@fedify/fedify 2.4.0-dev.1951 → 2.4.0-dev.1959

package/dist/{federation-BAtfz-C3.cjs → federation-BNJgxgH6.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-BTD1L4Sv.cjs");
-const require_proof = require("./proof-B_yPn2BI.cjs");
+const require_http = require("./http-BuOvqNbW.cjs");
+const require_proof = require("./proof-BVpjHUMS.cjs");
 const require_types = require("./types-RXm5YxpC.cjs");
-const require_kv_cache = require("./kv-cache-D3gKJwUK.cjs");
+const require_kv_cache = require("./kv-cache-Btl0s7i7.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -1463,12 +1463,14 @@ var KvKeyCache = class {
 	prefix;
 	options;
 	unavailableKeyTtl;
+	keyTtl;
 	nullKeys;
 	constructor(kv, prefix, options = {}) {
 		this.kv = kv;
 		this.prefix = prefix;
 		this.options = options;
 		this.unavailableKeyTtl = options.unavailableKeyTtl ?? Temporal$8.Duration.from({ minutes: 10 });
+		this.keyTtl = options.keyTtl ?? Temporal$8.Duration.from({ days: 30 });
 		this.nullKeys = /* @__PURE__ */ new Map();
 	}
 	#getFetchErrorKey(keyId) {
@@ -1509,7 +1511,7 @@ var KvKeyCache = class {
 		}
 		this.nullKeys.delete(keyId.href);
 		const serialized = await key.toJsonLd(this.options);
-		await this.kv.set([...this.prefix, keyId.href], serialized);
+		await this.kv.set([...this.prefix, keyId.href], serialized, { ttl: this.keyTtl });
 	}
 	async getFetchError(keyId) {
 		const cached = await this.kv.get(this.#getFetchErrorKey(keyId));
@@ -2467,7 +2469,7 @@ async function handleInbox(request, options) {
 * @returns A promise that resolves to an HTTP response.
 */
 async function handleInboxInternal(request, parameters, span) {
-	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider } = parameters;
+	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider } = parameters;
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
@@ -2538,7 +2540,12 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
-	const keyCache = new KvKeyCache(kv, kvPrefixes.publicKey, ctx);
+	const keyCache = new KvKeyCache(kv, kvPrefixes.publicKey, {
+		documentLoader: ctx.documentLoader,
+		contextLoader: ctx.contextLoader,
+		tracerProvider,
+		keyTtl: publicKeyTtl
+	});
 	const jsonWithoutSig = require_proof.detachSignature(json);
 	const hasLdSignature = require_proof.hasSignature(json);
 	const canAttemptAlternateAuthAfterLdSignatureFailure = skipSignatureVerification || hasHttpSignatureHeaders(request) || hasObjectIntegrityProof(jsonWithoutSig);
@@ -4763,6 +4770,8 @@ function createFederation(options) {
 var FederationImpl = class extends FederationBuilderImpl {
 	kv;
 	kvPrefixes;
+	publicKeyTtl;
+	httpMessageSignaturesSpecTtl;
 	inboxQueue;
 	outboxQueue;
 	fanoutQueue;
@@ -4828,6 +4837,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 			taskDeduplication: ["_fedify", "taskDeduplication"],
 			...options.kvPrefixes ?? {}
 		};
+		this.publicKeyTtl = Temporal$2.Duration.from(options.publicKeyTtl ?? { days: 30 });
+		this.httpMessageSignaturesSpecTtl = Temporal$2.Duration.from(options.httpMessageSignaturesSpecTtl ?? { days: 90 });
 		if (options.queue == null) {
 			this.inboxQueue = void 0;
 			this.outboxQueue = void 0;
@@ -4930,7 +4941,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		this.authenticatedDocumentLoaderFactory = (identity, factoryOpts) => require_http.instrumentDocumentLoader(userAuthFactory != null ? userAuthFactory(identity, factoryOpts) : require_kv_cache.getAuthenticatedDocumentLoader(identity, {
 			allowPrivateAddress: factoryOpts?.allowPrivateAddress ?? allowPrivateAddress,
 			userAgent: factoryOpts?.userAgent ?? userAgent,
-			specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, options.firstKnock),
+			specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, options.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 			tracerProvider: this.tracerProvider
 		}), {
 			meterProvider: this._meterProvider,
@@ -5305,7 +5316,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				inbox,
 				sharedInbox: message.sharedInbox,
 				headers: new Headers(message.headers),
-				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock),
+				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
 			});
@@ -5926,7 +5937,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				inbox: new URL(inbox),
 				sharedInbox: inboxes[inbox].sharedInbox,
 				headers: collectionSync == null ? void 0 : new Headers({ "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) }),
-				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock),
+				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
 			}));
@@ -6239,6 +6250,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					inboxContextFactory,
 					kv: this.kv,
 					kvPrefixes: this.kvPrefixes,
+					publicKeyTtl: this.publicKeyTtl,
 					queue: this.inboxQueue,
 					actorDispatcher: this.actorCallbacks?.dispatcher,
 					inboxListeners: this.inboxListeners,
@@ -6980,7 +6992,12 @@ var ContextImpl = class ContextImpl {
 		]);
 		const contextLoader = options.contextLoader ?? this.contextLoader;
 		const json = await activity.toJsonLd({ contextLoader });
-		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, this);
+		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
+			documentLoader: this.documentLoader,
+			contextLoader: this.contextLoader,
+			tracerProvider: this.tracerProvider,
+			keyTtl: this.federation.publicKeyTtl
+		});
 		if (await require_proof.verifyObject(_fedify_vocab.Activity, json, {
 			contextLoader,
 			documentLoader: options.documentLoader ?? this.documentLoader,
@@ -7255,7 +7272,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			sharedInbox: inboxes[inbox].sharedInbox,
 			meterProvider: ctx.meterProvider,
 			tracerProvider: ctx.tracerProvider,
-			specDeterminer: new KvSpecDeterminer(ctx.federation.kv, ctx.federation.kvPrefixes.httpMessageSignaturesSpec, ctx.federation.firstKnock)
+			specDeterminer: new KvSpecDeterminer(ctx.federation.kv, ctx.federation.kvPrefixes.httpMessageSignaturesSpec, ctx.federation.firstKnock, { specTtl: ctx.federation.httpMessageSignaturesSpecTtl })
 		}));
 		await Promise.all(promises);
 		return true;
@@ -7426,16 +7443,18 @@ var KvSpecDeterminer = class {
 	kv;
 	prefix;
 	defaultSpec;
-	constructor(kv, prefix, defaultSpec = "rfc9421") {
+	specTtl;
+	constructor(kv, prefix, defaultSpec = "rfc9421", options = {}) {
 		this.kv = kv;
 		this.prefix = prefix;
 		this.defaultSpec = defaultSpec;
+		this.specTtl = options.specTtl ?? Temporal$2.Duration.from({ days: 90 });
 	}
 	async determineSpec(origin) {
 		return await this.kv.get([...this.prefix, origin]) ?? this.defaultSpec;
 	}
 	async rememberSpec(origin, spec) {
-		await this.kv.set([...this.prefix, origin], spec);
+		await this.kv.set([...this.prefix, origin], spec, { ttl: this.specTtl });
 	}
 };
 function notFound(_request) {

package/dist/{http-CnBZmc4J.js → http-Bh37_81O.js}

@@ -10,7 +10,7 @@ import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } fro
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.1951+5c417eb8";
+var version = "2.4.0-dev.1959+0da7be03";
 //#endregion
 //#region src/sig/accept.ts
 /**

package/dist/{http-BTD1L4Sv.cjs → http-BuOvqNbW.cjs}

@@ -9,7 +9,7 @@ let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conve
 let byte_encodings_base64 = require("byte-encodings/base64");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.1951+5c417eb8";
+var version = "2.4.0-dev.1959+0da7be03";
 //#endregion
 //#region ../../node_modules/.pnpm/temporal-polyfill@1.0.1/node_modules/temporal-polyfill/chunks/root.js
 const NativeTemporal = globalThis.Temporal;

package/dist/{http-Cssq59HU.mjs → http-DyXZdUng.mjs}

@@ -1,10 +1,10 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-U6Pe1U6h.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-KDlQIBxX.mjs";
+import { n as version, t as name } from "./deno-Xg7DR4LS.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B7-JxJSv.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
-import { o as validateCryptoKey, r as fetchKeyDetailed } from "./key-GeKuVU-k.mjs";
+import { o as validateCryptoKey, r as fetchKeyDetailed } from "./key-CXsAkAt6.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{key-GeKuVU-k.mjs → key-CXsAkAt6.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-U6Pe1U6h.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-KDlQIBxX.mjs";
+import { n as version, t as name } from "./deno-Xg7DR4LS.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-B7-JxJSv.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{keycache-0Jk78XmB.mjs → keycache-ZLqIfrkL.mjs}

@@ -8,12 +8,14 @@ var KvKeyCache = class {
 	prefix;
 	options;
 	unavailableKeyTtl;
+	keyTtl;
 	nullKeys;
 	constructor(kv, prefix, options = {}) {
 		this.kv = kv;
 		this.prefix = prefix;
 		this.options = options;
 		this.unavailableKeyTtl = options.unavailableKeyTtl ?? Temporal.Duration.from({ minutes: 10 });
+		this.keyTtl = options.keyTtl ?? Temporal.Duration.from({ days: 30 });
 		this.nullKeys = /* @__PURE__ */ new Map();
 	}
 	#getFetchErrorKey(keyId) {
@@ -54,7 +56,7 @@ var KvKeyCache = class {
 		}
 		this.nullKeys.delete(keyId.href);
 		const serialized = await key.toJsonLd(this.options);
-		await this.kv.set([...this.prefix, keyId.href], serialized);
+		await this.kv.set([...this.prefix, keyId.href], serialized, { ttl: this.keyTtl });
 	}
 	async getFetchError(keyId) {
 		const cached = await this.kv.get(this.#getFetchErrorKey(keyId));

package/dist/kv-DBRWVx3Q.mjs

@@ -0,0 +1,104 @@
+import { Temporal } from "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as MemoryKvStore } from "./kv-DCHkaJ9-.mjs";
+//#region src/testing/kv.ts
+/**
+* A {@link KvStore} decorator whose entry expiry is driven by a virtual clock
+* instead of wall-clock time.
+*
+* {@link MemoryKvStore} decides expiry by comparing timestamps rather than by
+* scheduling timers, so a test that wants to observe a TTL elapsing would
+* otherwise have to sleep for longer than the TTL and hope the runner keeps
+* up.  That makes such tests both slow and load-sensitive.
+*
+* This decorator keeps the TTLs itself and never passes them to the store it
+* wraps, so nothing expires until {@link advance} moves the clock.  Cache
+* hits, expiry, and repopulation therefore all become deterministic, without
+* patching any global and without a test-only entry point in the library
+* itself.  The clock starts at the Unix epoch and only ever moves forward.
+*/
+var ManualClockKvStore = class {
+	#inner;
+	#expirations = /* @__PURE__ */ new Map();
+	#now = Temporal.Instant.fromEpochMilliseconds(0);
+	/**
+	* Present only when the wrapped store has its own `cas()`.  Callers such as
+	* the task deduplication planner test `kv.cas != null` to decide whether a
+	* conditional write is available, so the decorator must not advertise a
+	* capability the wrapped store lacks.
+	*/
+	cas;
+	constructor(inner = new MemoryKvStore()) {
+		this.#inner = inner;
+		const innerCas = inner.cas;
+		if (innerCas != null) this.cas = async (key, expectedValue, newValue, options) => {
+			await this.#evictIfExpired(key);
+			const swapped = await innerCas.call(inner, key, expectedValue, newValue);
+			if (swapped) this.#recordTtl(key, options);
+			return swapped;
+		};
+	}
+	/**
+	* The current reading of the virtual clock.
+	*/
+	get now() {
+		return this.#now;
+	}
+	/**
+	* Moves the virtual clock forward.  Any entry whose TTL has elapsed by the
+	* new time reads as missing from this point on, exactly as it would once a
+	* real `KvStore` had let it expire.
+	*/
+	advance(duration) {
+		this.#now = this.#now.add(Temporal.Duration.from(duration).round({ largestUnit: "hour" }));
+	}
+	#encodeKey(key) {
+		return JSON.stringify(key);
+	}
+	/**
+	* Drops the entry if its TTL has elapsed.  Mirrors {@link MemoryKvStore},
+	* which treats an entry as live up to and including its expiration instant.
+	*/
+	async #evictIfExpired(key) {
+		const encodedKey = this.#encodeKey(key);
+		const expiration = this.#expirations.get(encodedKey);
+		if (expiration == null) return;
+		if (this.#now.until(expiration).sign >= 0) return;
+		this.#expirations.delete(encodedKey);
+		await this.#inner.delete(key);
+	}
+	async #evictAllExpired() {
+		for (const [encodedKey, expiration] of [...this.#expirations]) {
+			if (this.#now.until(expiration).sign >= 0) continue;
+			this.#expirations.delete(encodedKey);
+			await this.#inner.delete(JSON.parse(encodedKey));
+		}
+	}
+	#recordTtl(key, options) {
+		const encodedKey = this.#encodeKey(key);
+		if (options?.ttl == null) {
+			this.#expirations.delete(encodedKey);
+			return;
+		}
+		this.#expirations.set(encodedKey, this.#now.add(options.ttl.round({ largestUnit: "hour" })));
+	}
+	async get(key) {
+		await this.#evictIfExpired(key);
+		return await this.#inner.get(key);
+	}
+	async set(key, value, options) {
+		this.#recordTtl(key, options);
+		await this.#inner.set(key, value);
+	}
+	async delete(key) {
+		this.#expirations.delete(this.#encodeKey(key));
+		await this.#inner.delete(key);
+	}
+	async *list(prefix) {
+		await this.#evictAllExpired();
+		yield* this.#inner.list(prefix);
+	}
+};
+//#endregion
+export { ManualClockKvStore as t };

package/dist/{kv-cache-D3gKJwUK.cjs → kv-cache-Btl0s7i7.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-BTD1L4Sv.cjs");
+const require_http = require("./http-BuOvqNbW.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");

package/dist/{kv-cache-CoMnysg5.mjs → kv-cache-BubmP7z9.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-KDlQIBxX.mjs";
+import { p as recordDocumentCache } from "./metrics-B7-JxJSv.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-CMUnx7rx.js → kv-cache-DjFxdXjk.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { C as recordDocumentCache, d as validateCryptoKey, t as doubleKnock } from "./http-CnBZmc4J.js";
+import { C as recordDocumentCache, d as validateCryptoKey, t as doubleKnock } from "./http-Bh37_81O.js";
 import { getLogger } from "@logtape/logtape";
 import { curry } from "es-toolkit";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/{ld-BLl_mzo2.mjs → ld-C5Qv0_xn.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-U6Pe1U6h.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-KDlQIBxX.mjs";
-import { n as fetchKey, o as validateCryptoKey } from "./key-GeKuVU-k.mjs";
+import { n as version, t as name } from "./deno-Xg7DR4LS.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B7-JxJSv.mjs";
+import { n as fetchKey, o as validateCryptoKey } from "./key-CXsAkAt6.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-KDlQIBxX.mjs → metrics-B7-JxJSv.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-U6Pe1U6h.mjs";
+import { n as version, t as name } from "./deno-Xg7DR4LS.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-CIlcGav-.mjs → middleware-BfRUvR8e.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-D-vIOT8Y.mjs";
+import { n as FederationImpl } from "./middleware-DB_evWhA.mjs";
 export { FederationImpl };

package/dist/{middleware-aheUmEPU.js → middleware-CF539vn2.js}

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { A as formatAcceptSignature, D as recordOutboxEnqueue, E as recordOutboxActivity, F as version, O as recordWebFingerHandle, P as name, S as recordCollectionTotalItems, T as recordInboxActivity, a as verifyRequestDetailed, b as recordCollectionPageItems, d as validateCryptoKey, f as getDurationMs, g as isAbortError, h as instrumentDocumentLoader, i as verifyRequest, k as registerQueueDepthGauge, m as getRemoteHost, n as parseRfc9421SignatureInput, o as exportJwk, p as getFederationMetrics, t as doubleKnock, u as importJwk, v as recordCircuitBreakerStateChange, w as recordFanoutRecipients, x as recordCollectionRequest, y as recordCollectionDispatchDuration } from "./http-CnBZmc4J.js";
-import { S as verifyCompactJsonLd, T as wrapContextLoaderForJsonLd, _ as hasSignature, b as isInvalidUrlTypeError, c as doesActorOwnKey, d as assertSafeJsonLd, g as getNormalizationContextLoader, h as detachSignature, i as verifyObject, l as getKeyOwner, n as hasProofLike, p as compactJsonLd, r as signObject, s as normalizeOutgoingActivityJsonLd, u as InvalidContextReferenceError, v as hasSignatureLike, x as signJsonLd, y as isClearlyMalformedContextReference } from "./proof-CLZurGKe.js";
+import { A as formatAcceptSignature, D as recordOutboxEnqueue, E as recordOutboxActivity, F as version, O as recordWebFingerHandle, P as name, S as recordCollectionTotalItems, T as recordInboxActivity, a as verifyRequestDetailed, b as recordCollectionPageItems, d as validateCryptoKey, f as getDurationMs, g as isAbortError, h as instrumentDocumentLoader, i as verifyRequest, k as registerQueueDepthGauge, m as getRemoteHost, n as parseRfc9421SignatureInput, o as exportJwk, p as getFederationMetrics, t as doubleKnock, u as importJwk, v as recordCircuitBreakerStateChange, w as recordFanoutRecipients, x as recordCollectionRequest, y as recordCollectionDispatchDuration } from "./http-Bh37_81O.js";
+import { S as verifyCompactJsonLd, T as wrapContextLoaderForJsonLd, _ as hasSignature, b as isInvalidUrlTypeError, c as doesActorOwnKey, d as assertSafeJsonLd, g as getNormalizationContextLoader, h as detachSignature, i as verifyObject, l as getKeyOwner, n as hasProofLike, p as compactJsonLd, r as signObject, s as normalizeOutgoingActivityJsonLd, u as InvalidContextReferenceError, v as hasSignatureLike, x as signJsonLd, y as isClearlyMalformedContextReference } from "./proof-3rlJfM0Z.js";
 import { n as getNodeInfo, t as nodeInfoToJson } from "./types-Dtyf8lVj.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-CMUnx7rx.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DjFxdXjk.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -1460,12 +1460,14 @@ var KvKeyCache = class {
 	prefix;
 	options;
 	unavailableKeyTtl;
+	keyTtl;
 	nullKeys;
 	constructor(kv, prefix, options = {}) {
 		this.kv = kv;
 		this.prefix = prefix;
 		this.options = options;
 		this.unavailableKeyTtl = options.unavailableKeyTtl ?? Temporal.Duration.from({ minutes: 10 });
+		this.keyTtl = options.keyTtl ?? Temporal.Duration.from({ days: 30 });
 		this.nullKeys = /* @__PURE__ */ new Map();
 	}
 	#getFetchErrorKey(keyId) {
@@ -1506,7 +1508,7 @@ var KvKeyCache = class {
 		}
 		this.nullKeys.delete(keyId.href);
 		const serialized = await key.toJsonLd(this.options);
-		await this.kv.set([...this.prefix, keyId.href], serialized);
+		await this.kv.set([...this.prefix, keyId.href], serialized, { ttl: this.keyTtl });
 	}
 	async getFetchError(keyId) {
 		const cached = await this.kv.get(this.#getFetchErrorKey(keyId));
@@ -2462,7 +2464,7 @@ async function handleInbox(request, options) {
 * @returns A promise that resolves to an HTTP response.
 */
 async function handleInboxInternal(request, parameters, span) {
-	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider } = parameters;
+	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider } = parameters;
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -2533,7 +2535,12 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
-	const keyCache = new KvKeyCache(kv, kvPrefixes.publicKey, ctx);
+	const keyCache = new KvKeyCache(kv, kvPrefixes.publicKey, {
+		documentLoader: ctx.documentLoader,
+		contextLoader: ctx.contextLoader,
+		tracerProvider,
+		keyTtl: publicKeyTtl
+	});
 	const jsonWithoutSig = detachSignature(json);
 	const hasLdSignature = hasSignature(json);
 	const canAttemptAlternateAuthAfterLdSignatureFailure = skipSignatureVerification || hasHttpSignatureHeaders(request) || hasObjectIntegrityProof(jsonWithoutSig);
@@ -4667,6 +4674,8 @@ function createFederation(options) {
 var FederationImpl = class extends FederationBuilderImpl {
 	kv;
 	kvPrefixes;
+	publicKeyTtl;
+	httpMessageSignaturesSpecTtl;
 	inboxQueue;
 	outboxQueue;
 	fanoutQueue;
@@ -4732,6 +4741,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 			taskDeduplication: ["_fedify", "taskDeduplication"],
 			...options.kvPrefixes ?? {}
 		};
+		this.publicKeyTtl = Temporal.Duration.from(options.publicKeyTtl ?? { days: 30 });
+		this.httpMessageSignaturesSpecTtl = Temporal.Duration.from(options.httpMessageSignaturesSpecTtl ?? { days: 90 });
 		if (options.queue == null) {
 			this.inboxQueue = void 0;
 			this.outboxQueue = void 0;
@@ -4834,7 +4845,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		this.authenticatedDocumentLoaderFactory = (identity, factoryOpts) => instrumentDocumentLoader(userAuthFactory != null ? userAuthFactory(identity, factoryOpts) : getAuthenticatedDocumentLoader(identity, {
 			allowPrivateAddress: factoryOpts?.allowPrivateAddress ?? allowPrivateAddress,
 			userAgent: factoryOpts?.userAgent ?? userAgent,
-			specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, options.firstKnock),
+			specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, options.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 			tracerProvider: this.tracerProvider
 		}), {
 			meterProvider: this._meterProvider,
@@ -5209,7 +5220,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				inbox,
 				sharedInbox: message.sharedInbox,
 				headers: new Headers(message.headers),
-				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock),
+				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
 			});
@@ -5830,7 +5841,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				inbox: new URL(inbox),
 				sharedInbox: inboxes[inbox].sharedInbox,
 				headers: collectionSync == null ? void 0 : new Headers({ "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) }),
-				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock),
+				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
 			}));
@@ -6143,6 +6154,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					inboxContextFactory,
 					kv: this.kv,
 					kvPrefixes: this.kvPrefixes,
+					publicKeyTtl: this.publicKeyTtl,
 					queue: this.inboxQueue,
 					actorDispatcher: this.actorCallbacks?.dispatcher,
 					inboxListeners: this.inboxListeners,
@@ -6884,7 +6896,12 @@ var ContextImpl = class ContextImpl {
 		]);
 		const contextLoader = options.contextLoader ?? this.contextLoader;
 		const json = await activity.toJsonLd({ contextLoader });
-		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, this);
+		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
+			documentLoader: this.documentLoader,
+			contextLoader: this.contextLoader,
+			tracerProvider: this.tracerProvider,
+			keyTtl: this.federation.publicKeyTtl
+		});
 		if (await verifyObject(Activity, json, {
 			contextLoader,
 			documentLoader: options.documentLoader ?? this.documentLoader,
@@ -7159,7 +7176,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			sharedInbox: inboxes[inbox].sharedInbox,
 			meterProvider: ctx.meterProvider,
 			tracerProvider: ctx.tracerProvider,
-			specDeterminer: new KvSpecDeterminer(ctx.federation.kv, ctx.federation.kvPrefixes.httpMessageSignaturesSpec, ctx.federation.firstKnock)
+			specDeterminer: new KvSpecDeterminer(ctx.federation.kv, ctx.federation.kvPrefixes.httpMessageSignaturesSpec, ctx.federation.firstKnock, { specTtl: ctx.federation.httpMessageSignaturesSpecTtl })
 		}));
 		await Promise.all(promises);
 		return true;
@@ -7330,16 +7347,18 @@ var KvSpecDeterminer = class {
 	kv;
 	prefix;
 	defaultSpec;
-	constructor(kv, prefix, defaultSpec = "rfc9421") {
+	specTtl;
+	constructor(kv, prefix, defaultSpec = "rfc9421", options = {}) {
 		this.kv = kv;
 		this.prefix = prefix;
 		this.defaultSpec = defaultSpec;
+		this.specTtl = options.specTtl ?? Temporal.Duration.from({ days: 90 });
 	}
 	async determineSpec(origin) {
 		return await this.kv.get([...this.prefix, origin]) ?? this.defaultSpec;
 	}
 	async rememberSpec(origin, spec) {
-		await this.kv.set([...this.prefix, origin], spec);
+		await this.kv.set([...this.prefix, origin], spec, { ttl: this.specTtl });
 	}
 };
 function notFound(_request) {