@fedify/fedify 2.4.0-dev.1668 → 2.4.0-dev.1727

package/dist/{temporal-polyfill-BCdTHexd.cjs → http-AyKngJ_h.cjs}

@@ -1,4 +1,16 @@
 const { URLPattern } = require("urlpattern-polyfill");
+let _logtape_logtape = require("@logtape/logtape");
+let _fedify_vocab = require("@fedify/vocab");
+let _opentelemetry_api = require("@opentelemetry/api");
+let byte_encodings_hex = require("byte-encodings/hex");
+let structured_field_values = require("structured-field-values");
+let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
+let byte_encodings_base64 = require("byte-encodings/base64");
+//#region deno.json
+var name = "@fedify/fedify";
+var version = "2.4.0-dev.1727+1eadcb04";
+//#endregion
 //#region ../../node_modules/.pnpm/temporal-polyfill@1.0.1/node_modules/temporal-polyfill/chunks/root.js
 const NativeTemporal = globalThis.Temporal;
 //#endregion
@@ -150,7 +162,7 @@ function parseInt0(s) {
 function padNumber(digits, num) {
 	return String(num).padStart(digits, "0");
 }
-const padNumber2 = /* @__PURE__ */ bindArgs(padNumber, 2);
+const padNumber2 = /*@__PURE__*/ bindArgs(padNumber, 2);
 function compareNumbers(a, b) {
 	return Math.sign(a - b);
 }
@@ -218,7 +230,7 @@ const unitNameMap = {
 	month: 8,
 	year: 9
 };
-const unitNamesAsc = /* @__PURE__ */ Object.keys(unitNameMap);
+const unitNamesAsc = /*@__PURE__*/ Object.keys(unitNameMap);
 const nanoInMicro = nanoInMicro$1;
 const nanoInMilli = nanoInMilli$1;
 const nanoInSec = nanoInSec$1;
@@ -234,19 +246,19 @@ const unitNanoMap = [
 	nanoInHour,
 	nanoInUtcDay
 ];
-const bigNanoInMicro = /* @__PURE__ */ BigInt(nanoInMicro);
-const bigNanoInMilli = /* @__PURE__ */ BigInt(nanoInMilli);
-const bigNanoInSec = /* @__PURE__ */ BigInt(nanoInSec);
-const bigNanoInMinute = /* @__PURE__ */ BigInt(nanoInMinute);
-const bigNanoInHour = /* @__PURE__ */ BigInt(nanoInHour);
-const bigNanoInUtcDay = /* @__PURE__ */ BigInt(nanoInUtcDay);
+const bigNanoInMicro = /*@__PURE__*/ BigInt(nanoInMicro);
+const bigNanoInMilli = /*@__PURE__*/ BigInt(nanoInMilli);
+const bigNanoInSec = /*@__PURE__*/ BigInt(nanoInSec);
+const bigNanoInMinute = /*@__PURE__*/ BigInt(nanoInMinute);
+const bigNanoInHour = /*@__PURE__*/ BigInt(nanoInHour);
+const bigNanoInUtcDay = /*@__PURE__*/ BigInt(nanoInUtcDay);
 function divideBigNanoToExactNumber(bigNano, divisorNano) {
 	const days = Number(bigNano / bigNanoInUtcDay);
 	const timeNano = Number(bigNano % bigNanoInUtcDay);
 	return days * (nanoInUtcDay / divisorNano) + (Math.trunc(timeNano / divisorNano) + timeNano % divisorNano / divisorNano);
 }
-const timeFieldNamesAsc = /* @__PURE__ */ unitNamesAsc.slice(0, 6);
-const timeGetters = /* @__PURE__ */ createPropGetters(timeFieldNamesAsc);
+const timeFieldNamesAsc = /*@__PURE__*/ unitNamesAsc.slice(0, 6);
+const timeGetters = /*@__PURE__*/ createPropGetters(timeFieldNamesAsc);
 const yearFieldNamesAsc = ["year"];
 const dayFieldNamesAsc = ["day"];
 const calendarDateFieldNamesAsc = [
@@ -268,24 +280,24 @@ const monthDayFieldNames = [
 	"month",
 	"monthCode"
 ];
-const timeFieldNamesAlpha = /* @__PURE__ */ sortStrings(timeFieldNamesAsc);
-const yearFieldNamesWithEraAlpha = /* @__PURE__ */ sortStrings(eraYearFieldNames, yearFieldNamesAsc);
-const yearMonthFieldNamesAlpha = /* @__PURE__ */ sortStrings(monthFieldNames, yearFieldNamesAsc);
-const yearMonthFieldNamesWithEraAlpha = /* @__PURE__ */ sortStrings(eraYearFieldNames, yearMonthFieldNamesAlpha);
-const yearMonthCodeFieldNamesAlpha = /* @__PURE__ */ sortStrings(["monthCode"], yearFieldNamesAsc);
-const yearMonthCodeFieldNamesWithEraAlpha = /* @__PURE__ */ sortStrings(eraYearFieldNames, yearMonthCodeFieldNamesAlpha);
-const monthCodeDayFieldNamesAlpha = /* @__PURE__ */ sortStrings(dayFieldNamesAsc, ["monthCode"]);
-const dateFieldNamesAlpha = /* @__PURE__ */ sortStrings(dayFieldNamesAsc, yearMonthFieldNamesAlpha);
-const dateFieldNamesWithEraAlpha = /* @__PURE__ */ sortStrings(dayFieldNamesAsc, eraYearFieldNames, yearMonthFieldNamesAlpha);
-const dateTimeFieldNamesAlpha = /* @__PURE__ */ sortStrings(dateFieldNamesAlpha, timeFieldNamesAsc);
-const dateTimeFieldNamesWithEraAlpha = /* @__PURE__ */ sortStrings(dateFieldNamesWithEraAlpha, timeFieldNamesAsc);
-const dateTimeAndOffsetFieldNamesAlpha = /* @__PURE__ */ sortStrings(dateFieldNamesAlpha, timeFieldNamesAsc, offsetFieldNames);
-const dateTimeAndOffsetFieldNamesWithEraAlpha = /* @__PURE__ */ sortStrings(dateFieldNamesWithEraAlpha, timeFieldNamesAsc, offsetFieldNames);
-const dateTimeAndZoneFieldNamesAlpha = /* @__PURE__ */ sortStrings(dateFieldNamesAlpha, timeFieldNamesAsc, offsetFieldNames, timeZoneFieldNames);
-const dateTimeAndZoneFieldNamesWithEraAlpha = /* @__PURE__ */ sortStrings(dateFieldNamesWithEraAlpha, timeFieldNamesAsc, offsetFieldNames, timeZoneFieldNames);
-const yearMonthCodeDayFieldNamesAlpha = /* @__PURE__ */ sortStrings(dayFieldNamesAsc, yearMonthCodeFieldNamesAlpha);
-const yearMonthCodeDayFieldNamesWithEraAlpha = /* @__PURE__ */ sortStrings(dayFieldNamesAsc, eraYearFieldNames, yearMonthCodeFieldNamesAlpha);
-const timeFieldDefaults = /* @__PURE__ */ zipPropsConst(timeFieldNamesAsc, 0);
+const timeFieldNamesAlpha = /*@__PURE__*/ sortStrings(timeFieldNamesAsc);
+const yearFieldNamesWithEraAlpha = /*@__PURE__*/ sortStrings(eraYearFieldNames, yearFieldNamesAsc);
+const yearMonthFieldNamesAlpha = /*@__PURE__*/ sortStrings(monthFieldNames, yearFieldNamesAsc);
+const yearMonthFieldNamesWithEraAlpha = /*@__PURE__*/ sortStrings(eraYearFieldNames, yearMonthFieldNamesAlpha);
+const yearMonthCodeFieldNamesAlpha = /*@__PURE__*/ sortStrings(["monthCode"], yearFieldNamesAsc);
+const yearMonthCodeFieldNamesWithEraAlpha = /*@__PURE__*/ sortStrings(eraYearFieldNames, yearMonthCodeFieldNamesAlpha);
+const monthCodeDayFieldNamesAlpha = /*@__PURE__*/ sortStrings(dayFieldNamesAsc, ["monthCode"]);
+const dateFieldNamesAlpha = /*@__PURE__*/ sortStrings(dayFieldNamesAsc, yearMonthFieldNamesAlpha);
+const dateFieldNamesWithEraAlpha = /*@__PURE__*/ sortStrings(dayFieldNamesAsc, eraYearFieldNames, yearMonthFieldNamesAlpha);
+const dateTimeFieldNamesAlpha = /*@__PURE__*/ sortStrings(dateFieldNamesAlpha, timeFieldNamesAsc);
+const dateTimeFieldNamesWithEraAlpha = /*@__PURE__*/ sortStrings(dateFieldNamesWithEraAlpha, timeFieldNamesAsc);
+const dateTimeAndOffsetFieldNamesAlpha = /*@__PURE__*/ sortStrings(dateFieldNamesAlpha, timeFieldNamesAsc, offsetFieldNames);
+const dateTimeAndOffsetFieldNamesWithEraAlpha = /*@__PURE__*/ sortStrings(dateFieldNamesWithEraAlpha, timeFieldNamesAsc, offsetFieldNames);
+const dateTimeAndZoneFieldNamesAlpha = /*@__PURE__*/ sortStrings(dateFieldNamesAlpha, timeFieldNamesAsc, offsetFieldNames, timeZoneFieldNames);
+const dateTimeAndZoneFieldNamesWithEraAlpha = /*@__PURE__*/ sortStrings(dateFieldNamesWithEraAlpha, timeFieldNamesAsc, offsetFieldNames, timeZoneFieldNames);
+const yearMonthCodeDayFieldNamesAlpha = /*@__PURE__*/ sortStrings(dayFieldNamesAsc, yearMonthCodeFieldNamesAlpha);
+const yearMonthCodeDayFieldNamesWithEraAlpha = /*@__PURE__*/ sortStrings(dayFieldNamesAsc, eraYearFieldNames, yearMonthCodeFieldNamesAlpha);
+const timeFieldDefaults = /*@__PURE__*/ zipPropsConst(timeFieldNamesAsc, 0);
 function validateTimeFields(timeFields) {
 	return constrainTimeFields(timeFields, 1), timeFields;
 }
@@ -514,20 +526,20 @@ function computeCalendarWeekOfYear(calendar, isoDate) {
 function computeCalendarYearOfWeek(calendar, isoDate) {
 	return calendar === void 0 ? computeIsoWeekFields(isoDate).yearOfWeek : void 0;
 }
-const durationFieldNamesAsc = /* @__PURE__ */ unitNamesAsc.map((unitName) => unitName + "s");
-const durationGetters = /* @__PURE__ */ createPropGetters(durationFieldNamesAsc);
-const durationFieldNamesAlpha = /* @__PURE__ */ sortStrings(durationFieldNamesAsc);
-const durationTimeFieldNamesAsc = /* @__PURE__ */ durationFieldNamesAsc.slice(0, 6);
-const durationDateFieldNamesAsc = /* @__PURE__ */ durationFieldNamesAsc.slice(6);
-const durationCalendarFieldNamesAsc = /* @__PURE__ */ durationDateFieldNamesAsc.slice(1);
-const durationFieldIndexes = /* @__PURE__ */ durationFieldNamesAsc.reduce((indexes, fieldName, i) => (indexes[fieldName] = i, indexes), {});
-const durationFieldDefaults = /* @__PURE__ */ zipPropsConst(durationFieldNamesAsc, 0);
-const durationTimeFieldDefaults = /* @__PURE__ */ zipPropsConst(durationTimeFieldNamesAsc, 0);
-const clearDurationFields = /* @__PURE__ */ bindArgs(zeroOutProps, durationFieldNamesAsc);
+const durationFieldNamesAsc = /*@__PURE__*/ unitNamesAsc.map((unitName) => unitName + "s");
+const durationGetters = /*@__PURE__*/ createPropGetters(durationFieldNamesAsc);
+const durationFieldNamesAlpha = /*@__PURE__*/ sortStrings(durationFieldNamesAsc);
+const durationTimeFieldNamesAsc = /*@__PURE__*/ durationFieldNamesAsc.slice(0, 6);
+const durationDateFieldNamesAsc = /*@__PURE__*/ durationFieldNamesAsc.slice(6);
+const durationCalendarFieldNamesAsc = /*@__PURE__*/ durationDateFieldNamesAsc.slice(1);
+const durationFieldIndexes = /*@__PURE__*/ durationFieldNamesAsc.reduce((indexes, fieldName, i) => (indexes[fieldName] = i, indexes), {});
+const durationFieldDefaults = /*@__PURE__*/ zipPropsConst(durationFieldNamesAsc, 0);
+const durationTimeFieldDefaults = /*@__PURE__*/ zipPropsConst(durationTimeFieldNamesAsc, 0);
+const clearDurationFields = /*@__PURE__*/ bindArgs(zeroOutProps, durationFieldNamesAsc);
 function requirePropDefined(optionName, optionVal) {
 	return optionVal ?? throwRangeError(missingField(optionName)), optionVal;
 }
-const requireString = /* @__PURE__ */ bindArgs(requireType, "string");
+const requireString = /*@__PURE__*/ bindArgs(requireType, "string");
 function requireType(typeName, arg, entityName = typeName) {
 	return typeof arg !== typeName && throwTypeError(invalidEntity(entityName, arg)), arg;
 }
@@ -639,17 +651,17 @@ function coerceChoiceOption(optionName, enumNameMap, options, defaultChoice = 0)
 	const enumNum = enumNameMap[enumStr];
 	return void 0 === enumNum && throwRangeError(invalidChoice(optionName, enumStr, enumNameMap)), enumNum;
 }
-const coerceSmallestUnit = /* @__PURE__ */ bindArgs(coerceUnitOption, smallestUnitStr);
-const coerceLargestUnit = /* @__PURE__ */ bindArgs(coerceUnitOption, "largestUnit");
-const coerceTotalUnit = /* @__PURE__ */ bindArgs(coerceUnitOption, "unit");
-const coerceOverflow = /* @__PURE__ */ bindArgs(coerceChoiceOption, "overflow", overflowMap);
-const coerceEpochDisambig = /* @__PURE__ */ bindArgs(coerceChoiceOption, "disambiguation", epochDisambigMap);
-const coerceOffsetDisambig = /* @__PURE__ */ bindArgs(coerceChoiceOption, "offset", offsetDisambigMap);
-const coerceCalendarDisplay = /* @__PURE__ */ bindArgs(coerceChoiceOption, "calendarName", calendarDisplayMap);
-const coerceTimeZoneDisplay = /* @__PURE__ */ bindArgs(coerceChoiceOption, "timeZoneName", timeZoneDisplayMap);
-const coerceOffsetDisplay = /* @__PURE__ */ bindArgs(coerceChoiceOption, "offset", offsetDisplayMap);
-const coerceRoundingMode = /* @__PURE__ */ bindArgs(coerceChoiceOption, "roundingMode", roundingModeMap);
-const coerceDirection = /* @__PURE__ */ bindArgs(coerceChoiceOption, "direction", directionMap);
+const coerceSmallestUnit = /*@__PURE__*/ bindArgs(coerceUnitOption, smallestUnitStr);
+const coerceLargestUnit = /*@__PURE__*/ bindArgs(coerceUnitOption, "largestUnit");
+const coerceTotalUnit = /*@__PURE__*/ bindArgs(coerceUnitOption, "unit");
+const coerceOverflow = /*@__PURE__*/ bindArgs(coerceChoiceOption, "overflow", overflowMap);
+const coerceEpochDisambig = /*@__PURE__*/ bindArgs(coerceChoiceOption, "disambiguation", epochDisambigMap);
+const coerceOffsetDisambig = /*@__PURE__*/ bindArgs(coerceChoiceOption, "offset", offsetDisambigMap);
+const coerceCalendarDisplay = /*@__PURE__*/ bindArgs(coerceChoiceOption, "calendarName", calendarDisplayMap);
+const coerceTimeZoneDisplay = /*@__PURE__*/ bindArgs(coerceChoiceOption, "timeZoneName", timeZoneDisplayMap);
+const coerceOffsetDisplay = /*@__PURE__*/ bindArgs(coerceChoiceOption, "offset", offsetDisplayMap);
+const coerceRoundingMode = /*@__PURE__*/ bindArgs(coerceChoiceOption, "roundingMode", roundingModeMap);
+const coerceDirection = /*@__PURE__*/ bindArgs(coerceChoiceOption, "direction", directionMap);
 function validateRoundingInc(roundingInc, smallestUnit, allowManyLargeUnits, solarMode) {
 	const upUnitNano = solarMode ? nanoInUtcDay : unitNanoMap[smallestUnit + 1];
 	if (upUnitNano) {
@@ -703,8 +715,8 @@ function refineZonedFieldOptions(options, defaultOffsetDisambig = 0) {
 		epochDisambig
 	];
 }
-const epochNanoMax = /* @__PURE__ */ BigInt(1e8) * bigNanoInUtcDay;
-const epochNanoMin = /* @__PURE__ */ BigInt(-1e8) * bigNanoInUtcDay;
+const epochNanoMax = /*@__PURE__*/ BigInt(1e8) * bigNanoInUtcDay;
+const epochNanoMin = /*@__PURE__*/ BigInt(-1e8) * bigNanoInUtcDay;
 const plainDateEpochNanoMin = epochNanoMin - bigNanoInUtcDay;
 const isoYearMonthIndexMin = -3261848;
 function checkIsoYearMonthInBounds(isoDate) {
@@ -975,11 +987,12 @@ function nudgeRelativeDuration(sign, durationFields, endEpochNano, _largestUnit,
 }
 function getTimeZoneTransitionEpochNanoseconds(slots, options) {
 	return slots.timeZone.U(slots.epochNanoseconds, ((options) => {
-		const res = coerceDirection(normalizeOptionsOrString(options, "direction"), 0);
+		const normalizedOptions = normalizeOptionsOrString(options, "direction");
+		const res = coerceDirection(normalizedOptions, 0);
 		return res || throwRangeError(invalidEntity("direction", res)), res;
 	})(options));
 }
-const zonedEpochSlotsToIso = /* @__PURE__ */ memoize(_zonedEpochSlotsToIso, WeakMap);
+const zonedEpochSlotsToIso = /*@__PURE__*/ memoize(_zonedEpochSlotsToIso, WeakMap);
 function _zonedEpochSlotsToIso(slots) {
 	const { epochNanoseconds, timeZone } = slots;
 	const offsetNanoseconds = timeZone.C(epochNanoseconds);
@@ -1545,7 +1558,7 @@ function resolveTimeFields(fields, overflow) {
 		...fields
 	}), overflow);
 }
-const offsetRegExp = /* @__PURE__ */ createRegExp("([+-])(\\d{2})(?::?(\\d{2})(?::?(\\d{2})(?:[.,](\\d{1,9}))?)?)?");
+const offsetRegExp = /*@__PURE__*/ createRegExp("([+-])(\\d{2})(?::?(\\d{2})(?::?(\\d{2})(?:[.,](\\d{1,9}))?)?)?");
 function parseOffsetNano(s) {
 	const offsetNano = parseOffsetNanoMaybe(s);
 	return void 0 === offsetNano && throwRangeError(failedParse(s)), offsetNano;
@@ -1580,13 +1593,13 @@ const dateFieldRefiners = {
 	},
 	day: toPositiveIntegerWithTruncation
 };
-const timeFieldRefiners = /* @__PURE__ */ zipPropsConst(timeFieldNamesAsc, toIntegerWithTrunc);
-const durationFieldRefiners = /* @__PURE__ */ zipPropsConst(durationFieldNamesAsc, toStrictInteger);
+const timeFieldRefiners = /*@__PURE__*/ zipPropsConst(timeFieldNamesAsc, toIntegerWithTrunc);
+const durationFieldRefiners = /*@__PURE__*/ zipPropsConst(durationFieldNamesAsc, toStrictInteger);
 const offsetFieldRefiners = { offset(offsetString) {
 	return parseOffsetNano(toStringViaPrimitive(offsetString));
 } };
-const dateTimeFieldRefiners = /* @__PURE__ */ Object.assign({}, dateFieldRefiners, timeFieldRefiners);
-const zonedDateTimeFieldRefiners = /* @__PURE__ */ Object.assign({}, dateTimeFieldRefiners, offsetFieldRefiners);
+const dateTimeFieldRefiners = /*@__PURE__*/ Object.assign({}, dateFieldRefiners, timeFieldRefiners);
+const zonedDateTimeFieldRefiners = /*@__PURE__*/ Object.assign({}, dateTimeFieldRefiners, offsetFieldRefiners);
 function readAndRefineBagFields(bag, validFieldNames, fieldRefiners, requiredFieldNames, disallowEmpty = !requiredFieldNames) {
 	const res = {};
 	let anyMatching = 0;
@@ -1689,7 +1702,9 @@ const timeZonePeriodDaysByName = {
 const minPossibleTransitionSec = -388152e4;
 function refineTimeDisplayTuple(options, maxSmallestUnit = 4) {
 	const subsecDigits = coerceFractionalSecondDigits(options);
-	return [coerceRoundingMode(options, 4), ...resolveSmallestUnitAndSubsecDigits(validateUnitRange(smallestUnitStr, coerceSmallestUnit(options), 0, maxSmallestUnit), subsecDigits)];
+	const roundingMode = coerceRoundingMode(options, 4);
+	const smallestUnit = coerceSmallestUnit(options);
+	return [roundingMode, ...resolveSmallestUnitAndSubsecDigits(validateUnitRange(smallestUnitStr, smallestUnit, 0, maxSmallestUnit), subsecDigits)];
 }
 function refineDateDisplayOptions(options) {
 	return coerceCalendarDisplay(normalizeOptions(options));
@@ -1864,15 +1879,17 @@ function resolveTimeZoneRecord(rawId) {
 		kind: "fixed",
 		...offsetRecord
 	};
-	return queryNamedTimeZoneRecord("UTC" === upperRawId ? "UTC" : ((rawId) => (badCharactersRegExp.test(rawId) && throwRangeError(invalidTimeZone(rawId)), icuRegExp.test(rawId) && throwRangeError("Forbidden ICU TimeZone"), rawId.toLowerCase().split("/").map((part, partI) => (part.length <= 3 || /\d/.test(part)) && !/etc|yap/.test(part) ? part.toUpperCase() : part.replace(/baja|dumont|[a-z]+/g, (a, i) => a.length <= 2 && !partI || "in" === a || "chat" === a ? a.toUpperCase() : a.length > 2 || !i ? capitalize(a).replace(/island|noronha|murdo|rivadavia|urville/, capitalize) : a)).join("/")))(rawId));
+	const normId = "UTC" === upperRawId ? "UTC" : ((rawId) => (badCharactersRegExp.test(rawId) && throwRangeError(invalidTimeZone(rawId)), icuRegExp.test(rawId) && throwRangeError("Forbidden ICU TimeZone"), rawId.toLowerCase().split("/").map((part, partI) => (part.length <= 3 || /\d/.test(part)) && !/etc|yap/.test(part) ? part.toUpperCase() : part.replace(/baja|dumont|[a-z]+/g, (a, i) => a.length <= 2 && !partI || "in" === a || "chat" === a ? a.toUpperCase() : a.length > 2 || !i ? capitalize(a).replace(/island|noronha|murdo|rivadavia|urville/, capitalize) : a)).join("/")))(rawId);
+	return queryNamedTimeZoneRecord(normId);
 }
-const queryNamedTimeZoneRecord = /* @__PURE__ */ memoize((normId) => {
+const queryNamedTimeZoneRecord = /*@__PURE__*/ memoize((normId) => {
 	if ("UTC" === normId) return {
 		kind: "utc",
 		id: normId,
 		o: normId
 	};
-	const format = queryTimeZoneIntlFormat(normId.toUpperCase());
+	const upperNormId = normId.toUpperCase();
+	const format = queryTimeZoneIntlFormat(upperNormId);
 	return {
 		kind: "named",
 		id: normId,
@@ -1880,7 +1897,7 @@ const queryNamedTimeZoneRecord = /* @__PURE__ */ memoize((normId) => {
 		o: format.resolvedOptions().timeZone
 	};
 });
-const queryTimeZoneIntlFormat = /* @__PURE__ */ memoize((upperNormId) => new RawDateTimeFormat("en-u-hc-h23", {
+const queryTimeZoneIntlFormat = /*@__PURE__*/ memoize((upperNormId) => new RawDateTimeFormat("en-u-hc-h23", {
 	calendar: "iso8601",
 	timeZone: upperNormId,
 	era: "short",
@@ -1895,7 +1912,7 @@ function queryTimeZone(rawTimeZoneId) {
 	const record = resolveTimeZoneRecord(rawTimeZoneId);
 	return queryTimeZoneRecord(record.id, record);
 }
-const queryTimeZoneRecord = /* @__PURE__ */ memoize((normTimeZoneId, record) => "named" === record.kind ? new IntlTimeZone(normTimeZoneId, record.o, record.format) : new FixedTimeZone(normTimeZoneId, record.o, "fixed" === record.kind ? record._ : 0));
+const queryTimeZoneRecord = /*@__PURE__*/ memoize((normTimeZoneId, record) => "named" === record.kind ? new IntlTimeZone(normTimeZoneId, record.o, record.format) : new FixedTimeZone(normTimeZoneId, record.o, "fixed" === record.kind ? record._ : 0));
 var FixedTimeZone = class {
 	constructor(id, compareKey, offsetNano) {
 		this.id = id, this.o = compareKey, this._ = offsetNano;
@@ -1977,7 +1994,8 @@ var IntlTimeZone = class {
 				return void 0 !== intlParts.era && "bce" === normalizeEraName(intlParts.era) ? 1 - year : year;
 			})(intlParts), parseInt(intlParts.month), parseInt(intlParts.day)) + 3600 * parseInt(intlParts.hour) + 60 * parseInt(intlParts.minute) + parseInt(intlParts.second) - epochSec;
 		})(format), ((timeZoneId) => {
-			return timeZonePeriodDaysByName[timeZoneId.split("/").pop()] || 60;
+			const timeZoneName = timeZoneId.split("/").pop();
+			return timeZonePeriodDaysByName[timeZoneName] || 60;
 		})(id));
 	}
 	C(epochNano) {
@@ -2201,12 +2219,12 @@ function offsetRegExpStr(separatorIndex) {
 	return "([+-])" + timeRegExpStr(separatorIndex);
 }
 const dateTimeRegExpStr = "(?:(?:([+-])(\\d{6}))|(\\d{4}))(-?)(\\d{2})\\4(\\d{2})(?:[T ]" + timeRegExpStr(8) + "(Z|" + offsetRegExpStr(15) + ")?)?";
-const yearMonthRegExp = /* @__PURE__ */ createRegExp("(?:(?:([+-])(\\d{6}))|(\\d{4}))-?(\\d{2})((?:\\[(!?)([^\\]]*)\\]){0,9})");
-const monthDayRegExp = /* @__PURE__ */ createRegExp("(?:--)?(\\d{2})-?(\\d{2})((?:\\[(!?)([^\\]]*)\\]){0,9})");
-const dateTimeRegExp = /* @__PURE__ */ createRegExp(dateTimeRegExpStr + "((?:\\[(!?)([^\\]]*)\\]){0,9})");
-const timeRegExp = /* @__PURE__ */ createRegExp("T?" + timeRegExpStr(2) + `(${offsetRegExpStr(9)})?((?:\\[(!?)([^\\]]*)\\]){0,9})`);
-const annotationRegExp = /* @__PURE__ */ new RegExp("\\[(!?)([^\\]]*)\\]", "g");
-const durationRegExp = /* @__PURE__ */ createRegExp("([+-])?P(\\d+Y)?(\\d+M)?(\\d+W)?(\\d+D)?(?:T(?:(\\d+)(?:[.,](\\d{1,9}))?H)?(?:(\\d+)(?:[.,](\\d{1,9}))?M)?(?:(\\d+)(?:[.,](\\d{1,9}))?S)?)?");
+const yearMonthRegExp = /*@__PURE__*/ createRegExp("(?:(?:([+-])(\\d{6}))|(\\d{4}))-?(\\d{2})((?:\\[(!?)([^\\]]*)\\]){0,9})");
+const monthDayRegExp = /*@__PURE__*/ createRegExp("(?:--)?(\\d{2})-?(\\d{2})((?:\\[(!?)([^\\]]*)\\]){0,9})");
+const dateTimeRegExp = /*@__PURE__*/ createRegExp(dateTimeRegExpStr + "((?:\\[(!?)([^\\]]*)\\]){0,9})");
+const timeRegExp = /*@__PURE__*/ createRegExp("T?" + timeRegExpStr(2) + `(${offsetRegExpStr(9)})?((?:\\[(!?)([^\\]]*)\\]){0,9})`);
+const annotationRegExp = /*@__PURE__*/ new RegExp("\\[(!?)([^\\]]*)\\]", "g");
+const durationRegExp = /*@__PURE__*/ createRegExp("([+-])?P(\\d+Y)?(\\d+M)?(\\d+W)?(\\d+D)?(?:T(?:(\\d+)(?:[.,](\\d{1,9}))?H)?(?:(\\d+)(?:[.,](\\d{1,9}))?M)?(?:(\\d+)(?:[.,](\\d{1,9}))?S)?)?");
 function parseDateTimeLike(s) {
 	const parts = dateTimeRegExp.exec(s);
 	return parts ? ((parts) => {
@@ -2484,8 +2502,8 @@ const timeDefaultShapeFields = {
 	minute: "numeric",
 	second: "numeric"
 };
-const dateTimeDefaultShapeFields = /* @__PURE__ */ Object.assign({}, dateDefaultShapeFields, timeDefaultShapeFields);
-const zonedDateTimeDefaultShapeFields = /* @__PURE__ */ Object.assign({}, dateTimeDefaultShapeFields, { timeZoneName: "short" });
+const dateTimeDefaultShapeFields = /*@__PURE__*/ Object.assign({}, dateDefaultShapeFields, timeDefaultShapeFields);
+const zonedDateTimeDefaultShapeFields = /*@__PURE__*/ Object.assign({}, dateTimeDefaultShapeFields, { timeZoneName: "short" });
 const yearMonthDefaultShapeFields = {
 	year: "numeric",
 	month: "numeric"
@@ -2509,15 +2527,15 @@ const timeShapeFieldNames = [
 	"fractionalSecondDigits",
 	"timeStyle"
 ];
-const dateTimeShapeFieldNames = /* @__PURE__ */ dateShapeFieldNames.concat(timeShapeFieldNames);
-const yearMonthIgnoredFieldNames = /* @__PURE__ */ ["weekday", "day"].concat(timeShapeFieldNames);
-const monthDayIgnoredFieldNames = /* @__PURE__ */ ["weekday", "year"].concat(timeShapeFieldNames);
-const transformInstantOptions = /* @__PURE__ */ createOptionsTransformer(dateTimeShapeFieldNames, [], [], dateTimeDefaultShapeFields);
-const transformZonedOptions = /* @__PURE__ */ createOptionsTransformer(dateTimeShapeFieldNames, [], [], zonedDateTimeDefaultShapeFields);
-const transformDateTimeOptions = /* @__PURE__ */ createOptionsTransformer(dateTimeShapeFieldNames, [], ["timeZoneName"], dateTimeDefaultShapeFields);
-const transformDateOptions = /* @__PURE__ */ createOptionsTransformer(dateShapeFieldNames, timeShapeFieldNames, ["timeZoneName"], dateDefaultShapeFields);
-const transformTimeOptions = /* @__PURE__ */ createOptionsTransformer(timeShapeFieldNames, dateShapeFieldNames, ["timeZoneName", "era"], timeDefaultShapeFields);
-const transformYearMonthOptions = /* @__PURE__ */ createOptionsTransformer([
+const dateTimeShapeFieldNames = /*@__PURE__*/ dateShapeFieldNames.concat(timeShapeFieldNames);
+const yearMonthIgnoredFieldNames = /*@__PURE__*/ ["weekday", "day"].concat(timeShapeFieldNames);
+const monthDayIgnoredFieldNames = /*@__PURE__*/ ["weekday", "year"].concat(timeShapeFieldNames);
+const transformInstantOptions = /*@__PURE__*/ createOptionsTransformer(dateTimeShapeFieldNames, [], [], dateTimeDefaultShapeFields);
+const transformZonedOptions = /*@__PURE__*/ createOptionsTransformer(dateTimeShapeFieldNames, [], [], zonedDateTimeDefaultShapeFields);
+const transformDateTimeOptions = /*@__PURE__*/ createOptionsTransformer(dateTimeShapeFieldNames, [], ["timeZoneName"], dateTimeDefaultShapeFields);
+const transformDateOptions = /*@__PURE__*/ createOptionsTransformer(dateShapeFieldNames, timeShapeFieldNames, ["timeZoneName"], dateDefaultShapeFields);
+const transformTimeOptions = /*@__PURE__*/ createOptionsTransformer(timeShapeFieldNames, dateShapeFieldNames, ["timeZoneName", "era"], timeDefaultShapeFields);
+const transformYearMonthOptions = /*@__PURE__*/ createOptionsTransformer([
 	"year",
 	"month",
 	"dateStyle"
@@ -2539,7 +2557,7 @@ const transformYearMonthOptions = /* @__PURE__ */ createOptionsTransformer([
 		month: "numeric"
 	}
 });
-const transformMonthDayOptions = /* @__PURE__ */ createOptionsTransformer([
+const transformMonthDayOptions = /*@__PURE__*/ createOptionsTransformer([
 	"month",
 	"day",
 	"dateStyle"
@@ -2713,8 +2731,8 @@ function resolveBasicCalendarId(rawCalendarId) {
 function resolveBasicCalendarArg(rawCalendarId = isoCalendarId) {
 	return resolveBasicCalendarId(rawCalendarId);
 }
-const zonedDateTimeSlotsMap = /* @__PURE__ */ new WeakMap();
-const ZonedDateTime = /* @__PURE__ */ defineTemporalClass(ZonedDateTimeBranding, class {
+const zonedDateTimeSlotsMap = /*@__PURE__*/ new WeakMap();
+const ZonedDateTime = /*@__PURE__*/ defineTemporalClass(ZonedDateTimeBranding, class {
 	constructor(epochNanoseconds, timeZoneId, calendar = void 0) {
 		const epochNano = checkEpochNanoInBounds(toBigInt(epochNanoseconds));
 		const timeZone = queryTimeZone(refineTimeZoneId(timeZoneId));
@@ -2862,8 +2880,8 @@ function refineTimeZoneArg(arg) {
 	}
 	return ((arg) => resolveTimeZoneId(parseTimeZoneId(requireString(arg))))(arg);
 }
-const instantSlotsMap = /* @__PURE__ */ new WeakMap();
-const Instant = /* @__PURE__ */ defineTemporalClass(InstantBranding, class {
+const instantSlotsMap = /*@__PURE__*/ new WeakMap();
+const Instant = /*@__PURE__*/ defineTemporalClass(InstantBranding, class {
 	constructor(epochNanoseconds) {
 		const epochNano = checkEpochNanoInBounds(toBigInt(epochNanoseconds));
 		initInstant(this, createEpochNanoSlots(epochNano));
@@ -2948,8 +2966,8 @@ const { toTemporalInstant: toTemporalInstant$1 } = { toTemporalInstant() {
 function initInstant(instance, slots) {
 	return instantSlotsMap.set(instance, slots), attachDebugString(instance), instance;
 }
-const plainMonthDaySlotsMap = /* @__PURE__ */ new WeakMap();
-const PlainMonthDay = /* @__PURE__ */ defineTemporalClass(PlainMonthDayBranding, class {
+const plainMonthDaySlotsMap = /*@__PURE__*/ new WeakMap();
+const PlainMonthDay = /*@__PURE__*/ defineTemporalClass(PlainMonthDayBranding, class {
 	constructor(isoMonth, isoDay, calendar = void 0, referenceIsoYear) {
 		const isoMonthInt = toIntegerWithTrunc(isoMonth);
 		const isoDayInt = toIntegerWithTrunc(isoDay);
@@ -3013,8 +3031,8 @@ function toPlainMonthDaySlots(arg, options) {
 function initPlainMonthDay(instance, slots) {
 	return plainMonthDaySlotsMap.set(instance, slots), attachDebugString(instance), instance;
 }
-const plainYearMonthSlotsMap = /* @__PURE__ */ new WeakMap();
-const PlainYearMonth = /* @__PURE__ */ defineTemporalClass(PlainYearMonthBranding, class {
+const plainYearMonthSlotsMap = /*@__PURE__*/ new WeakMap();
+const PlainYearMonth = /*@__PURE__*/ defineTemporalClass(PlainYearMonthBranding, class {
 	constructor(isoYear, isoMonth, calendar = void 0, referenceIsoDay) {
 		const isoYearInt = toIntegerWithTrunc(isoYear);
 		const isoMonthInt = toIntegerWithTrunc(isoMonth);
@@ -3106,8 +3124,8 @@ function getTemporalBrandingAndSlots(obj) {
 function validateBag(bag) {
 	return (getTemporalBrandingAndSlots(bag) || void 0 !== bag.calendar || void 0 !== bag.timeZone) && throwTypeError("Invalid bag"), bag;
 }
-const plainTimeSlotsMap = /* @__PURE__ */ new WeakMap();
-const PlainTime = /* @__PURE__ */ defineTemporalClass(PlainTimeBranding, class {
+const plainTimeSlotsMap = /*@__PURE__*/ new WeakMap();
+const PlainTime = /*@__PURE__*/ defineTemporalClass(PlainTimeBranding, class {
 	constructor(hour = 0, minute = 0, second = 0, millisecond = 0, microsecond = 0, nanosecond = 0) {
 		const fields = validateTimeFields(mapProps(toIntegerWithTrunc, {
 			hour,
@@ -3189,8 +3207,8 @@ function optionalToPlainTimeFields(timeArg) {
 function initPlainTime(instance, slots) {
 	return plainTimeSlotsMap.set(instance, slots), attachDebugString(instance), instance;
 }
-const plainDateTimeSlotsMap = /* @__PURE__ */ new WeakMap();
-const PlainDateTime = /* @__PURE__ */ defineTemporalClass(PlainDateTimeBranding, class {
+const plainDateTimeSlotsMap = /*@__PURE__*/ new WeakMap();
+const PlainDateTime = /*@__PURE__*/ defineTemporalClass(PlainDateTimeBranding, class {
 	constructor(isoYear, isoMonth, isoDay, hour = 0, minute = 0, second = 0, millisecond = 0, microsecond = 0, nanosecond = 0, calendar = void 0) {
 		const fields = checkIsoDateTimeInBounds(validateIsoDateTimeFields(mapProps(toIntegerWithTrunc, {
 			year: isoYear,
@@ -3301,8 +3319,8 @@ function toPlainDateTimeSlots(arg, options) {
 function initPlainDateTime(instance, slots) {
 	return plainDateTimeSlotsMap.set(instance, slots), attachDebugString(instance), instance;
 }
-const plainDateSlotsMap = /* @__PURE__ */ new WeakMap();
-const PlainDate = /* @__PURE__ */ defineTemporalClass(PlainDateBranding, class {
+const plainDateSlotsMap = /*@__PURE__*/ new WeakMap();
+const PlainDate = /*@__PURE__*/ defineTemporalClass(PlainDateBranding, class {
 	constructor(isoYear, isoMonth, isoDay, calendar = void 0) {
 		const fields = checkIsoDateInBounds(validateIsoDateFields(mapProps(toIntegerWithTrunc, {
 			year: isoYear,
@@ -3420,8 +3438,8 @@ function refineCalendarArg(arg) {
 	}
 	return ((arg) => resolveBasicCalendarId(parseCalendarId(requireString(arg))))(arg);
 }
-const durationSlotsMap = /* @__PURE__ */ new WeakMap();
-const Duration = /* @__PURE__ */ defineTemporalClass(DurationBranding, class {
+const durationSlotsMap = /*@__PURE__*/ new WeakMap();
+const Duration = /*@__PURE__*/ defineTemporalClass(DurationBranding, class {
 	constructor(years = 0, months = 0, weeks = 0, days = 0, hours = 0, minutes = 0, seconds = 0, milliseconds = 0, microseconds = 0, nanoseconds = 0) {
 		const fields = validateDurationFields(mapProps(toStrictInteger, {
 			years,
@@ -3514,7 +3532,7 @@ function refinePublicRelativeTo(relativeTo) {
 function initDuration(instance, slots) {
 	return durationSlotsMap.set(instance, slots), attachDebugString(instance), instance;
 }
-const Now = /* @__PURE__ */ Object.defineProperties({}, {
+const Now = /*@__PURE__*/ Object.defineProperties({}, {
 	...createStringTagDescriptors("Temporal.Now"),
 	...createPropDescriptors({
 		timeZoneId() {
@@ -3538,7 +3556,7 @@ const Now = /* @__PURE__ */ Object.defineProperties({}, {
 		}
 	})
 });
-const Temporal$1 = /* @__PURE__ */ Object.defineProperties({}, {
+const Temporal$2 = /*@__PURE__*/ Object.defineProperties({}, {
 	...createStringTagDescriptors("Temporal"),
 	...createPropDescriptors({
 		PlainYearMonth,
@@ -3554,12 +3572,2691 @@ const Temporal$1 = /* @__PURE__ */ Object.defineProperties({}, {
 });
 //#endregion
 //#region ../../node_modules/.pnpm/temporal-polyfill@1.0.1/node_modules/temporal-polyfill/index.js
-const Temporal = NativeTemporal || Temporal$1;
+const Temporal$1 = NativeTemporal || Temporal$2;
 NativeTemporal && Date.prototype.toTemporalInstant;
 //#endregion
+//#region src/sig/accept.ts
+/**
+* `Accept-Signature` header parsing, serialization, and validation utilities
+* for RFC 9421 §5 challenge-response negotiation.
+*
+* @module
+*/
+/**
+* Parses an `Accept-Signature` header value (RFC 9421 §5.1) into an
+* array of {@link AcceptSignatureMember} objects.
+*
+* The `Accept-Signature` field is a Dictionary Structured Field
+* (RFC 8941 §3.2).  Each dictionary member describes a single
+* requested message signature.
+*
+* On parse failure (malformed or empty header), returns an empty array.
+*
+* @param header The raw `Accept-Signature` header value string.
+* @returns An array of parsed members.  Empty if the header is
+*          malformed or empty.
+* @since 2.1.0
+*/
+function parseAcceptSignature(header) {
+	try {
+		return parseEachSignature((0, structured_field_values.decodeDict)(header));
+	} catch {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"sig",
+			"http"
+		]).warn("Failed to parse Accept-Signature header: {header}", { header });
+		return [];
+	}
+}
+const compactObject = (obj) => Object.fromEntries(Object.entries(obj).filter(([_, v]) => v !== void 0));
+const parseEachSignature = (dict) => Object.entries(dict).filter(([_, item]) => Array.isArray(item.value)).map(([label, item]) => ({
+	label,
+	components: item.value.filter((subitem) => typeof subitem.value === "string").map((subitem) => ({
+		value: subitem.value,
+		params: subitem.params ?? {}
+	})),
+	parameters: compactParams(item)
+}));
+const compactParams = (item) => {
+	const { keyid, alg, created, expires, nonce, tag } = item.params ?? {};
+	return compactObject({
+		keyid: stringOrUndefined(keyid),
+		alg: stringOrUndefined(alg),
+		created: trueOrUndefined(created),
+		expires: trueOrUndefined(expires),
+		nonce: stringOrUndefined(nonce),
+		tag: stringOrUndefined(tag)
+	});
+};
+const stringOrUndefined = (v) => typeof v === "string" ? v : void 0;
+const trueOrUndefined = (v) => v === true ? true : void 0;
+/**
+* Serializes an array of {@link AcceptSignatureMember} objects into an
+* `Accept-Signature` header value string (RFC 9421 §5.1).
+*
+* The output is a Dictionary Structured Field (RFC 8941 §3.2).
+*
+* @param members The members to serialize.
+* @returns The serialized header value string.
+* @since 2.1.0
+*/
+function formatAcceptSignature(members) {
+	const items = members.map((member) => [member.label, new structured_field_values.Item(compToItems(member), compactParameters(member))]);
+	return (0, structured_field_values.encodeDict)(Object.fromEntries(items));
+}
+const compToItems = (member) => member.components.map((c) => new structured_field_values.Item(c.value, c.params));
+const compactParameters = (member) => {
+	const { keyid, alg, created, expires, nonce, tag } = member.parameters;
+	return compactObject({
+		keyid,
+		alg,
+		created,
+		expires,
+		nonce,
+		tag
+	});
+};
+/**
+* Filters out {@link AcceptSignatureMember} entries whose covered
+* components include response-only identifiers (`@status`) that are
+* not applicable to request-target messages, as required by
+* [RFC 9421 §5](https://www.rfc-editor.org/rfc/rfc9421#section-5).
+*
+* A warning is logged for each discarded entry.
+*
+* @param members The parsed `Accept-Signature` entries to validate.
+* @returns Only entries that are valid for request-target messages.
+* @since 2.1.0
+*/
+function validateAcceptSignature(members) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"sig",
+		"http"
+	]);
+	return members.filter((member) => {
+		if (member.components.every((c) => c.value !== "@status")) return true;
+		logLabel(logger, member.label);
+		return false;
+	});
+}
+const logLabel = (logger, label) => logger.warn("Discarding Accept-Signature member {label}: covered components include response-only identifier @status.", { label });
+/**
+* Attempts to translate an {@link AcceptSignatureMember} challenge into
+* RFC 9421 signing options that the local signer can fulfill.
+*
+* Returns `null` if the challenge cannot be fulfilled—for example, if
+* the requested `alg` or `keyid` is incompatible with the local key.
+*
+* Safety constraints:
+* - `alg`: only honored if it matches `localAlg`.
+* - `keyid`: only honored if it matches `localKeyId`.
+* - `components`: passed through exactly as requested, per RFC 9421 §5.2.
+* - `nonce`, `tag`, and `expires` are passed through directly.
+*
+* @param entry The challenge entry from the `Accept-Signature` header.
+* @param localKeyId The local key identifier (e.g., the actor key URL).
+* @param localAlg The algorithm of the local private key
+*                 (e.g., `"rsa-v1_5-sha256"`).
+* @returns Signing options if the challenge can be fulfilled, or `null`.
+* @since 2.1.0
+*/
+function fulfillAcceptSignature(entry, localKeyId, localAlg) {
+	if (entry.parameters.alg != null && entry.parameters.alg !== localAlg) return null;
+	if (entry.parameters.keyid != null && entry.parameters.keyid !== localKeyId) return null;
+	return {
+		label: entry.label,
+		components: entry.components,
+		nonce: entry.parameters.nonce,
+		tag: entry.parameters.tag,
+		expires: entry.parameters.expires
+	};
+}
+//#endregion
+//#region src/federation/metrics.ts
+var FederationMetrics = class {
+	deliverySent;
+	deliveryPermanentFailure;
+	signatureVerificationFailure;
+	signatureVerificationDuration;
+	signatureKeyFetchDuration;
+	deliveryDuration;
+	inboxProcessingDuration;
+	httpServerRequestCount;
+	httpServerRequestDuration;
+	queueTaskEnqueued;
+	queueTaskStarted;
+	queueTaskCompleted;
+	queueTaskFailed;
+	queueTaskDuration;
+	queueTaskInFlight;
+	queueDepth;
+	fanoutRecipients;
+	inboxActivity;
+	outboxActivity;
+	circuitBreakerStateChange;
+	keyLookup;
+	keyLookupDuration;
+	documentFetch;
+	documentFetchDuration;
+	documentCache;
+	webFingerHandle;
+	webFingerHandleDuration;
+	collectionRequest;
+	collectionDispatchDuration;
+	collectionPageItems;
+	collectionTotalItems;
+	constructor(meterProvider) {
+		const meter = meterProvider.getMeter(name, version);
+		this.deliverySent = meter.createCounter("activitypub.delivery.sent", {
+			description: "ActivityPub delivery attempts.",
+			unit: "{attempt}"
+		});
+		this.deliveryPermanentFailure = meter.createCounter("activitypub.delivery.permanent_failure", {
+			description: "ActivityPub deliveries abandoned as permanent failures.",
+			unit: "{failure}"
+		});
+		this.signatureVerificationFailure = meter.createCounter("activitypub.signature.verification_failure", {
+			description: "ActivityPub signature verification failures.",
+			unit: "{failure}"
+		});
+		this.signatureVerificationDuration = meter.createHistogram("activitypub.signature.verification.duration", {
+			description: "Duration of ActivityPub signature verification, including local key lookup and remote key fetches.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				.1,
+				.25,
+				.5,
+				1,
+				2.5,
+				5,
+				10,
+				25,
+				50,
+				100,
+				250,
+				500,
+				1e3
+			] }
+		});
+		this.signatureKeyFetchDuration = meter.createHistogram("activitypub.signature.key_fetch.duration", {
+			description: "Duration of public key lookup performed during ActivityPub signature verification.",
+			unit: "ms"
+		});
+		this.deliveryDuration = meter.createHistogram("activitypub.delivery.duration", {
+			description: "Duration of ActivityPub delivery attempts.",
+			unit: "ms"
+		});
+		this.inboxProcessingDuration = meter.createHistogram("activitypub.inbox.processing_duration", {
+			description: "Duration of ActivityPub inbox listener processing.",
+			unit: "ms"
+		});
+		this.httpServerRequestCount = meter.createCounter("fedify.http.server.request.count", {
+			description: "HTTP requests handled by Federation.fetch().",
+			unit: "{request}"
+		});
+		this.httpServerRequestDuration = meter.createHistogram("fedify.http.server.request.duration", {
+			description: "Duration of HTTP requests handled by Federation.fetch().",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.queueTaskEnqueued = meter.createCounter("fedify.queue.task.enqueued", {
+			description: "Tasks Fedify enqueued for inbox, outbox, or fanout work.",
+			unit: "{task}"
+		});
+		this.queueTaskStarted = meter.createCounter("fedify.queue.task.started", {
+			description: "Tasks Fedify began processing as a queue worker.",
+			unit: "{task}"
+		});
+		this.queueTaskCompleted = meter.createCounter("fedify.queue.task.completed", {
+			description: "Queue tasks Fedify finished processing without throwing.",
+			unit: "{task}"
+		});
+		this.queueTaskFailed = meter.createCounter("fedify.queue.task.failed", {
+			description: "Queue tasks Fedify abandoned because processing threw.",
+			unit: "{task}"
+		});
+		this.queueTaskDuration = meter.createHistogram("fedify.queue.task.duration", {
+			description: "Duration of queue task processing in Fedify workers.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.queueTaskInFlight = meter.createUpDownCounter("fedify.queue.task.in_flight", {
+			description: "Queue tasks currently being processed in this Fedify process.",
+			unit: "{task}"
+		});
+		this.queueDepth = meter.createObservableGauge("fedify.queue.depth", {
+			description: "Messages waiting in configured Fedify queues, as reported by the queue backend.",
+			unit: "{message}"
+		});
+		this.fanoutRecipients = meter.createHistogram("activitypub.fanout.recipients", {
+			description: "Number of recipient inboxes produced by an ActivityPub fanout task.",
+			unit: "{recipient}"
+		});
+		this.inboxActivity = meter.createCounter("activitypub.inbox.activity", {
+			description: "ActivityPub activities observed at the inbox lifecycle level: queued, processed, retried, rejected, or abandoned.",
+			unit: "{activity}"
+		});
+		this.outboxActivity = meter.createCounter("activitypub.outbox.activity", {
+			description: "ActivityPub activities observed at the outbox lifecycle level: queued, retried, or abandoned.  Per-recipient delivery counters live on `activitypub.delivery.*`.",
+			unit: "{activity}"
+		});
+		this.circuitBreakerStateChange = meter.createCounter("activitypub.circuit_breaker.state_change", {
+			description: "Outbound ActivityPub delivery circuit breaker changes.",
+			unit: "{change}"
+		});
+		this.keyLookup = meter.createCounter("activitypub.key.lookup", {
+			description: "Public-key lookup attempts performed by Fedify, including cache hits, local resolutions, and remote fetches.",
+			unit: "{lookup}"
+		});
+		this.keyLookupDuration = meter.createHistogram("activitypub.key.lookup.duration", {
+			description: "Duration of public-key lookups performed by Fedify, including cache hits, local resolutions, and any remote fetch.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.documentFetch = meter.createCounter("activitypub.document.fetch", {
+			description: "Remote JSON-LD document loader invocations made by Fedify-wrapped loaders.",
+			unit: "{fetch}"
+		});
+		this.documentFetchDuration = meter.createHistogram("activitypub.document.fetch.duration", {
+			description: "Duration of remote JSON-LD document loader invocations made by Fedify-wrapped loaders.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.documentCache = meter.createCounter("activitypub.document.cache", {
+			description: "KV-backed document loader cache lookups, with `hit` or `miss` classification.",
+			unit: "{lookup}"
+		});
+		this.webFingerHandle = meter.createCounter("webfinger.handle", {
+			description: "Incoming WebFinger requests handled by Fedify, classified by terminal outcome.",
+			unit: "{request}"
+		});
+		this.webFingerHandleDuration = meter.createHistogram("webfinger.handle.duration", {
+			description: "Duration of incoming WebFinger request handling in Fedify.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.collectionRequest = meter.createCounter("activitypub.collection.request", {
+			description: "ActivityPub collection and collection-page requests handled by Fedify.",
+			unit: "{request}"
+		});
+		this.collectionDispatchDuration = meter.createHistogram("activitypub.collection.dispatch.duration", {
+			description: "Duration of ActivityPub collection dispatcher callbacks.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.collectionPageItems = meter.createHistogram("activitypub.collection.page.items", {
+			description: "Number of items Fedify materialized for an ActivityPub collection response.",
+			unit: "{item}"
+		});
+		this.collectionTotalItems = meter.createHistogram("activitypub.collection.total_items", {
+			description: "Total item count reported by ActivityPub collection counters.",
+			unit: "{item}"
+		});
+	}
+	recordDelivery(inbox, durationMs, success, activityType) {
+		const deliveryAttributes = {
+			"activitypub.remote.host": getRemoteHost(inbox),
+			"activitypub.delivery.success": success
+		};
+		if (activityType != null) deliveryAttributes["activitypub.activity.type"] = activityType;
+		this.deliverySent.add(1, deliveryAttributes);
+		this.deliveryDuration.record(durationMs, deliveryAttributes);
+	}
+	recordPermanentFailure(inbox, statusCode) {
+		this.deliveryPermanentFailure.add(1, {
+			"activitypub.remote.host": getRemoteHost(inbox),
+			"http.response.status_code": statusCode
+		});
+	}
+	recordSignatureVerificationFailure(reason, remoteHost) {
+		const attributes = { "activitypub.verification.failure_reason": reason };
+		if (remoteHost != null) attributes["activitypub.remote.host"] = remoteHost;
+		this.signatureVerificationFailure.add(1, attributes);
+	}
+	recordSignatureVerificationDuration(durationMs, kind, result, extra = {}) {
+		const attributes = {
+			"activitypub.signature.kind": kind,
+			"activitypub.signature.result": result
+		};
+		if (extra.algorithm != null) attributes["http_signatures.algorithm"] = extra.algorithm;
+		if (extra.failureReason != null) attributes["http_signatures.failure_reason"] = extra.failureReason;
+		if (extra.ldType != null) attributes["ld_signatures.type"] = extra.ldType;
+		if (extra.cryptosuite != null) attributes["object_integrity_proofs.cryptosuite"] = extra.cryptosuite;
+		this.signatureVerificationDuration.record(durationMs, attributes);
+	}
+	recordSignatureKeyFetchDuration(durationMs, kind, result) {
+		this.signatureKeyFetchDuration.record(durationMs, {
+			"activitypub.signature.kind": kind,
+			"activitypub.signature.key_fetch.result": result
+		});
+	}
+	recordInboxProcessingDuration(activityType, durationMs) {
+		this.inboxProcessingDuration.record(durationMs, { "activitypub.activity.type": activityType });
+	}
+	recordHttpServerRequest(method, endpoint, durationMs, options = {}) {
+		const attributes = {
+			"http.request.method": normalizeHttpMethod(method),
+			"fedify.endpoint": endpoint
+		};
+		if (options.statusCode != null) attributes["http.response.status_code"] = options.statusCode;
+		if (options.routeTemplate != null) attributes["fedify.route.template"] = options.routeTemplate;
+		this.httpServerRequestCount.add(1, attributes);
+		this.httpServerRequestDuration.record(durationMs, attributes);
+	}
+	recordQueueTaskEnqueued(common, attempt, count = 1) {
+		const attributes = buildQueueTaskAttributes(common);
+		attributes["fedify.queue.task.attempt"] = attempt;
+		this.queueTaskEnqueued.add(count, attributes);
+	}
+	recordQueueTaskStarted(common) {
+		this.queueTaskStarted.add(1, buildQueueTaskAttributes(common));
+	}
+	incrementQueueTaskInFlight(common) {
+		this.queueTaskInFlight.add(1, buildQueueTaskInFlightAttributes(common));
+	}
+	decrementQueueTaskInFlight(common) {
+		this.queueTaskInFlight.add(-1, buildQueueTaskInFlightAttributes(common));
+	}
+	recordQueueTaskOutcome(common, result, durationMs, failureReason) {
+		const attributes = buildQueueTaskAttributes(common);
+		attributes["fedify.queue.task.result"] = result;
+		if (failureReason != null && result === "failed") attributes["fedify.task.failure_reason"] = failureReason;
+		if (result === "completed") this.queueTaskCompleted.add(1, attributes);
+		else if (result === "failed") this.queueTaskFailed.add(1, attributes);
+		this.queueTaskDuration.record(durationMs, attributes);
+	}
+	recordFanoutRecipients(recipientCount, activityType) {
+		const attributes = {};
+		if (activityType != null) attributes["activitypub.activity.type"] = activityType;
+		this.fanoutRecipients.record(recipientCount, attributes);
+	}
+	recordInboxActivity(result, activityType) {
+		this.inboxActivity.add(1, buildActivityLifecycleAttributes(result, activityType));
+	}
+	recordOutboxActivity(result, activityType) {
+		this.outboxActivity.add(1, buildActivityLifecycleAttributes(result, activityType));
+	}
+	recordCircuitBreakerStateChange(remoteHost, state) {
+		this.circuitBreakerStateChange.add(1, {
+			"activitypub.remote.host": remoteHost,
+			"activitypub.circuit_breaker.state": state
+		});
+	}
+	recordKeyLookup(attrs) {
+		const attributes = {
+			"activitypub.lookup.kind": "public_key",
+			"activitypub.lookup.result": attrs.result,
+			"activitypub.cache.enabled": attrs.cacheEnabled
+		};
+		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
+		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+		this.keyLookup.add(1, attributes);
+		this.keyLookupDuration.record(attrs.durationMs, attributes);
+	}
+	recordDocumentFetch(attrs) {
+		const attributes = {
+			"activitypub.lookup.kind": attrs.kind,
+			"activitypub.lookup.result": attrs.result
+		};
+		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
+		if (attrs.cacheEnabled != null) attributes["activitypub.cache.enabled"] = attrs.cacheEnabled;
+		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+		this.documentFetch.add(1, attributes);
+		this.documentFetchDuration.record(attrs.durationMs, attributes);
+	}
+	recordDocumentCache(attrs) {
+		const attributes = {
+			"activitypub.lookup.kind": attrs.kind,
+			"activitypub.lookup.result": attrs.result
+		};
+		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
+		this.documentCache.add(1, attributes);
+	}
+	recordWebFingerHandle(attrs) {
+		const attributes = { "webfinger.handle.result": attrs.result };
+		if (attrs.scheme != null) attributes["webfinger.resource.scheme"] = attrs.scheme;
+		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+		this.webFingerHandle.add(1, attributes);
+		this.webFingerHandleDuration.record(attrs.durationMs, attributes);
+	}
+	recordCollectionRequest(attrs) {
+		this.collectionRequest.add(1, buildCollectionAttributes(attrs));
+	}
+	recordCollectionDispatchDuration(durationMs, attrs) {
+		this.collectionDispatchDuration.record(durationMs, buildCollectionAttributes(attrs));
+	}
+	recordCollectionPageItems(itemCount, attrs) {
+		this.collectionPageItems.record(itemCount, buildCollectionAttributes(attrs));
+	}
+	recordCollectionTotalItems(totalItems, attrs) {
+		this.collectionTotalItems.record(totalItems, buildCollectionAttributes(attrs));
+	}
+};
+function buildCollectionAttributes(attrs) {
+	const attributes = {
+		"activitypub.collection.kind": attrs.kind,
+		"activitypub.collection.page": attrs.page,
+		"activitypub.collection.result": attrs.result,
+		"fedify.collection.dispatcher": attrs.dispatcher
+	};
+	if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+	return attributes;
+}
+function buildActivityLifecycleAttributes(result, activityType) {
+	const attributes = { "activitypub.processing.result": result };
+	if (activityType != null) attributes["activitypub.activity.type"] = activityType;
+	return attributes;
+}
+function buildQueueTaskAttributes(common) {
+	const attributes = { "fedify.queue.role": common.role };
+	const backend = getQueueBackend(common.queue);
+	if (backend != null) attributes["fedify.queue.backend"] = backend;
+	const nativeRetrial = common.queue?.nativeRetrial;
+	if (typeof nativeRetrial === "boolean") attributes["fedify.queue.native_retrial"] = nativeRetrial;
+	if (common.activityType != null) attributes["activitypub.activity.type"] = common.activityType;
+	if (common.taskName != null) attributes["fedify.task.name"] = common.taskName;
+	return attributes;
+}
+function buildQueueTaskInFlightAttributes(common) {
+	return buildQueueTaskAttributes({
+		role: common.role,
+		queue: common.queue
+	});
+}
+/**
+* Returns the constructor name of the given message queue, when it is a
+* meaningful identifier.  Used as a best-effort `fedify.queue.backend`
+* attribute on queue task metrics; returns `undefined` for plain object
+* literals (whose constructor is `Object`) so the attribute does not appear
+* with a non-informative value.
+* @since 2.3.0
+*/
+function getQueueBackend(queue) {
+	const name = queue?.constructor?.name;
+	if (name == null || name === "" || name === "Object") return void 0;
+	return name;
+}
+/**
+* Registers a callback for observing queue backend depth.
+* @since 2.3.0
+*/
+function registerQueueDepthGauge(meterProvider, entries, options = {}) {
+	const uniqueQueues = /* @__PURE__ */ new Map();
+	for (const { role, queue } of entries) {
+		if (queue?.getDepth == null) continue;
+		const roles = uniqueQueues.get(queue);
+		if (roles == null) uniqueQueues.set(queue, [role]);
+		else if (!roles.includes(role)) roles.push(role);
+	}
+	if (uniqueQueues.size < 1) return;
+	const queueEntries = Array.from(uniqueQueues.entries());
+	getFederationMetrics(meterProvider).queueDepth.addCallback(async (observableResult) => {
+		await Promise.all(queueEntries.map(async ([queue, roles]) => {
+			let depth;
+			try {
+				depth = await queue.getDepth();
+			} catch {
+				return;
+			}
+			if (depth == null) return;
+			const attributes = buildQueueDepthAttributes(queue, roles, options);
+			observableResult.observe(depth.queued, {
+				...attributes,
+				"fedify.queue.depth.state": "queued"
+			});
+			if (depth.ready != null) observableResult.observe(depth.ready, {
+				...attributes,
+				"fedify.queue.depth.state": "ready"
+			});
+			if (depth.delayed != null) observableResult.observe(depth.delayed, {
+				...attributes,
+				"fedify.queue.depth.state": "delayed"
+			});
+		}));
+	});
+}
+function buildQueueDepthAttributes(queue, roles, options) {
+	const sortedRoles = roles.toSorted();
+	const role = sortedRoles.length === 1 ? sortedRoles[0] : "shared";
+	const attributes = { "fedify.queue.role": role };
+	if (options.sourceId != null) attributes["fedify.federation.instance_id"] = options.sourceId;
+	if (role === "shared") attributes["fedify.queue.roles"] = sortedRoles.join(",");
+	const backend = getQueueBackend(queue);
+	if (backend != null) attributes["fedify.queue.backend"] = backend;
+	const nativeRetrial = queue.nativeRetrial;
+	if (typeof nativeRetrial === "boolean") attributes["fedify.queue.native_retrial"] = nativeRetrial;
+	return attributes;
+}
+/**
+* Records `fedify.queue.task.enqueued` for an outgoing outbox enqueue and,
+* for the initial attempt, also records
+* `activitypub.outbox.activity{queued}`.
+*
+* Both `Context.sendActivity()` and `OutboxContext.forwardActivity()` enqueue
+* outbox messages with the same metric attributes (role, queue, activity
+* type, attempt), so they share this helper rather than each defining a local
+* closure.  Retry enqueues (attempt > 0) intentionally do not record a
+* second `activitypub.outbox.activity{queued}`; retries are reported as
+* `result=retried` from the retry-scheduling site, which has the failure
+* context.
+* @since 2.3.0
+*/
+function recordOutboxEnqueue(meterProvider, outboxQueue, message) {
+	const metrics = getFederationMetrics(meterProvider);
+	metrics.recordQueueTaskEnqueued({
+		role: "outbox",
+		queue: outboxQueue,
+		activityType: message.activityType
+	}, message.attempt);
+	if (message.attempt === 0) metrics.recordOutboxActivity("queued", message.activityType);
+}
+/**
+* Records `activitypub.fanout.recipients` with the number of recipient
+* inboxes a single fanout produced.  The histogram is unitless count
+* (one measurement per fanout enqueue).  Recipient URLs are deliberately
+* not recorded; only the activity type, when known.
+* @since 2.3.0
+*/
+function recordFanoutRecipients(meterProvider, recipientCount, activityType) {
+	getFederationMetrics(meterProvider).recordFanoutRecipients(recipientCount, activityType);
+}
+/**
+* Records one `activitypub.inbox.activity` measurement.  The
+* `activitypub.processing.result` attribute is always present;
+* `activitypub.activity.type` is recorded only when Fedify already knows
+* the activity type.
+* @since 2.3.0
+*/
+function recordInboxActivity(meterProvider, result, activityType) {
+	getFederationMetrics(meterProvider).recordInboxActivity(result, activityType);
+}
+/**
+* Records one `activitypub.outbox.activity` measurement.  The
+* `activitypub.processing.result` attribute is always present;
+* `activitypub.activity.type` is recorded only when Fedify already knows
+* the activity type (it is always known for outbox lifecycle events).
+* @since 2.3.0
+*/
+function recordOutboxActivity(meterProvider, result, activityType) {
+	getFederationMetrics(meterProvider).recordOutboxActivity(result, activityType);
+}
+/**
+* Records one outbound delivery circuit breaker state transition.
+* @since 2.3.0
+*/
+function recordCircuitBreakerStateChange(meterProvider, remoteHost, state) {
+	getFederationMetrics(meterProvider).recordCircuitBreakerStateChange(remoteHost, state);
+}
+/**
+* Records one measurement on `activitypub.key.lookup` (counter) and
+* `activitypub.key.lookup.duration` (histogram) for a public-key lookup.
+*
+* `activitypub.lookup.kind` is always recorded as `public_key`; the result
+* classification, remote host, HTTP status code (when an HTTP response was
+* received), and `activitypub.cache.enabled` are recorded as attributes on
+* both measurements.  Full key URLs and key IDs are deliberately omitted to
+* keep cardinality bounded.
+* @since 2.3.0
+*/
+function recordKeyLookup(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordKeyLookup(attrs);
+}
+/**
+* Records one measurement each on `activitypub.document.fetch` (counter)
+* and `activitypub.document.fetch.duration` (histogram) for one remote
+* JSON-LD document loader invocation, with bounded
+* `activitypub.lookup.kind` and `activitypub.lookup.result` attributes
+* plus the optional remote-host, cache-enabled, and HTTP status-code
+* attributes.  Counter and histogram are always recorded together so
+* aggregate rate and latency views stay in sync.
+* @since 2.3.0
+*/
+function recordDocumentFetch(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordDocumentFetch(attrs);
+}
+/**
+* Records one `activitypub.document.cache` measurement, classifying the
+* lookup as `hit` (the cache returned an entry) or `miss` (the cache was
+* consulted and returned nothing, prompting a delegate fetch).
+* @since 2.3.0
+*/
+function recordDocumentCache(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordDocumentCache(attrs);
+}
+/**
+* Records one measurement on `webfinger.handle` (counter) and
+* `webfinger.handle.duration` (histogram) for an incoming WebFinger
+* request handled by Fedify.  Counter and histogram are always recorded
+* together, with `webfinger.handle.result` set to one of `resolved`,
+* `invalid`, `not_found`, `tombstoned`, or `error`.  The queried
+* resource string is deliberately excluded; it remains on the
+* `webfinger.handle` span for trace-level investigation.
+* @since 2.3.0
+*/
+function recordWebFingerHandle(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordWebFingerHandle(attrs);
+}
+/**
+* Records one `activitypub.collection.request` measurement for a
+* collection or collection-page request handled by Fedify.
+* @since 2.3.0
+*/
+function recordCollectionRequest(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordCollectionRequest(attrs);
+}
+/**
+* Records one `activitypub.collection.dispatch.duration` measurement for a
+* collection dispatcher callback invocation.
+* @since 2.3.0
+*/
+function recordCollectionDispatchDuration(meterProvider, durationMs, attrs) {
+	getFederationMetrics(meterProvider).recordCollectionDispatchDuration(durationMs, attrs);
+}
+/**
+* Records one `activitypub.collection.page.items` measurement when Fedify
+* has materialized collection items in memory.
+* @since 2.3.0
+*/
+function recordCollectionPageItems(meterProvider, itemCount, attrs) {
+	getFederationMetrics(meterProvider).recordCollectionPageItems(itemCount, attrs);
+}
+/**
+* Records one `activitypub.collection.total_items` measurement when a
+* collection counter has already reported a total item count.
+* @since 2.3.0
+*/
+function recordCollectionTotalItems(meterProvider, totalItems, attrs) {
+	getFederationMetrics(meterProvider).recordCollectionTotalItems(totalItems, attrs);
+}
+/**
+* Classifies a thrown value from a key or document fetch into the bounded
+* {@link LookupResult} taxonomy and, when an HTTP response was received,
+* surfaces its status code.
+*
+*  -  `FetchError` with a `Response` whose status is `404` or `410`:
+*     `result=not_found` and the response status code.
+*  -  `FetchError` with any other `Response`: `result=error` and the
+*     response status code.
+*  -  `FetchError` without a `Response`: `result=network_error`.
+*  -  An `AbortError` (typically from a cancelled fetch): `result=network_error`.
+*  -  A bare `TypeError` (the shape native `fetch()` raises on DNS, connect,
+*     and TLS failures before any response is observed):
+*     `result=network_error`.
+*  -  Any other value: `result=error`.
+* @since 2.3.0
+*/
+function classifyFetchError(error) {
+	if (error instanceof _fedify_vocab_runtime.FetchError) {
+		if (error.response != null) {
+			const status = error.response.status;
+			return {
+				result: status === 404 || status === 410 ? "not_found" : "error",
+				statusCode: status
+			};
+		}
+		return { result: "network_error" };
+	}
+	if (isAbortError$1(error)) return { result: "network_error" };
+	if (error instanceof TypeError) return { result: "network_error" };
+	return { result: "error" };
+}
+/**
+* Wraps a {@link DocumentLoader} so each invocation records one
+* measurement on `activitypub.document.fetch` (counter) and one on
+* `activitypub.document.fetch.duration` (histogram), classifying the
+* outcome via {@link classifyFetchError} when the wrapped loader throws
+* and as `fetched` on success.  The wrapper rethrows whatever the
+* wrapped loader throws so caller behavior is unchanged.
+*
+* The wrapper records the host of the requested URL, including any
+* non-default port, on `activitypub.remote.host` when the URL parses; full
+* URLs, paths, and query strings are deliberately excluded to keep
+* cardinality bounded.
+* HTTP status codes are recorded only when the failure carries a
+* `Response` (currently, when the wrapped loader throws a
+* {@link FetchError} with a non-`null` `response`).
+* @since 2.3.0
+*/
+function instrumentDocumentLoader(loader, options) {
+	const meterProvider = options.meterProvider;
+	if (meterProvider == null) return loader;
+	return async (url, opts) => {
+		const start = performance.now();
+		let remoteUrl;
+		try {
+			remoteUrl = new URL(url);
+		} catch {
+			remoteUrl = void 0;
+		}
+		try {
+			const result = await loader(url, opts);
+			recordDocumentFetch(meterProvider, {
+				durationMs: getDurationMs(start),
+				kind: options.kind,
+				result: "fetched",
+				remoteUrl,
+				cacheEnabled: options.cacheEnabled
+			});
+			return result;
+		} catch (error) {
+			const classified = classifyFetchError(error);
+			recordDocumentFetch(meterProvider, {
+				durationMs: getDurationMs(start),
+				kind: options.kind,
+				result: classified.result,
+				remoteUrl,
+				cacheEnabled: options.cacheEnabled,
+				statusCode: classified.statusCode
+			});
+			throw error;
+		}
+	};
+}
+/**
+* Times an awaited public key fetch and records exactly one
+* `activitypub.signature.key_fetch.duration` measurement, classifying the
+* outcome as `hit`, `fetched`, or `error` based on the `cached` flag and
+* whether the returned key is non-null.  Errors thrown by the fetch are
+* reported as `error` and rethrown, so verifier behavior is unchanged.
+*
+* Shared by the three signature verifiers (HTTP, Linked Data, Object
+* Integrity Proofs); the only per-call variation is the
+* `activitypub.signature.kind` attribute value.
+* @since 2.3.0
+*/
+async function measureSignatureKeyFetch(meterProvider, kind, fetch) {
+	const start = performance.now();
+	try {
+		const result = await fetch();
+		getFederationMetrics(meterProvider).recordSignatureKeyFetchDuration(getDurationMs(start), kind, result.key != null ? result.cached ? "hit" : "fetched" : "error");
+		return result;
+	} catch (error) {
+		getFederationMetrics(meterProvider).recordSignatureKeyFetchDuration(getDurationMs(start), kind, "error");
+		throw error;
+	}
+}
+/**
+* Whether the given thrown value is an `AbortError`.
+*
+* `processQueuedTask` distinguishes aborted tasks (recorded as
+* `fedify.queue.task.result=aborted`) from other failures so that backend
+* shutdown signals do not inflate the `fedify.queue.task.failed` counter.
+* @since 2.3.0
+*/
+function isAbortError$1(error) {
+	if (error == null || typeof error !== "object") return false;
+	const name = error.name;
+	return typeof name === "string" && name === "AbortError";
+}
+const KNOWN_HTTP_METHODS = /* @__PURE__ */ new Set([
+	"CONNECT",
+	"DELETE",
+	"GET",
+	"HEAD",
+	"OPTIONS",
+	"PATCH",
+	"POST",
+	"PUT",
+	"QUERY",
+	"TRACE"
+]);
+function normalizeHttpMethod(method) {
+	const upper = method.toUpperCase();
+	return KNOWN_HTTP_METHODS.has(upper) ? upper : "_OTHER";
+}
+const federationMetrics = /* @__PURE__ */ new WeakMap();
+/**
+* Gets the cached Fedify metric instruments for a meter provider.
+* @since 2.3.0
+*/
+function getFederationMetrics(meterProvider = _opentelemetry_api.metrics.getMeterProvider()) {
+	let instruments = federationMetrics.get(meterProvider);
+	if (instruments == null) {
+		instruments = new FederationMetrics(meterProvider);
+		federationMetrics.set(meterProvider, instruments);
+	}
+	return instruments;
+}
+/**
+* Gets the bounded remote host attribute value for a URL.
+* @since 2.3.0
+*/
+function getRemoteHost(url) {
+	return url.host;
+}
+/**
+* Gets an elapsed duration in milliseconds from a `performance.now()` value.
+* @since 2.3.0
+*/
+function getDurationMs(start) {
+	return Math.max(0, performance.now() - start);
+}
+//#endregion
+//#region src/sig/key.ts
+/**
+* Checks if the given key is valid and supported.  No-op if the key is valid,
+* otherwise throws an error.
+* @param key The key to check.
+* @param type Which type of key to check.  If not specified, the key can be
+*             either public or private.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+function validateCryptoKey(key, type) {
+	if (type != null && key.type !== type) throw new TypeError(`The key is not a ${type} key.`);
+	if (!key.extractable) throw new TypeError("The key is not extractable.");
+	if (key.algorithm.name !== "RSASSA-PKCS1-v1_5" && key.algorithm.name !== "Ed25519") throw new TypeError("Currently only RSASSA-PKCS1-v1_5 and Ed25519 keys are supported.  More algorithms will be added in the future!");
+	if (key.algorithm.name === "RSASSA-PKCS1-v1_5") {
+		if (key.algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
+	}
+}
+/**
+* Generates a key pair which is appropriate for Fedify.
+* @param algorithm The algorithm to use.  Currently only RSASSA-PKCS1-v1_5 and
+*                  Ed25519 are supported.
+* @returns The generated key pair.
+* @throws {TypeError} If the algorithm is unsupported.
+*/
+function generateCryptoKeyPair(algorithm) {
+	if (algorithm == null) (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"sig",
+		"key"
+	]).warn("No algorithm specified.  Using RSASSA-PKCS1-v1_5 by default, but it is recommended to specify the algorithm explicitly as the parameter will be required in the future.");
+	if (algorithm == null || algorithm === "RSASSA-PKCS1-v1_5") return crypto.subtle.generateKey({
+		name: "RSASSA-PKCS1-v1_5",
+		modulusLength: 4096,
+		publicExponent: new Uint8Array([
+			1,
+			0,
+			1
+		]),
+		hash: "SHA-256"
+	}, true, ["sign", "verify"]);
+	else if (algorithm === "Ed25519") return crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+	throw new TypeError("Unsupported algorithm: " + algorithm);
+}
+/**
+* Exports a key in JWK format.
+* @param key The key to export.  Either public or private key.
+* @returns The exported key in JWK format.  The key is suitable for
+*          serialization and storage.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+async function exportJwk(key) {
+	validateCryptoKey(key);
+	const jwk = await crypto.subtle.exportKey("jwk", key);
+	if (jwk.crv === "Ed25519") jwk.alg = "Ed25519";
+	return jwk;
+}
+/**
+* Imports a key from JWK format.
+* @param jwk The key in JWK format.
+* @param type Which type of key to import, either `"public"` or `"private"`.
+* @returns The imported key.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+async function importJwk(jwk, type) {
+	let key;
+	if (jwk.kty === "RSA" && jwk.alg === "RS256") key = await crypto.subtle.importKey("jwk", jwk, {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, true, type === "public" ? ["verify"] : ["sign"]);
+	else if (jwk.kty === "OKP" && jwk.crv === "Ed25519") {
+		if (navigator?.userAgent === "Cloudflare-Workers") {
+			jwk = { ...jwk };
+			delete jwk.alg;
+		}
+		key = await crypto.subtle.importKey("jwk", jwk, "Ed25519", true, type === "public" ? ["verify"] : ["sign"]);
+	} else throw new TypeError("Unsupported JWK format.");
+	validateCryptoKey(key, type);
+	return key;
+}
+async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
+	tracerProvider ??= _opentelemetry_api.trace.getTracerProvider();
+	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
+		kind: _opentelemetry_api.SpanKind.CLIENT,
+		attributes: {
+			"http.method": "GET",
+			"url.full": keyId.href,
+			"url.scheme": keyId.protocol.replace(/:$/, ""),
+			"url.domain": keyId.hostname,
+			"url.path": keyId.pathname,
+			"url.query": keyId.search.replace(/^\?/, ""),
+			"url.fragment": keyId.hash.replace(/^#/, "")
+		}
+	}, async (span) => {
+		try {
+			const result = await fetcher();
+			span.setAttribute("activitypub.actor.key.cached", result.cached);
+			return result;
+		} catch (e) {
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(e)
+			});
+			throw e;
+		} finally {
+			span.end();
+		}
+	});
+}
+/**
+* Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
+* If the given URL contains an {@link Actor} object, it tries to find
+* the corresponding key in the `publicKey` or `assertionMethod` property.
+* @template T The type of the key to fetch.  Either {@link CryptographicKey}
+*              or {@link Multikey}.
+* @param keyId The URL of the key.
+* @param cls The class of the key to fetch.  Either {@link CryptographicKey}
+*            or {@link Multikey}.
+* @param options Options for fetching the key.  See {@link FetchKeyOptions}.
+* @returns The fetched key or `null` if the key is not found.
+* @since 1.3.0
+*/
+function fetchKey(keyId, cls, options = {}) {
+	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
+	return withFetchKeySpan(keyId, options.tracerProvider, () => fetchKeyInternal(keyId, cls, options));
+}
+/**
+* Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL,
+* preserving transport-level fetch failures for callers that need to inspect
+* why the key could not be loaded.
+*
+* @template T The type of the key to fetch.  Either {@link CryptographicKey}
+*              or {@link Multikey}.
+* @param keyId The URL of the key.
+* @param cls The class of the key to fetch.  Either {@link CryptographicKey}
+*            or {@link Multikey}.
+* @param options Options for fetching the key.
+* @returns The fetched key, or detailed fetch failure information.
+* @since 2.1.0
+*/
+async function fetchKeyDetailed(keyId, cls, options = {}) {
+	const cacheKey = typeof keyId === "string" ? new URL(keyId) : keyId;
+	return await withFetchKeySpan(cacheKey, options.tracerProvider, async () => {
+		return await fetchKeyWithResult(cacheKey, cls, options, async (cacheKey, keyId, keyCache, logger) => {
+			const fetchError = await keyCache?.getFetchError?.(cacheKey);
+			if (fetchError != null) {
+				logger.debug("Entry {keyId} found in cache with preserved fetch failure details.", { keyId });
+				return {
+					key: null,
+					cached: true,
+					fetchError
+				};
+			}
+			logger.debug("Entry {keyId} found in cache, but no fetch failure details are available.", { keyId });
+			return {
+				key: null,
+				cached: true
+			};
+		}, async (error, cacheKey, keyId, keyCache, logger) => {
+			logger.debug("Failed to fetch key {keyId}.", {
+				keyId,
+				error
+			});
+			await keyCache?.set(cacheKey, null);
+			if (error instanceof _fedify_vocab_runtime.FetchError && error.response != null) {
+				const fetchError = {
+					status: error.response.status,
+					response: error.response.clone()
+				};
+				await keyCache?.setFetchError?.(cacheKey, fetchError);
+				return {
+					key: null,
+					cached: false,
+					fetchError
+				};
+			}
+			const fetchError = { error: error instanceof Error ? error : new Error(String(error)) };
+			await keyCache?.setFetchError?.(cacheKey, fetchError);
+			return {
+				key: null,
+				cached: false,
+				fetchError
+			};
+		});
+	});
+}
+async function getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger) {
+	if (keyCache == null) return null;
+	const cachedKey = await keyCache.get(cacheKey);
+	const hit = checkCachedKeyHit(cachedKey, keyId, cls, logger);
+	if (hit != null) return hit;
+	if (cachedKey === null) {
+		logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
+		return {
+			key: null,
+			cached: true
+		};
+	}
+	return null;
+}
+function checkCachedKeyHit(cachedKey, keyId, cls, logger) {
+	if (cachedKey instanceof cls && cachedKey.publicKey != null) {
+		logger.debug("Key {keyId} found in cache.", { keyId });
+		return {
+			key: cachedKey,
+			cached: true
+		};
+	}
+	return null;
+}
+async function clearFetchErrorMetadata(keyId, keyCache) {
+	await keyCache?.setFetchError?.(keyId, null);
+}
+function isDidKeyUrl(keyId) {
+	return keyId.protocol === "did:" && keyId.pathname.startsWith("key:");
+}
+async function doRawKeysMatch(left, right) {
+	const [leftRaw, rightRaw] = await Promise.all([crypto.subtle.exportKey("raw", left), crypto.subtle.exportKey("raw", right)]);
+	if (leftRaw.byteLength !== rightRaw.byteLength) return false;
+	const leftBytes = new Uint8Array(leftRaw);
+	const rightBytes = new Uint8Array(rightRaw);
+	return leftBytes.every((byte, index) => byte === rightBytes[index]);
+}
+async function isCachedDidKeyValid(key, verificationMethod) {
+	try {
+		return key.id?.href === verificationMethod.id.href && key.controllerId?.href === verificationMethod.controller.href && await doRawKeysMatch(key.publicKey, verificationMethod.publicKey);
+	} catch {
+		return false;
+	}
+}
+async function resolveDidKey(cacheKey, cls, keyCache, logger) {
+	if (!isDidKeyUrl(cacheKey)) return null;
+	const keyId = cacheKey.href;
+	if (!(cls === _fedify_vocab.Multikey)) {
+		logger.debug("Failed to resolve did:key {keyId}; did:key verification methods are only supported as Multikey values.", { keyId });
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	let verificationMethod;
+	try {
+		verificationMethod = await (0, _fedify_vocab_runtime.parseDidKeyVerificationMethod)(cacheKey);
+	} catch (error) {
+		logger.debug("Failed to resolve did:key verification method {keyId}: {error}", {
+			keyId,
+			error
+		});
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	const hit = checkCachedKeyHit(await keyCache?.get(cacheKey), keyId, cls, logger);
+	if (hit?.key instanceof _fedify_vocab.Multikey && await isCachedDidKeyValid(hit.key, verificationMethod)) return hit;
+	const key = new _fedify_vocab.Multikey({
+		id: verificationMethod.id,
+		controller: verificationMethod.controller,
+		publicKey: verificationMethod.publicKey
+	});
+	await keyCache?.set(cacheKey, key);
+	await clearFetchErrorMetadata(cacheKey, keyCache);
+	logger.debug("Resolved did:key verification method {keyId}.", { keyId });
+	return {
+		key,
+		cached: false
+	};
+}
+async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
+	let object;
+	try {
+		object = await _fedify_vocab.Object.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		});
+	} catch (e) {
+		if (!(e instanceof TypeError)) throw e;
+		try {
+			object = await cls.fromJsonLd(document, {
+				documentLoader,
+				contextLoader,
+				tracerProvider
+			});
+		} catch (e) {
+			if (e instanceof TypeError) {
+				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+				await keyCache?.set(cacheKey, null);
+				await clearFetchErrorMetadata(cacheKey, keyCache);
+				return {
+					key: null,
+					cached: false
+				};
+			}
+			throw e;
+		}
+	}
+	let key = null;
+	if (object instanceof cls) key = object;
+	else if ((0, _fedify_vocab.isActor)(object)) {
+		const keys = cls === _fedify_vocab.CryptographicKey ? object.getPublicKeys({
+			documentLoader,
+			contextLoader,
+			suppressError: true,
+			tracerProvider
+		}) : object.getAssertionMethods({
+			documentLoader,
+			contextLoader,
+			suppressError: true,
+			tracerProvider
+		});
+		let length = 0;
+		let lastKey = null;
+		try {
+			for await (const k of keys) {
+				length++;
+				lastKey = k;
+				if (k.id?.href === keyId) {
+					key = k;
+					break;
+				}
+			}
+		} catch (e) {
+			if (!(e instanceof TypeError)) throw e;
+			logger.debug("Failed to verify; a malformed key was encountered while iterating the keys of {keyId}; treating it as a missing key: {error}", {
+				keyId,
+				error: e
+			});
+		}
+		const keyIdUrl = new URL(keyId);
+		if (key == null && keyIdUrl.hash === "" && length === 1) key = lastKey;
+		if (key == null) {
+			logger.debug("Failed to verify; object {keyId} returned an {actorType}, but has no key matching {keyId}.", {
+				keyId,
+				actorType: object.constructor.name
+			});
+			await keyCache?.set(cacheKey, null);
+			await clearFetchErrorMetadata(cacheKey, keyCache);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	} else {
+		logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		await clearFetchErrorMetadata(cacheKey, keyCache);
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	if (key.publicKey == null) {
+		logger.debug("Failed to verify; key {keyId} has no publicKeyPem field.", { keyId });
+		await keyCache?.set(cacheKey, null);
+		await clearFetchErrorMetadata(cacheKey, keyCache);
+		return {
+			key: null,
+			cached: false
+		};
+	}
+	if (keyCache != null) {
+		await keyCache.set(cacheKey, key);
+		logger.debug("Key {keyId} cached.", { keyId });
+	}
+	await clearFetchErrorMetadata(cacheKey, keyCache);
+	return {
+		key,
+		cached: false
+	};
+}
+async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, onFetchError) {
+	const start = performance.now();
+	let outcome = { result: "error" };
+	try {
+		const logger = (0, _logtape_logtape.getLogger)([
+			"fedify",
+			"sig",
+			"key"
+		]);
+		const keyId = cacheKey.href;
+		const keyCache = options.keyCache;
+		const didKey = await resolveDidKey(cacheKey, cls, keyCache, logger);
+		if (didKey != null) {
+			outcome = { result: didKey.key == null ? "invalid" : didKey.cached ? "hit" : "fetched" };
+			return didKey;
+		}
+		const cached = await getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger);
+		if (cached?.key === null && cached.cached) {
+			const cachedUnavailable = await onCachedUnavailable(cacheKey, keyId, keyCache, logger);
+			outcome = { result: "hit" };
+			return cachedUnavailable;
+		}
+		if (cached != null) {
+			outcome = { result: "hit" };
+			return cached;
+		}
+		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
+		let document;
+		try {
+			document = (await (options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)())(keyId)).document;
+		} catch (error) {
+			const classified = classifyFetchError(error);
+			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
+			outcome = classified;
+			return errored;
+		}
+		const resolved = await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
+		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
+		return resolved;
+	} finally {
+		recordKeyLookup(options.meterProvider, {
+			durationMs: getDurationMs(start),
+			result: outcome.result,
+			remoteUrl: cacheKey,
+			cacheEnabled: options.keyCache != null,
+			statusCode: outcome.statusCode
+		});
+	}
+}
+async function fetchKeyInternal(keyId, cls, options = {}) {
+	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
+		return {
+			key: null,
+			cached: true
+		};
+	}, async (error, cacheKey, keyId, keyCache, logger) => {
+		logger.debug("Failed to fetch key {keyId}.", {
+			keyId,
+			error
+		});
+		await keyCache?.set(cacheKey, null);
+		if (error instanceof _fedify_vocab_runtime.FetchError && error.response != null) await keyCache?.setFetchError?.(cacheKey, {
+			status: error.response.status,
+			response: error.response.clone()
+		});
+		else await keyCache?.setFetchError?.(cacheKey, { error: error instanceof Error ? error : new Error(String(error)) });
+		return {
+			key: null,
+			cached: false
+		};
+	});
+}
+//#endregion
+//#region src/sig/http.ts
+const Temporal = Temporal$1;
+const DEFAULT_MAX_REDIRECTION = 20;
+const DOUBLE_KNOCK_TRANSPORT_RETRY_DELAY_MS = 100;
+/**
+* Signs a request using the given private key.
+* @param request The request to sign.
+* @param privateKey The private key to use for signing.
+* @param keyId The key ID to use for the signature.  It will be used by the
+*              verifier.
+* @returns The signed request.
+* @throws {TypeError} If the private key is invalid or unsupported.
+*/
+async function signRequest(request, privateKey, keyId, options = {}) {
+	validateCryptoKey(privateKey, "private");
+	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("http_signatures.sign", async (span) => {
+		try {
+			const spec = options.spec ?? "draft-cavage-http-signatures-12";
+			let signed;
+			if (spec === "rfc9421") signed = await signRequestRfc9421(request, privateKey, keyId, span, options.currentTime, options.body, options.rfc9421);
+			else signed = await signRequestDraft(request, privateKey, keyId, span, options.currentTime, options.body);
+			if (span.isRecording()) {
+				span.setAttribute(_opentelemetry_semantic_conventions.ATTR_HTTP_REQUEST_METHOD, signed.method);
+				span.setAttribute(_opentelemetry_semantic_conventions.ATTR_URL_FULL, signed.url);
+				for (const [name, value] of signed.headers) span.setAttribute((0, _opentelemetry_semantic_conventions.ATTR_HTTP_REQUEST_HEADER)(name), value);
+				span.setAttribute("http_signatures.key_id", keyId.href);
+			}
+			return signed;
+		} catch (error) {
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
+async function signRequestDraft(request, privateKey, keyId, span, currentTime, bodyBuffer) {
+	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
+	const url = new URL(request.url);
+	const body = bodyBuffer !== void 0 ? bodyBuffer : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
+	const headers = new Headers(request.headers);
+	if (!headers.has("Host")) headers.set("Host", url.host);
+	if (!headers.has("Digest") && body != null) {
+		const digest = await crypto.subtle.digest("SHA-256", body);
+		headers.set("Digest", `SHA-256=${(0, byte_encodings_base64.encodeBase64)(digest)}`);
+		if (span.isRecording()) span.setAttribute("http_signatures.digest.sha-256", (0, byte_encodings_hex.encodeHex)(digest));
+	}
+	if (!headers.has("Date")) headers.set("Date", currentTime == null ? (/* @__PURE__ */ new Date()).toUTCString() : new Date(currentTime.toString()).toUTCString());
+	const serialized = [["(request-target)", `${request.method.toLowerCase()} ${url.pathname}`], ...headers];
+	const headerNames = serialized.map(([name]) => name);
+	const message = serialized.map(([name, value]) => `${name}: ${value.trim()}`).join("\n");
+	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, new TextEncoder().encode(message));
+	const sigHeader = `keyId="${keyId.href}",algorithm="rsa-sha256",headers="${headerNames.join(" ")}",signature="${(0, byte_encodings_base64.encodeBase64)(signature)}"`;
+	headers.set("Signature", sigHeader);
+	if (span.isRecording()) {
+		span.setAttribute("http_signatures.algorithm", "rsa-sha256");
+		span.setAttribute("http_signatures.signature", (0, byte_encodings_hex.encodeHex)(signature));
+	}
+	return new Request(request, {
+		headers,
+		body
+	});
+}
+function formatRfc9421SignatureParameters(params) {
+	return Array.from(iterRfc9421(params)).join(";");
+}
+function* iterRfc9421(params) {
+	yield `alg="${params.algorithm}"`;
+	yield `keyid="${params.keyId.href}"`;
+	yield `created=${params.created}`;
+	if (params.expires != null) yield `expires=${params.expires}`;
+	if (params.nonce != null) yield `nonce="${escapeSfString(params.nonce)}"`;
+	if (params.tag != null) yield `tag="${escapeSfString(params.tag)}"`;
+}
+const escapeSfString = (value) => value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
+function formatComponentId(component) {
+	return (0, structured_field_values.encodeItem)(new structured_field_values.Item(component.value, component.params));
+}
+/**
+* Creates a signature base for a request according to RFC 9421.
+* @param request The request to create a signature base for.
+* @param components The components to include in the signature base.
+* @param parameters The signature parameters to include in the signature base.
+* @returns The signature base as a string.
+*/
+function createRfc9421SignatureBase(request, components, parameters) {
+	const url = new URL(request.url);
+	return components.map((component) => {
+		const id = formatComponentId(component);
+		const derived = derivedComponents[component.value]?.(request, url);
+		if (derived != null) return `${id}: ${derived}`;
+		if (component.value.startsWith("@")) throw new Error(`Unsupported derived component: ${component.value}`);
+		const header = request.headers.get(component.value);
+		if (header == null) throw new Error(`Missing header: ${component.value}`);
+		return `${id}: ${header}`;
+	}).concat([`"@signature-params": (${components.map((c) => formatComponentId(c)).join(" ")});${parameters}`]).join("\n");
+}
+const derivedComponents = {
+	"@method": (request) => request.method.toUpperCase(),
+	"@target-uri": (_, url) => url.href,
+	"@authority": (_, url) => url.host,
+	"@scheme": (_, url) => url.protocol.slice(0, -1),
+	"@request-target": (request, url) => `${request.method.toLowerCase()} ${url.pathname}${url.search}`,
+	"@path": (_, url) => url.pathname,
+	"@query": (_, { search }) => search.startsWith("?") ? search.slice(1) : search,
+	"@query-param": () => {
+		throw new Error("@query-param requires a parameter name");
+	},
+	"@status": () => {
+		throw new Error("@status is only valid for responses");
+	}
+};
+/**
+* Formats a signature using rfc9421 format.
+* @param signature The raw signature bytes.
+* @param components The components that were signed.
+* @param parameters The signature parameters.
+* @returns The formatted signature string.
+*/
+function formatRfc9421Signature(signature, components, parameters, label = "sig1") {
+	return [`${label}=(${components.map((c) => formatComponentId(c)).join(" ")});${parameters}`, `${label}=:${(0, byte_encodings_base64.encodeBase64)(signature)}:`];
+}
+/**
+* Parse RFC 9421 Signature-Input header.
+* @param signatureInput The Signature-Input header value.
+* @returns Parsed signature input parameters.
+*/
+function parseRfc9421SignatureInput(signatureInput) {
+	let dict;
+	try {
+		dict = (0, structured_field_values.decodeDict)(signatureInput);
+	} catch (error) {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"sig",
+			"http"
+		]).debug("Failed to parse Signature-Input header: {signatureInput}", {
+			signatureInput,
+			error
+		});
+		return {};
+	}
+	const result = {};
+	for (const [label, item] of Object.entries(dict)) {
+		if (!Array.isArray(item.value) || typeof item.params.keyid !== "string" || typeof item.params.created !== "number") continue;
+		const components = item.value.filter((subitem) => typeof subitem.value === "string").map((subitem) => ({
+			value: subitem.value,
+			params: subitem.params ?? {}
+		}));
+		const params = (0, structured_field_values.encodeItem)(new structured_field_values.Item(0, item.params));
+		result[label] = {
+			keyId: item.params.keyid,
+			alg: item.params.alg,
+			created: item.params.created,
+			nonce: typeof item.params.nonce === "string" ? item.params.nonce : void 0,
+			tag: typeof item.params.tag === "string" ? item.params.tag : void 0,
+			components,
+			parameters: params.slice(params.indexOf(";") + 1)
+		};
+	}
+	return result;
+}
+/**
+* Parse RFC 9421 Signature header.
+* @param signature The Signature header value.
+* @returns Parsed signature values.
+*/
+function parseRfc9421Signature(signature) {
+	let dict;
+	try {
+		dict = (0, structured_field_values.decodeDict)(signature);
+	} catch (error) {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"sig",
+			"http"
+		]).debug("Failed to parse Signature header: {signature}", {
+			signature,
+			error
+		});
+		return {};
+	}
+	const result = {};
+	for (const [key, value] of Object.entries(dict)) if (value.value instanceof Uint8Array) result[key] = value.value;
+	return result;
+}
+async function signRequestRfc9421(request, privateKey, keyId, span, currentTime, bodyBuffer, rfc9421Options) {
+	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
+	const url = new URL(request.url);
+	const body = bodyBuffer !== void 0 ? bodyBuffer : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
+	const headers = new Headers(request.headers);
+	if (!headers.has("Host")) headers.set("Host", url.host);
+	if (!headers.has("Content-Digest") && body != null) {
+		const digest = await crypto.subtle.digest("SHA-256", body);
+		headers.set("Content-Digest", `sha-256=:${(0, byte_encodings_base64.encodeBase64)(digest)}:`);
+		if (span.isRecording()) span.setAttribute("http_signatures.digest.sha-256", (0, byte_encodings_hex.encodeHex)(digest));
+	}
+	currentTime ??= Temporal.Now.instant();
+	const created = currentTime.epochMilliseconds / 1e3 | 0;
+	if (!headers.has("Date")) headers.set("Date", new Date(currentTime.toString()).toUTCString());
+	const label = rfc9421Options?.label ?? "sig1";
+	const components = [...rfc9421Options?.components ?? [
+		{
+			value: "@method",
+			params: {}
+		},
+		{
+			value: "@target-uri",
+			params: {}
+		},
+		{
+			value: "@authority",
+			params: {}
+		},
+		{
+			value: "host",
+			params: {}
+		},
+		{
+			value: "date",
+			params: {}
+		}
+	], ...body != null ? [{
+		value: "content-digest",
+		params: {}
+	}] : []];
+	const signatureParams = formatRfc9421SignatureParameters({
+		algorithm: "rsa-v1_5-sha256",
+		keyId,
+		created,
+		expires: rfc9421Options?.expires === true ? (currentTime.epochMilliseconds / 1e3 | 0) + 3600 : void 0,
+		nonce: rfc9421Options?.nonce,
+		tag: rfc9421Options?.tag
+	});
+	let signatureBase;
+	try {
+		signatureBase = createRfc9421SignatureBase(new Request(request.url, {
+			method: request.method,
+			headers
+		}), components, signatureParams);
+	} catch (error) {
+		throw new TypeError(`Failed to create signature base: ${String(error)}; it is probably a bug in the implementation.  Please report it at Fedify's issue tracker.`);
+	}
+	const signatureBytes = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, new TextEncoder().encode(signatureBase));
+	const [signatureInput, signature] = formatRfc9421Signature(signatureBytes, components, signatureParams, label);
+	const existingInput = headers.get("Signature-Input");
+	headers.set("Signature-Input", existingInput != null ? `${existingInput}, ${signatureInput}` : signatureInput);
+	const existingSignature = headers.get("Signature");
+	headers.set("Signature", existingSignature != null ? `${existingSignature}, ${signature}` : signature);
+	if (span.isRecording()) {
+		span.setAttribute("http_signatures.algorithm", "rsa-v1_5-sha256");
+		span.setAttribute("http_signatures.signature", (0, byte_encodings_hex.encodeHex)(signatureBytes));
+		span.setAttribute("http_signatures.created", created.toString());
+	}
+	return new Request(request, {
+		headers,
+		body
+	});
+}
+const supportedHashAlgorithms = {
+	"sha": "SHA-1",
+	"sha-256": "SHA-256",
+	"sha-512": "SHA-512"
+};
+function noSignatureResult() {
+	return {
+		verified: false,
+		reason: { type: "noSignature" }
+	};
+}
+function invalidSignatureResult(keyId) {
+	return keyId == null ? {
+		verified: false,
+		reason: { type: "invalidSignature" }
+	} : {
+		verified: false,
+		reason: {
+			type: "invalidSignature",
+			keyId
+		}
+	};
+}
+function keyFetchErrorResult(keyId, result) {
+	return {
+		verified: false,
+		reason: {
+			type: "keyFetchError",
+			keyId,
+			result
+		}
+	};
+}
+function parseKeyId(value) {
+	if (value == null) return null;
+	try {
+		return new URL(value);
+	} catch {
+		return null;
+	}
+}
+function getKeyFetchErrorName(error) {
+	return error.name || error.constructor.name || "Error";
+}
+/**
+* Known draft-cavage `algorithm` parameter values, used to keep the
+* `http_signatures.algorithm` metric attribute on a bounded set.  The header
+* field is attacker-controlled and not used to select the verification
+* algorithm, so unknown values are dropped from the metric to prevent
+* cardinality blow-up.
+*/
+const DRAFT_KNOWN_ALGORITHMS = /* @__PURE__ */ new Set([
+	"ecdsa-sha256",
+	"ecdsa-sha384",
+	"ecdsa-sha512",
+	"ed25519",
+	"hs2019",
+	"rsa-sha1",
+	"rsa-sha256",
+	"rsa-sha512"
+]);
+function classifyHttpVerifyResult(result) {
+	if (result.verified) return "verified";
+	return result.reason.type === "noSignature" ? "missing" : "rejected";
+}
+function recordVerificationResult(span, result) {
+	span.setAttribute("http_signatures.verified", result.verified);
+	if (result.verified === true) return;
+	const reason = result.reason;
+	span.setAttribute("http_signatures.failure_reason", reason.type);
+	if ("keyId" in reason && reason.keyId != null) span.setAttribute("http_signatures.key_id", reason.keyId.href);
+	if (reason.type !== "keyFetchError") return;
+	if ("status" in reason.result) span.setAttribute("http_signatures.key_fetch_status", reason.result.status);
+	else span.setAttribute("http_signatures.key_fetch_error", getKeyFetchErrorName(reason.result.error));
+}
+/**
+* Verifies the signature of a request.
+*
+* Note that this function consumes the request body, so it should not be used
+* if the request body is already consumed.  Consuming the request body after
+* calling this function is okay, since this function clones the request
+* under the hood.
+*
+* @param request The request to verify.
+* @param options Options for verifying the request.
+* @returns The public key of the verified signature, or `null` if the signature
+*          could not be verified.
+*/
+async function verifyRequest(request, options = {}) {
+	const result = await verifyRequestDetailed(request, options);
+	return result.verified ? result.key : null;
+}
+/**
+* Verifies the signature of a request and returns a structured failure reason
+* when verification does not succeed.
+*
+* @param request The request to verify.
+* @param options Options for verifying the request.
+* @returns The verified public key, or a structured verification failure.
+* @since 2.1.0
+*/
+async function verifyRequestDetailed(request, options = {}) {
+	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("http_signatures.verify", async (span) => {
+		if (span.isRecording()) {
+			span.setAttribute(_opentelemetry_semantic_conventions.ATTR_HTTP_REQUEST_METHOD, request.method);
+			span.setAttribute(_opentelemetry_semantic_conventions.ATTR_URL_FULL, request.url);
+			for (const [name, value] of request.headers) span.setAttribute((0, _opentelemetry_semantic_conventions.ATTR_HTTP_REQUEST_HEADER)(name), value);
+		}
+		const start = performance.now();
+		const metricsContext = {};
+		let result;
+		let threw = false;
+		try {
+			let spec = options.spec;
+			if (spec == null) spec = request.headers.has("Signature-Input") ? "rfc9421" : "draft-cavage-http-signatures-12";
+			if (spec === "rfc9421") result = await verifyRequestRfc9421(request, span, metricsContext, options);
+			else result = await verifyRequestDraft(request, span, metricsContext, options);
+			recordVerificationResult(span, result);
+			if (!result.verified) span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
+			return result;
+		} catch (error) {
+			threw = true;
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			throw error;
+		} finally {
+			const classified = threw ? "error" : classifyHttpVerifyResult(result);
+			const failureReason = result != null && !result.verified && result.reason.type !== "noSignature" ? result.reason.type : void 0;
+			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "http", classified, {
+				algorithm: metricsContext.algorithm,
+				failureReason
+			});
+			span.end();
+		}
+	});
+}
+async function verifyRequestDraft(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, meterProvider, tracerProvider } = {}) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"sig",
+		"http"
+	]);
+	if (request.bodyUsed) {
+		logger.error("Failed to verify; the request body is already consumed.", { url: request.url });
+		return noSignatureResult();
+	} else if (request.body?.locked) {
+		logger.error("Failed to verify; the request body is locked.", { url: request.url });
+		return noSignatureResult();
+	}
+	const originalRequest = request;
+	request = request.clone();
+	const sigHeader = request.headers.get("Signature");
+	if (sigHeader == null) {
+		logger.debug("Failed to verify; no Signature header found.", { headers: Object.fromEntries(request.headers.entries()) });
+		return noSignatureResult();
+	}
+	const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)=(?:"([^"]*)"|(\d+))\s*$/)).filter((m) => m != null).map((m) => [m[1], m[2] ?? m[3]]));
+	const parsedKeyId = parseKeyId(sigValues.keyId);
+	const dateHeader = request.headers.get("Date");
+	if (dateHeader == null) {
+		logger.debug("Failed to verify; no Date header found.", { headers: Object.fromEntries(request.headers.entries()) });
+		return invalidSignatureResult(parsedKeyId);
+	}
+	const digestHeader = request.headers.get("Digest");
+	if (request.method !== "GET" && request.method !== "HEAD" && digestHeader == null) {
+		logger.debug("Failed to verify; no Digest header found.", { headers: Object.fromEntries(request.headers.entries()) });
+		return invalidSignatureResult(parsedKeyId);
+	}
+	let body = null;
+	if (digestHeader != null) {
+		body = await request.arrayBuffer();
+		const digests = digestHeader.split(",").map((pair) => pair.includes("=") ? pair.split("=", 2) : [pair, ""]);
+		let matched = false;
+		for (let [algo, digestBase64] of digests) {
+			algo = algo.trim().toLowerCase();
+			if (!(algo in supportedHashAlgorithms)) continue;
+			let digest;
+			try {
+				digest = (0, byte_encodings_base64.decodeBase64)(digestBase64);
+			} catch (error) {
+				logger.debug("Failed to verify; invalid base64 encoding: {digest}.", {
+					digest: digestBase64,
+					error
+				});
+				return invalidSignatureResult(parsedKeyId);
+			}
+			if (span.isRecording()) span.setAttribute(`http_signatures.digest.${algo}`, (0, byte_encodings_hex.encodeHex)(digest));
+			const expectedDigest = await crypto.subtle.digest(supportedHashAlgorithms[algo], body);
+			if (!timingSafeEqual(digest, new Uint8Array(expectedDigest))) {
+				logger.debug("Failed to verify; digest mismatch ({algorithm}): {digest} != {expectedDigest}.", {
+					algorithm: algo,
+					digest: digestBase64,
+					expectedDigest: (0, byte_encodings_base64.encodeBase64)(expectedDigest)
+				});
+				return invalidSignatureResult(parsedKeyId);
+			}
+			matched = true;
+		}
+		if (!matched) {
+			logger.debug("Failed to verify; no supported digest algorithm found.  Supported: {supportedAlgorithms}; found: {algorithms}.", {
+				supportedAlgorithms: Object.keys(supportedHashAlgorithms),
+				algorithms: digests.map(([algo]) => algo)
+			});
+			return invalidSignatureResult(parsedKeyId);
+		}
+	}
+	const date = Temporal.Instant.from(new Date(dateHeader).toISOString());
+	const now = currentTime ?? Temporal.Now.instant();
+	if (timeWindow !== false) {
+		const tw = timeWindow ?? { hours: 1 };
+		if (Temporal.Instant.compare(date, now.add(tw)) > 0) {
+			logger.debug("Failed to verify; Date is too far in the future.", {
+				date: date.toString(),
+				now: now.toString()
+			});
+			return invalidSignatureResult(parsedKeyId);
+		} else if (Temporal.Instant.compare(date, now.subtract(tw)) < 0) {
+			logger.debug("Failed to verify; Date is too far in the past.", {
+				date: date.toString(),
+				now: now.toString()
+			});
+			return invalidSignatureResult(parsedKeyId);
+		}
+	}
+	if (!("keyId" in sigValues)) {
+		logger.debug("Failed to verify; no keyId field found in the Signature header.", { signature: sigHeader });
+		return invalidSignatureResult(null);
+	} else if (!("headers" in sigValues)) {
+		logger.debug("Failed to verify; no headers field found in the Signature header.", { signature: sigHeader });
+		return invalidSignatureResult(parsedKeyId);
+	} else if (!("signature" in sigValues)) {
+		logger.debug("Failed to verify; no signature field found in the Signature header.", { signature: sigHeader });
+		return invalidSignatureResult(parsedKeyId);
+	}
+	if ("expires" in sigValues) {
+		const expiresSeconds = parseInt(sigValues.expires);
+		if (!Number.isInteger(expiresSeconds)) {
+			logger.debug("Failed to verify; invalid expires field in the Signature header: {expires}.", {
+				expires: sigValues.expires,
+				signature: sigHeader
+			});
+			return invalidSignatureResult(parsedKeyId);
+		}
+		const expires = Temporal.Instant.fromEpochMilliseconds(expiresSeconds * 1e3);
+		if (Temporal.Instant.compare(now, expires) > 0) {
+			logger.debug("Failed to verify; signature expired at {expires} (now: {now}).", {
+				expires: expires.toString(),
+				now: now.toString(),
+				signature: sigHeader
+			});
+			return invalidSignatureResult(parsedKeyId);
+		}
+	}
+	if ("created" in sigValues) {
+		const createdSeconds = parseInt(sigValues.created);
+		if (!Number.isInteger(createdSeconds)) {
+			logger.debug("Failed to verify; invalid created field in the Signature header: {created}.", {
+				created: sigValues.created,
+				signature: sigHeader
+			});
+			return invalidSignatureResult(parsedKeyId);
+		}
+		if (timeWindow !== false) {
+			const created = Temporal.Instant.fromEpochMilliseconds(createdSeconds * 1e3);
+			const tw = timeWindow ?? { minutes: 1 };
+			if (Temporal.Instant.compare(created, now.add(tw)) > 0) {
+				logger.debug("Failed to verify; created is too far in the future.", {
+					created: created.toString(),
+					now: now.toString()
+				});
+				return invalidSignatureResult(parsedKeyId);
+			} else if (Temporal.Instant.compare(created, now.subtract(tw)) < 0) {
+				logger.debug("Failed to verify; created is too far in the past.", {
+					created: created.toString(),
+					now: now.toString()
+				});
+				return invalidSignatureResult(parsedKeyId);
+			}
+		}
+	}
+	const { keyId, headers, signature } = sigValues;
+	const keyIdUrl = parseKeyId(keyId);
+	if (keyIdUrl == null) return invalidSignatureResult(null);
+	span?.setAttribute("http_signatures.key_id", keyId);
+	if ("algorithm" in sigValues) {
+		span?.setAttribute("http_signatures.algorithm", sigValues.algorithm);
+		const normalizedAlgorithm = sigValues.algorithm.toLowerCase();
+		if (DRAFT_KNOWN_ALGORITHMS.has(normalizedAlgorithm)) metricsContext.algorithm = normalizedAlgorithm;
+	}
+	const { key, cached, fetchError } = await measureSignatureKeyFetch(meterProvider, "http", () => fetchKeyDetailed(keyIdUrl, _fedify_vocab.CryptographicKey, {
+		documentLoader,
+		contextLoader,
+		keyCache,
+		tracerProvider,
+		meterProvider
+	}));
+	if (fetchError != null) return keyFetchErrorResult(keyIdUrl, fetchError);
+	if (key == null) return invalidSignatureResult(keyIdUrl);
+	const headerNames = headers.split(/\s+/g);
+	if (!headerNames.includes("(request-target)") || !headerNames.includes("date")) {
+		logger.debug("Failed to verify; required headers missing in the Signature header: {headers}.", { headers });
+		return invalidSignatureResult(keyIdUrl);
+	}
+	if (body != null && !headerNames.includes("digest")) {
+		logger.debug("Failed to verify; required headers missing in the Signature header: {headers}.", { headers });
+		return invalidSignatureResult(keyIdUrl);
+	}
+	const message = headerNames.map((name) => `${name}: ` + (name === "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name === "(created)" ? sigValues.created ?? "" : name === "(expires)" ? sigValues.expires ?? "" : name === "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
+	const sig = (0, byte_encodings_base64.decodeBase64)(signature);
+	span?.setAttribute("http_signatures.signature", (0, byte_encodings_hex.encodeHex)(sig));
+	if (!await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message))) {
+		if (cached) {
+			logger.debug("Failed to verify with the cached key {keyId}; signature {signature} is invalid.  Retrying with the freshly fetched key...", {
+				keyId,
+				signature,
+				message
+			});
+			return await verifyRequestDraft(originalRequest, span, metricsContext, {
+				documentLoader,
+				contextLoader,
+				timeWindow,
+				currentTime,
+				keyCache: {
+					get: () => Promise.resolve(void 0),
+					set: async (keyId, key) => await keyCache?.set(keyId, key)
+				},
+				meterProvider,
+				tracerProvider
+			});
+		}
+		logger.debug("Failed to verify with the fetched key {keyId}; signature {signature} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
+			keyId,
+			signature,
+			message
+		});
+		return invalidSignatureResult(keyIdUrl);
+	}
+	return {
+		verified: true,
+		key
+	};
+}
+/**
+* RFC 9421 map of algorithm identifiers to WebCrypto algorithms
+*/
+const rfc9421AlgorithmMap = {
+	"rsa-v1_5-sha256": {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	},
+	"rsa-v1_5-sha512": {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-512"
+	},
+	"rsa-pss-sha512": {
+		name: "RSA-PSS",
+		hash: "SHA-512"
+	},
+	"ecdsa-p256-sha256": {
+		name: "ECDSA",
+		hash: "SHA-256"
+	},
+	"ecdsa-p384-sha384": {
+		name: "ECDSA",
+		hash: "SHA-384"
+	},
+	"ed25519": { name: "Ed25519" }
+};
+/**
+* Verifies a Content-Digest header according to RFC 9421.
+* @param digestHeader The Content-Digest header value.
+* @param body The message body to verify against.
+* @returns Whether the digest is valid.
+*/
+async function verifyRfc9421ContentDigest(digestHeader, body) {
+	const digests = digestHeader.split(",").map((pair) => {
+		pair = pair.trim();
+		const pos = pair.indexOf("=");
+		const algo = pos < 0 ? pair : pair.slice(0, pos);
+		const value = pos < 0 ? "" : pair.slice(pos + 1);
+		return {
+			algo: algo.trim().toLowerCase(),
+			value: value.trim()
+		};
+	});
+	for (const { algo, value } of digests) {
+		let hashAlgo;
+		if (algo === "sha-256") hashAlgo = "SHA-256";
+		else if (algo === "sha-512") hashAlgo = "SHA-512";
+		else continue;
+		const base64Match = value.match(/^:([^:]+):$/);
+		if (!base64Match) continue;
+		let digest;
+		try {
+			digest = (0, byte_encodings_base64.decodeBase64)(base64Match[1]);
+		} catch {
+			continue;
+		}
+		const calculatedDigest = await crypto.subtle.digest(hashAlgo, body);
+		if (timingSafeEqual(digest, new Uint8Array(calculatedDigest))) return true;
+	}
+	return false;
+}
+async function verifyRequestRfc9421(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, meterProvider, tracerProvider } = {}) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"sig",
+		"http"
+	]);
+	if (request.bodyUsed) {
+		logger.error("Failed to verify; the request body is already consumed.", { url: request.url });
+		return noSignatureResult();
+	} else if (request.body?.locked) {
+		logger.error("Failed to verify; the request body is locked.", { url: request.url });
+		return noSignatureResult();
+	}
+	const originalRequest = request;
+	request = request.clone();
+	const signatureInputHeader = request.headers.get("Signature-Input");
+	if (!signatureInputHeader) {
+		logger.debug("Failed to verify; no Signature-Input header found.", { headers: Object.fromEntries(request.headers.entries()) });
+		return noSignatureResult();
+	}
+	const signatureHeader = request.headers.get("Signature");
+	if (!signatureHeader) {
+		logger.debug("Failed to verify; no Signature header found.", { headers: Object.fromEntries(request.headers.entries()) });
+		return noSignatureResult();
+	}
+	const signatureInputs = parseRfc9421SignatureInput(signatureInputHeader);
+	logger.debug("Parsed Signature-Input header: {signatureInputs}", { signatureInputs });
+	const signatures = parseRfc9421Signature(signatureHeader);
+	const signatureNames = Object.keys(signatureInputs);
+	if (signatureNames.length === 0) {
+		logger.debug("Failed to verify; no valid signatures found in Signature-Input header.", { header: signatureInputHeader });
+		return invalidSignatureResult(null);
+	}
+	let failure = noSignatureResult();
+	let failureAlgorithm;
+	const setFailure = (result, algorithm) => {
+		failure = result;
+		failureAlgorithm = algorithm;
+	};
+	for (const sigName of signatureNames) {
+		if (!signatures[sigName]) {
+			setFailure(invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId)));
+			continue;
+		}
+		const sigInput = signatureInputs[sigName];
+		const sigBytes = signatures[sigName];
+		const keyId = parseKeyId(sigInput.keyId);
+		if (!sigInput.keyId) {
+			logger.debug("Failed to verify; missing keyId in signature {signatureName}.", {
+				signatureName: sigName,
+				signatureInput: signatureInputHeader
+			});
+			setFailure(invalidSignatureResult(null));
+			continue;
+		}
+		if (!sigInput.created) {
+			logger.debug("Failed to verify; missing created timestamp in signature {signatureName}.", {
+				signatureName: sigName,
+				signatureInput: signatureInputHeader
+			});
+			setFailure(invalidSignatureResult(keyId));
+			continue;
+		}
+		const signatureCreated = Temporal.Instant.fromEpochMilliseconds(sigInput.created * 1e3);
+		const now = currentTime ?? Temporal.Now.instant();
+		if (timeWindow !== false) {
+			const tw = timeWindow ?? { hours: 1 };
+			if (Temporal.Instant.compare(signatureCreated, now.add(tw)) > 0) {
+				logger.debug("Failed to verify; signature created time is too far in the future.", {
+					created: signatureCreated.toString(),
+					now: now.toString()
+				});
+				setFailure(invalidSignatureResult(keyId));
+				continue;
+			} else if (Temporal.Instant.compare(signatureCreated, now.subtract(tw)) < 0) {
+				logger.debug("Failed to verify; signature created time is too far in the past.", {
+					created: signatureCreated.toString(),
+					now: now.toString()
+				});
+				setFailure(invalidSignatureResult(keyId));
+				continue;
+			}
+		}
+		if (request.method !== "GET" && request.method !== "HEAD" && sigInput.components.some((c) => c.value === "content-digest")) {
+			const contentDigestHeader = request.headers.get("Content-Digest");
+			if (!contentDigestHeader) {
+				logger.debug("Failed to verify; Content-Digest header required but not found.", { components: sigInput.components });
+				setFailure(invalidSignatureResult(keyId));
+				continue;
+			}
+			if (!await verifyRfc9421ContentDigest(contentDigestHeader, await request.arrayBuffer())) {
+				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
+				setFailure(invalidSignatureResult(keyId));
+				continue;
+			}
+		}
+		span?.setAttribute("http_signatures.key_id", sigInput.keyId);
+		span?.setAttribute("http_signatures.created", sigInput.created.toString());
+		if (keyId == null) {
+			setFailure(invalidSignatureResult(null));
+			continue;
+		}
+		const { key, cached, fetchError } = await measureSignatureKeyFetch(meterProvider, "http", () => fetchKeyDetailed(keyId, _fedify_vocab.CryptographicKey, {
+			documentLoader,
+			contextLoader,
+			keyCache,
+			tracerProvider,
+			meterProvider
+		}));
+		if (fetchError != null) {
+			setFailure(keyFetchErrorResult(keyId, fetchError));
+			continue;
+		}
+		if (!key) {
+			logger.debug("Failed to fetch key: {keyId}", { keyId: sigInput.keyId });
+			setFailure(invalidSignatureResult(keyId));
+			continue;
+		}
+		let alg = sigInput.alg?.toLowerCase();
+		if (alg == null) {
+			if (key.publicKey.algorithm.name === "RSASSA-PKCS1-v1_5") alg = "hash" in key.publicKey.algorithm ? key.publicKey.algorithm.hash === "SHA-512" ? "rsa-v1_5-sha512" : "rsa-v1_5-sha256" : "rsa-v1_5-sha256";
+			else if (key.publicKey.algorithm.name === "RSA-PSS") alg = "rsa-pss-sha512";
+			else if (key.publicKey.algorithm.name === "ECDSA") alg = "namedCurve" in key.publicKey.algorithm && key.publicKey.algorithm.namedCurve === "P-256" ? "ecdsa-p256-sha256" : "ecdsa-p384-sha384";
+			else if (key.publicKey.algorithm.name === "Ed25519") alg = "ed25519";
+		}
+		if (alg) span?.setAttribute("http_signatures.algorithm", alg);
+		const algorithm = alg && rfc9421AlgorithmMap[alg];
+		const candidateAlgorithm = algorithm ? alg : void 0;
+		if (!algorithm) {
+			logger.debug("Failed to verify; unsupported algorithm: {algorithm}", {
+				algorithm: sigInput.alg,
+				supported: Object.keys(rfc9421AlgorithmMap)
+			});
+			setFailure(invalidSignatureResult(keyId));
+			continue;
+		}
+		let signatureBase;
+		try {
+			signatureBase = createRfc9421SignatureBase(request, sigInput.components, sigInput.parameters);
+		} catch (error) {
+			logger.debug("Failed to create signature base for verification: {error}", {
+				error,
+				signatureInput: sigInput
+			});
+			setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
+			continue;
+		}
+		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
+		span?.setAttribute("http_signatures.signature", (0, byte_encodings_hex.encodeHex)(sigBytes));
+		try {
+			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes)) {
+				metricsContext.algorithm = candidateAlgorithm;
+				return {
+					verified: true,
+					key,
+					signatureLabel: sigName
+				};
+			} else if (cached) {
+				logger.debug("Failed to verify with cached key {keyId}; retrying with fresh key...", { keyId: sigInput.keyId });
+				return await verifyRequestRfc9421(originalRequest, span, metricsContext, {
+					documentLoader,
+					contextLoader,
+					timeWindow,
+					currentTime,
+					keyCache: {
+						get: () => Promise.resolve(void 0),
+						set: async (keyId, key) => await keyCache?.set(keyId, key)
+					},
+					spec: "rfc9421",
+					meterProvider,
+					tracerProvider
+				});
+			} else {
+				logger.debug("Failed to verify signature with fetched key {keyId}; signature invalid.", {
+					keyId: sigInput.keyId,
+					signatureBase
+				});
+				setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
+			}
+		} catch (error) {
+			logger.debug("Error during signature verification: {error}", {
+				error,
+				keyId: sigInput.keyId,
+				algorithm: sigInput.alg
+			});
+			setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
+		}
+	}
+	metricsContext.algorithm = failureAlgorithm;
+	return failure;
+}
+/**
+* Helper function to create a new Request for redirect handling.
+* @param request The original request.
+* @param location The redirect location.
+* @param body The request body as ArrayBuffer or null.
+* @returns A new Request object for the redirect.
+*/
+function createRedirectRequest(request, location, body) {
+	const url = new URL(location, request.url);
+	return new Request(url, {
+		method: request.method,
+		headers: request.headers,
+		body,
+		redirect: "manual",
+		signal: request.signal,
+		mode: request.mode,
+		credentials: request.credentials,
+		referrer: request.referrer,
+		referrerPolicy: request.referrerPolicy,
+		integrity: request.integrity,
+		keepalive: request.keepalive,
+		cache: request.cache
+	});
+}
+async function fetchDoubleKnockRequest(request, signedRequest, signal) {
+	const maxAttempts = request.method === "GET" || request.method === "HEAD" ? 2 : 1;
+	for (let attempt = 1;; attempt++) try {
+		return await fetch(signedRequest, {
+			redirect: "manual",
+			signal
+		});
+	} catch (error) {
+		const abortedSignal = getAbortedSignal(signal, request.signal, signedRequest.signal);
+		if (abortedSignal != null) throw getAbortReason(abortedSignal);
+		if (isAbortError(error)) throw error;
+		if (attempt >= maxAttempts) throw createFetchError(request.url, error);
+		await sleep(DOUBLE_KNOCK_TRANSPORT_RETRY_DELAY_MS, signal, request.signal, signedRequest.signal);
+	}
+}
+function createFetchError(url, cause) {
+	const error = new _fedify_vocab_runtime.FetchError(url, cause instanceof Error ? cause.message : String(cause));
+	error.cause = cause;
+	return error;
+}
+function isAbortError(error) {
+	return error instanceof Error && error.name === "AbortError";
+}
+async function sleep(ms, ...signals) {
+	const abortSignals = signals.filter((signal) => signal != null);
+	const abortedSignal = getAbortedSignal(...abortSignals);
+	if (abortedSignal != null) throw getAbortReason(abortedSignal);
+	if (abortSignals.length < 1) {
+		await new Promise((resolve) => setTimeout(resolve, ms));
+		return;
+	}
+	await new Promise((resolve, reject) => {
+		const removeAbortListeners = () => {
+			for (const signal of abortSignals) signal.removeEventListener("abort", handleAbort);
+		};
+		const timeout = setTimeout(() => {
+			removeAbortListeners();
+			resolve();
+		}, ms);
+		function handleAbort(event) {
+			clearTimeout(timeout);
+			removeAbortListeners();
+			reject(getAbortReason(event.currentTarget));
+		}
+		for (const signal of abortSignals) signal.addEventListener("abort", handleAbort, { once: true });
+	});
+}
+function getAbortedSignal(...signals) {
+	return signals.find((signal) => signal?.aborted);
+}
+function getAbortReason(signal) {
+	return signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
+}
+/**
+* Performs a double-knock request to the given URL.  For the details of
+* double-knocking, see
+* <https://swicg.github.io/activitypub-http-signature/#how-to-upgrade-supported-versions>.
+* @param request The request to send.
+* @param identity The identity to use for signing the request.
+* @param options The options for double-knock requests.
+* @returns The response to the request.
+* @since 1.6.0
+*/
+async function doubleKnock(request, identity, options = {}) {
+	return await doubleKnockInternal(request, identity, options);
+}
+async function doubleKnockInternal(request, identity, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
+	const { specDeterminer, log, tracerProvider, signal } = options;
+	const maximumRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
+	visited.add(request.url);
+	const origin = new URL(request.url).origin;
+	const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
+	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
+	let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+		spec: firstTrySpec,
+		tracerProvider,
+		body
+	});
+	log?.(signedRequest);
+	let response = await fetchDoubleKnockRequest(request, signedRequest, signal);
+	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+		if (redirected >= maximumRedirection) throw new _fedify_vocab_runtime.FetchError(request.url, `Too many redirections (${redirected + 1})`);
+		const redirectRequest = createRedirectRequest(request, response.headers.get("Location"), body);
+		if (visited.has(redirectRequest.url)) throw new _fedify_vocab_runtime.FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
+		return doubleKnockInternal(redirectRequest, identity, {
+			...options,
+			body
+		}, redirected + 1, visited);
+	} else if (response.status === 400 || response.status === 401 || response.status > 401) {
+		const logger = (0, _logtape_logtape.getLogger)([
+			"fedify",
+			"sig",
+			"http"
+		]);
+		const acceptSigHeader = response.headers.get("Accept-Signature");
+		if (acceptSigHeader != null) {
+			const entries = validateAcceptSignature(parseAcceptSignature(acceptSigHeader));
+			const localKeyId = identity.keyId.href;
+			const localAlg = "rsa-v1_5-sha256";
+			let fulfilled = false;
+			let challengeRequest;
+			for (const entry of entries) {
+				const rfc9421 = fulfillAcceptSignature(entry, localKeyId, localAlg);
+				if (rfc9421 == null) continue;
+				logger.debug("Received Accept-Signature challenge; accumulating label {label} and components {components}.", {
+					label: rfc9421.label,
+					components: rfc9421.components
+				});
+				try {
+					challengeRequest = await signRequest(challengeRequest ?? request, identity.privateKey, identity.keyId, {
+						spec: "rfc9421",
+						tracerProvider,
+						body,
+						rfc9421
+					});
+					fulfilled = true;
+				} catch (error) {
+					logger.debug("Failed to fulfill Accept-Signature challenge entry {label}: {error}", {
+						label: entry.label,
+						error
+					});
+				}
+			}
+			if (fulfilled && challengeRequest != null) {
+				signedRequest = challengeRequest;
+				log?.(signedRequest);
+				response = await fetch(signedRequest, {
+					redirect: "manual",
+					signal
+				});
+				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) return doubleKnock(createRedirectRequest(request, response.headers.get("Location"), body), identity, {
+					...options,
+					body
+				});
+			}
+			if (fulfilled && response.status < 300) {
+				await specDeterminer?.rememberSpec(origin, "rfc9421");
+				return response;
+			}
+			if (fulfilled && response.status !== 400 && response.status !== 401) return response;
+		}
+		const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
+		logger.debug("Failed to verify with the spec {spec} ({status} {statusText}); retrying with spec {secondSpec}... (double-knocking)", {
+			spec: firstTrySpec,
+			secondSpec: spec,
+			status: response.status,
+			statusText: response.statusText
+		});
+		signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+			spec,
+			tracerProvider,
+			body
+		});
+		log?.(signedRequest);
+		response = await fetchDoubleKnockRequest(request, signedRequest, signal);
+		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+			if (redirected >= maximumRedirection) throw new _fedify_vocab_runtime.FetchError(request.url, `Too many redirections (${redirected + 1})`);
+			const redirectRequest = createRedirectRequest(request, response.headers.get("Location"), body);
+			if (visited.has(redirectRequest.url)) throw new _fedify_vocab_runtime.FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
+			return doubleKnockInternal(redirectRequest, identity, {
+				...options,
+				body
+			}, redirected + 1, visited);
+		} else if (response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
+	} else await specDeterminer?.rememberSpec(origin, firstTrySpec);
+	return response;
+}
+/**
+* Performs a timing-safe equality comparison between two `Uint8Array` values.
+*
+* This function is designed to take a constant amount of time to execute,
+* dependent only on the length of the longer of the two arrays,
+* regardless of where the first difference in bytes occurs. This helps
+* prevent timing attacks.
+*
+* @param a The first bytes.
+* @param b The second bytes.
+* @returns `true` if the arrays are of the same length and contain the same
+*          bytes, `false` otherwise.
+* @since 1.6.0
+*/
+function timingSafeEqual(a, b) {
+	const lenA = a.length;
+	const lenB = b.length;
+	const commonLength = Math.max(lenA, lenB);
+	let result = 0;
+	for (let i = 0; i < commonLength; i++) {
+		const byteA = i < lenA ? a[i] : 0;
+		const byteB = i < lenB ? b[i] : 0;
+		result |= byteA ^ byteB;
+	}
+	result |= lenA ^ lenB;
+	return result === 0;
+}
+//#endregion
 Object.defineProperty(exports, "Temporal", {
 	enumerable: true,
 	get: function() {
-		return Temporal;
+		return Temporal$1;
+	}
+});
+Object.defineProperty(exports, "doubleKnock", {
+	enumerable: true,
+	get: function() {
+		return doubleKnock;
+	}
+});
+Object.defineProperty(exports, "exportJwk", {
+	enumerable: true,
+	get: function() {
+		return exportJwk;
+	}
+});
+Object.defineProperty(exports, "fetchKey", {
+	enumerable: true,
+	get: function() {
+		return fetchKey;
+	}
+});
+Object.defineProperty(exports, "fetchKeyDetailed", {
+	enumerable: true,
+	get: function() {
+		return fetchKeyDetailed;
+	}
+});
+Object.defineProperty(exports, "formatAcceptSignature", {
+	enumerable: true,
+	get: function() {
+		return formatAcceptSignature;
+	}
+});
+Object.defineProperty(exports, "fulfillAcceptSignature", {
+	enumerable: true,
+	get: function() {
+		return fulfillAcceptSignature;
+	}
+});
+Object.defineProperty(exports, "generateCryptoKeyPair", {
+	enumerable: true,
+	get: function() {
+		return generateCryptoKeyPair;
+	}
+});
+Object.defineProperty(exports, "getDurationMs", {
+	enumerable: true,
+	get: function() {
+		return getDurationMs;
+	}
+});
+Object.defineProperty(exports, "getFederationMetrics", {
+	enumerable: true,
+	get: function() {
+		return getFederationMetrics;
+	}
+});
+Object.defineProperty(exports, "getRemoteHost", {
+	enumerable: true,
+	get: function() {
+		return getRemoteHost;
+	}
+});
+Object.defineProperty(exports, "importJwk", {
+	enumerable: true,
+	get: function() {
+		return importJwk;
+	}
+});
+Object.defineProperty(exports, "instrumentDocumentLoader", {
+	enumerable: true,
+	get: function() {
+		return instrumentDocumentLoader;
+	}
+});
+Object.defineProperty(exports, "isAbortError", {
+	enumerable: true,
+	get: function() {
+		return isAbortError$1;
+	}
+});
+Object.defineProperty(exports, "measureSignatureKeyFetch", {
+	enumerable: true,
+	get: function() {
+		return measureSignatureKeyFetch;
+	}
+});
+Object.defineProperty(exports, "name", {
+	enumerable: true,
+	get: function() {
+		return name;
+	}
+});
+Object.defineProperty(exports, "parseAcceptSignature", {
+	enumerable: true,
+	get: function() {
+		return parseAcceptSignature;
+	}
+});
+Object.defineProperty(exports, "parseRfc9421SignatureInput", {
+	enumerable: true,
+	get: function() {
+		return parseRfc9421SignatureInput;
+	}
+});
+Object.defineProperty(exports, "recordCircuitBreakerStateChange", {
+	enumerable: true,
+	get: function() {
+		return recordCircuitBreakerStateChange;
+	}
+});
+Object.defineProperty(exports, "recordCollectionDispatchDuration", {
+	enumerable: true,
+	get: function() {
+		return recordCollectionDispatchDuration;
+	}
+});
+Object.defineProperty(exports, "recordCollectionPageItems", {
+	enumerable: true,
+	get: function() {
+		return recordCollectionPageItems;
+	}
+});
+Object.defineProperty(exports, "recordCollectionRequest", {
+	enumerable: true,
+	get: function() {
+		return recordCollectionRequest;
+	}
+});
+Object.defineProperty(exports, "recordCollectionTotalItems", {
+	enumerable: true,
+	get: function() {
+		return recordCollectionTotalItems;
+	}
+});
+Object.defineProperty(exports, "recordDocumentCache", {
+	enumerable: true,
+	get: function() {
+		return recordDocumentCache;
+	}
+});
+Object.defineProperty(exports, "recordFanoutRecipients", {
+	enumerable: true,
+	get: function() {
+		return recordFanoutRecipients;
+	}
+});
+Object.defineProperty(exports, "recordInboxActivity", {
+	enumerable: true,
+	get: function() {
+		return recordInboxActivity;
+	}
+});
+Object.defineProperty(exports, "recordOutboxActivity", {
+	enumerable: true,
+	get: function() {
+		return recordOutboxActivity;
+	}
+});
+Object.defineProperty(exports, "recordOutboxEnqueue", {
+	enumerable: true,
+	get: function() {
+		return recordOutboxEnqueue;
+	}
+});
+Object.defineProperty(exports, "recordWebFingerHandle", {
+	enumerable: true,
+	get: function() {
+		return recordWebFingerHandle;
+	}
+});
+Object.defineProperty(exports, "registerQueueDepthGauge", {
+	enumerable: true,
+	get: function() {
+		return registerQueueDepthGauge;
+	}
+});
+Object.defineProperty(exports, "signRequest", {
+	enumerable: true,
+	get: function() {
+		return signRequest;
+	}
+});
+Object.defineProperty(exports, "validateAcceptSignature", {
+	enumerable: true,
+	get: function() {
+		return validateAcceptSignature;
+	}
+});
+Object.defineProperty(exports, "validateCryptoKey", {
+	enumerable: true,
+	get: function() {
+		return validateCryptoKey;
+	}
+});
+Object.defineProperty(exports, "verifyRequest", {
+	enumerable: true,
+	get: function() {
+		return verifyRequest;
+	}
+});
+Object.defineProperty(exports, "verifyRequestDetailed", {
+	enumerable: true,
+	get: function() {
+		return verifyRequestDetailed;
+	}
+});
+Object.defineProperty(exports, "version", {
+	enumerable: true,
+	get: function() {
+		return version;
 	}
 });