@fedify/fedify 2.4.0-dev.2149 → 2.4.0-dev.2157

package/dist/{http-C_jobbLz.cjs → http-BObQoB0j.cjs}

@@ -16,7 +16,7 @@ json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2149+e2302034";
+var version = "2.4.0-dev.2157+b76e5888";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -5804,7 +5804,7 @@ function normalizeContextReference(reference, baseUrl) {
 /** @internal */
 function isInvalidUrlTypeError(error) {
 	const code = error.code;
-	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+	return error instanceof TypeError && (code === "ERR_INVALID_URL" || error.message === "Invalid URL string." || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
 }
 async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
 	if (context === null) return createGraphAliasContextState();
@@ -7300,6 +7300,11 @@ function hasValidPortableProofShape(proofValue) {
 		return Array.isArray(values) && values.length === 1 && !(isJsonLdNode(values[0]) && "@list" in values[0]);
 	});
 }
+/**
+* Classifies an expanded JSON-LD node into an FEP-2277 core type by the
+* properties it has.
+* @internal
+*/
 function classifyFep2277CoreType(node) {
 	if (FEP_2277_ACTOR_PROPERTIES.every((property) => property in node)) return "actor";
 	if (`${SECURITY_NAMESPACE}publicKeyMultibase` in node) return "verificationMethod";
@@ -8903,6 +8908,8 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 		failure = result;
 		failureAlgorithm = algorithm;
 	};
+	let body = null;
+	let digestValid = null;
 	for (const sigName of signatureNames) {
 		if (!signatures[sigName]) {
 			setFailure(invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId)));
@@ -8954,7 +8961,9 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 				setFailure(invalidSignatureResult(keyId));
 				continue;
 			}
-			if (!await verifyRfc9421ContentDigest(contentDigestHeader, await request.arrayBuffer())) {
+			body ??= await request.arrayBuffer();
+			digestValid ??= await verifyRfc9421ContentDigest(contentDigestHeader, body);
+			if (!digestValid) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
 				setFailure(invalidSignatureResult(keyId));
 				continue;
@@ -9310,6 +9319,12 @@ Object.defineProperty(exports, "attachSignature", {
 		return attachSignature;
 	}
 });
+Object.defineProperty(exports, "classifyFep2277CoreType", {
+	enumerable: true,
+	get: function() {
+		return classifyFep2277CoreType;
+	}
+});
 Object.defineProperty(exports, "compactJsonLd", {
 	enumerable: true,
 	get: function() {

package/dist/{http-BoH-e8sR.mjs → http-CGcLv8rh.mjs}

@@ -1,12 +1,12 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-yXpYZm4K.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DMqdDud_.mjs";
+import { n as version, t as name } from "./deno-D1gcWWqB.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B41pRPfd.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
 import { f as parseKeyIdString } from "./portable-key-id-Bg259c4Z.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-BtO7WCfP.mjs";
-import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-HM5Siym0.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-CPM4r6tP.mjs";
+import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-D8uWZF7b.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -804,6 +804,8 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 		failure = result;
 		failureAlgorithm = algorithm;
 	};
+	let body = null;
+	let digestValid = null;
 	for (const sigName of signatureNames) {
 		if (!signatures[sigName]) {
 			setFailure(invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId)));
@@ -855,7 +857,9 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 				setFailure(invalidSignatureResult(keyId));
 				continue;
 			}
-			if (!await verifyRfc9421ContentDigest(contentDigestHeader, await request.arrayBuffer())) {
+			body ??= await request.arrayBuffer();
+			digestValid ??= await verifyRfc9421ContentDigest(contentDigestHeader, body);
+			if (!digestValid) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
 				setFailure(invalidSignatureResult(keyId));
 				continue;

package/dist/{http-CBRurnlR.js → http-Dgtt45-K.js}

@@ -14,7 +14,7 @@ import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2149+e2302034";
+var version = "2.4.0-dev.2157+b76e5888";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -2238,7 +2238,7 @@ function normalizeContextReference(reference, baseUrl) {
 /** @internal */
 function isInvalidUrlTypeError(error) {
 	const code = error.code;
-	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+	return error instanceof TypeError && (code === "ERR_INVALID_URL" || error.message === "Invalid URL string." || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
 }
 async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
 	if (context === null) return createGraphAliasContextState();
@@ -3733,6 +3733,11 @@ function hasValidPortableProofShape(proofValue) {
 		return Array.isArray(values) && values.length === 1 && !(isJsonLdNode(values[0]) && "@list" in values[0]);
 	});
 }
+/**
+* Classifies an expanded JSON-LD node into an FEP-2277 core type by the
+* properties it has.
+* @internal
+*/
 function classifyFep2277CoreType(node) {
 	if (FEP_2277_ACTOR_PROPERTIES.every((property) => property in node)) return "actor";
 	if (`${SECURITY_NAMESPACE}publicKeyMultibase` in node) return "verificationMethod";
@@ -5335,6 +5340,8 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 		failure = result;
 		failureAlgorithm = algorithm;
 	};
+	let body = null;
+	let digestValid = null;
 	for (const sigName of signatureNames) {
 		if (!signatures[sigName]) {
 			setFailure(invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId)));
@@ -5386,7 +5393,9 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 				setFailure(invalidSignatureResult(keyId));
 				continue;
 			}
-			if (!await verifyRfc9421ContentDigest(contentDigestHeader, await request.arrayBuffer())) {
+			body ??= await request.arrayBuffer();
+			digestValid ??= await verifyRfc9421ContentDigest(contentDigestHeader, body);
+			if (!digestValid) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
 				setFailure(invalidSignatureResult(keyId));
 				continue;
@@ -5712,4 +5721,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { recordCollectionRequest as $, isClearlyMalformedContextReference as A, fetchKeyDetailed as B, attachSignature as C, name as Ct, getNormalizationContextLoader as D, detachSignature as E, verifySignature as F, getDurationMs as G, importJwk as H, wrapContextLoaderForJsonLd as I, instrumentDocumentLoader as J, getFederationMetrics as K, exportJwk as L, signJsonLd as M, verifyCompactJsonLd as N, hasSignature as O, verifyJsonLd as P, recordCollectionPageItems as Q, fetchActorDocument as R, assertSafeJsonLd as S, isSamePublicKey as St, createSignature as T, validateCryptoKey as U, generateCryptoKeyPair as V, verifyKeyOwnership as W, recordCircuitBreakerStateChange as X, isAbortError$1 as Y, recordCollectionDispatchDuration as Z, verifyPortableObjectProofPolicy as _, hasPortableActor as _t, signRequest as a, recordOutboxEnqueue as at, normalizeOutgoingActivityJsonLd as b, isPortableKeyId as bt, fetchPortableGatewayKey as c, preloadedOnlyDocumentLoader as ct, createProof as d, parseAcceptSignature as dt, recordCollectionTotalItems as et, hasProofLike as f, validateAcceptSignature as ft, verifyPortableObjectProof as g, getRawCanonicalPortableId as gt, verifyObject as h, getPortableDid as ht, selectRequestSignature as i, recordOutboxActivity as it, isInvalidUrlTypeError as j, hasSignatureLike as k, resolvePortableActorKey as l, formatAcceptSignature as lt, verifyMapLocalProof as m, getGatewayKeyBase as mt, listRequestSignatures as n, recordFanoutRecipients as nt, verifyRequest as o, recordWebFingerHandle as ot, signObject as p, getCanonicalPortableId as pt, getRemoteHost as q, parseRfc9421SignatureInput as r, recordInboxActivity as rt, verifyRequestDetailed as s, registerQueueDepthGauge as st, doubleKnock as t, recordDocumentCache as tt, InvalidPortableObjectIdError as u, fulfillAcceptSignature as ut, verifyPortableObjectProofWithRoot as v, isCompatibleKeyId as vt, compactJsonLd as w, version as wt, InvalidContextReferenceError as x, isPortableUri as xt, verifyProof as y, isPortableId as yt, fetchKey as z };
+export { recordCollectionPageItems as $, hasSignatureLike as A, fetchKey as B, assertSafeJsonLd as C, isSamePublicKey as Ct, detachSignature as D, createSignature as E, verifyJsonLd as F, verifyKeyOwnership as G, generateCryptoKeyPair as H, verifySignature as I, getRemoteHost as J, getDurationMs as K, wrapContextLoaderForJsonLd as L, isInvalidUrlTypeError as M, signJsonLd as N, getNormalizationContextLoader as O, verifyCompactJsonLd as P, recordCollectionDispatchDuration as Q, exportJwk as R, InvalidContextReferenceError as S, isPortableUri as St, compactJsonLd as T, version as Tt, importJwk as U, fetchKeyDetailed as V, validateCryptoKey as W, isAbortError$1 as X, instrumentDocumentLoader as Y, recordCircuitBreakerStateChange as Z, verifyPortableObjectProof as _, getRawCanonicalPortableId as _t, signRequest as a, recordOutboxActivity as at, verifyProof as b, isPortableId as bt, fetchPortableGatewayKey as c, registerQueueDepthGauge as ct, classifyFep2277CoreType as d, fulfillAcceptSignature as dt, recordCollectionRequest as et, createProof as f, parseAcceptSignature as ft, verifyObject as g, getPortableDid as gt, verifyMapLocalProof as h, getGatewayKeyBase as ht, selectRequestSignature as i, recordInboxActivity as it, isClearlyMalformedContextReference as j, hasSignature as k, resolvePortableActorKey as l, preloadedOnlyDocumentLoader as lt, signObject as m, getCanonicalPortableId as mt, listRequestSignatures as n, recordDocumentCache as nt, verifyRequest as o, recordOutboxEnqueue as ot, hasProofLike as p, validateAcceptSignature as pt, getFederationMetrics as q, parseRfc9421SignatureInput as r, recordFanoutRecipients as rt, verifyRequestDetailed as s, recordWebFingerHandle as st, doubleKnock as t, recordCollectionTotalItems as tt, InvalidPortableObjectIdError as u, formatAcceptSignature as ut, verifyPortableObjectProofPolicy as v, hasPortableActor as vt, attachSignature as w, name as wt, normalizeOutgoingActivityJsonLd as x, isPortableKeyId as xt, verifyPortableObjectProofWithRoot as y, isCompatibleKeyId as yt, fetchActorDocument as z };

package/dist/{key-BtO7WCfP.mjs → key-CPM4r6tP.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-yXpYZm4K.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DMqdDud_.mjs";
+import { n as version, t as name } from "./deno-D1gcWWqB.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-B41pRPfd.mjs";
 import { c as isPortableId, f as parseKeyIdString, o as isCompatibleKeyId, s as isPortableActorDocument, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";

package/dist/{kv-cache-E0es0w4R.js → kv-cache-BweyIZTb.js}

@@ -1,8 +1,8 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { U as validateCryptoKey, t as doubleKnock, tt as recordDocumentCache } from "./http-CBRurnlR.js";
+import { W as validateCryptoKey, nt as recordDocumentCache, t as doubleKnock } from "./http-Dgtt45-K.js";
 import { getLogger } from "@logtape/logtape";
-import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";
 //#region src/utils/docloader.ts
 const logger$1 = getLogger([
@@ -10,10 +10,13 @@ const logger$1 = getLogger([
 	"utils",
 	"docloader"
 ]);
+const DEFAULT_MAX_REDIRECTION = 20;
 /**
 * Gets an authenticated {@link DocumentLoader} for the given identity.
 * Note that an authenticated document loader intentionally does not cache
 * the fetched documents.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 * @param identity The identity to get the document loader for.
 *                 The actor's key pair.
 * @param options The options for the document loader.
@@ -23,29 +26,52 @@ const logger$1 = getLogger([
 */
 function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, tracerProvider } = {}) {
 	validateCryptoKey(identity.privateKey);
-	async function load(url, options) {
-		await validateUrl(url, options);
-		return getRemoteDocument(url, await doubleKnock(createActivityPubRequest(url, { userAgent }), identity, {
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
+		options?.signal?.throwIfAborted();
+		let currentUrl = new URL(url).href;
+		await validateUrl(currentUrl, options);
+		visited.add(currentUrl);
+		const originalRequest = createActivityPubRequest(currentUrl, { userAgent });
+		function follow(nextUrl) {
+			options?.signal?.throwIfAborted();
+			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+			if (visited.has(nextUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
+			redirected++;
+		}
+		const response = await doubleKnock(originalRequest, identity, {
 			maxRedirection,
 			specDeterminer,
 			log: curry(logRequest)(logger$1),
 			tracerProvider,
 			signal: options?.signal,
-			validateRedirect: (url) => validateUrl(url, options)
-		}), load, options);
+			validateRedirect: async (nextUrl) => {
+				follow(nextUrl);
+				await validateUrl(nextUrl, options);
+				visited.add(nextUrl);
+				currentUrl = nextUrl;
+			}
+		});
+		return getRemoteDocument(currentUrl, response, (alternateUrl) => {
+			follow(alternateUrl);
+			return load(alternateUrl, options, redirected, visited);
+		}, options);
 	}
 	async function validateUrl(url, options) {
 		if (!allowPrivateAddress) try {
 			await validatePublicUrl(url);
 		} catch (error) {
-			if (error instanceof UrlError) logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+			if (error instanceof UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
 				url,
 				error
 			});
 			throw error;
 		}
 	}
-	return load;
+	return (url, options) => load(url, options);
 }
 //#endregion
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-BxUqVENn.cjs → kv-cache-D2fnB8qu.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-C_jobbLz.cjs");
+const require_http = require("./http-BObQoB0j.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");
@@ -9,10 +9,13 @@ const logger$1 = (0, _logtape_logtape.getLogger)([
 	"utils",
 	"docloader"
 ]);
+const DEFAULT_MAX_REDIRECTION = 20;
 /**
 * Gets an authenticated {@link DocumentLoader} for the given identity.
 * Note that an authenticated document loader intentionally does not cache
 * the fetched documents.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 * @param identity The identity to get the document loader for.
 *                 The actor's key pair.
 * @param options The options for the document loader.
@@ -22,29 +25,52 @@ const logger$1 = (0, _logtape_logtape.getLogger)([
 */
 function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, tracerProvider } = {}) {
 	require_http.validateCryptoKey(identity.privateKey);
-	async function load(url, options) {
-		await validateUrl(url, options);
-		return (0, _fedify_vocab_runtime.getRemoteDocument)(url, await require_http.doubleKnock((0, _fedify_vocab_runtime.createActivityPubRequest)(url, { userAgent }), identity, {
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
+		options?.signal?.throwIfAborted();
+		let currentUrl = new URL(url).href;
+		await validateUrl(currentUrl, options);
+		visited.add(currentUrl);
+		const originalRequest = (0, _fedify_vocab_runtime.createActivityPubRequest)(currentUrl, { userAgent });
+		function follow(nextUrl) {
+			options?.signal?.throwIfAborted();
+			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new _fedify_vocab_runtime.FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+			if (visited.has(nextUrl)) throw new _fedify_vocab_runtime.FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
+			redirected++;
+		}
+		const response = await require_http.doubleKnock(originalRequest, identity, {
 			maxRedirection,
 			specDeterminer,
 			log: (0, es_toolkit.curry)(_fedify_vocab_runtime.logRequest)(logger$1),
 			tracerProvider,
 			signal: options?.signal,
-			validateRedirect: (url) => validateUrl(url, options)
-		}), load, options);
+			validateRedirect: async (nextUrl) => {
+				follow(nextUrl);
+				await validateUrl(nextUrl, options);
+				visited.add(nextUrl);
+				currentUrl = nextUrl;
+			}
+		});
+		return (0, _fedify_vocab_runtime.getRemoteDocument)(currentUrl, response, (alternateUrl) => {
+			follow(alternateUrl);
+			return load(alternateUrl, options, redirected, visited);
+		}, options);
 	}
 	async function validateUrl(url, options) {
 		if (!allowPrivateAddress) try {
 			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
 		} catch (error) {
-			if (error instanceof _fedify_vocab_runtime.UrlError) logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+			if (error instanceof _fedify_vocab_runtime.UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
 				url,
 				error
 			});
 			throw error;
 		}
 	}
-	return load;
+	return (url, options) => load(url, options);
 }
 //#endregion
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-CMuTXrkC.mjs → kv-cache-bdPqTR1k.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-DMqdDud_.mjs";
+import { p as recordDocumentCache } from "./metrics-B41pRPfd.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{ld-YYBfDbe_.mjs → ld-lU_ZqzsQ.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-yXpYZm4K.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DMqdDud_.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-BtO7WCfP.mjs";
+import { n as version, t as name } from "./deno-D1gcWWqB.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-B41pRPfd.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-CPM4r6tP.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -206,7 +206,7 @@ function normalizeContextReference(reference, baseUrl) {
 /** @internal */
 function isInvalidUrlTypeError(error) {
 	const code = error.code;
-	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+	return error instanceof TypeError && (code === "ERR_INVALID_URL" || error.message === "Invalid URL string." || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
 }
 async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
 	if (context === null) return createGraphAliasContextState();

package/dist/{metrics-DMqdDud_.mjs → metrics-B41pRPfd.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-yXpYZm4K.mjs";
+import { n as version, t as name } from "./deno-D1gcWWqB.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts