@fedify/fedify 2.4.0-dev.1668 → 2.4.0-dev.1740

package/dist/http-BpT5cE6r.cjs

@@ -1,2694 +0,0 @@
-const { URLPattern } = require("urlpattern-polyfill");
-require("./chunk-Czpeue4M.cjs");
-const require_temporal_polyfill = require("./temporal-polyfill-BCdTHexd.cjs");
-let _logtape_logtape = require("@logtape/logtape");
-let _fedify_vocab = require("@fedify/vocab");
-let _opentelemetry_api = require("@opentelemetry/api");
-let byte_encodings_hex = require("byte-encodings/hex");
-let structured_field_values = require("structured-field-values");
-let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
-let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
-let byte_encodings_base64 = require("byte-encodings/base64");
-//#region deno.json
-var name = "@fedify/fedify";
-var version = "2.4.0-dev.1668+90797b01";
-//#endregion
-//#region src/sig/accept.ts
-/**
-* `Accept-Signature` header parsing, serialization, and validation utilities
-* for RFC 9421 §5 challenge-response negotiation.
-*
-* @module
-*/
-/**
-* Parses an `Accept-Signature` header value (RFC 9421 §5.1) into an
-* array of {@link AcceptSignatureMember} objects.
-*
-* The `Accept-Signature` field is a Dictionary Structured Field
-* (RFC 8941 §3.2).  Each dictionary member describes a single
-* requested message signature.
-*
-* On parse failure (malformed or empty header), returns an empty array.
-*
-* @param header The raw `Accept-Signature` header value string.
-* @returns An array of parsed members.  Empty if the header is
-*          malformed or empty.
-* @since 2.1.0
-*/
-function parseAcceptSignature(header) {
-	try {
-		return parseEachSignature((0, structured_field_values.decodeDict)(header));
-	} catch {
-		(0, _logtape_logtape.getLogger)([
-			"fedify",
-			"sig",
-			"http"
-		]).warn("Failed to parse Accept-Signature header: {header}", { header });
-		return [];
-	}
-}
-const compactObject = (obj) => Object.fromEntries(Object.entries(obj).filter(([_, v]) => v !== void 0));
-const parseEachSignature = (dict) => Object.entries(dict).filter(([_, item]) => Array.isArray(item.value)).map(([label, item]) => ({
-	label,
-	components: item.value.filter((subitem) => typeof subitem.value === "string").map((subitem) => ({
-		value: subitem.value,
-		params: subitem.params ?? {}
-	})),
-	parameters: compactParams(item)
-}));
-const compactParams = (item) => {
-	const { keyid, alg, created, expires, nonce, tag } = item.params ?? {};
-	return compactObject({
-		keyid: stringOrUndefined(keyid),
-		alg: stringOrUndefined(alg),
-		created: trueOrUndefined(created),
-		expires: trueOrUndefined(expires),
-		nonce: stringOrUndefined(nonce),
-		tag: stringOrUndefined(tag)
-	});
-};
-const stringOrUndefined = (v) => typeof v === "string" ? v : void 0;
-const trueOrUndefined = (v) => v === true ? true : void 0;
-/**
-* Serializes an array of {@link AcceptSignatureMember} objects into an
-* `Accept-Signature` header value string (RFC 9421 §5.1).
-*
-* The output is a Dictionary Structured Field (RFC 8941 §3.2).
-*
-* @param members The members to serialize.
-* @returns The serialized header value string.
-* @since 2.1.0
-*/
-function formatAcceptSignature(members) {
-	const items = members.map((member) => [member.label, new structured_field_values.Item(compToItems(member), compactParameters(member))]);
-	return (0, structured_field_values.encodeDict)(Object.fromEntries(items));
-}
-const compToItems = (member) => member.components.map((c) => new structured_field_values.Item(c.value, c.params));
-const compactParameters = (member) => {
-	const { keyid, alg, created, expires, nonce, tag } = member.parameters;
-	return compactObject({
-		keyid,
-		alg,
-		created,
-		expires,
-		nonce,
-		tag
-	});
-};
-/**
-* Filters out {@link AcceptSignatureMember} entries whose covered
-* components include response-only identifiers (`@status`) that are
-* not applicable to request-target messages, as required by
-* [RFC 9421 §5](https://www.rfc-editor.org/rfc/rfc9421#section-5).
-*
-* A warning is logged for each discarded entry.
-*
-* @param members The parsed `Accept-Signature` entries to validate.
-* @returns Only entries that are valid for request-target messages.
-* @since 2.1.0
-*/
-function validateAcceptSignature(members) {
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"sig",
-		"http"
-	]);
-	return members.filter((member) => {
-		if (member.components.every((c) => c.value !== "@status")) return true;
-		logLabel(logger, member.label);
-		return false;
-	});
-}
-const logLabel = (logger, label) => logger.warn("Discarding Accept-Signature member {label}: covered components include response-only identifier @status.", { label });
-/**
-* Attempts to translate an {@link AcceptSignatureMember} challenge into
-* RFC 9421 signing options that the local signer can fulfill.
-*
-* Returns `null` if the challenge cannot be fulfilled—for example, if
-* the requested `alg` or `keyid` is incompatible with the local key.
-*
-* Safety constraints:
-* - `alg`: only honored if it matches `localAlg`.
-* - `keyid`: only honored if it matches `localKeyId`.
-* - `components`: passed through exactly as requested, per RFC 9421 §5.2.
-* - `nonce`, `tag`, and `expires` are passed through directly.
-*
-* @param entry The challenge entry from the `Accept-Signature` header.
-* @param localKeyId The local key identifier (e.g., the actor key URL).
-* @param localAlg The algorithm of the local private key
-*                 (e.g., `"rsa-v1_5-sha256"`).
-* @returns Signing options if the challenge can be fulfilled, or `null`.
-* @since 2.1.0
-*/
-function fulfillAcceptSignature(entry, localKeyId, localAlg) {
-	if (entry.parameters.alg != null && entry.parameters.alg !== localAlg) return null;
-	if (entry.parameters.keyid != null && entry.parameters.keyid !== localKeyId) return null;
-	return {
-		label: entry.label,
-		components: entry.components,
-		nonce: entry.parameters.nonce,
-		tag: entry.parameters.tag,
-		expires: entry.parameters.expires
-	};
-}
-//#endregion
-//#region src/federation/metrics.ts
-var FederationMetrics = class {
-	deliverySent;
-	deliveryPermanentFailure;
-	signatureVerificationFailure;
-	signatureVerificationDuration;
-	signatureKeyFetchDuration;
-	deliveryDuration;
-	inboxProcessingDuration;
-	httpServerRequestCount;
-	httpServerRequestDuration;
-	queueTaskEnqueued;
-	queueTaskStarted;
-	queueTaskCompleted;
-	queueTaskFailed;
-	queueTaskDuration;
-	queueTaskInFlight;
-	queueDepth;
-	fanoutRecipients;
-	inboxActivity;
-	outboxActivity;
-	circuitBreakerStateChange;
-	keyLookup;
-	keyLookupDuration;
-	documentFetch;
-	documentFetchDuration;
-	documentCache;
-	webFingerHandle;
-	webFingerHandleDuration;
-	collectionRequest;
-	collectionDispatchDuration;
-	collectionPageItems;
-	collectionTotalItems;
-	constructor(meterProvider) {
-		const meter = meterProvider.getMeter(name, version);
-		this.deliverySent = meter.createCounter("activitypub.delivery.sent", {
-			description: "ActivityPub delivery attempts.",
-			unit: "{attempt}"
-		});
-		this.deliveryPermanentFailure = meter.createCounter("activitypub.delivery.permanent_failure", {
-			description: "ActivityPub deliveries abandoned as permanent failures.",
-			unit: "{failure}"
-		});
-		this.signatureVerificationFailure = meter.createCounter("activitypub.signature.verification_failure", {
-			description: "ActivityPub signature verification failures.",
-			unit: "{failure}"
-		});
-		this.signatureVerificationDuration = meter.createHistogram("activitypub.signature.verification.duration", {
-			description: "Duration of ActivityPub signature verification, including local key lookup and remote key fetches.",
-			unit: "ms",
-			advice: { explicitBucketBoundaries: [
-				.1,
-				.25,
-				.5,
-				1,
-				2.5,
-				5,
-				10,
-				25,
-				50,
-				100,
-				250,
-				500,
-				1e3
-			] }
-		});
-		this.signatureKeyFetchDuration = meter.createHistogram("activitypub.signature.key_fetch.duration", {
-			description: "Duration of public key lookup performed during ActivityPub signature verification.",
-			unit: "ms"
-		});
-		this.deliveryDuration = meter.createHistogram("activitypub.delivery.duration", {
-			description: "Duration of ActivityPub delivery attempts.",
-			unit: "ms"
-		});
-		this.inboxProcessingDuration = meter.createHistogram("activitypub.inbox.processing_duration", {
-			description: "Duration of ActivityPub inbox listener processing.",
-			unit: "ms"
-		});
-		this.httpServerRequestCount = meter.createCounter("fedify.http.server.request.count", {
-			description: "HTTP requests handled by Federation.fetch().",
-			unit: "{request}"
-		});
-		this.httpServerRequestDuration = meter.createHistogram("fedify.http.server.request.duration", {
-			description: "Duration of HTTP requests handled by Federation.fetch().",
-			unit: "ms",
-			advice: { explicitBucketBoundaries: [
-				5,
-				10,
-				25,
-				50,
-				75,
-				100,
-				250,
-				500,
-				750,
-				1e3,
-				2500,
-				5e3,
-				7500,
-				1e4
-			] }
-		});
-		this.queueTaskEnqueued = meter.createCounter("fedify.queue.task.enqueued", {
-			description: "Tasks Fedify enqueued for inbox, outbox, or fanout work.",
-			unit: "{task}"
-		});
-		this.queueTaskStarted = meter.createCounter("fedify.queue.task.started", {
-			description: "Tasks Fedify began processing as a queue worker.",
-			unit: "{task}"
-		});
-		this.queueTaskCompleted = meter.createCounter("fedify.queue.task.completed", {
-			description: "Queue tasks Fedify finished processing without throwing.",
-			unit: "{task}"
-		});
-		this.queueTaskFailed = meter.createCounter("fedify.queue.task.failed", {
-			description: "Queue tasks Fedify abandoned because processing threw.",
-			unit: "{task}"
-		});
-		this.queueTaskDuration = meter.createHistogram("fedify.queue.task.duration", {
-			description: "Duration of queue task processing in Fedify workers.",
-			unit: "ms",
-			advice: { explicitBucketBoundaries: [
-				5,
-				10,
-				25,
-				50,
-				75,
-				100,
-				250,
-				500,
-				750,
-				1e3,
-				2500,
-				5e3,
-				7500,
-				1e4
-			] }
-		});
-		this.queueTaskInFlight = meter.createUpDownCounter("fedify.queue.task.in_flight", {
-			description: "Queue tasks currently being processed in this Fedify process.",
-			unit: "{task}"
-		});
-		this.queueDepth = meter.createObservableGauge("fedify.queue.depth", {
-			description: "Messages waiting in configured Fedify queues, as reported by the queue backend.",
-			unit: "{message}"
-		});
-		this.fanoutRecipients = meter.createHistogram("activitypub.fanout.recipients", {
-			description: "Number of recipient inboxes produced by an ActivityPub fanout task.",
-			unit: "{recipient}"
-		});
-		this.inboxActivity = meter.createCounter("activitypub.inbox.activity", {
-			description: "ActivityPub activities observed at the inbox lifecycle level: queued, processed, retried, rejected, or abandoned.",
-			unit: "{activity}"
-		});
-		this.outboxActivity = meter.createCounter("activitypub.outbox.activity", {
-			description: "ActivityPub activities observed at the outbox lifecycle level: queued, retried, or abandoned.  Per-recipient delivery counters live on `activitypub.delivery.*`.",
-			unit: "{activity}"
-		});
-		this.circuitBreakerStateChange = meter.createCounter("activitypub.circuit_breaker.state_change", {
-			description: "Outbound ActivityPub delivery circuit breaker changes.",
-			unit: "{change}"
-		});
-		this.keyLookup = meter.createCounter("activitypub.key.lookup", {
-			description: "Public-key lookup attempts performed by Fedify, including cache hits, local resolutions, and remote fetches.",
-			unit: "{lookup}"
-		});
-		this.keyLookupDuration = meter.createHistogram("activitypub.key.lookup.duration", {
-			description: "Duration of public-key lookups performed by Fedify, including cache hits, local resolutions, and any remote fetch.",
-			unit: "ms",
-			advice: { explicitBucketBoundaries: [
-				5,
-				10,
-				25,
-				50,
-				75,
-				100,
-				250,
-				500,
-				750,
-				1e3,
-				2500,
-				5e3,
-				7500,
-				1e4
-			] }
-		});
-		this.documentFetch = meter.createCounter("activitypub.document.fetch", {
-			description: "Remote JSON-LD document loader invocations made by Fedify-wrapped loaders.",
-			unit: "{fetch}"
-		});
-		this.documentFetchDuration = meter.createHistogram("activitypub.document.fetch.duration", {
-			description: "Duration of remote JSON-LD document loader invocations made by Fedify-wrapped loaders.",
-			unit: "ms",
-			advice: { explicitBucketBoundaries: [
-				5,
-				10,
-				25,
-				50,
-				75,
-				100,
-				250,
-				500,
-				750,
-				1e3,
-				2500,
-				5e3,
-				7500,
-				1e4
-			] }
-		});
-		this.documentCache = meter.createCounter("activitypub.document.cache", {
-			description: "KV-backed document loader cache lookups, with `hit` or `miss` classification.",
-			unit: "{lookup}"
-		});
-		this.webFingerHandle = meter.createCounter("webfinger.handle", {
-			description: "Incoming WebFinger requests handled by Fedify, classified by terminal outcome.",
-			unit: "{request}"
-		});
-		this.webFingerHandleDuration = meter.createHistogram("webfinger.handle.duration", {
-			description: "Duration of incoming WebFinger request handling in Fedify.",
-			unit: "ms",
-			advice: { explicitBucketBoundaries: [
-				5,
-				10,
-				25,
-				50,
-				75,
-				100,
-				250,
-				500,
-				750,
-				1e3,
-				2500,
-				5e3,
-				7500,
-				1e4
-			] }
-		});
-		this.collectionRequest = meter.createCounter("activitypub.collection.request", {
-			description: "ActivityPub collection and collection-page requests handled by Fedify.",
-			unit: "{request}"
-		});
-		this.collectionDispatchDuration = meter.createHistogram("activitypub.collection.dispatch.duration", {
-			description: "Duration of ActivityPub collection dispatcher callbacks.",
-			unit: "ms",
-			advice: { explicitBucketBoundaries: [
-				5,
-				10,
-				25,
-				50,
-				75,
-				100,
-				250,
-				500,
-				750,
-				1e3,
-				2500,
-				5e3,
-				7500,
-				1e4
-			] }
-		});
-		this.collectionPageItems = meter.createHistogram("activitypub.collection.page.items", {
-			description: "Number of items Fedify materialized for an ActivityPub collection response.",
-			unit: "{item}"
-		});
-		this.collectionTotalItems = meter.createHistogram("activitypub.collection.total_items", {
-			description: "Total item count reported by ActivityPub collection counters.",
-			unit: "{item}"
-		});
-	}
-	recordDelivery(inbox, durationMs, success, activityType) {
-		const deliveryAttributes = {
-			"activitypub.remote.host": getRemoteHost(inbox),
-			"activitypub.delivery.success": success
-		};
-		if (activityType != null) deliveryAttributes["activitypub.activity.type"] = activityType;
-		this.deliverySent.add(1, deliveryAttributes);
-		this.deliveryDuration.record(durationMs, deliveryAttributes);
-	}
-	recordPermanentFailure(inbox, statusCode) {
-		this.deliveryPermanentFailure.add(1, {
-			"activitypub.remote.host": getRemoteHost(inbox),
-			"http.response.status_code": statusCode
-		});
-	}
-	recordSignatureVerificationFailure(reason, remoteHost) {
-		const attributes = { "activitypub.verification.failure_reason": reason };
-		if (remoteHost != null) attributes["activitypub.remote.host"] = remoteHost;
-		this.signatureVerificationFailure.add(1, attributes);
-	}
-	recordSignatureVerificationDuration(durationMs, kind, result, extra = {}) {
-		const attributes = {
-			"activitypub.signature.kind": kind,
-			"activitypub.signature.result": result
-		};
-		if (extra.algorithm != null) attributes["http_signatures.algorithm"] = extra.algorithm;
-		if (extra.failureReason != null) attributes["http_signatures.failure_reason"] = extra.failureReason;
-		if (extra.ldType != null) attributes["ld_signatures.type"] = extra.ldType;
-		if (extra.cryptosuite != null) attributes["object_integrity_proofs.cryptosuite"] = extra.cryptosuite;
-		this.signatureVerificationDuration.record(durationMs, attributes);
-	}
-	recordSignatureKeyFetchDuration(durationMs, kind, result) {
-		this.signatureKeyFetchDuration.record(durationMs, {
-			"activitypub.signature.kind": kind,
-			"activitypub.signature.key_fetch.result": result
-		});
-	}
-	recordInboxProcessingDuration(activityType, durationMs) {
-		this.inboxProcessingDuration.record(durationMs, { "activitypub.activity.type": activityType });
-	}
-	recordHttpServerRequest(method, endpoint, durationMs, options = {}) {
-		const attributes = {
-			"http.request.method": normalizeHttpMethod(method),
-			"fedify.endpoint": endpoint
-		};
-		if (options.statusCode != null) attributes["http.response.status_code"] = options.statusCode;
-		if (options.routeTemplate != null) attributes["fedify.route.template"] = options.routeTemplate;
-		this.httpServerRequestCount.add(1, attributes);
-		this.httpServerRequestDuration.record(durationMs, attributes);
-	}
-	recordQueueTaskEnqueued(common, attempt, count = 1) {
-		const attributes = buildQueueTaskAttributes(common);
-		attributes["fedify.queue.task.attempt"] = attempt;
-		this.queueTaskEnqueued.add(count, attributes);
-	}
-	recordQueueTaskStarted(common) {
-		this.queueTaskStarted.add(1, buildQueueTaskAttributes(common));
-	}
-	incrementQueueTaskInFlight(common) {
-		this.queueTaskInFlight.add(1, buildQueueTaskInFlightAttributes(common));
-	}
-	decrementQueueTaskInFlight(common) {
-		this.queueTaskInFlight.add(-1, buildQueueTaskInFlightAttributes(common));
-	}
-	recordQueueTaskOutcome(common, result, durationMs, failureReason) {
-		const attributes = buildQueueTaskAttributes(common);
-		attributes["fedify.queue.task.result"] = result;
-		if (failureReason != null && result === "failed") attributes["fedify.task.failure_reason"] = failureReason;
-		if (result === "completed") this.queueTaskCompleted.add(1, attributes);
-		else if (result === "failed") this.queueTaskFailed.add(1, attributes);
-		this.queueTaskDuration.record(durationMs, attributes);
-	}
-	recordFanoutRecipients(recipientCount, activityType) {
-		const attributes = {};
-		if (activityType != null) attributes["activitypub.activity.type"] = activityType;
-		this.fanoutRecipients.record(recipientCount, attributes);
-	}
-	recordInboxActivity(result, activityType) {
-		this.inboxActivity.add(1, buildActivityLifecycleAttributes(result, activityType));
-	}
-	recordOutboxActivity(result, activityType) {
-		this.outboxActivity.add(1, buildActivityLifecycleAttributes(result, activityType));
-	}
-	recordCircuitBreakerStateChange(remoteHost, state) {
-		this.circuitBreakerStateChange.add(1, {
-			"activitypub.remote.host": remoteHost,
-			"activitypub.circuit_breaker.state": state
-		});
-	}
-	recordKeyLookup(attrs) {
-		const attributes = {
-			"activitypub.lookup.kind": "public_key",
-			"activitypub.lookup.result": attrs.result,
-			"activitypub.cache.enabled": attrs.cacheEnabled
-		};
-		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
-		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
-		this.keyLookup.add(1, attributes);
-		this.keyLookupDuration.record(attrs.durationMs, attributes);
-	}
-	recordDocumentFetch(attrs) {
-		const attributes = {
-			"activitypub.lookup.kind": attrs.kind,
-			"activitypub.lookup.result": attrs.result
-		};
-		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
-		if (attrs.cacheEnabled != null) attributes["activitypub.cache.enabled"] = attrs.cacheEnabled;
-		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
-		this.documentFetch.add(1, attributes);
-		this.documentFetchDuration.record(attrs.durationMs, attributes);
-	}
-	recordDocumentCache(attrs) {
-		const attributes = {
-			"activitypub.lookup.kind": attrs.kind,
-			"activitypub.lookup.result": attrs.result
-		};
-		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
-		this.documentCache.add(1, attributes);
-	}
-	recordWebFingerHandle(attrs) {
-		const attributes = { "webfinger.handle.result": attrs.result };
-		if (attrs.scheme != null) attributes["webfinger.resource.scheme"] = attrs.scheme;
-		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
-		this.webFingerHandle.add(1, attributes);
-		this.webFingerHandleDuration.record(attrs.durationMs, attributes);
-	}
-	recordCollectionRequest(attrs) {
-		this.collectionRequest.add(1, buildCollectionAttributes(attrs));
-	}
-	recordCollectionDispatchDuration(durationMs, attrs) {
-		this.collectionDispatchDuration.record(durationMs, buildCollectionAttributes(attrs));
-	}
-	recordCollectionPageItems(itemCount, attrs) {
-		this.collectionPageItems.record(itemCount, buildCollectionAttributes(attrs));
-	}
-	recordCollectionTotalItems(totalItems, attrs) {
-		this.collectionTotalItems.record(totalItems, buildCollectionAttributes(attrs));
-	}
-};
-function buildCollectionAttributes(attrs) {
-	const attributes = {
-		"activitypub.collection.kind": attrs.kind,
-		"activitypub.collection.page": attrs.page,
-		"activitypub.collection.result": attrs.result,
-		"fedify.collection.dispatcher": attrs.dispatcher
-	};
-	if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
-	return attributes;
-}
-function buildActivityLifecycleAttributes(result, activityType) {
-	const attributes = { "activitypub.processing.result": result };
-	if (activityType != null) attributes["activitypub.activity.type"] = activityType;
-	return attributes;
-}
-function buildQueueTaskAttributes(common) {
-	const attributes = { "fedify.queue.role": common.role };
-	const backend = getQueueBackend(common.queue);
-	if (backend != null) attributes["fedify.queue.backend"] = backend;
-	const nativeRetrial = common.queue?.nativeRetrial;
-	if (typeof nativeRetrial === "boolean") attributes["fedify.queue.native_retrial"] = nativeRetrial;
-	if (common.activityType != null) attributes["activitypub.activity.type"] = common.activityType;
-	if (common.taskName != null) attributes["fedify.task.name"] = common.taskName;
-	return attributes;
-}
-function buildQueueTaskInFlightAttributes(common) {
-	return buildQueueTaskAttributes({
-		role: common.role,
-		queue: common.queue
-	});
-}
-/**
-* Returns the constructor name of the given message queue, when it is a
-* meaningful identifier.  Used as a best-effort `fedify.queue.backend`
-* attribute on queue task metrics; returns `undefined` for plain object
-* literals (whose constructor is `Object`) so the attribute does not appear
-* with a non-informative value.
-* @since 2.3.0
-*/
-function getQueueBackend(queue) {
-	const name = queue?.constructor?.name;
-	if (name == null || name === "" || name === "Object") return void 0;
-	return name;
-}
-/**
-* Registers a callback for observing queue backend depth.
-* @since 2.3.0
-*/
-function registerQueueDepthGauge(meterProvider, entries, options = {}) {
-	const uniqueQueues = /* @__PURE__ */ new Map();
-	for (const { role, queue } of entries) {
-		if (queue?.getDepth == null) continue;
-		const roles = uniqueQueues.get(queue);
-		if (roles == null) uniqueQueues.set(queue, [role]);
-		else if (!roles.includes(role)) roles.push(role);
-	}
-	if (uniqueQueues.size < 1) return;
-	const queueEntries = Array.from(uniqueQueues.entries());
-	getFederationMetrics(meterProvider).queueDepth.addCallback(async (observableResult) => {
-		await Promise.all(queueEntries.map(async ([queue, roles]) => {
-			let depth;
-			try {
-				depth = await queue.getDepth();
-			} catch {
-				return;
-			}
-			if (depth == null) return;
-			const attributes = buildQueueDepthAttributes(queue, roles, options);
-			observableResult.observe(depth.queued, {
-				...attributes,
-				"fedify.queue.depth.state": "queued"
-			});
-			if (depth.ready != null) observableResult.observe(depth.ready, {
-				...attributes,
-				"fedify.queue.depth.state": "ready"
-			});
-			if (depth.delayed != null) observableResult.observe(depth.delayed, {
-				...attributes,
-				"fedify.queue.depth.state": "delayed"
-			});
-		}));
-	});
-}
-function buildQueueDepthAttributes(queue, roles, options) {
-	const sortedRoles = roles.toSorted();
-	const role = sortedRoles.length === 1 ? sortedRoles[0] : "shared";
-	const attributes = { "fedify.queue.role": role };
-	if (options.sourceId != null) attributes["fedify.federation.instance_id"] = options.sourceId;
-	if (role === "shared") attributes["fedify.queue.roles"] = sortedRoles.join(",");
-	const backend = getQueueBackend(queue);
-	if (backend != null) attributes["fedify.queue.backend"] = backend;
-	const nativeRetrial = queue.nativeRetrial;
-	if (typeof nativeRetrial === "boolean") attributes["fedify.queue.native_retrial"] = nativeRetrial;
-	return attributes;
-}
-/**
-* Records `fedify.queue.task.enqueued` for an outgoing outbox enqueue and,
-* for the initial attempt, also records
-* `activitypub.outbox.activity{queued}`.
-*
-* Both `Context.sendActivity()` and `OutboxContext.forwardActivity()` enqueue
-* outbox messages with the same metric attributes (role, queue, activity
-* type, attempt), so they share this helper rather than each defining a local
-* closure.  Retry enqueues (attempt > 0) intentionally do not record a
-* second `activitypub.outbox.activity{queued}`; retries are reported as
-* `result=retried` from the retry-scheduling site, which has the failure
-* context.
-* @since 2.3.0
-*/
-function recordOutboxEnqueue(meterProvider, outboxQueue, message) {
-	const metrics = getFederationMetrics(meterProvider);
-	metrics.recordQueueTaskEnqueued({
-		role: "outbox",
-		queue: outboxQueue,
-		activityType: message.activityType
-	}, message.attempt);
-	if (message.attempt === 0) metrics.recordOutboxActivity("queued", message.activityType);
-}
-/**
-* Records `activitypub.fanout.recipients` with the number of recipient
-* inboxes a single fanout produced.  The histogram is unitless count
-* (one measurement per fanout enqueue).  Recipient URLs are deliberately
-* not recorded; only the activity type, when known.
-* @since 2.3.0
-*/
-function recordFanoutRecipients(meterProvider, recipientCount, activityType) {
-	getFederationMetrics(meterProvider).recordFanoutRecipients(recipientCount, activityType);
-}
-/**
-* Records one `activitypub.inbox.activity` measurement.  The
-* `activitypub.processing.result` attribute is always present;
-* `activitypub.activity.type` is recorded only when Fedify already knows
-* the activity type.
-* @since 2.3.0
-*/
-function recordInboxActivity(meterProvider, result, activityType) {
-	getFederationMetrics(meterProvider).recordInboxActivity(result, activityType);
-}
-/**
-* Records one `activitypub.outbox.activity` measurement.  The
-* `activitypub.processing.result` attribute is always present;
-* `activitypub.activity.type` is recorded only when Fedify already knows
-* the activity type (it is always known for outbox lifecycle events).
-* @since 2.3.0
-*/
-function recordOutboxActivity(meterProvider, result, activityType) {
-	getFederationMetrics(meterProvider).recordOutboxActivity(result, activityType);
-}
-/**
-* Records one outbound delivery circuit breaker state transition.
-* @since 2.3.0
-*/
-function recordCircuitBreakerStateChange(meterProvider, remoteHost, state) {
-	getFederationMetrics(meterProvider).recordCircuitBreakerStateChange(remoteHost, state);
-}
-/**
-* Records one measurement on `activitypub.key.lookup` (counter) and
-* `activitypub.key.lookup.duration` (histogram) for a public-key lookup.
-*
-* `activitypub.lookup.kind` is always recorded as `public_key`; the result
-* classification, remote host, HTTP status code (when an HTTP response was
-* received), and `activitypub.cache.enabled` are recorded as attributes on
-* both measurements.  Full key URLs and key IDs are deliberately omitted to
-* keep cardinality bounded.
-* @since 2.3.0
-*/
-function recordKeyLookup(meterProvider, attrs) {
-	getFederationMetrics(meterProvider).recordKeyLookup(attrs);
-}
-/**
-* Records one measurement each on `activitypub.document.fetch` (counter)
-* and `activitypub.document.fetch.duration` (histogram) for one remote
-* JSON-LD document loader invocation, with bounded
-* `activitypub.lookup.kind` and `activitypub.lookup.result` attributes
-* plus the optional remote-host, cache-enabled, and HTTP status-code
-* attributes.  Counter and histogram are always recorded together so
-* aggregate rate and latency views stay in sync.
-* @since 2.3.0
-*/
-function recordDocumentFetch(meterProvider, attrs) {
-	getFederationMetrics(meterProvider).recordDocumentFetch(attrs);
-}
-/**
-* Records one `activitypub.document.cache` measurement, classifying the
-* lookup as `hit` (the cache returned an entry) or `miss` (the cache was
-* consulted and returned nothing, prompting a delegate fetch).
-* @since 2.3.0
-*/
-function recordDocumentCache(meterProvider, attrs) {
-	getFederationMetrics(meterProvider).recordDocumentCache(attrs);
-}
-/**
-* Records one measurement on `webfinger.handle` (counter) and
-* `webfinger.handle.duration` (histogram) for an incoming WebFinger
-* request handled by Fedify.  Counter and histogram are always recorded
-* together, with `webfinger.handle.result` set to one of `resolved`,
-* `invalid`, `not_found`, `tombstoned`, or `error`.  The queried
-* resource string is deliberately excluded; it remains on the
-* `webfinger.handle` span for trace-level investigation.
-* @since 2.3.0
-*/
-function recordWebFingerHandle(meterProvider, attrs) {
-	getFederationMetrics(meterProvider).recordWebFingerHandle(attrs);
-}
-/**
-* Records one `activitypub.collection.request` measurement for a
-* collection or collection-page request handled by Fedify.
-* @since 2.3.0
-*/
-function recordCollectionRequest(meterProvider, attrs) {
-	getFederationMetrics(meterProvider).recordCollectionRequest(attrs);
-}
-/**
-* Records one `activitypub.collection.dispatch.duration` measurement for a
-* collection dispatcher callback invocation.
-* @since 2.3.0
-*/
-function recordCollectionDispatchDuration(meterProvider, durationMs, attrs) {
-	getFederationMetrics(meterProvider).recordCollectionDispatchDuration(durationMs, attrs);
-}
-/**
-* Records one `activitypub.collection.page.items` measurement when Fedify
-* has materialized collection items in memory.
-* @since 2.3.0
-*/
-function recordCollectionPageItems(meterProvider, itemCount, attrs) {
-	getFederationMetrics(meterProvider).recordCollectionPageItems(itemCount, attrs);
-}
-/**
-* Records one `activitypub.collection.total_items` measurement when a
-* collection counter has already reported a total item count.
-* @since 2.3.0
-*/
-function recordCollectionTotalItems(meterProvider, totalItems, attrs) {
-	getFederationMetrics(meterProvider).recordCollectionTotalItems(totalItems, attrs);
-}
-/**
-* Classifies a thrown value from a key or document fetch into the bounded
-* {@link LookupResult} taxonomy and, when an HTTP response was received,
-* surfaces its status code.
-*
-*  -  `FetchError` with a `Response` whose status is `404` or `410`:
-*     `result=not_found` and the response status code.
-*  -  `FetchError` with any other `Response`: `result=error` and the
-*     response status code.
-*  -  `FetchError` without a `Response`: `result=network_error`.
-*  -  An `AbortError` (typically from a cancelled fetch): `result=network_error`.
-*  -  A bare `TypeError` (the shape native `fetch()` raises on DNS, connect,
-*     and TLS failures before any response is observed):
-*     `result=network_error`.
-*  -  Any other value: `result=error`.
-* @since 2.3.0
-*/
-function classifyFetchError(error) {
-	if (error instanceof _fedify_vocab_runtime.FetchError) {
-		if (error.response != null) {
-			const status = error.response.status;
-			return {
-				result: status === 404 || status === 410 ? "not_found" : "error",
-				statusCode: status
-			};
-		}
-		return { result: "network_error" };
-	}
-	if (isAbortError$1(error)) return { result: "network_error" };
-	if (error instanceof TypeError) return { result: "network_error" };
-	return { result: "error" };
-}
-/**
-* Wraps a {@link DocumentLoader} so each invocation records one
-* measurement on `activitypub.document.fetch` (counter) and one on
-* `activitypub.document.fetch.duration` (histogram), classifying the
-* outcome via {@link classifyFetchError} when the wrapped loader throws
-* and as `fetched` on success.  The wrapper rethrows whatever the
-* wrapped loader throws so caller behavior is unchanged.
-*
-* The wrapper records the host of the requested URL, including any
-* non-default port, on `activitypub.remote.host` when the URL parses; full
-* URLs, paths, and query strings are deliberately excluded to keep
-* cardinality bounded.
-* HTTP status codes are recorded only when the failure carries a
-* `Response` (currently, when the wrapped loader throws a
-* {@link FetchError} with a non-`null` `response`).
-* @since 2.3.0
-*/
-function instrumentDocumentLoader(loader, options) {
-	const meterProvider = options.meterProvider;
-	if (meterProvider == null) return loader;
-	return async (url, opts) => {
-		const start = performance.now();
-		let remoteUrl;
-		try {
-			remoteUrl = new URL(url);
-		} catch {
-			remoteUrl = void 0;
-		}
-		try {
-			const result = await loader(url, opts);
-			recordDocumentFetch(meterProvider, {
-				durationMs: getDurationMs(start),
-				kind: options.kind,
-				result: "fetched",
-				remoteUrl,
-				cacheEnabled: options.cacheEnabled
-			});
-			return result;
-		} catch (error) {
-			const classified = classifyFetchError(error);
-			recordDocumentFetch(meterProvider, {
-				durationMs: getDurationMs(start),
-				kind: options.kind,
-				result: classified.result,
-				remoteUrl,
-				cacheEnabled: options.cacheEnabled,
-				statusCode: classified.statusCode
-			});
-			throw error;
-		}
-	};
-}
-/**
-* Times an awaited public key fetch and records exactly one
-* `activitypub.signature.key_fetch.duration` measurement, classifying the
-* outcome as `hit`, `fetched`, or `error` based on the `cached` flag and
-* whether the returned key is non-null.  Errors thrown by the fetch are
-* reported as `error` and rethrown, so verifier behavior is unchanged.
-*
-* Shared by the three signature verifiers (HTTP, Linked Data, Object
-* Integrity Proofs); the only per-call variation is the
-* `activitypub.signature.kind` attribute value.
-* @since 2.3.0
-*/
-async function measureSignatureKeyFetch(meterProvider, kind, fetch) {
-	const start = performance.now();
-	try {
-		const result = await fetch();
-		getFederationMetrics(meterProvider).recordSignatureKeyFetchDuration(getDurationMs(start), kind, result.key != null ? result.cached ? "hit" : "fetched" : "error");
-		return result;
-	} catch (error) {
-		getFederationMetrics(meterProvider).recordSignatureKeyFetchDuration(getDurationMs(start), kind, "error");
-		throw error;
-	}
-}
-/**
-* Whether the given thrown value is an `AbortError`.
-*
-* `processQueuedTask` distinguishes aborted tasks (recorded as
-* `fedify.queue.task.result=aborted`) from other failures so that backend
-* shutdown signals do not inflate the `fedify.queue.task.failed` counter.
-* @since 2.3.0
-*/
-function isAbortError$1(error) {
-	if (error == null || typeof error !== "object") return false;
-	const name = error.name;
-	return typeof name === "string" && name === "AbortError";
-}
-const KNOWN_HTTP_METHODS = new Set([
-	"CONNECT",
-	"DELETE",
-	"GET",
-	"HEAD",
-	"OPTIONS",
-	"PATCH",
-	"POST",
-	"PUT",
-	"QUERY",
-	"TRACE"
-]);
-function normalizeHttpMethod(method) {
-	const upper = method.toUpperCase();
-	return KNOWN_HTTP_METHODS.has(upper) ? upper : "_OTHER";
-}
-const federationMetrics = /* @__PURE__ */ new WeakMap();
-/**
-* Gets the cached Fedify metric instruments for a meter provider.
-* @since 2.3.0
-*/
-function getFederationMetrics(meterProvider = _opentelemetry_api.metrics.getMeterProvider()) {
-	let instruments = federationMetrics.get(meterProvider);
-	if (instruments == null) {
-		instruments = new FederationMetrics(meterProvider);
-		federationMetrics.set(meterProvider, instruments);
-	}
-	return instruments;
-}
-/**
-* Gets the bounded remote host attribute value for a URL.
-* @since 2.3.0
-*/
-function getRemoteHost(url) {
-	return url.host;
-}
-/**
-* Gets an elapsed duration in milliseconds from a `performance.now()` value.
-* @since 2.3.0
-*/
-function getDurationMs(start) {
-	return Math.max(0, performance.now() - start);
-}
-//#endregion
-//#region src/sig/key.ts
-/**
-* Checks if the given key is valid and supported.  No-op if the key is valid,
-* otherwise throws an error.
-* @param key The key to check.
-* @param type Which type of key to check.  If not specified, the key can be
-*             either public or private.
-* @throws {TypeError} If the key is invalid or unsupported.
-*/
-function validateCryptoKey(key, type) {
-	if (type != null && key.type !== type) throw new TypeError(`The key is not a ${type} key.`);
-	if (!key.extractable) throw new TypeError("The key is not extractable.");
-	if (key.algorithm.name !== "RSASSA-PKCS1-v1_5" && key.algorithm.name !== "Ed25519") throw new TypeError("Currently only RSASSA-PKCS1-v1_5 and Ed25519 keys are supported.  More algorithms will be added in the future!");
-	if (key.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		if (key.algorithm.hash.name !== "SHA-256") throw new TypeError("For compatibility with the existing Fediverse software (e.g., Mastodon), hash algorithm for RSASSA-PKCS1-v1_5 keys must be SHA-256.");
-	}
-}
-/**
-* Generates a key pair which is appropriate for Fedify.
-* @param algorithm The algorithm to use.  Currently only RSASSA-PKCS1-v1_5 and
-*                  Ed25519 are supported.
-* @returns The generated key pair.
-* @throws {TypeError} If the algorithm is unsupported.
-*/
-function generateCryptoKeyPair(algorithm) {
-	if (algorithm == null) (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"sig",
-		"key"
-	]).warn("No algorithm specified.  Using RSASSA-PKCS1-v1_5 by default, but it is recommended to specify the algorithm explicitly as the parameter will be required in the future.");
-	if (algorithm == null || algorithm === "RSASSA-PKCS1-v1_5") return crypto.subtle.generateKey({
-		name: "RSASSA-PKCS1-v1_5",
-		modulusLength: 4096,
-		publicExponent: new Uint8Array([
-			1,
-			0,
-			1
-		]),
-		hash: "SHA-256"
-	}, true, ["sign", "verify"]);
-	else if (algorithm === "Ed25519") return crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
-	throw new TypeError("Unsupported algorithm: " + algorithm);
-}
-/**
-* Exports a key in JWK format.
-* @param key The key to export.  Either public or private key.
-* @returns The exported key in JWK format.  The key is suitable for
-*          serialization and storage.
-* @throws {TypeError} If the key is invalid or unsupported.
-*/
-async function exportJwk(key) {
-	validateCryptoKey(key);
-	const jwk = await crypto.subtle.exportKey("jwk", key);
-	if (jwk.crv === "Ed25519") jwk.alg = "Ed25519";
-	return jwk;
-}
-/**
-* Imports a key from JWK format.
-* @param jwk The key in JWK format.
-* @param type Which type of key to import, either `"public"` or `"private"`.
-* @returns The imported key.
-* @throws {TypeError} If the key is invalid or unsupported.
-*/
-async function importJwk(jwk, type) {
-	let key;
-	if (jwk.kty === "RSA" && jwk.alg === "RS256") key = await crypto.subtle.importKey("jwk", jwk, {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-256"
-	}, true, type === "public" ? ["verify"] : ["sign"]);
-	else if (jwk.kty === "OKP" && jwk.crv === "Ed25519") {
-		if (navigator?.userAgent === "Cloudflare-Workers") {
-			jwk = { ...jwk };
-			delete jwk.alg;
-		}
-		key = await crypto.subtle.importKey("jwk", jwk, "Ed25519", true, type === "public" ? ["verify"] : ["sign"]);
-	} else throw new TypeError("Unsupported JWK format.");
-	validateCryptoKey(key, type);
-	return key;
-}
-async function withFetchKeySpan(keyId, tracerProvider, fetcher) {
-	tracerProvider ??= _opentelemetry_api.trace.getTracerProvider();
-	return await tracerProvider.getTracer(name, version).startActiveSpan("activitypub.fetch_key", {
-		kind: _opentelemetry_api.SpanKind.CLIENT,
-		attributes: {
-			"http.method": "GET",
-			"url.full": keyId.href,
-			"url.scheme": keyId.protocol.replace(/:$/, ""),
-			"url.domain": keyId.hostname,
-			"url.path": keyId.pathname,
-			"url.query": keyId.search.replace(/^\?/, ""),
-			"url.fragment": keyId.hash.replace(/^#/, "")
-		}
-	}, async (span) => {
-		try {
-			const result = await fetcher();
-			span.setAttribute("activitypub.actor.key.cached", result.cached);
-			return result;
-		} catch (e) {
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.ERROR,
-				message: String(e)
-			});
-			throw e;
-		} finally {
-			span.end();
-		}
-	});
-}
-/**
-* Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
-* If the given URL contains an {@link Actor} object, it tries to find
-* the corresponding key in the `publicKey` or `assertionMethod` property.
-* @template T The type of the key to fetch.  Either {@link CryptographicKey}
-*              or {@link Multikey}.
-* @param keyId The URL of the key.
-* @param cls The class of the key to fetch.  Either {@link CryptographicKey}
-*            or {@link Multikey}.
-* @param options Options for fetching the key.  See {@link FetchKeyOptions}.
-* @returns The fetched key or `null` if the key is not found.
-* @since 1.3.0
-*/
-function fetchKey(keyId, cls, options = {}) {
-	keyId = typeof keyId === "string" ? new URL(keyId) : keyId;
-	return withFetchKeySpan(keyId, options.tracerProvider, () => fetchKeyInternal(keyId, cls, options));
-}
-/**
-* Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL,
-* preserving transport-level fetch failures for callers that need to inspect
-* why the key could not be loaded.
-*
-* @template T The type of the key to fetch.  Either {@link CryptographicKey}
-*              or {@link Multikey}.
-* @param keyId The URL of the key.
-* @param cls The class of the key to fetch.  Either {@link CryptographicKey}
-*            or {@link Multikey}.
-* @param options Options for fetching the key.
-* @returns The fetched key, or detailed fetch failure information.
-* @since 2.1.0
-*/
-async function fetchKeyDetailed(keyId, cls, options = {}) {
-	const cacheKey = typeof keyId === "string" ? new URL(keyId) : keyId;
-	return await withFetchKeySpan(cacheKey, options.tracerProvider, async () => {
-		return await fetchKeyWithResult(cacheKey, cls, options, async (cacheKey, keyId, keyCache, logger) => {
-			const fetchError = await keyCache?.getFetchError?.(cacheKey);
-			if (fetchError != null) {
-				logger.debug("Entry {keyId} found in cache with preserved fetch failure details.", { keyId });
-				return {
-					key: null,
-					cached: true,
-					fetchError
-				};
-			}
-			logger.debug("Entry {keyId} found in cache, but no fetch failure details are available.", { keyId });
-			return {
-				key: null,
-				cached: true
-			};
-		}, async (error, cacheKey, keyId, keyCache, logger) => {
-			logger.debug("Failed to fetch key {keyId}.", {
-				keyId,
-				error
-			});
-			await keyCache?.set(cacheKey, null);
-			if (error instanceof _fedify_vocab_runtime.FetchError && error.response != null) {
-				const fetchError = {
-					status: error.response.status,
-					response: error.response.clone()
-				};
-				await keyCache?.setFetchError?.(cacheKey, fetchError);
-				return {
-					key: null,
-					cached: false,
-					fetchError
-				};
-			}
-			const fetchError = { error: error instanceof Error ? error : new Error(String(error)) };
-			await keyCache?.setFetchError?.(cacheKey, fetchError);
-			return {
-				key: null,
-				cached: false,
-				fetchError
-			};
-		});
-	});
-}
-async function getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger) {
-	if (keyCache == null) return null;
-	const cachedKey = await keyCache.get(cacheKey);
-	const hit = checkCachedKeyHit(cachedKey, keyId, cls, logger);
-	if (hit != null) return hit;
-	if (cachedKey === null) {
-		logger.debug("Entry {keyId} found in cache, but it is unavailable.", { keyId });
-		return {
-			key: null,
-			cached: true
-		};
-	}
-	return null;
-}
-function checkCachedKeyHit(cachedKey, keyId, cls, logger) {
-	if (cachedKey instanceof cls && cachedKey.publicKey != null) {
-		logger.debug("Key {keyId} found in cache.", { keyId });
-		return {
-			key: cachedKey,
-			cached: true
-		};
-	}
-	return null;
-}
-async function clearFetchErrorMetadata(keyId, keyCache) {
-	await keyCache?.setFetchError?.(keyId, null);
-}
-function isDidKeyUrl(keyId) {
-	return keyId.protocol === "did:" && keyId.pathname.startsWith("key:");
-}
-async function doRawKeysMatch(left, right) {
-	const [leftRaw, rightRaw] = await Promise.all([crypto.subtle.exportKey("raw", left), crypto.subtle.exportKey("raw", right)]);
-	if (leftRaw.byteLength !== rightRaw.byteLength) return false;
-	const leftBytes = new Uint8Array(leftRaw);
-	const rightBytes = new Uint8Array(rightRaw);
-	return leftBytes.every((byte, index) => byte === rightBytes[index]);
-}
-async function isCachedDidKeyValid(key, verificationMethod) {
-	try {
-		return key.id?.href === verificationMethod.id.href && key.controllerId?.href === verificationMethod.controller.href && await doRawKeysMatch(key.publicKey, verificationMethod.publicKey);
-	} catch {
-		return false;
-	}
-}
-async function resolveDidKey(cacheKey, cls, keyCache, logger) {
-	if (!isDidKeyUrl(cacheKey)) return null;
-	const keyId = cacheKey.href;
-	if (!(cls === _fedify_vocab.Multikey)) {
-		logger.debug("Failed to resolve did:key {keyId}; did:key verification methods are only supported as Multikey values.", { keyId });
-		return {
-			key: null,
-			cached: false
-		};
-	}
-	let verificationMethod;
-	try {
-		verificationMethod = await (0, _fedify_vocab_runtime.parseDidKeyVerificationMethod)(cacheKey);
-	} catch (error) {
-		logger.debug("Failed to resolve did:key verification method {keyId}: {error}", {
-			keyId,
-			error
-		});
-		return {
-			key: null,
-			cached: false
-		};
-	}
-	const hit = checkCachedKeyHit(await keyCache?.get(cacheKey), keyId, cls, logger);
-	if (hit?.key instanceof _fedify_vocab.Multikey && await isCachedDidKeyValid(hit.key, verificationMethod)) return hit;
-	const key = new _fedify_vocab.Multikey({
-		id: verificationMethod.id,
-		controller: verificationMethod.controller,
-		publicKey: verificationMethod.publicKey
-	});
-	await keyCache?.set(cacheKey, key);
-	await clearFetchErrorMetadata(cacheKey, keyCache);
-	logger.debug("Resolved did:key verification method {keyId}.", { keyId });
-	return {
-		key,
-		cached: false
-	};
-}
-async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoader, contextLoader, keyCache, tracerProvider }, logger) {
-	let object;
-	try {
-		object = await _fedify_vocab.Object.fromJsonLd(document, {
-			documentLoader,
-			contextLoader,
-			tracerProvider
-		});
-	} catch (e) {
-		if (!(e instanceof TypeError)) throw e;
-		try {
-			object = await cls.fromJsonLd(document, {
-				documentLoader,
-				contextLoader,
-				tracerProvider
-			});
-		} catch (e) {
-			if (e instanceof TypeError) {
-				logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
-				await keyCache?.set(cacheKey, null);
-				await clearFetchErrorMetadata(cacheKey, keyCache);
-				return {
-					key: null,
-					cached: false
-				};
-			}
-			throw e;
-		}
-	}
-	let key = null;
-	if (object instanceof cls) key = object;
-	else if ((0, _fedify_vocab.isActor)(object)) {
-		const keys = cls === _fedify_vocab.CryptographicKey ? object.getPublicKeys({
-			documentLoader,
-			contextLoader,
-			suppressError: true,
-			tracerProvider
-		}) : object.getAssertionMethods({
-			documentLoader,
-			contextLoader,
-			suppressError: true,
-			tracerProvider
-		});
-		let length = 0;
-		let lastKey = null;
-		try {
-			for await (const k of keys) {
-				length++;
-				lastKey = k;
-				if (k.id?.href === keyId) {
-					key = k;
-					break;
-				}
-			}
-		} catch (e) {
-			if (!(e instanceof TypeError)) throw e;
-			logger.debug("Failed to verify; a malformed key was encountered while iterating the keys of {keyId}; treating it as a missing key: {error}", {
-				keyId,
-				error: e
-			});
-		}
-		const keyIdUrl = new URL(keyId);
-		if (key == null && keyIdUrl.hash === "" && length === 1) key = lastKey;
-		if (key == null) {
-			logger.debug("Failed to verify; object {keyId} returned an {actorType}, but has no key matching {keyId}.", {
-				keyId,
-				actorType: object.constructor.name
-			});
-			await keyCache?.set(cacheKey, null);
-			await clearFetchErrorMetadata(cacheKey, keyCache);
-			return {
-				key: null,
-				cached: false
-			};
-		}
-	} else {
-		logger.debug("Failed to verify; key {keyId} returned an invalid object.", { keyId });
-		await keyCache?.set(cacheKey, null);
-		await clearFetchErrorMetadata(cacheKey, keyCache);
-		return {
-			key: null,
-			cached: false
-		};
-	}
-	if (key.publicKey == null) {
-		logger.debug("Failed to verify; key {keyId} has no publicKeyPem field.", { keyId });
-		await keyCache?.set(cacheKey, null);
-		await clearFetchErrorMetadata(cacheKey, keyCache);
-		return {
-			key: null,
-			cached: false
-		};
-	}
-	if (keyCache != null) {
-		await keyCache.set(cacheKey, key);
-		logger.debug("Key {keyId} cached.", { keyId });
-	}
-	await clearFetchErrorMetadata(cacheKey, keyCache);
-	return {
-		key,
-		cached: false
-	};
-}
-async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, onFetchError) {
-	const start = performance.now();
-	let outcome = { result: "error" };
-	try {
-		const logger = (0, _logtape_logtape.getLogger)([
-			"fedify",
-			"sig",
-			"key"
-		]);
-		const keyId = cacheKey.href;
-		const keyCache = options.keyCache;
-		const didKey = await resolveDidKey(cacheKey, cls, keyCache, logger);
-		if (didKey != null) {
-			outcome = { result: didKey.key == null ? "invalid" : didKey.cached ? "hit" : "fetched" };
-			return didKey;
-		}
-		const cached = await getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger);
-		if (cached?.key === null && cached.cached) {
-			const cachedUnavailable = await onCachedUnavailable(cacheKey, keyId, keyCache, logger);
-			outcome = { result: "hit" };
-			return cachedUnavailable;
-		}
-		if (cached != null) {
-			outcome = { result: "hit" };
-			return cached;
-		}
-		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
-		let document;
-		try {
-			document = (await (options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)())(keyId)).document;
-		} catch (error) {
-			const classified = classifyFetchError(error);
-			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
-			outcome = classified;
-			return errored;
-		}
-		const resolved = await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
-		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
-		return resolved;
-	} finally {
-		recordKeyLookup(options.meterProvider, {
-			durationMs: getDurationMs(start),
-			result: outcome.result,
-			remoteUrl: cacheKey,
-			cacheEnabled: options.keyCache != null,
-			statusCode: outcome.statusCode
-		});
-	}
-}
-async function fetchKeyInternal(keyId, cls, options = {}) {
-	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
-		return {
-			key: null,
-			cached: true
-		};
-	}, async (error, cacheKey, keyId, keyCache, logger) => {
-		logger.debug("Failed to fetch key {keyId}.", {
-			keyId,
-			error
-		});
-		await keyCache?.set(cacheKey, null);
-		if (error instanceof _fedify_vocab_runtime.FetchError && error.response != null) await keyCache?.setFetchError?.(cacheKey, {
-			status: error.response.status,
-			response: error.response.clone()
-		});
-		else await keyCache?.setFetchError?.(cacheKey, { error: error instanceof Error ? error : new Error(String(error)) });
-		return {
-			key: null,
-			cached: false
-		};
-	});
-}
-//#endregion
-//#region src/sig/http.ts
-const Temporal = require_temporal_polyfill.Temporal;
-const DEFAULT_MAX_REDIRECTION = 20;
-const DOUBLE_KNOCK_TRANSPORT_RETRY_DELAY_MS = 100;
-/**
-* Signs a request using the given private key.
-* @param request The request to sign.
-* @param privateKey The private key to use for signing.
-* @param keyId The key ID to use for the signature.  It will be used by the
-*              verifier.
-* @returns The signed request.
-* @throws {TypeError} If the private key is invalid or unsupported.
-*/
-async function signRequest(request, privateKey, keyId, options = {}) {
-	validateCryptoKey(privateKey, "private");
-	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("http_signatures.sign", async (span) => {
-		try {
-			const spec = options.spec ?? "draft-cavage-http-signatures-12";
-			let signed;
-			if (spec === "rfc9421") signed = await signRequestRfc9421(request, privateKey, keyId, span, options.currentTime, options.body, options.rfc9421);
-			else signed = await signRequestDraft(request, privateKey, keyId, span, options.currentTime, options.body);
-			if (span.isRecording()) {
-				span.setAttribute(_opentelemetry_semantic_conventions.ATTR_HTTP_REQUEST_METHOD, signed.method);
-				span.setAttribute(_opentelemetry_semantic_conventions.ATTR_URL_FULL, signed.url);
-				for (const [name, value] of signed.headers) span.setAttribute((0, _opentelemetry_semantic_conventions.ATTR_HTTP_REQUEST_HEADER)(name), value);
-				span.setAttribute("http_signatures.key_id", keyId.href);
-			}
-			return signed;
-		} catch (error) {
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
-		}
-	});
-}
-async function signRequestDraft(request, privateKey, keyId, span, currentTime, bodyBuffer) {
-	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
-	const url = new URL(request.url);
-	const body = bodyBuffer !== void 0 ? bodyBuffer : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
-	const headers = new Headers(request.headers);
-	if (!headers.has("Host")) headers.set("Host", url.host);
-	if (!headers.has("Digest") && body != null) {
-		const digest = await crypto.subtle.digest("SHA-256", body);
-		headers.set("Digest", `SHA-256=${(0, byte_encodings_base64.encodeBase64)(digest)}`);
-		if (span.isRecording()) span.setAttribute("http_signatures.digest.sha-256", (0, byte_encodings_hex.encodeHex)(digest));
-	}
-	if (!headers.has("Date")) headers.set("Date", currentTime == null ? (/* @__PURE__ */ new Date()).toUTCString() : new Date(currentTime.toString()).toUTCString());
-	const serialized = [["(request-target)", `${request.method.toLowerCase()} ${url.pathname}`], ...headers];
-	const headerNames = serialized.map(([name]) => name);
-	const message = serialized.map(([name, value]) => `${name}: ${value.trim()}`).join("\n");
-	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, new TextEncoder().encode(message));
-	const sigHeader = `keyId="${keyId.href}",algorithm="rsa-sha256",headers="${headerNames.join(" ")}",signature="${(0, byte_encodings_base64.encodeBase64)(signature)}"`;
-	headers.set("Signature", sigHeader);
-	if (span.isRecording()) {
-		span.setAttribute("http_signatures.algorithm", "rsa-sha256");
-		span.setAttribute("http_signatures.signature", (0, byte_encodings_hex.encodeHex)(signature));
-	}
-	return new Request(request, {
-		headers,
-		body
-	});
-}
-function formatRfc9421SignatureParameters(params) {
-	return Array.from(iterRfc9421(params)).join(";");
-}
-function* iterRfc9421(params) {
-	yield `alg="${params.algorithm}"`;
-	yield `keyid="${params.keyId.href}"`;
-	yield `created=${params.created}`;
-	if (params.expires != null) yield `expires=${params.expires}`;
-	if (params.nonce != null) yield `nonce="${escapeSfString(params.nonce)}"`;
-	if (params.tag != null) yield `tag="${escapeSfString(params.tag)}"`;
-}
-const escapeSfString = (value) => value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
-function formatComponentId(component) {
-	return (0, structured_field_values.encodeItem)(new structured_field_values.Item(component.value, component.params));
-}
-/**
-* Creates a signature base for a request according to RFC 9421.
-* @param request The request to create a signature base for.
-* @param components The components to include in the signature base.
-* @param parameters The signature parameters to include in the signature base.
-* @returns The signature base as a string.
-*/
-function createRfc9421SignatureBase(request, components, parameters) {
-	const url = new URL(request.url);
-	return components.map((component) => {
-		const id = formatComponentId(component);
-		const derived = derivedComponents[component.value]?.(request, url);
-		if (derived != null) return `${id}: ${derived}`;
-		if (component.value.startsWith("@")) throw new Error(`Unsupported derived component: ${component.value}`);
-		const header = request.headers.get(component.value);
-		if (header == null) throw new Error(`Missing header: ${component.value}`);
-		return `${id}: ${header}`;
-	}).concat([`"@signature-params": (${components.map((c) => formatComponentId(c)).join(" ")});${parameters}`]).join("\n");
-}
-const derivedComponents = {
-	"@method": (request) => request.method.toUpperCase(),
-	"@target-uri": (_, url) => url.href,
-	"@authority": (_, url) => url.host,
-	"@scheme": (_, url) => url.protocol.slice(0, -1),
-	"@request-target": (request, url) => `${request.method.toLowerCase()} ${url.pathname}${url.search}`,
-	"@path": (_, url) => url.pathname,
-	"@query": (_, { search }) => search.startsWith("?") ? search.slice(1) : search,
-	"@query-param": () => {
-		throw new Error("@query-param requires a parameter name");
-	},
-	"@status": () => {
-		throw new Error("@status is only valid for responses");
-	}
-};
-/**
-* Formats a signature using rfc9421 format.
-* @param signature The raw signature bytes.
-* @param components The components that were signed.
-* @param parameters The signature parameters.
-* @returns The formatted signature string.
-*/
-function formatRfc9421Signature(signature, components, parameters, label = "sig1") {
-	return [`${label}=(${components.map((c) => formatComponentId(c)).join(" ")});${parameters}`, `${label}=:${(0, byte_encodings_base64.encodeBase64)(signature)}:`];
-}
-/**
-* Parse RFC 9421 Signature-Input header.
-* @param signatureInput The Signature-Input header value.
-* @returns Parsed signature input parameters.
-*/
-function parseRfc9421SignatureInput(signatureInput) {
-	let dict;
-	try {
-		dict = (0, structured_field_values.decodeDict)(signatureInput);
-	} catch (error) {
-		(0, _logtape_logtape.getLogger)([
-			"fedify",
-			"sig",
-			"http"
-		]).debug("Failed to parse Signature-Input header: {signatureInput}", {
-			signatureInput,
-			error
-		});
-		return {};
-	}
-	const result = {};
-	for (const [label, item] of Object.entries(dict)) {
-		if (!Array.isArray(item.value) || typeof item.params.keyid !== "string" || typeof item.params.created !== "number") continue;
-		const components = item.value.filter((subitem) => typeof subitem.value === "string").map((subitem) => ({
-			value: subitem.value,
-			params: subitem.params ?? {}
-		}));
-		const params = (0, structured_field_values.encodeItem)(new structured_field_values.Item(0, item.params));
-		result[label] = {
-			keyId: item.params.keyid,
-			alg: item.params.alg,
-			created: item.params.created,
-			nonce: typeof item.params.nonce === "string" ? item.params.nonce : void 0,
-			tag: typeof item.params.tag === "string" ? item.params.tag : void 0,
-			components,
-			parameters: params.slice(params.indexOf(";") + 1)
-		};
-	}
-	return result;
-}
-/**
-* Parse RFC 9421 Signature header.
-* @param signature The Signature header value.
-* @returns Parsed signature values.
-*/
-function parseRfc9421Signature(signature) {
-	let dict;
-	try {
-		dict = (0, structured_field_values.decodeDict)(signature);
-	} catch (error) {
-		(0, _logtape_logtape.getLogger)([
-			"fedify",
-			"sig",
-			"http"
-		]).debug("Failed to parse Signature header: {signature}", {
-			signature,
-			error
-		});
-		return {};
-	}
-	const result = {};
-	for (const [key, value] of Object.entries(dict)) if (value.value instanceof Uint8Array) result[key] = value.value;
-	return result;
-}
-async function signRequestRfc9421(request, privateKey, keyId, span, currentTime, bodyBuffer, rfc9421Options) {
-	if (privateKey.algorithm.name !== "RSASSA-PKCS1-v1_5") throw new TypeError("Unsupported algorithm: " + privateKey.algorithm.name);
-	const url = new URL(request.url);
-	const body = bodyBuffer !== void 0 ? bodyBuffer : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
-	const headers = new Headers(request.headers);
-	if (!headers.has("Host")) headers.set("Host", url.host);
-	if (!headers.has("Content-Digest") && body != null) {
-		const digest = await crypto.subtle.digest("SHA-256", body);
-		headers.set("Content-Digest", `sha-256=:${(0, byte_encodings_base64.encodeBase64)(digest)}:`);
-		if (span.isRecording()) span.setAttribute("http_signatures.digest.sha-256", (0, byte_encodings_hex.encodeHex)(digest));
-	}
-	currentTime ??= Temporal.Now.instant();
-	const created = currentTime.epochMilliseconds / 1e3 | 0;
-	if (!headers.has("Date")) headers.set("Date", new Date(currentTime.toString()).toUTCString());
-	const label = rfc9421Options?.label ?? "sig1";
-	const components = [...rfc9421Options?.components ?? [
-		{
-			value: "@method",
-			params: {}
-		},
-		{
-			value: "@target-uri",
-			params: {}
-		},
-		{
-			value: "@authority",
-			params: {}
-		},
-		{
-			value: "host",
-			params: {}
-		},
-		{
-			value: "date",
-			params: {}
-		}
-	], ...body != null ? [{
-		value: "content-digest",
-		params: {}
-	}] : []];
-	const signatureParams = formatRfc9421SignatureParameters({
-		algorithm: "rsa-v1_5-sha256",
-		keyId,
-		created,
-		expires: rfc9421Options?.expires === true ? (currentTime.epochMilliseconds / 1e3 | 0) + 3600 : void 0,
-		nonce: rfc9421Options?.nonce,
-		tag: rfc9421Options?.tag
-	});
-	let signatureBase;
-	try {
-		signatureBase = createRfc9421SignatureBase(new Request(request.url, {
-			method: request.method,
-			headers
-		}), components, signatureParams);
-	} catch (error) {
-		throw new TypeError(`Failed to create signature base: ${String(error)}; it is probably a bug in the implementation.  Please report it at Fedify's issue tracker.`);
-	}
-	const signatureBytes = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, new TextEncoder().encode(signatureBase));
-	const [signatureInput, signature] = formatRfc9421Signature(signatureBytes, components, signatureParams, label);
-	const existingInput = headers.get("Signature-Input");
-	headers.set("Signature-Input", existingInput != null ? `${existingInput}, ${signatureInput}` : signatureInput);
-	const existingSignature = headers.get("Signature");
-	headers.set("Signature", existingSignature != null ? `${existingSignature}, ${signature}` : signature);
-	if (span.isRecording()) {
-		span.setAttribute("http_signatures.algorithm", "rsa-v1_5-sha256");
-		span.setAttribute("http_signatures.signature", (0, byte_encodings_hex.encodeHex)(signatureBytes));
-		span.setAttribute("http_signatures.created", created.toString());
-	}
-	return new Request(request, {
-		headers,
-		body
-	});
-}
-const supportedHashAlgorithms = {
-	"sha": "SHA-1",
-	"sha-256": "SHA-256",
-	"sha-512": "SHA-512"
-};
-function noSignatureResult() {
-	return {
-		verified: false,
-		reason: { type: "noSignature" }
-	};
-}
-function invalidSignatureResult(keyId) {
-	return keyId == null ? {
-		verified: false,
-		reason: { type: "invalidSignature" }
-	} : {
-		verified: false,
-		reason: {
-			type: "invalidSignature",
-			keyId
-		}
-	};
-}
-function keyFetchErrorResult(keyId, result) {
-	return {
-		verified: false,
-		reason: {
-			type: "keyFetchError",
-			keyId,
-			result
-		}
-	};
-}
-function parseKeyId(value) {
-	if (value == null) return null;
-	try {
-		return new URL(value);
-	} catch {
-		return null;
-	}
-}
-function getKeyFetchErrorName(error) {
-	return error.name || error.constructor.name || "Error";
-}
-/**
-* Known draft-cavage `algorithm` parameter values, used to keep the
-* `http_signatures.algorithm` metric attribute on a bounded set.  The header
-* field is attacker-controlled and not used to select the verification
-* algorithm, so unknown values are dropped from the metric to prevent
-* cardinality blow-up.
-*/
-const DRAFT_KNOWN_ALGORITHMS = new Set([
-	"ecdsa-sha256",
-	"ecdsa-sha384",
-	"ecdsa-sha512",
-	"ed25519",
-	"hs2019",
-	"rsa-sha1",
-	"rsa-sha256",
-	"rsa-sha512"
-]);
-function classifyHttpVerifyResult(result) {
-	if (result.verified) return "verified";
-	return result.reason.type === "noSignature" ? "missing" : "rejected";
-}
-function recordVerificationResult(span, result) {
-	span.setAttribute("http_signatures.verified", result.verified);
-	if (result.verified === true) return;
-	const reason = result.reason;
-	span.setAttribute("http_signatures.failure_reason", reason.type);
-	if ("keyId" in reason && reason.keyId != null) span.setAttribute("http_signatures.key_id", reason.keyId.href);
-	if (reason.type !== "keyFetchError") return;
-	if ("status" in reason.result) span.setAttribute("http_signatures.key_fetch_status", reason.result.status);
-	else span.setAttribute("http_signatures.key_fetch_error", getKeyFetchErrorName(reason.result.error));
-}
-/**
-* Verifies the signature of a request.
-*
-* Note that this function consumes the request body, so it should not be used
-* if the request body is already consumed.  Consuming the request body after
-* calling this function is okay, since this function clones the request
-* under the hood.
-*
-* @param request The request to verify.
-* @param options Options for verifying the request.
-* @returns The public key of the verified signature, or `null` if the signature
-*          could not be verified.
-*/
-async function verifyRequest(request, options = {}) {
-	const result = await verifyRequestDetailed(request, options);
-	return result.verified ? result.key : null;
-}
-/**
-* Verifies the signature of a request and returns a structured failure reason
-* when verification does not succeed.
-*
-* @param request The request to verify.
-* @param options Options for verifying the request.
-* @returns The verified public key, or a structured verification failure.
-* @since 2.1.0
-*/
-async function verifyRequestDetailed(request, options = {}) {
-	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version).startActiveSpan("http_signatures.verify", async (span) => {
-		if (span.isRecording()) {
-			span.setAttribute(_opentelemetry_semantic_conventions.ATTR_HTTP_REQUEST_METHOD, request.method);
-			span.setAttribute(_opentelemetry_semantic_conventions.ATTR_URL_FULL, request.url);
-			for (const [name, value] of request.headers) span.setAttribute((0, _opentelemetry_semantic_conventions.ATTR_HTTP_REQUEST_HEADER)(name), value);
-		}
-		const start = performance.now();
-		const metricsContext = {};
-		let result;
-		let threw = false;
-		try {
-			let spec = options.spec;
-			if (spec == null) spec = request.headers.has("Signature-Input") ? "rfc9421" : "draft-cavage-http-signatures-12";
-			if (spec === "rfc9421") result = await verifyRequestRfc9421(request, span, metricsContext, options);
-			else result = await verifyRequestDraft(request, span, metricsContext, options);
-			recordVerificationResult(span, result);
-			if (!result.verified) span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
-			return result;
-		} catch (error) {
-			threw = true;
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			const classified = threw ? "error" : classifyHttpVerifyResult(result);
-			const failureReason = result != null && !result.verified && result.reason.type !== "noSignature" ? result.reason.type : void 0;
-			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "http", classified, {
-				algorithm: metricsContext.algorithm,
-				failureReason
-			});
-			span.end();
-		}
-	});
-}
-async function verifyRequestDraft(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, meterProvider, tracerProvider } = {}) {
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"sig",
-		"http"
-	]);
-	if (request.bodyUsed) {
-		logger.error("Failed to verify; the request body is already consumed.", { url: request.url });
-		return noSignatureResult();
-	} else if (request.body?.locked) {
-		logger.error("Failed to verify; the request body is locked.", { url: request.url });
-		return noSignatureResult();
-	}
-	const originalRequest = request;
-	request = request.clone();
-	const sigHeader = request.headers.get("Signature");
-	if (sigHeader == null) {
-		logger.debug("Failed to verify; no Signature header found.", { headers: Object.fromEntries(request.headers.entries()) });
-		return noSignatureResult();
-	}
-	const sigValues = Object.fromEntries(sigHeader.split(",").map((pair) => pair.match(/^\s*([A-Za-z]+)=(?:"([^"]*)"|(\d+))\s*$/)).filter((m) => m != null).map((m) => [m[1], m[2] ?? m[3]]));
-	const parsedKeyId = parseKeyId(sigValues.keyId);
-	const dateHeader = request.headers.get("Date");
-	if (dateHeader == null) {
-		logger.debug("Failed to verify; no Date header found.", { headers: Object.fromEntries(request.headers.entries()) });
-		return invalidSignatureResult(parsedKeyId);
-	}
-	const digestHeader = request.headers.get("Digest");
-	if (request.method !== "GET" && request.method !== "HEAD" && digestHeader == null) {
-		logger.debug("Failed to verify; no Digest header found.", { headers: Object.fromEntries(request.headers.entries()) });
-		return invalidSignatureResult(parsedKeyId);
-	}
-	let body = null;
-	if (digestHeader != null) {
-		body = await request.arrayBuffer();
-		const digests = digestHeader.split(",").map((pair) => pair.includes("=") ? pair.split("=", 2) : [pair, ""]);
-		let matched = false;
-		for (let [algo, digestBase64] of digests) {
-			algo = algo.trim().toLowerCase();
-			if (!(algo in supportedHashAlgorithms)) continue;
-			let digest;
-			try {
-				digest = (0, byte_encodings_base64.decodeBase64)(digestBase64);
-			} catch (error) {
-				logger.debug("Failed to verify; invalid base64 encoding: {digest}.", {
-					digest: digestBase64,
-					error
-				});
-				return invalidSignatureResult(parsedKeyId);
-			}
-			if (span.isRecording()) span.setAttribute(`http_signatures.digest.${algo}`, (0, byte_encodings_hex.encodeHex)(digest));
-			const expectedDigest = await crypto.subtle.digest(supportedHashAlgorithms[algo], body);
-			if (!timingSafeEqual(digest, new Uint8Array(expectedDigest))) {
-				logger.debug("Failed to verify; digest mismatch ({algorithm}): {digest} != {expectedDigest}.", {
-					algorithm: algo,
-					digest: digestBase64,
-					expectedDigest: (0, byte_encodings_base64.encodeBase64)(expectedDigest)
-				});
-				return invalidSignatureResult(parsedKeyId);
-			}
-			matched = true;
-		}
-		if (!matched) {
-			logger.debug("Failed to verify; no supported digest algorithm found.  Supported: {supportedAlgorithms}; found: {algorithms}.", {
-				supportedAlgorithms: Object.keys(supportedHashAlgorithms),
-				algorithms: digests.map(([algo]) => algo)
-			});
-			return invalidSignatureResult(parsedKeyId);
-		}
-	}
-	const date = Temporal.Instant.from(new Date(dateHeader).toISOString());
-	const now = currentTime ?? Temporal.Now.instant();
-	if (timeWindow !== false) {
-		const tw = timeWindow ?? { hours: 1 };
-		if (Temporal.Instant.compare(date, now.add(tw)) > 0) {
-			logger.debug("Failed to verify; Date is too far in the future.", {
-				date: date.toString(),
-				now: now.toString()
-			});
-			return invalidSignatureResult(parsedKeyId);
-		} else if (Temporal.Instant.compare(date, now.subtract(tw)) < 0) {
-			logger.debug("Failed to verify; Date is too far in the past.", {
-				date: date.toString(),
-				now: now.toString()
-			});
-			return invalidSignatureResult(parsedKeyId);
-		}
-	}
-	if (!("keyId" in sigValues)) {
-		logger.debug("Failed to verify; no keyId field found in the Signature header.", { signature: sigHeader });
-		return invalidSignatureResult(null);
-	} else if (!("headers" in sigValues)) {
-		logger.debug("Failed to verify; no headers field found in the Signature header.", { signature: sigHeader });
-		return invalidSignatureResult(parsedKeyId);
-	} else if (!("signature" in sigValues)) {
-		logger.debug("Failed to verify; no signature field found in the Signature header.", { signature: sigHeader });
-		return invalidSignatureResult(parsedKeyId);
-	}
-	if ("expires" in sigValues) {
-		const expiresSeconds = parseInt(sigValues.expires);
-		if (!Number.isInteger(expiresSeconds)) {
-			logger.debug("Failed to verify; invalid expires field in the Signature header: {expires}.", {
-				expires: sigValues.expires,
-				signature: sigHeader
-			});
-			return invalidSignatureResult(parsedKeyId);
-		}
-		const expires = Temporal.Instant.fromEpochMilliseconds(expiresSeconds * 1e3);
-		if (Temporal.Instant.compare(now, expires) > 0) {
-			logger.debug("Failed to verify; signature expired at {expires} (now: {now}).", {
-				expires: expires.toString(),
-				now: now.toString(),
-				signature: sigHeader
-			});
-			return invalidSignatureResult(parsedKeyId);
-		}
-	}
-	if ("created" in sigValues) {
-		const createdSeconds = parseInt(sigValues.created);
-		if (!Number.isInteger(createdSeconds)) {
-			logger.debug("Failed to verify; invalid created field in the Signature header: {created}.", {
-				created: sigValues.created,
-				signature: sigHeader
-			});
-			return invalidSignatureResult(parsedKeyId);
-		}
-		if (timeWindow !== false) {
-			const created = Temporal.Instant.fromEpochMilliseconds(createdSeconds * 1e3);
-			const tw = timeWindow ?? { minutes: 1 };
-			if (Temporal.Instant.compare(created, now.add(tw)) > 0) {
-				logger.debug("Failed to verify; created is too far in the future.", {
-					created: created.toString(),
-					now: now.toString()
-				});
-				return invalidSignatureResult(parsedKeyId);
-			} else if (Temporal.Instant.compare(created, now.subtract(tw)) < 0) {
-				logger.debug("Failed to verify; created is too far in the past.", {
-					created: created.toString(),
-					now: now.toString()
-				});
-				return invalidSignatureResult(parsedKeyId);
-			}
-		}
-	}
-	const { keyId, headers, signature } = sigValues;
-	const keyIdUrl = parseKeyId(keyId);
-	if (keyIdUrl == null) return invalidSignatureResult(null);
-	span?.setAttribute("http_signatures.key_id", keyId);
-	if ("algorithm" in sigValues) {
-		span?.setAttribute("http_signatures.algorithm", sigValues.algorithm);
-		const normalizedAlgorithm = sigValues.algorithm.toLowerCase();
-		if (DRAFT_KNOWN_ALGORITHMS.has(normalizedAlgorithm)) metricsContext.algorithm = normalizedAlgorithm;
-	}
-	const { key, cached, fetchError } = await measureSignatureKeyFetch(meterProvider, "http", () => fetchKeyDetailed(keyIdUrl, _fedify_vocab.CryptographicKey, {
-		documentLoader,
-		contextLoader,
-		keyCache,
-		tracerProvider,
-		meterProvider
-	}));
-	if (fetchError != null) return keyFetchErrorResult(keyIdUrl, fetchError);
-	if (key == null) return invalidSignatureResult(keyIdUrl);
-	const headerNames = headers.split(/\s+/g);
-	if (!headerNames.includes("(request-target)") || !headerNames.includes("date")) {
-		logger.debug("Failed to verify; required headers missing in the Signature header: {headers}.", { headers });
-		return invalidSignatureResult(keyIdUrl);
-	}
-	if (body != null && !headerNames.includes("digest")) {
-		logger.debug("Failed to verify; required headers missing in the Signature header: {headers}.", { headers });
-		return invalidSignatureResult(keyIdUrl);
-	}
-	const message = headerNames.map((name) => `${name}: ` + (name === "(request-target)" ? `${request.method.toLowerCase()} ${new URL(request.url).pathname}` : name === "(created)" ? sigValues.created ?? "" : name === "(expires)" ? sigValues.expires ?? "" : name === "host" ? request.headers.get("host") ?? new URL(request.url).host : request.headers.get(name))).join("\n");
-	const sig = (0, byte_encodings_base64.decodeBase64)(signature);
-	span?.setAttribute("http_signatures.signature", (0, byte_encodings_hex.encodeHex)(sig));
-	if (!await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key.publicKey, sig, new TextEncoder().encode(message))) {
-		if (cached) {
-			logger.debug("Failed to verify with the cached key {keyId}; signature {signature} is invalid.  Retrying with the freshly fetched key...", {
-				keyId,
-				signature,
-				message
-			});
-			return await verifyRequestDraft(originalRequest, span, metricsContext, {
-				documentLoader,
-				contextLoader,
-				timeWindow,
-				currentTime,
-				keyCache: {
-					get: () => Promise.resolve(void 0),
-					set: async (keyId, key) => await keyCache?.set(keyId, key)
-				},
-				meterProvider,
-				tracerProvider
-			});
-		}
-		logger.debug("Failed to verify with the fetched key {keyId}; signature {signature} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
-			keyId,
-			signature,
-			message
-		});
-		return invalidSignatureResult(keyIdUrl);
-	}
-	return {
-		verified: true,
-		key
-	};
-}
-/**
-* RFC 9421 map of algorithm identifiers to WebCrypto algorithms
-*/
-const rfc9421AlgorithmMap = {
-	"rsa-v1_5-sha256": {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-256"
-	},
-	"rsa-v1_5-sha512": {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-512"
-	},
-	"rsa-pss-sha512": {
-		name: "RSA-PSS",
-		hash: "SHA-512"
-	},
-	"ecdsa-p256-sha256": {
-		name: "ECDSA",
-		hash: "SHA-256"
-	},
-	"ecdsa-p384-sha384": {
-		name: "ECDSA",
-		hash: "SHA-384"
-	},
-	"ed25519": { name: "Ed25519" }
-};
-/**
-* Verifies a Content-Digest header according to RFC 9421.
-* @param digestHeader The Content-Digest header value.
-* @param body The message body to verify against.
-* @returns Whether the digest is valid.
-*/
-async function verifyRfc9421ContentDigest(digestHeader, body) {
-	const digests = digestHeader.split(",").map((pair) => {
-		pair = pair.trim();
-		const pos = pair.indexOf("=");
-		const algo = pos < 0 ? pair : pair.slice(0, pos);
-		const value = pos < 0 ? "" : pair.slice(pos + 1);
-		return {
-			algo: algo.trim().toLowerCase(),
-			value: value.trim()
-		};
-	});
-	for (const { algo, value } of digests) {
-		let hashAlgo;
-		if (algo === "sha-256") hashAlgo = "SHA-256";
-		else if (algo === "sha-512") hashAlgo = "SHA-512";
-		else continue;
-		const base64Match = value.match(/^:([^:]+):$/);
-		if (!base64Match) continue;
-		let digest;
-		try {
-			digest = (0, byte_encodings_base64.decodeBase64)(base64Match[1]);
-		} catch {
-			continue;
-		}
-		const calculatedDigest = await crypto.subtle.digest(hashAlgo, body);
-		if (timingSafeEqual(digest, new Uint8Array(calculatedDigest))) return true;
-	}
-	return false;
-}
-async function verifyRequestRfc9421(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, meterProvider, tracerProvider } = {}) {
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"sig",
-		"http"
-	]);
-	if (request.bodyUsed) {
-		logger.error("Failed to verify; the request body is already consumed.", { url: request.url });
-		return noSignatureResult();
-	} else if (request.body?.locked) {
-		logger.error("Failed to verify; the request body is locked.", { url: request.url });
-		return noSignatureResult();
-	}
-	const originalRequest = request;
-	request = request.clone();
-	const signatureInputHeader = request.headers.get("Signature-Input");
-	if (!signatureInputHeader) {
-		logger.debug("Failed to verify; no Signature-Input header found.", { headers: Object.fromEntries(request.headers.entries()) });
-		return noSignatureResult();
-	}
-	const signatureHeader = request.headers.get("Signature");
-	if (!signatureHeader) {
-		logger.debug("Failed to verify; no Signature header found.", { headers: Object.fromEntries(request.headers.entries()) });
-		return noSignatureResult();
-	}
-	const signatureInputs = parseRfc9421SignatureInput(signatureInputHeader);
-	logger.debug("Parsed Signature-Input header: {signatureInputs}", { signatureInputs });
-	const signatures = parseRfc9421Signature(signatureHeader);
-	const signatureNames = Object.keys(signatureInputs);
-	if (signatureNames.length === 0) {
-		logger.debug("Failed to verify; no valid signatures found in Signature-Input header.", { header: signatureInputHeader });
-		return invalidSignatureResult(null);
-	}
-	let failure = noSignatureResult();
-	let failureAlgorithm;
-	const setFailure = (result, algorithm) => {
-		failure = result;
-		failureAlgorithm = algorithm;
-	};
-	for (const sigName of signatureNames) {
-		if (!signatures[sigName]) {
-			setFailure(invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId)));
-			continue;
-		}
-		const sigInput = signatureInputs[sigName];
-		const sigBytes = signatures[sigName];
-		const keyId = parseKeyId(sigInput.keyId);
-		if (!sigInput.keyId) {
-			logger.debug("Failed to verify; missing keyId in signature {signatureName}.", {
-				signatureName: sigName,
-				signatureInput: signatureInputHeader
-			});
-			setFailure(invalidSignatureResult(null));
-			continue;
-		}
-		if (!sigInput.created) {
-			logger.debug("Failed to verify; missing created timestamp in signature {signatureName}.", {
-				signatureName: sigName,
-				signatureInput: signatureInputHeader
-			});
-			setFailure(invalidSignatureResult(keyId));
-			continue;
-		}
-		const signatureCreated = Temporal.Instant.fromEpochMilliseconds(sigInput.created * 1e3);
-		const now = currentTime ?? Temporal.Now.instant();
-		if (timeWindow !== false) {
-			const tw = timeWindow ?? { hours: 1 };
-			if (Temporal.Instant.compare(signatureCreated, now.add(tw)) > 0) {
-				logger.debug("Failed to verify; signature created time is too far in the future.", {
-					created: signatureCreated.toString(),
-					now: now.toString()
-				});
-				setFailure(invalidSignatureResult(keyId));
-				continue;
-			} else if (Temporal.Instant.compare(signatureCreated, now.subtract(tw)) < 0) {
-				logger.debug("Failed to verify; signature created time is too far in the past.", {
-					created: signatureCreated.toString(),
-					now: now.toString()
-				});
-				setFailure(invalidSignatureResult(keyId));
-				continue;
-			}
-		}
-		if (request.method !== "GET" && request.method !== "HEAD" && sigInput.components.some((c) => c.value === "content-digest")) {
-			const contentDigestHeader = request.headers.get("Content-Digest");
-			if (!contentDigestHeader) {
-				logger.debug("Failed to verify; Content-Digest header required but not found.", { components: sigInput.components });
-				setFailure(invalidSignatureResult(keyId));
-				continue;
-			}
-			if (!await verifyRfc9421ContentDigest(contentDigestHeader, await request.arrayBuffer())) {
-				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
-				setFailure(invalidSignatureResult(keyId));
-				continue;
-			}
-		}
-		span?.setAttribute("http_signatures.key_id", sigInput.keyId);
-		span?.setAttribute("http_signatures.created", sigInput.created.toString());
-		if (keyId == null) {
-			setFailure(invalidSignatureResult(null));
-			continue;
-		}
-		const { key, cached, fetchError } = await measureSignatureKeyFetch(meterProvider, "http", () => fetchKeyDetailed(keyId, _fedify_vocab.CryptographicKey, {
-			documentLoader,
-			contextLoader,
-			keyCache,
-			tracerProvider,
-			meterProvider
-		}));
-		if (fetchError != null) {
-			setFailure(keyFetchErrorResult(keyId, fetchError));
-			continue;
-		}
-		if (!key) {
-			logger.debug("Failed to fetch key: {keyId}", { keyId: sigInput.keyId });
-			setFailure(invalidSignatureResult(keyId));
-			continue;
-		}
-		let alg = sigInput.alg?.toLowerCase();
-		if (alg == null) {
-			if (key.publicKey.algorithm.name === "RSASSA-PKCS1-v1_5") alg = "hash" in key.publicKey.algorithm ? key.publicKey.algorithm.hash === "SHA-512" ? "rsa-v1_5-sha512" : "rsa-v1_5-sha256" : "rsa-v1_5-sha256";
-			else if (key.publicKey.algorithm.name === "RSA-PSS") alg = "rsa-pss-sha512";
-			else if (key.publicKey.algorithm.name === "ECDSA") alg = "namedCurve" in key.publicKey.algorithm && key.publicKey.algorithm.namedCurve === "P-256" ? "ecdsa-p256-sha256" : "ecdsa-p384-sha384";
-			else if (key.publicKey.algorithm.name === "Ed25519") alg = "ed25519";
-		}
-		if (alg) span?.setAttribute("http_signatures.algorithm", alg);
-		const algorithm = alg && rfc9421AlgorithmMap[alg];
-		const candidateAlgorithm = algorithm ? alg : void 0;
-		if (!algorithm) {
-			logger.debug("Failed to verify; unsupported algorithm: {algorithm}", {
-				algorithm: sigInput.alg,
-				supported: Object.keys(rfc9421AlgorithmMap)
-			});
-			setFailure(invalidSignatureResult(keyId));
-			continue;
-		}
-		let signatureBase;
-		try {
-			signatureBase = createRfc9421SignatureBase(request, sigInput.components, sigInput.parameters);
-		} catch (error) {
-			logger.debug("Failed to create signature base for verification: {error}", {
-				error,
-				signatureInput: sigInput
-			});
-			setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
-			continue;
-		}
-		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
-		span?.setAttribute("http_signatures.signature", (0, byte_encodings_hex.encodeHex)(sigBytes));
-		try {
-			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes)) {
-				metricsContext.algorithm = candidateAlgorithm;
-				return {
-					verified: true,
-					key,
-					signatureLabel: sigName
-				};
-			} else if (cached) {
-				logger.debug("Failed to verify with cached key {keyId}; retrying with fresh key...", { keyId: sigInput.keyId });
-				return await verifyRequestRfc9421(originalRequest, span, metricsContext, {
-					documentLoader,
-					contextLoader,
-					timeWindow,
-					currentTime,
-					keyCache: {
-						get: () => Promise.resolve(void 0),
-						set: async (keyId, key) => await keyCache?.set(keyId, key)
-					},
-					spec: "rfc9421",
-					meterProvider,
-					tracerProvider
-				});
-			} else {
-				logger.debug("Failed to verify signature with fetched key {keyId}; signature invalid.", {
-					keyId: sigInput.keyId,
-					signatureBase
-				});
-				setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
-			}
-		} catch (error) {
-			logger.debug("Error during signature verification: {error}", {
-				error,
-				keyId: sigInput.keyId,
-				algorithm: sigInput.alg
-			});
-			setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
-		}
-	}
-	metricsContext.algorithm = failureAlgorithm;
-	return failure;
-}
-/**
-* Helper function to create a new Request for redirect handling.
-* @param request The original request.
-* @param location The redirect location.
-* @param body The request body as ArrayBuffer or null.
-* @returns A new Request object for the redirect.
-*/
-function createRedirectRequest(request, location, body) {
-	const url = new URL(location, request.url);
-	return new Request(url, {
-		method: request.method,
-		headers: request.headers,
-		body,
-		redirect: "manual",
-		signal: request.signal,
-		mode: request.mode,
-		credentials: request.credentials,
-		referrer: request.referrer,
-		referrerPolicy: request.referrerPolicy,
-		integrity: request.integrity,
-		keepalive: request.keepalive,
-		cache: request.cache
-	});
-}
-async function fetchDoubleKnockRequest(request, signedRequest, signal) {
-	const maxAttempts = request.method === "GET" || request.method === "HEAD" ? 2 : 1;
-	for (let attempt = 1;; attempt++) try {
-		return await fetch(signedRequest, {
-			redirect: "manual",
-			signal
-		});
-	} catch (error) {
-		const abortedSignal = getAbortedSignal(signal, request.signal, signedRequest.signal);
-		if (abortedSignal != null) throw getAbortReason(abortedSignal);
-		if (isAbortError(error)) throw error;
-		if (attempt >= maxAttempts) throw createFetchError(request.url, error);
-		await sleep(DOUBLE_KNOCK_TRANSPORT_RETRY_DELAY_MS, signal, request.signal, signedRequest.signal);
-	}
-}
-function createFetchError(url, cause) {
-	const error = new _fedify_vocab_runtime.FetchError(url, cause instanceof Error ? cause.message : String(cause));
-	error.cause = cause;
-	return error;
-}
-function isAbortError(error) {
-	return error instanceof Error && error.name === "AbortError";
-}
-async function sleep(ms, ...signals) {
-	const abortSignals = signals.filter((signal) => signal != null);
-	const abortedSignal = getAbortedSignal(...abortSignals);
-	if (abortedSignal != null) throw getAbortReason(abortedSignal);
-	if (abortSignals.length < 1) {
-		await new Promise((resolve) => setTimeout(resolve, ms));
-		return;
-	}
-	await new Promise((resolve, reject) => {
-		const removeAbortListeners = () => {
-			for (const signal of abortSignals) signal.removeEventListener("abort", handleAbort);
-		};
-		const timeout = setTimeout(() => {
-			removeAbortListeners();
-			resolve();
-		}, ms);
-		function handleAbort(event) {
-			clearTimeout(timeout);
-			removeAbortListeners();
-			reject(getAbortReason(event.currentTarget));
-		}
-		for (const signal of abortSignals) signal.addEventListener("abort", handleAbort, { once: true });
-	});
-}
-function getAbortedSignal(...signals) {
-	return signals.find((signal) => signal?.aborted);
-}
-function getAbortReason(signal) {
-	return signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
-}
-/**
-* Performs a double-knock request to the given URL.  For the details of
-* double-knocking, see
-* <https://swicg.github.io/activitypub-http-signature/#how-to-upgrade-supported-versions>.
-* @param request The request to send.
-* @param identity The identity to use for signing the request.
-* @param options The options for double-knock requests.
-* @returns The response to the request.
-* @since 1.6.0
-*/
-async function doubleKnock(request, identity, options = {}) {
-	return await doubleKnockInternal(request, identity, options);
-}
-async function doubleKnockInternal(request, identity, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
-	const { specDeterminer, log, tracerProvider, signal } = options;
-	const maximumRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
-	visited.add(request.url);
-	const origin = new URL(request.url).origin;
-	const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
-	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
-	let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
-		spec: firstTrySpec,
-		tracerProvider,
-		body
-	});
-	log?.(signedRequest);
-	let response = await fetchDoubleKnockRequest(request, signedRequest, signal);
-	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-		if (redirected >= maximumRedirection) throw new _fedify_vocab_runtime.FetchError(request.url, `Too many redirections (${redirected + 1})`);
-		const redirectRequest = createRedirectRequest(request, response.headers.get("Location"), body);
-		if (visited.has(redirectRequest.url)) throw new _fedify_vocab_runtime.FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
-		return doubleKnockInternal(redirectRequest, identity, {
-			...options,
-			body
-		}, redirected + 1, visited);
-	} else if (response.status === 400 || response.status === 401 || response.status > 401) {
-		const logger = (0, _logtape_logtape.getLogger)([
-			"fedify",
-			"sig",
-			"http"
-		]);
-		const acceptSigHeader = response.headers.get("Accept-Signature");
-		if (acceptSigHeader != null) {
-			const entries = validateAcceptSignature(parseAcceptSignature(acceptSigHeader));
-			const localKeyId = identity.keyId.href;
-			const localAlg = "rsa-v1_5-sha256";
-			let fulfilled = false;
-			let challengeRequest;
-			for (const entry of entries) {
-				const rfc9421 = fulfillAcceptSignature(entry, localKeyId, localAlg);
-				if (rfc9421 == null) continue;
-				logger.debug("Received Accept-Signature challenge; accumulating label {label} and components {components}.", {
-					label: rfc9421.label,
-					components: rfc9421.components
-				});
-				try {
-					challengeRequest = await signRequest(challengeRequest ?? request, identity.privateKey, identity.keyId, {
-						spec: "rfc9421",
-						tracerProvider,
-						body,
-						rfc9421
-					});
-					fulfilled = true;
-				} catch (error) {
-					logger.debug("Failed to fulfill Accept-Signature challenge entry {label}: {error}", {
-						label: entry.label,
-						error
-					});
-				}
-			}
-			if (fulfilled && challengeRequest != null) {
-				signedRequest = challengeRequest;
-				log?.(signedRequest);
-				response = await fetch(signedRequest, {
-					redirect: "manual",
-					signal
-				});
-				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) return doubleKnock(createRedirectRequest(request, response.headers.get("Location"), body), identity, {
-					...options,
-					body
-				});
-			}
-			if (fulfilled && response.status < 300) {
-				await specDeterminer?.rememberSpec(origin, "rfc9421");
-				return response;
-			}
-			if (fulfilled && response.status !== 400 && response.status !== 401) return response;
-		}
-		const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
-		logger.debug("Failed to verify with the spec {spec} ({status} {statusText}); retrying with spec {secondSpec}... (double-knocking)", {
-			spec: firstTrySpec,
-			secondSpec: spec,
-			status: response.status,
-			statusText: response.statusText
-		});
-		signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
-			spec,
-			tracerProvider,
-			body
-		});
-		log?.(signedRequest);
-		response = await fetchDoubleKnockRequest(request, signedRequest, signal);
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-			if (redirected >= maximumRedirection) throw new _fedify_vocab_runtime.FetchError(request.url, `Too many redirections (${redirected + 1})`);
-			const redirectRequest = createRedirectRequest(request, response.headers.get("Location"), body);
-			if (visited.has(redirectRequest.url)) throw new _fedify_vocab_runtime.FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
-			return doubleKnockInternal(redirectRequest, identity, {
-				...options,
-				body
-			}, redirected + 1, visited);
-		} else if (response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
-	} else await specDeterminer?.rememberSpec(origin, firstTrySpec);
-	return response;
-}
-/**
-* Performs a timing-safe equality comparison between two `Uint8Array` values.
-*
-* This function is designed to take a constant amount of time to execute,
-* dependent only on the length of the longer of the two arrays,
-* regardless of where the first difference in bytes occurs. This helps
-* prevent timing attacks.
-*
-* @param a The first bytes.
-* @param b The second bytes.
-* @returns `true` if the arrays are of the same length and contain the same
-*          bytes, `false` otherwise.
-* @since 1.6.0
-*/
-function timingSafeEqual(a, b) {
-	const lenA = a.length;
-	const lenB = b.length;
-	const commonLength = Math.max(lenA, lenB);
-	let result = 0;
-	for (let i = 0; i < commonLength; i++) {
-		const byteA = i < lenA ? a[i] : 0;
-		const byteB = i < lenB ? b[i] : 0;
-		result |= byteA ^ byteB;
-	}
-	result |= lenA ^ lenB;
-	return result === 0;
-}
-//#endregion
-Object.defineProperty(exports, "doubleKnock", {
-	enumerable: true,
-	get: function() {
-		return doubleKnock;
-	}
-});
-Object.defineProperty(exports, "exportJwk", {
-	enumerable: true,
-	get: function() {
-		return exportJwk;
-	}
-});
-Object.defineProperty(exports, "fetchKey", {
-	enumerable: true,
-	get: function() {
-		return fetchKey;
-	}
-});
-Object.defineProperty(exports, "fetchKeyDetailed", {
-	enumerable: true,
-	get: function() {
-		return fetchKeyDetailed;
-	}
-});
-Object.defineProperty(exports, "formatAcceptSignature", {
-	enumerable: true,
-	get: function() {
-		return formatAcceptSignature;
-	}
-});
-Object.defineProperty(exports, "fulfillAcceptSignature", {
-	enumerable: true,
-	get: function() {
-		return fulfillAcceptSignature;
-	}
-});
-Object.defineProperty(exports, "generateCryptoKeyPair", {
-	enumerable: true,
-	get: function() {
-		return generateCryptoKeyPair;
-	}
-});
-Object.defineProperty(exports, "getDurationMs", {
-	enumerable: true,
-	get: function() {
-		return getDurationMs;
-	}
-});
-Object.defineProperty(exports, "getFederationMetrics", {
-	enumerable: true,
-	get: function() {
-		return getFederationMetrics;
-	}
-});
-Object.defineProperty(exports, "getRemoteHost", {
-	enumerable: true,
-	get: function() {
-		return getRemoteHost;
-	}
-});
-Object.defineProperty(exports, "importJwk", {
-	enumerable: true,
-	get: function() {
-		return importJwk;
-	}
-});
-Object.defineProperty(exports, "instrumentDocumentLoader", {
-	enumerable: true,
-	get: function() {
-		return instrumentDocumentLoader;
-	}
-});
-Object.defineProperty(exports, "isAbortError", {
-	enumerable: true,
-	get: function() {
-		return isAbortError$1;
-	}
-});
-Object.defineProperty(exports, "measureSignatureKeyFetch", {
-	enumerable: true,
-	get: function() {
-		return measureSignatureKeyFetch;
-	}
-});
-Object.defineProperty(exports, "name", {
-	enumerable: true,
-	get: function() {
-		return name;
-	}
-});
-Object.defineProperty(exports, "parseAcceptSignature", {
-	enumerable: true,
-	get: function() {
-		return parseAcceptSignature;
-	}
-});
-Object.defineProperty(exports, "parseRfc9421SignatureInput", {
-	enumerable: true,
-	get: function() {
-		return parseRfc9421SignatureInput;
-	}
-});
-Object.defineProperty(exports, "recordCircuitBreakerStateChange", {
-	enumerable: true,
-	get: function() {
-		return recordCircuitBreakerStateChange;
-	}
-});
-Object.defineProperty(exports, "recordCollectionDispatchDuration", {
-	enumerable: true,
-	get: function() {
-		return recordCollectionDispatchDuration;
-	}
-});
-Object.defineProperty(exports, "recordCollectionPageItems", {
-	enumerable: true,
-	get: function() {
-		return recordCollectionPageItems;
-	}
-});
-Object.defineProperty(exports, "recordCollectionRequest", {
-	enumerable: true,
-	get: function() {
-		return recordCollectionRequest;
-	}
-});
-Object.defineProperty(exports, "recordCollectionTotalItems", {
-	enumerable: true,
-	get: function() {
-		return recordCollectionTotalItems;
-	}
-});
-Object.defineProperty(exports, "recordDocumentCache", {
-	enumerable: true,
-	get: function() {
-		return recordDocumentCache;
-	}
-});
-Object.defineProperty(exports, "recordFanoutRecipients", {
-	enumerable: true,
-	get: function() {
-		return recordFanoutRecipients;
-	}
-});
-Object.defineProperty(exports, "recordInboxActivity", {
-	enumerable: true,
-	get: function() {
-		return recordInboxActivity;
-	}
-});
-Object.defineProperty(exports, "recordOutboxActivity", {
-	enumerable: true,
-	get: function() {
-		return recordOutboxActivity;
-	}
-});
-Object.defineProperty(exports, "recordOutboxEnqueue", {
-	enumerable: true,
-	get: function() {
-		return recordOutboxEnqueue;
-	}
-});
-Object.defineProperty(exports, "recordWebFingerHandle", {
-	enumerable: true,
-	get: function() {
-		return recordWebFingerHandle;
-	}
-});
-Object.defineProperty(exports, "registerQueueDepthGauge", {
-	enumerable: true,
-	get: function() {
-		return registerQueueDepthGauge;
-	}
-});
-Object.defineProperty(exports, "signRequest", {
-	enumerable: true,
-	get: function() {
-		return signRequest;
-	}
-});
-Object.defineProperty(exports, "validateAcceptSignature", {
-	enumerable: true,
-	get: function() {
-		return validateAcceptSignature;
-	}
-});
-Object.defineProperty(exports, "validateCryptoKey", {
-	enumerable: true,
-	get: function() {
-		return validateCryptoKey;
-	}
-});
-Object.defineProperty(exports, "verifyRequest", {
-	enumerable: true,
-	get: function() {
-		return verifyRequest;
-	}
-});
-Object.defineProperty(exports, "verifyRequestDetailed", {
-	enumerable: true,
-	get: function() {
-		return verifyRequestDetailed;
-	}
-});
-Object.defineProperty(exports, "version", {
-	enumerable: true,
-	get: function() {
-		return version;
-	}
-});