeyCache.get()", async () => {
 	assertEquals(multikey?.id?.href, "https://example.com/key2");
 	cache.nullKeys.set("https://example.com/null", Temporal.Now.instant().add(Temporal.Duration.from({ minutes: 10 })));
 	assertEquals(await cache.get(new URL("https://example.com/null")), null);
-	await kv.set(["pk", "https://example.com/null2"], null);
+	await kv.set([
+		"pk",
+		"2",
+		"https://example.com/null2"
+	], null);
 	assertEquals(await new KvKeyCache(kv, ["pk"]).get(new URL("https://example.com/null2")), null);
 });
 test("KvKeyCache fetch error metadata", async () => {
@@ -90,5 +113,16 @@ test("KvKeyCache unavailable entries expire", async () => {
 	assertEquals(await cache.get(keyId), void 0);
 	assertEquals(await cache.getFetchError(keyId), void 0);
 });
+test("KvKeyCache.get() ignores entries from an earlier generation", async () => {
+	const kv = new MemoryKvStore();
+	const cache = new KvKeyCache(kv, ["pk"]);
+	await kv.set(["pk", "https://example.com/key"], {
+		"@context": "https://w3id.org/security/v1",
+		id: "https://example.com/key",
+		owner: "https://example.com/impersonated",
+		type: "CryptographicKey"
+	});
+	assertEquals(await cache.get(new URL("https://example.com/key")), void 0);
+});
 //#endregion
 export {};