@fedify/fedify 2.4.0-dev.2164 → 2.4.0-dev.2190

package/dist/{http-Cok5-vIC.d.ts → http-DGx0KOws.d.ts}

@@ -601,6 +601,30 @@ interface VerifyRequestOptions {
   */
   spec?: HttpMessageSignaturesSpec;
   /**
+  * The maximum number of [RFC 9421] signatures of a request to verify.
+  * A request can carry several signatures, each of which may make Fedify
+  * fetch the key that it names, so only the first ones in the order of
+  * the `Signature-Input` header are verified, and the rest are ignored as
+  * if they were absent.  Every signature among the first ones counts, even
+  * if it fails before its key is fetched, e.g., because it is too old, or
+  * names the same key as another one.  The key of a key ID is looked up
+  * only once for all the signatures that name it.
+  *
+  * It has to be a positive integer, or `Infinity` to verify every
+  * signature, which lets a single request make Fedify fetch any number of
+  * keys.  Draft-cavage HTTP Signatures carry a single signature, so this
+  * option does not affect them.
+  *
+  * Three by default.
+  *
+  * [RFC 9421]: https://www.rfc-editor.org/rfc/rfc9421
+  * @throws {RangeError} Thrown by {@link verifyRequest} and
+  *         {@link verifyRequestDetailed} if the value is not a positive
+  *         integer or `Infinity`.
+  * @since 2.4.0
+  */
+  maxSignatures?: number;
+  /**
   * The OpenTelemetry tracer provider.  If omitted, the global tracer provider
   * is used.
   * @since 1.3.0
@@ -651,6 +675,8 @@ type VerifyRequestDetailedResult = {
 * @param options Options for verifying the request.
 * @returns The public key of the verified signature, or `null` if the signature
 *          could not be verified.
+* @throws {RangeError} Thrown if {@link VerifyRequestOptions.maxSignatures}
+*         is not a positive integer or `Infinity`.
 */
 declare function verifyRequest(request: Request, options?: VerifyRequestOptions): Promise<CryptographicKey | null>;
 /**
@@ -660,6 +686,8 @@ declare function verifyRequest(request: Request, options?: VerifyRequestOptions)
 * @param request The request to verify.
 * @param options Options for verifying the request.
 * @returns The verified public key, or a structured verification failure.
+* @throws {RangeError} Thrown if {@link VerifyRequestOptions.maxSignatures}
+*         is not a positive integer or `Infinity`.
 * @since 2.1.0
 */
 declare function verifyRequestDetailed(request: Request, options?: VerifyRequestOptions): Promise<VerifyRequestDetailedResult>;

package/dist/{http-DRH0n8TD.mjs → http-Y1ObT1A8.mjs}

@@ -1,13 +1,13 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CizGaYeG.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CFBEehTc.mjs";
+import { n as version, t as name } from "./deno-EopndaNb.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-zMe834ID.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
-import { f as parseKeyIdString } from "./portable-key-id-Bg259c4Z.mjs";
-import { a as promoteKeyOwnerEvidence } from "./key-owner-evidence-Bo3yaeL5.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-D5awqp7u.mjs";
-import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-Bv1RdQ0n.mjs";
+import { m as parseKeyIdString } from "./portable-key-id-Ca30-hOa.mjs";
+import { a as promoteKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, t as bypassKeyCacheReads } from "./key-DyXf88bq.mjs";
+import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-Duue9Y2Y.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -215,16 +215,19 @@ function parseDraftSignature(signature) {
 * Lists the HTTP Signatures that a request claims to carry, without verifying
 * any of them.  Signatures whose key IDs are not URLs are left out.
 * @param request The request.
+* @param maxSignatures The maximum number of RFC 9421 signatures to consider,
+*                      counted the same way as by {@link verifyRequest}, so
+*                      that the signatures it ignores are not listed either.
 * @returns The signatures; RFC 9421 ones if the request has
 *          a `Signature-Input` header, or a draft-cavage one otherwise.
 * @internal
 */
-function listRequestSignatures(request) {
+function listRequestSignatures(request, maxSignatures = 3) {
 	const signatureInput = request.headers.get("Signature-Input");
 	if (signatureInput != null) {
 		const signatures = [];
-		const inputs = parseRfc9421SignatureInput(signatureInput);
-		for (const [label, input] of Object.entries(inputs)) {
+		const inputs = Object.entries(parseRfc9421SignatureInput(signatureInput));
+		for (const [label, input] of inputs.slice(0, maxSignatures)) {
 			const keyId = parseKeyId(input.keyId);
 			if (keyId == null) continue;
 			signatures.push({
@@ -352,6 +355,18 @@ async function signRequestRfc9421(request, privateKey, keyId, span, currentTime,
 		body
 	});
 }
+/**
+* Checks that a maximum number of signatures to verify is a positive safe
+* integer or `Infinity`.
+* @param value The value to check.
+* @param name The name of the option, used in the error message.
+* @throws {RangeError} Thrown if the value is not valid.
+* @internal
+*/
+function validateMaxSignatures(value, name) {
+	if (value === Infinity || Number.isSafeInteger(value) && value >= 1) return;
+	throw new RangeError(`${name} must be a positive integer or Infinity.`);
+}
 const supportedHashAlgorithms = {
 	"sha": "SHA-1",
 	"sha-256": "SHA-256",
@@ -444,6 +459,8 @@ function recordVerificationResult(span, result) {
 * @param options Options for verifying the request.
 * @returns The public key of the verified signature, or `null` if the signature
 *          could not be verified.
+* @throws {RangeError} Thrown if {@link VerifyRequestOptions.maxSignatures}
+*         is not a positive integer or `Infinity`.
 */
 async function verifyRequest(request, options = {}) {
 	const result = await verifyRequestDetailed(request, options);
@@ -456,9 +473,12 @@ async function verifyRequest(request, options = {}) {
 * @param request The request to verify.
 * @param options Options for verifying the request.
 * @returns The verified public key, or a structured verification failure.
+* @throws {RangeError} Thrown if {@link VerifyRequestOptions.maxSignatures}
+*         is not a positive integer or `Infinity`.
 * @since 2.1.0
 */
 async function verifyRequestDetailed(request, options = {}) {
+	if (options.maxSignatures !== void 0) validateMaxSignatures(options.maxSignatures, "maxSignatures");
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("http_signatures.verify", async (span) => {
 		if (span.isRecording()) {
 			span.setAttribute(ATTR_HTTP_REQUEST_METHOD, request.method);
@@ -767,7 +787,100 @@ async function verifyRfc9421ContentDigest(digestHeader, body) {
 	}
 	return false;
 }
-async function verifyRequestRfc9421(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, meterProvider, tracerProvider } = {}) {
+/**
+* Verifies one RFC 9421 signature of a request with a key.
+* @param request The request, whose body may be consumed already.
+* @param sigInput The parsed `Signature-Input` member of the signature.
+* @param sigBytes The bytes of the signature.
+* @param key The public key named by the signature.
+* @param span The span to record the algorithm and the signature on.
+* @returns Whether the signature is verified, and the algorithm of the
+*          signature if it is supported.
+*/
+async function verifyRfc9421SignatureWithKey(request, sigInput, sigBytes, key, span) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"http"
+	]);
+	let alg = sigInput.alg?.toLowerCase();
+	if (alg == null) {
+		if (key.publicKey.algorithm.name === "RSASSA-PKCS1-v1_5") alg = "hash" in key.publicKey.algorithm ? key.publicKey.algorithm.hash === "SHA-512" ? "rsa-v1_5-sha512" : "rsa-v1_5-sha256" : "rsa-v1_5-sha256";
+		else if (key.publicKey.algorithm.name === "RSA-PSS") alg = "rsa-pss-sha512";
+		else if (key.publicKey.algorithm.name === "ECDSA") alg = "namedCurve" in key.publicKey.algorithm && key.publicKey.algorithm.namedCurve === "P-256" ? "ecdsa-p256-sha256" : "ecdsa-p384-sha384";
+		else if (key.publicKey.algorithm.name === "Ed25519") alg = "ed25519";
+	}
+	if (alg) span?.setAttribute("http_signatures.algorithm", alg);
+	const algorithm = alg && rfc9421AlgorithmMap[alg];
+	if (!algorithm) {
+		logger.debug("Failed to verify; unsupported algorithm: {algorithm}", {
+			algorithm: sigInput.alg,
+			supported: Object.keys(rfc9421AlgorithmMap)
+		});
+		return {
+			verified: false,
+			mismatched: false
+		};
+	}
+	const metricAlgorithm = alg;
+	let signatureBase;
+	try {
+		signatureBase = createRfc9421SignatureBase(request, sigInput.components, sigInput.parameters);
+	} catch (error) {
+		logger.debug("Failed to create signature base for verification: {error}", {
+			error,
+			signatureInput: sigInput
+		});
+		return {
+			verified: false,
+			algorithm: metricAlgorithm,
+			mismatched: false
+		};
+	}
+	const signatureBaseBytes = new TextEncoder().encode(signatureBase);
+	span?.setAttribute("http_signatures.signature", encodeHex(sigBytes));
+	const algorithmName = typeof algorithm === "string" ? algorithm : algorithm.name;
+	if (key.publicKey.algorithm.name !== algorithmName) {
+		logger.debug("Failed to verify; key {keyId} is not a key for algorithm {algorithm}.", {
+			keyId: sigInput.keyId,
+			algorithm: alg
+		});
+		return {
+			verified: false,
+			algorithm: metricAlgorithm,
+			mismatched: true
+		};
+	}
+	let verified;
+	try {
+		verified = await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes);
+	} catch (error) {
+		logger.debug("Error during signature verification: {error}", {
+			error,
+			keyId: sigInput.keyId,
+			algorithm: sigInput.alg
+		});
+		return {
+			verified: false,
+			algorithm: metricAlgorithm,
+			mismatched: false
+		};
+	}
+	if (verified) return {
+		verified: true,
+		algorithm: metricAlgorithm
+	};
+	logger.debug("Failed to verify signature with key {keyId}; signature invalid.", {
+		keyId: sigInput.keyId,
+		signatureBase
+	});
+	return {
+		verified: false,
+		algorithm: metricAlgorithm,
+		mismatched: true
+	};
+}
+async function verifyRequestRfc9421(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, maxSignatures = 3, meterProvider, tracerProvider } = {}) {
 	const logger = getLogger([
 		"fedify",
 		"sig",
@@ -780,7 +893,6 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 		logger.error("Failed to verify; the request body is locked.", { url: request.url });
 		return noSignatureResult();
 	}
-	const originalRequest = request;
 	request = request.clone();
 	const signatureInputHeader = request.headers.get("Signature-Input");
 	if (!signatureInputHeader) {
@@ -800,6 +912,29 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 		logger.debug("Failed to verify; no valid signatures found in Signature-Input header.", { header: signatureInputHeader });
 		return invalidSignatureResult(null);
 	}
+	if (signatureNames.length > maxSignatures) {
+		logger.debug("Verifying only the first {maxSignatures} of the {count} signatures in the Signature-Input header; the rest are ignored.", {
+			maxSignatures,
+			count: signatureNames.length
+		});
+		signatureNames.splice(maxSignatures);
+	}
+	const keyLookups = /* @__PURE__ */ new Map();
+	const refreshedKeyIds = /* @__PURE__ */ new Set();
+	const lookUpKey = (keyId, keyCache) => measureSignatureKeyFetch(meterProvider, "http", () => fetchKeyDetailed(keyId, CryptographicKey, {
+		documentLoader,
+		contextLoader,
+		keyCache,
+		tracerProvider,
+		meterProvider,
+		portableKeyResolvers: createPortableKeyResolvers({
+			documentLoader,
+			contextLoader,
+			keyCache,
+			tracerProvider,
+			meterProvider
+		})
+	}));
 	let failure = noSignatureResult();
 	let failureAlgorithm;
 	const setFailure = (result, algorithm) => {
@@ -873,94 +1008,40 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 			setFailure(invalidSignatureResult(null));
 			continue;
 		}
-		const { key, cached, fetchError } = await measureSignatureKeyFetch(meterProvider, "http", () => fetchKeyDetailed(keyId, CryptographicKey, {
-			documentLoader,
-			contextLoader,
-			keyCache,
-			tracerProvider,
-			meterProvider,
-			portableKeyResolvers: createPortableKeyResolvers({
-				documentLoader,
-				contextLoader,
-				keyCache,
-				tracerProvider,
-				meterProvider
-			})
-		}));
-		if (fetchError != null) {
-			setFailure(keyFetchErrorResult(keyId, fetchError));
-			continue;
+		let lookup = keyLookups.get(keyId.href);
+		if (lookup == null) {
+			lookup = await lookUpKey(keyId, keyCache);
+			keyLookups.set(keyId.href, lookup);
 		}
-		if (!key) {
-			logger.debug("Failed to fetch key: {keyId}", { keyId: sigInput.keyId });
-			setFailure(invalidSignatureResult(keyId));
-			continue;
-		}
-		let alg = sigInput.alg?.toLowerCase();
-		if (alg == null) {
-			if (key.publicKey.algorithm.name === "RSASSA-PKCS1-v1_5") alg = "hash" in key.publicKey.algorithm ? key.publicKey.algorithm.hash === "SHA-512" ? "rsa-v1_5-sha512" : "rsa-v1_5-sha256" : "rsa-v1_5-sha256";
-			else if (key.publicKey.algorithm.name === "RSA-PSS") alg = "rsa-pss-sha512";
-			else if (key.publicKey.algorithm.name === "ECDSA") alg = "namedCurve" in key.publicKey.algorithm && key.publicKey.algorithm.namedCurve === "P-256" ? "ecdsa-p256-sha256" : "ecdsa-p384-sha384";
-			else if (key.publicKey.algorithm.name === "Ed25519") alg = "ed25519";
-		}
-		if (alg) span?.setAttribute("http_signatures.algorithm", alg);
-		const algorithm = alg && rfc9421AlgorithmMap[alg];
-		const candidateAlgorithm = algorithm ? alg : void 0;
-		if (!algorithm) {
-			logger.debug("Failed to verify; unsupported algorithm: {algorithm}", {
-				algorithm: sigInput.alg,
-				supported: Object.keys(rfc9421AlgorithmMap)
-			});
-			setFailure(invalidSignatureResult(keyId));
-			continue;
-		}
-		let signatureBase;
-		try {
-			signatureBase = createRfc9421SignatureBase(request, sigInput.components, sigInput.parameters);
-		} catch (error) {
-			logger.debug("Failed to create signature base for verification: {error}", {
-				error,
-				signatureInput: sigInput
-			});
-			setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
-			continue;
-		}
-		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
-		span?.setAttribute("http_signatures.signature", encodeHex(sigBytes));
-		try {
-			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes)) {
-				metricsContext.algorithm = candidateAlgorithm;
+		while (true) {
+			const { key, cached, fetchError } = lookup;
+			if (fetchError != null) {
+				setFailure(keyFetchErrorResult(keyId, fetchError));
+				break;
+			}
+			if (!key) {
+				logger.debug("Failed to fetch key: {keyId}", { keyId: sigInput.keyId });
+				setFailure(invalidSignatureResult(keyId));
+				break;
+			}
+			const result = await verifyRfc9421SignatureWithKey(request, sigInput, sigBytes, key, span);
+			if (result.verified) {
+				metricsContext.algorithm = result.algorithm;
 				return {
 					verified: true,
 					key,
 					signatureLabel: sigName
 				};
-			} else if (cached) {
+			}
+			if (result.mismatched && cached && !refreshedKeyIds.has(keyId.href)) {
 				logger.debug("Failed to verify with cached key {keyId}; retrying with fresh key...", { keyId: sigInput.keyId });
-				return await verifyRequestRfc9421(originalRequest, span, metricsContext, {
-					documentLoader,
-					contextLoader,
-					timeWindow,
-					currentTime,
-					keyCache: bypassKeyCacheReads(keyCache),
-					spec: "rfc9421",
-					meterProvider,
-					tracerProvider
-				});
-			} else {
-				logger.debug("Failed to verify signature with fetched key {keyId}; signature invalid.", {
-					keyId: sigInput.keyId,
-					signatureBase
-				});
-				setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
+				refreshedKeyIds.add(keyId.href);
+				lookup = await lookUpKey(keyId, bypassKeyCacheReads(keyCache));
+				keyLookups.set(keyId.href, lookup);
+				continue;
 			}
-		} catch (error) {
-			logger.debug("Error during signature verification: {error}", {
-				error,
-				keyId: sigInput.keyId,
-				algorithm: sigInput.alg
-			});
-			setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
+			setFailure(invalidSignatureResult(keyId), result.algorithm);
+			break;
 		}
 	}
 	metricsContext.algorithm = failureAlgorithm;
@@ -1060,16 +1141,19 @@ async function doubleKnock(request, identity, options = {}) {
 }
 async function doubleKnockInternal(request, identity, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 	const { specDeterminer, log, tracerProvider, signal } = options;
+	signal?.throwIfAborted();
 	const maximumRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
 	visited.add(request.url);
 	const origin = new URL(request.url).origin;
 	const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
+	signal?.throwIfAborted();
 	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
 	let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
 		spec: firstTrySpec,
 		tracerProvider,
 		body
 	});
+	signal?.throwIfAborted();
 	log?.(signedRequest);
 	let response = await fetchDoubleKnockRequest(request, signedRequest, signal);
 	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
@@ -1094,6 +1178,7 @@ async function doubleKnockInternal(request, identity, options, redirected = 0, v
 			let fulfilled = false;
 			let challengeRequest;
 			for (const entry of entries) {
+				signal?.throwIfAborted();
 				const rfc9421 = fulfillAcceptSignature(entry, localKeyId, localAlg);
 				if (rfc9421 == null) continue;
 				logger.debug("Received Accept-Signature challenge; accumulating label {label} and components {components}.", {
@@ -1116,6 +1201,7 @@ async function doubleKnockInternal(request, identity, options, redirected = 0, v
 				}
 			}
 			if (fulfilled && challengeRequest != null) {
+				signal?.throwIfAborted();
 				signedRequest = challengeRequest;
 				log?.(signedRequest);
 				response = await fetch(signedRequest, {
@@ -1140,11 +1226,13 @@ async function doubleKnockInternal(request, identity, options, redirected = 0, v
 			status: response.status,
 			statusText: response.statusText
 		});
+		signal?.throwIfAborted();
 		signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
 			spec,
 			tracerProvider,
 			body
 		});
+		signal?.throwIfAborted();
 		log?.(signedRequest);
 		response = await fetchDoubleKnockRequest(request, signedRequest, signal);
 		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
@@ -1187,4 +1275,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { listRequestSignatures as a, selectRequestSignature as c, verifyRequest as d, verifyRequestDetailed as f, formatRfc9421SignatureParameters as i, signRequest as l, doubleKnock as n, parseRfc9421Signature as o, formatRfc9421Signature as r, parseRfc9421SignatureInput as s, createRfc9421SignatureBase as t, timingSafeEqual as u };
+export { listRequestSignatures as a, selectRequestSignature as c, validateMaxSignatures as d, verifyRequest as f, formatRfc9421SignatureParameters as i, signRequest as l, doubleKnock as n, parseRfc9421Signature as o, verifyRequestDetailed as p, formatRfc9421Signature as r, parseRfc9421SignatureInput as s, createRfc9421SignatureBase as t, timingSafeEqual as u };

package/dist/{key-D5awqp7u.mjs → key-DyXf88bq.mjs}

@@ -1,10 +1,10 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CizGaYeG.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-CFBEehTc.mjs";
-import { c as isPortableId, f as parseKeyIdString, o as isCompatibleKeyId, s as isPortableActorDocument, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
-import { n as attachKeyOwnerEvidence, t as MAX_PORTABLE_KEY_TTL } from "./key-owner-evidence-Bo3yaeL5.mjs";
+import { n as version, t as name } from "./deno-EopndaNb.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-zMe834ID.mjs";
+import { c as isPortableActorDocument, d as isPortableUri, l as isPortableId, m as parseKeyIdString, s as isCompatibleKeyId } from "./portable-key-id-Ca30-hOa.mjs";
+import { n as attachKeyOwnerEvidence, t as MAX_PORTABLE_KEY_TTL } from "./key-owner-evidence-APB6NpSk.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{key-owner-evidence-Bo3yaeL5.mjs → key-owner-evidence-APB6NpSk.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { i as getRawCanonicalPortableId, s as isPortableActorDocument, t as getCanonicalPortableId } from "./portable-key-id-Bg259c4Z.mjs";
+import { a as getRawCanonicalPortableId, c as isPortableActorDocument, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
 import { CryptographicKey, Object as Object$1 } from "@fedify/vocab";
 //#region src/sig/key-owner-evidence.ts
 /**

package/dist/{keycache-PiOM9pM0.mjs → keycache-Da8A8mZa.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { t as MAX_PORTABLE_KEY_TTL } from "./key-owner-evidence-Bo3yaeL5.mjs";
+import { t as MAX_PORTABLE_KEY_TTL } from "./key-owner-evidence-APB6NpSk.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 //#region src/federation/keycache.ts
 const KEY_CACHE_GENERATION = "2";

package/dist/{kv-cache-CZiBDLPi.js → kv-cache-C02XitwK.js}

@@ -1,8 +1,8 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { W as validateCryptoKey, at as recordDocumentCache, t as doubleKnock } from "./http-Baovr6xq.js";
+import { G as validateCryptoKey, ot as recordDocumentCache, t as doubleKnock } from "./http-BqN5kyUf.js";
 import { getLogger } from "@logtape/logtape";
-import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, resolveDocumentLoaderTimeout, validatePublicUrl, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";
 //#region src/utils/docloader.ts
 const logger$1 = getLogger([
@@ -17,15 +17,19 @@ const DEFAULT_MAX_REDIRECTION = 20;
 * the fetched documents.
 * At most 20 HTTP redirects and alternate document links are followed in total
 * per call.  Revisiting a URL within that chain throws a {@link FetchError}.
+* Each call, including its double-knocking retries, times out after
+* 10 seconds by default; see {@link DocumentLoaderFactoryOptions.timeout}.
 * @param identity The identity to get the document loader for.
 *                 The actor's key pair.
 * @param options The options for the document loader.
 * @returns The authenticated document loader.
 * @throws {TypeError} If the key is invalid or unsupported.
+* @throws {RangeError} If the `timeout` option is invalid.
 * @since 0.4.0
 */
-function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, tracerProvider } = {}) {
+function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, timeout, tracerProvider } = {}) {
 	validateCryptoKey(identity.privateKey);
+	const resolvedTimeout = resolveDocumentLoaderTimeout(timeout);
 	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
 		let currentUrl = new URL(url).href;
@@ -51,27 +55,31 @@ function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedi
 				currentUrl = nextUrl;
 			}
 		});
+		options?.signal?.throwIfAborted();
 		return getRemoteDocument(currentUrl, response, (alternateUrl) => {
 			follow(alternateUrl);
 			return load(alternateUrl, options, redirected, visited);
 		}, options);
 	}
 	async function validateUrl(url, options) {
-		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
-		} catch (error) {
-			if (error instanceof UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
-				url,
-				error
-			});
-			else logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
-				url,
-				error
-			});
-			throw error;
+		if (!allowPrivateAddress) {
+			try {
+				await validatePublicUrl(url);
+			} catch (error) {
+				if (error instanceof UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
+					url,
+					error
+				});
+				else logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+					url,
+					error
+				});
+				throw error;
+			}
+			options?.signal?.throwIfAborted();
 		}
 	}
-	return (url, options) => load(url, options);
+	return withDocumentLoaderTimeout((url, options) => load(url, options), resolvedTimeout);
 }
 //#endregion
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-C7RWL7hz.mjs → kv-cache-C8YjNAi_.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-CFBEehTc.mjs";
+import { p as recordDocumentCache } from "./metrics-zMe834ID.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-Ct-KWRta.cjs → kv-cache-DUXluAc0.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-R4g1McwE.cjs");
+const require_http = require("./http-CCr2_ipG.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");
@@ -16,15 +16,19 @@ const DEFAULT_MAX_REDIRECTION = 20;
 * the fetched documents.
 * At most 20 HTTP redirects and alternate document links are followed in total
 * per call.  Revisiting a URL within that chain throws a {@link FetchError}.
+* Each call, including its double-knocking retries, times out after
+* 10 seconds by default; see {@link DocumentLoaderFactoryOptions.timeout}.
 * @param identity The identity to get the document loader for.
 *                 The actor's key pair.
 * @param options The options for the document loader.
 * @returns The authenticated document loader.
 * @throws {TypeError} If the key is invalid or unsupported.
+* @throws {RangeError} If the `timeout` option is invalid.
 * @since 0.4.0
 */
-function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, tracerProvider } = {}) {
+function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, timeout, tracerProvider } = {}) {
 	require_http.validateCryptoKey(identity.privateKey);
+	const resolvedTimeout = (0, _fedify_vocab_runtime.resolveDocumentLoaderTimeout)(timeout);
 	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
 		let currentUrl = new URL(url).href;
@@ -50,27 +54,31 @@ function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedi
 				currentUrl = nextUrl;
 			}
 		});
+		options?.signal?.throwIfAborted();
 		return (0, _fedify_vocab_runtime.getRemoteDocument)(currentUrl, response, (alternateUrl) => {
 			follow(alternateUrl);
 			return load(alternateUrl, options, redirected, visited);
 		}, options);
 	}
 	async function validateUrl(url, options) {
-		if (!allowPrivateAddress) try {
-			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
-		} catch (error) {
-			if (error instanceof _fedify_vocab_runtime.UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
-				url,
-				error
-			});
-			else logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
-				url,
-				error
-			});
-			throw error;
+		if (!allowPrivateAddress) {
+			try {
+				await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
+			} catch (error) {
+				if (error instanceof _fedify_vocab_runtime.UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
+					url,
+					error
+				});
+				else logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+					url,
+					error
+				});
+				throw error;
+			}
+			options?.signal?.throwIfAborted();
 		}
 	}
-	return (url, options) => load(url, options);
+	return (0, _fedify_vocab_runtime.withDocumentLoaderTimeout)((url, options) => load(url, options), resolvedTimeout);
 }
 //#endregion
 //#region src/utils/kv-cache.ts

package/dist/{ld-CyliEU48.mjs → ld-oQj6j_hP.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CizGaYeG.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CFBEehTc.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-D5awqp7u.mjs";
+import { n as version, t as name } from "./deno-EopndaNb.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-zMe834ID.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-DyXf88bq.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";