@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/key-owner-evidence-APB6NpSk.mjs

@@ -0,0 +1,108 @@
+import { Temporal } from "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { a as getRawCanonicalPortableId, c as isPortableActorDocument, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
+import { CryptographicKey, Object as Object$1 } from "@fedify/vocab";
+//#region src/sig/key-owner-evidence.ts
+/**
+* How long a key of an [FEP-ef61] portable actor is trusted after its actor's
+* signed document vouched for it, however long the proof of the document is
+* valid.  The actor can drop the key or the gateway from its document at any
+* time, so the key is looked up again at least this often.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @internal
+*/
+const MAX_PORTABLE_KEY_TTL = Temporal.Duration.from({ hours: 1 });
+const candidates = /* @__PURE__ */ new WeakMap();
+const verified = /* @__PURE__ */ new WeakMap();
+/**
+* Attaches to a key that was just resolved the evidence of the portable actor
+* that owns it.  The evidence is not used until the key verifies
+* a signature; see {@link promoteKeyOwnerEvidence}.
+*
+* Nothing is attached unless the document, the key's owner, and the actor
+* the key ID belongs to agree on the actor's canonical portable ID.
+* @param key The key, whose owner the document vouched for.
+* @param document The expanded root node of the actor's verified document.
+* @param expires When the evidence must not be used anymore.
+* @returns Whether the evidence was attached.
+* @internal
+*/
+function attachKeyOwnerEvidence(key, document, expires) {
+	if (!(key instanceof CryptographicKey) || key.id == null || key.ownerId == null || key.publicKey == null || document == null || typeof document !== "object" || Array.isArray(document)) return false;
+	const rawId = document["@id"];
+	if (typeof rawId !== "string") return false;
+	const keyBase = new URL(key.id.href);
+	keyBase.hash = "";
+	const ownerId = getCanonicalPortableId(key.ownerId);
+	if (ownerId == null || getRawCanonicalPortableId(rawId) !== ownerId || getCanonicalPortableId(keyBase) !== ownerId) return false;
+	candidates.set(key, {
+		keyId: key.id.href,
+		keyOwner: key.ownerId.href,
+		publicKey: key.publicKey,
+		ownerId,
+		document: structuredClone(document),
+		expires
+	});
+	return true;
+}
+/**
+* Makes the evidence attached to a key usable, as the key has just verified
+* an HTTP Signature.  Nothing happens if the key has no evidence.
+* @param key The key that verified a signature.
+* @internal
+*/
+function promoteKeyOwnerEvidence(key) {
+	const evidence = candidates.get(key);
+	if (evidence == null) return;
+	candidates.delete(key);
+	verified.set(key, evidence);
+}
+/**
+* Gets the evidence of the portable actor that owns a key HTTP Signature
+* verification returned.
+* @param key The key.
+* @param now The current time.
+* @returns The evidence, or `undefined` if the key was not returned by HTTP
+*          Signature verification, if it has no evidence, if the evidence
+*          expired, or if the key has been changed since.
+* @internal
+*/
+function getVerifiedKeyOwnerEvidence(key, now = Temporal.Now.instant()) {
+	const evidence = verified.get(key);
+	if (evidence == null) return void 0;
+	if (Temporal.Instant.compare(now, evidence.expires) >= 0) {
+		verified.delete(key);
+		return;
+	}
+	if (key.id?.href !== evidence.keyId || key.ownerId?.href !== evidence.keyOwner || key.publicKey !== evidence.publicKey) return;
+	return evidence;
+}
+/**
+* Parses the actor from the evidence, i.e., from the expansion of its
+* document whose proof was verified.  Every call returns a new object.
+* @param evidence The evidence.
+* @param options Options for parsing the document.
+* @returns The actor, or `null` if the document is not the actor that
+*          the evidence is about, or the evidence expired meanwhile.
+* @internal
+*/
+async function parseKeyOwnerEvidence(evidence, options = {}) {
+	const refuse = (url) => Promise.reject(/* @__PURE__ */ new Error(`Refusing to fetch ${url}.`));
+	let actor;
+	try {
+		actor = await Object$1.fromJsonLd(structuredClone(evidence.document), {
+			documentLoader: refuse,
+			contextLoader: options.contextLoader,
+			tracerProvider: options.tracerProvider
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		return null;
+	}
+	if (!isPortableActorDocument(actor) || getCanonicalPortableId(actor.id) !== evidence.ownerId || Temporal.Instant.compare(Temporal.Now.instant(), evidence.expires) >= 0) return null;
+	return actor;
+}
+//#endregion
+export { promoteKeyOwnerEvidence as a, parseKeyOwnerEvidence as i, attachKeyOwnerEvidence as n, getVerifiedKeyOwnerEvidence as r, MAX_PORTABLE_KEY_TTL as t };

package/dist/keycache-Da8A8mZa.mjs

@@ -0,0 +1,200 @@
+import { Temporal } from "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as MAX_PORTABLE_KEY_TTL } from "./key-owner-evidence-APB6NpSk.mjs";
+import { CryptographicKey, Multikey } from "@fedify/vocab";
+//#region src/federation/keycache.ts
+const KEY_CACHE_GENERATION = "2";
+const COMPATIBLE_KEY_SEGMENT = "__compatible";
+const MAX_OWNER_BYTES = 32 * 1024;
+function isCompatibleKeyEntry(value) {
+	return value != null && typeof value === "object" && "key" in value && "expires" in value && typeof value.expires === "number";
+}
+function isJsonObject(value) {
+	return value != null && typeof value === "object" && !Array.isArray(value);
+}
+var KvKeyCache = class {
+	kv;
+	prefix;
+	options;
+	unavailableKeyTtl;
+	keyTtl;
+	nullKeys;
+	constructor(kv, prefix, options = {}) {
+		this.kv = kv;
+		this.prefix = prefix;
+		this.options = options;
+		this.unavailableKeyTtl = options.unavailableKeyTtl ?? Temporal.Duration.from({ minutes: 10 });
+		this.keyTtl = options.keyTtl ?? Temporal.Duration.from({ days: 30 });
+		this.nullKeys = /* @__PURE__ */ new Map();
+	}
+	#getFetchErrorKey(keyId) {
+		return [
+			...this.prefix,
+			"__fetchError",
+			keyId.href
+		];
+	}
+	#entryKey(keyId) {
+		return [
+			...this.prefix,
+			KEY_CACHE_GENERATION,
+			keyId.href
+		];
+	}
+	async get(keyId) {
+		const negativeExpiration = this.nullKeys.get(keyId.href);
+		if (negativeExpiration != null) {
+			if (Temporal.Now.instant().until(negativeExpiration).sign >= 0) return null;
+			this.nullKeys.delete(keyId.href);
+		}
+		const serialized = await this.kv.get(this.#entryKey(keyId));
+		if (serialized === void 0) return void 0;
+		if (serialized === null) {
+			this.nullKeys.set(keyId.href, Temporal.Now.instant().add(this.unavailableKeyTtl));
+			return null;
+		}
+		try {
+			return await CryptographicKey.fromJsonLd(serialized, this.options);
+		} catch {
+			try {
+				return await Multikey.fromJsonLd(serialized, this.options);
+			} catch {
+				await this.kv.delete(this.#entryKey(keyId));
+				return;
+			}
+		}
+	}
+	async set(keyId, key) {
+		if (key == null) {
+			this.nullKeys.set(keyId.href, Temporal.Now.instant().add(this.unavailableKeyTtl));
+			await this.kv.set(this.#entryKey(keyId), null, { ttl: this.unavailableKeyTtl });
+			return;
+		}
+		this.nullKeys.delete(keyId.href);
+		const serialized = await key.toJsonLd(this.options);
+		await this.kv.set(this.#entryKey(keyId), serialized, { ttl: this.keyTtl });
+	}
+	/**
+	* Returns the namespace of keys at FEP-ef61 compatible identifiers looked
+	* up for the given purpose.  Its entries carry the time they expire, which
+	* is checked when they are read, so that an entry is never used after
+	* the proof that vouched for its key expired, however late the underlying
+	* store evicts it.
+	* @param scope The purpose of the lookups.
+	* @returns The namespace.
+	* @internal
+	*/
+	compatibleKeyScope(scope) {
+		const now = this.options.now ?? (() => Temporal.Now.instant());
+		const entryKey = (keyId) => [
+			...this.prefix,
+			COMPATIBLE_KEY_SEGMENT,
+			scope,
+			keyId.href
+		];
+		const isExpired = (entry) => entry.expires <= now().epochMilliseconds;
+		const keyTtl = Math.min(this.keyTtl.total("millisecond"), MAX_PORTABLE_KEY_TTL.total("millisecond"));
+		const unavailableKeyTtl = this.unavailableKeyTtl.total("millisecond");
+		const getEntry = async (keyId) => {
+			const entry = await this.kv.get(entryKey(keyId));
+			if (entry === void 0) return void 0;
+			if (!isCompatibleKeyEntry(entry) || isExpired(entry)) {
+				await this.kv.delete(entryKey(keyId));
+				return;
+			}
+			if (entry.key === null) return null;
+			let expires;
+			try {
+				expires = Temporal.Instant.fromEpochMilliseconds(entry.expires);
+			} catch (error) {
+				if (!(error instanceof RangeError)) throw error;
+				await this.kv.delete(entryKey(keyId));
+				return;
+			}
+			let key;
+			try {
+				key = await CryptographicKey.fromJsonLd(entry.key, this.options);
+			} catch {
+				try {
+					key = await Multikey.fromJsonLd(entry.key, this.options);
+				} catch {
+					await this.kv.delete(entryKey(keyId));
+					return;
+				}
+			}
+			if (isExpired(entry)) return void 0;
+			return {
+				key,
+				...isJsonObject(entry.owner) ? { owner: entry.owner } : {},
+				expires
+			};
+		};
+		return {
+			get: async (keyId) => {
+				const entry = await getEntry(keyId);
+				return entry == null ? entry : entry.key;
+			},
+			getEntry,
+			set: async (keyId, key, options) => {
+				const serialized = key == null ? null : await key.toJsonLd(this.options);
+				const current = now();
+				let expires = current.epochMilliseconds + (key == null ? unavailableKeyTtl : keyTtl);
+				if (options?.expires != null) expires = Math.min(expires, options.expires.epochMilliseconds);
+				const ttl = expires - current.epochMilliseconds;
+				if (ttl <= 0) {
+					await this.kv.delete(entryKey(keyId));
+					return;
+				}
+				const owner = key == null || options?.owner == null || new TextEncoder().encode(JSON.stringify(options.owner)).length > MAX_OWNER_BYTES ? void 0 : options.owner;
+				await this.kv.set(entryKey(keyId), {
+					key: serialized,
+					expires,
+					...owner == null ? {} : { owner }
+				}, { ttl: Temporal.Duration.from({ milliseconds: ttl }) });
+				return key == null ? void 0 : Temporal.Instant.fromEpochMilliseconds(expires);
+			},
+			delete: async (keyId) => {
+				await this.kv.delete(entryKey(keyId));
+			}
+		};
+	}
+	async getFetchError(keyId) {
+		const cached = await this.kv.get(this.#getFetchErrorKey(keyId));
+		if (cached == null || typeof cached !== "object") return void 0;
+		if ("status" in cached && typeof cached.status === "number" && "statusText" in cached && typeof cached.statusText === "string" && "headers" in cached && Array.isArray(cached.headers) && "body" in cached && typeof cached.body === "string") return {
+			status: cached.status,
+			response: new Response(cached.body, {
+				status: cached.status,
+				statusText: cached.statusText,
+				headers: cached.headers
+			})
+		};
+		else if ("errorName" in cached && typeof cached.errorName === "string" && "errorMessage" in cached && typeof cached.errorMessage === "string") {
+			const error = new Error(cached.errorMessage);
+			error.name = cached.errorName;
+			return { error };
+		}
+	}
+	async setFetchError(keyId, error) {
+		if (error == null) {
+			await this.kv.delete(this.#getFetchErrorKey(keyId));
+			return;
+		}
+		if ("status" in error) {
+			await this.kv.set(this.#getFetchErrorKey(keyId), {
+				status: error.status,
+				statusText: error.response.statusText,
+				headers: Array.from(error.response.headers.entries()),
+				body: await error.response.clone().text()
+			}, { ttl: this.unavailableKeyTtl });
+			return;
+		}
+		await this.kv.set(this.#getFetchErrorKey(keyId), {
+			errorName: error.error.name,
+			errorMessage: error.error.message
+		}, { ttl: this.unavailableKeyTtl });
+	}
+};
+//#endregion
+export { KvKeyCache as t };

package/dist/{kv-D6hNiMTK.d.ts → kv-B2mzK5tl.d.cts}

@@ -41,14 +41,15 @@ interface KvStore {
   /**
   * Gets the value for the given key.
   * @param key The key to get the value for.
-  * @returns The value for the key, or `undefined` if the key does not exist.
+  * @returns The value for the key, including `null` if stored, or `undefined`
+  *          if the key does not exist.
   * @template T The type of the value to get.
   */
   get<T = unknown>(key: KvKey): Promise<T | undefined>;
   /**
   * Sets the value for the given key.
   * @param key The key to set the value for.
-  * @param value The value to set.
+  * @param value The value to set.  `null` is a storable value.
   * @param options Additional options for setting the value.
   */
   set(key: KvKey, value: unknown, options?: KvStoreSetOptions): Promise<void>;

package/dist/{kv-gJ8LYbxX.d.cts → kv-B2mzK5tl.d.ts}

@@ -41,14 +41,15 @@ interface KvStore {
   /**
   * Gets the value for the given key.
   * @param key The key to get the value for.
-  * @returns The value for the key, or `undefined` if the key does not exist.
+  * @returns The value for the key, including `null` if stored, or `undefined`
+  *          if the key does not exist.
   * @template T The type of the value to get.
   */
   get<T = unknown>(key: KvKey): Promise<T | undefined>;
   /**
   * Sets the value for the given key.
   * @param key The key to set the value for.
-  * @param value The value to set.
+  * @param value The value to set.  `null` is a storable value.
   * @param options Additional options for setting the value.
   */
   set(key: KvKey, value: unknown, options?: KvStoreSetOptions): Promise<void>;

package/dist/kv-DBRWVx3Q.mjs

@@ -0,0 +1,104 @@
+import { Temporal } from "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as MemoryKvStore } from "./kv-DCHkaJ9-.mjs";
+//#region src/testing/kv.ts
+/**
+* A {@link KvStore} decorator whose entry expiry is driven by a virtual clock
+* instead of wall-clock time.
+*
+* {@link MemoryKvStore} decides expiry by comparing timestamps rather than by
+* scheduling timers, so a test that wants to observe a TTL elapsing would
+* otherwise have to sleep for longer than the TTL and hope the runner keeps
+* up.  That makes such tests both slow and load-sensitive.
+*
+* This decorator keeps the TTLs itself and never passes them to the store it
+* wraps, so nothing expires until {@link advance} moves the clock.  Cache
+* hits, expiry, and repopulation therefore all become deterministic, without
+* patching any global and without a test-only entry point in the library
+* itself.  The clock starts at the Unix epoch and only ever moves forward.
+*/
+var ManualClockKvStore = class {
+	#inner;
+	#expirations = /* @__PURE__ */ new Map();
+	#now = Temporal.Instant.fromEpochMilliseconds(0);
+	/**
+	* Present only when the wrapped store has its own `cas()`.  Callers such as
+	* the task deduplication planner test `kv.cas != null` to decide whether a
+	* conditional write is available, so the decorator must not advertise a
+	* capability the wrapped store lacks.
+	*/
+	cas;
+	constructor(inner = new MemoryKvStore()) {
+		this.#inner = inner;
+		const innerCas = inner.cas;
+		if (innerCas != null) this.cas = async (key, expectedValue, newValue, options) => {
+			await this.#evictIfExpired(key);
+			const swapped = await innerCas.call(inner, key, expectedValue, newValue);
+			if (swapped) this.#recordTtl(key, options);
+			return swapped;
+		};
+	}
+	/**
+	* The current reading of the virtual clock.
+	*/
+	get now() {
+		return this.#now;
+	}
+	/**
+	* Moves the virtual clock forward.  Any entry whose TTL has elapsed by the
+	* new time reads as missing from this point on, exactly as it would once a
+	* real `KvStore` had let it expire.
+	*/
+	advance(duration) {
+		this.#now = this.#now.add(Temporal.Duration.from(duration).round({ largestUnit: "hour" }));
+	}
+	#encodeKey(key) {
+		return JSON.stringify(key);
+	}
+	/**
+	* Drops the entry if its TTL has elapsed.  Mirrors {@link MemoryKvStore},
+	* which treats an entry as live up to and including its expiration instant.
+	*/
+	async #evictIfExpired(key) {
+		const encodedKey = this.#encodeKey(key);
+		const expiration = this.#expirations.get(encodedKey);
+		if (expiration == null) return;
+		if (this.#now.until(expiration).sign >= 0) return;
+		this.#expirations.delete(encodedKey);
+		await this.#inner.delete(key);
+	}
+	async #evictAllExpired() {
+		for (const [encodedKey, expiration] of [...this.#expirations]) {
+			if (this.#now.until(expiration).sign >= 0) continue;
+			this.#expirations.delete(encodedKey);
+			await this.#inner.delete(JSON.parse(encodedKey));
+		}
+	}
+	#recordTtl(key, options) {
+		const encodedKey = this.#encodeKey(key);
+		if (options?.ttl == null) {
+			this.#expirations.delete(encodedKey);
+			return;
+		}
+		this.#expirations.set(encodedKey, this.#now.add(options.ttl.round({ largestUnit: "hour" })));
+	}
+	async get(key) {
+		await this.#evictIfExpired(key);
+		return await this.#inner.get(key);
+	}
+	async set(key, value, options) {
+		this.#recordTtl(key, options);
+		await this.#inner.set(key, value);
+	}
+	async delete(key) {
+		this.#expirations.delete(this.#encodeKey(key));
+		await this.#inner.delete(key);
+	}
+	async *list(prefix) {
+		await this.#evictAllExpired();
+		yield* this.#inner.list(prefix);
+	}
+};
+//#endregion
+export { ManualClockKvStore as t };

package/dist/{kv-cache-KyGqJqSp.mjs → kv-cache-BF1hnW65.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-DMk-nTxI.mjs";
+import { p as recordDocumentCache } from "./metrics-CYg9yxBL.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-5bnX3-Jq.js → kv-cache-CTQr1tbn.js}

@@ -1,47 +1,85 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { C as recordDocumentCache, d as validateCryptoKey, t as doubleKnock } from "./http-CsmQ-BQ4.js";
+import { G as validateCryptoKey, ot as recordDocumentCache, t as doubleKnock } from "./http-DydWCB7R.js";
 import { getLogger } from "@logtape/logtape";
+import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, resolveDocumentLoaderTimeout, validatePublicUrl, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";
-import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 //#region src/utils/docloader.ts
 const logger$1 = getLogger([
 	"fedify",
 	"utils",
 	"docloader"
 ]);
+const DEFAULT_MAX_REDIRECTION = 20;
 /**
 * Gets an authenticated {@link DocumentLoader} for the given identity.
 * Note that an authenticated document loader intentionally does not cache
 * the fetched documents.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
+* Each call, including its double-knocking retries, times out after
+* 10 seconds by default; see {@link DocumentLoaderFactoryOptions.timeout}.
 * @param identity The identity to get the document loader for.
 *                 The actor's key pair.
 * @param options The options for the document loader.
 * @returns The authenticated document loader.
 * @throws {TypeError} If the key is invalid or unsupported.
+* @throws {RangeError} If the `timeout` option is invalid.
 * @since 0.4.0
 */
-function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, tracerProvider } = {}) {
+function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, timeout, tracerProvider } = {}) {
 	validateCryptoKey(identity.privateKey);
-	async function load(url, options) {
-		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
-		} catch (error) {
-			if (error instanceof UrlError) logger$1.error("Disallowed private URL: {url}", {
-				url,
-				error
-			});
-			throw error;
+	const resolvedTimeout = resolveDocumentLoaderTimeout(timeout);
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
+		options?.signal?.throwIfAborted();
+		let currentUrl = new URL(url).href;
+		await validateUrl(currentUrl, options);
+		visited.add(currentUrl);
+		const originalRequest = createActivityPubRequest(currentUrl, { userAgent });
+		function follow(nextUrl) {
+			options?.signal?.throwIfAborted();
+			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+			if (visited.has(nextUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
+			redirected++;
 		}
-		return getRemoteDocument(url, await doubleKnock(createActivityPubRequest(url, { userAgent }), identity, {
+		const response = await doubleKnock(originalRequest, identity, {
 			maxRedirection,
 			specDeterminer,
 			log: curry(logRequest)(logger$1),
 			tracerProvider,
-			signal: options?.signal
-		}), load);
+			signal: options?.signal,
+			validateRedirect: async (nextUrl) => {
+				follow(nextUrl);
+				await validateUrl(nextUrl, options);
+				visited.add(nextUrl);
+				currentUrl = nextUrl;
+			}
+		});
+		options?.signal?.throwIfAborted();
+		return getRemoteDocument(currentUrl, response, (alternateUrl) => {
+			follow(alternateUrl);
+			return load(alternateUrl, options, redirected, visited);
+		}, options);
+	}
+	async function validateUrl(url, options) {
+		if (!allowPrivateAddress) {
+			try {
+				await validatePublicUrl(url);
+			} catch (error) {
+				if (error instanceof UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
+					url,
+					error
+				});
+				else logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+					url,
+					error
+				});
+				throw error;
+			}
+			options?.signal?.throwIfAborted();
+		}
 	}
-	return load;
+	return withDocumentLoaderTimeout((url, options) => load(url, options), resolvedTimeout);
 }
 //#endregion
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-DQ29C4XL.cjs → kv-cache-DCac1nEU.cjs}

@@ -1,52 +1,88 @@
 const { URLPattern } = require("urlpattern-polyfill");
-require("./chunk-Czpeue4M.cjs");
-const require_http = require("./http-hlIjmewS.cjs");
-const require_temporal_polyfill = require("./temporal-polyfill-BCdTHexd.cjs");
+const require_http = require("./http-B5JT115n.cjs");
 let _logtape_logtape = require("@logtape/logtape");
-let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let es_toolkit = require("es-toolkit");
 //#region src/utils/docloader.ts
 const logger$1 = (0, _logtape_logtape.getLogger)([
 	"fedify",
 	"utils",
 	"docloader"
 ]);
+const DEFAULT_MAX_REDIRECTION = 20;
 /**
 * Gets an authenticated {@link DocumentLoader} for the given identity.
 * Note that an authenticated document loader intentionally does not cache
 * the fetched documents.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
+* Each call, including its double-knocking retries, times out after
+* 10 seconds by default; see {@link DocumentLoaderFactoryOptions.timeout}.
 * @param identity The identity to get the document loader for.
 *                 The actor's key pair.
 * @param options The options for the document loader.
 * @returns The authenticated document loader.
 * @throws {TypeError} If the key is invalid or unsupported.
+* @throws {RangeError} If the `timeout` option is invalid.
 * @since 0.4.0
 */
-function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, tracerProvider } = {}) {
+function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, timeout, tracerProvider } = {}) {
 	require_http.validateCryptoKey(identity.privateKey);
-	async function load(url, options) {
-		if (!allowPrivateAddress) try {
-			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
-		} catch (error) {
-			if (error instanceof _fedify_vocab_runtime.UrlError) logger$1.error("Disallowed private URL: {url}", {
-				url,
-				error
-			});
-			throw error;
+	const resolvedTimeout = (0, _fedify_vocab_runtime.resolveDocumentLoaderTimeout)(timeout);
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
+		options?.signal?.throwIfAborted();
+		let currentUrl = new URL(url).href;
+		await validateUrl(currentUrl, options);
+		visited.add(currentUrl);
+		const originalRequest = (0, _fedify_vocab_runtime.createActivityPubRequest)(currentUrl, { userAgent });
+		function follow(nextUrl) {
+			options?.signal?.throwIfAborted();
+			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new _fedify_vocab_runtime.FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+			if (visited.has(nextUrl)) throw new _fedify_vocab_runtime.FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
+			redirected++;
 		}
-		return (0, _fedify_vocab_runtime.getRemoteDocument)(url, await require_http.doubleKnock((0, _fedify_vocab_runtime.createActivityPubRequest)(url, { userAgent }), identity, {
+		const response = await require_http.doubleKnock(originalRequest, identity, {
 			maxRedirection,
 			specDeterminer,
 			log: (0, es_toolkit.curry)(_fedify_vocab_runtime.logRequest)(logger$1),
 			tracerProvider,
-			signal: options?.signal
-		}), load);
+			signal: options?.signal,
+			validateRedirect: async (nextUrl) => {
+				follow(nextUrl);
+				await validateUrl(nextUrl, options);
+				visited.add(nextUrl);
+				currentUrl = nextUrl;
+			}
+		});
+		options?.signal?.throwIfAborted();
+		return (0, _fedify_vocab_runtime.getRemoteDocument)(currentUrl, response, (alternateUrl) => {
+			follow(alternateUrl);
+			return load(alternateUrl, options, redirected, visited);
+		}, options);
+	}
+	async function validateUrl(url, options) {
+		if (!allowPrivateAddress) {
+			try {
+				await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
+			} catch (error) {
+				if (error instanceof _fedify_vocab_runtime.UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
+					url,
+					error
+				});
+				else logger$1[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+					url,
+					error
+				});
+				throw error;
+			}
+			options?.signal?.throwIfAborted();
+		}
 	}
-	return load;
+	return (0, _fedify_vocab_runtime.withDocumentLoaderTimeout)((url, options) => load(url, options), resolvedTimeout);
 }
 //#endregion
 //#region src/utils/kv-cache.ts
-const Temporal = require_temporal_polyfill.Temporal;
+const Temporal = require_http.Temporal;
 const logger = (0, _logtape_logtape.getLogger)([
 	"fedify",
 	"utils",