@fedify/fedify 2.0.28-dev.1974 → 2.0.28-dev.1979

package/dist/{builder-DBKy92BX.mjs → builder-CAAXTNeK.mjs}

@@ -2,8 +2,8 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError, t as Router } from "./router-CrMLXoOr.mjs";
-import { n as version, t as name } from "./deno-CGtm12Ft.mjs";
-import { t as InboxListenerSet } from "./inbox-BZNyUPzW.mjs";
+import { n as version, t as name } from "./deno-D3gZ1DsB.mjs";
+import { t as InboxListenerSet } from "./inbox-DC8NbYIj.mjs";
 import { getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";
@@ -42,7 +42,7 @@ var FederationBuilderImpl = class {
 		this.collectionTypeIds = {};
 	}
 	async build(options) {
-		const { FederationImpl } = await import("./middleware-sbzAVAzo.mjs");
+		const { FederationImpl } = await import("./middleware-BqkNe0c6.mjs");
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();

package/dist/compat/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { bt as ActivityTransformer, n as Context } from "../context-CJZHWLmz.cjs";
+import { bt as ActivityTransformer, n as Context } from "../context-zLLwVY_G.cjs";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { bt as ActivityTransformer, n as Context } from "../context-DnsFj3yK.js";
+import { bt as ActivityTransformer, n as Context } from "../context-DJ5oMnte.js";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/transformers.test.mjs

@@ -5,7 +5,7 @@ import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
 import { t as assert } from "../assert-ddO5KLpe.mjs";
 import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { _ as autoIdAssigner, g as actorDehydrator, n as FederationImpl } from "../middleware-DpEJSmjy.mjs";
+import { _ as autoIdAssigner, g as actorDehydrator, n as FederationImpl } from "../middleware-D3a1JsO1.mjs";
 import { test } from "@fedify/fixture";
 import { Follow, Person } from "@fedify/vocab";
 //#region src/compat/transformers.test.ts

package/dist/{context-DnsFj3yK.d.ts → context-DJ5oMnte.d.ts}

@@ -1391,7 +1391,8 @@ interface FederationOptions<TContextData> {
   */
   authenticatedDocumentLoaderFactory?: AuthenticatedDocumentLoaderFactory;
   /**
-  * Whether to allow fetching private network addresses in the document loader.
+  * Whether to allow private network addresses in the document loader and
+  * outbound activity delivery, including redirects.
   *
   * If turned on, {@link FederationOptions.documentLoader},
   * {@link FederationOptions.contextLoader}, and

package/dist/{context-CJZHWLmz.d.cts → context-zLLwVY_G.d.cts}

@@ -1391,7 +1391,8 @@ interface FederationOptions<TContextData> {
   */
   authenticatedDocumentLoaderFactory?: AuthenticatedDocumentLoaderFactory;
   /**
-  * Whether to allow fetching private network addresses in the document loader.
+  * Whether to allow private network addresses in the document loader and
+  * outbound activity delivery, including redirects.
   *
   * If turned on, {@link FederationOptions.documentLoader},
   * {@link FederationOptions.contextLoader}, and

package/dist/{deno-CGtm12Ft.mjs → deno-D3gZ1DsB.mjs}

@@ -3,6 +3,6 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.28-dev.1974+d70e3148";
+var version = "2.0.28-dev.1979+d0048bc7";
 //#endregion
 export { version as n, name as t };

package/dist/{docloader-_hXTUC-b.mjs → docloader-DIk3fEXZ.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { a as validateCryptoKey } from "./key-rC9mW1U5.mjs";
-import { n as doubleKnock } from "./http--P33qRwW.mjs";
+import { a as validateCryptoKey } from "./key-BQUnVMwc.mjs";
+import { n as doubleKnock } from "./http-Bn3-am6C.mjs";
 import { curry } from "es-toolkit";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, validatePublicUrl } from "@fedify/vocab-runtime";
 import { getLogger } from "@logtape/logtape";

package/dist/federation/builder.test.mjs

@@ -5,7 +5,7 @@ import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { a as assertExists } from "../std__assert-Duiq_YC9.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
 import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { n as createFederationBuilder } from "../builder-DBKy92BX.mjs";
+import { n as createFederationBuilder } from "../builder-CAAXTNeK.mjs";
 import { test } from "@fedify/fixture";
 import { Activity, Note, Person } from "@fedify/vocab";
 //#region src/federation/builder.test.ts

package/dist/federation/handler.test.mjs

@@ -6,12 +6,12 @@ import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-Duiq_YC9.mjs";
 import { t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
 import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { s as signRequest } from "../http--P33qRwW.mjs";
+import { s as signRequest } from "../http-Bn3-am6C.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, s as rsaPublicKey2 } from "../keys-CtZLJq76.mjs";
-import { a as compactJsonLd, f as signJsonLd } from "../ld-CN2nacLy.mjs";
+import { a as compactJsonLd, f as signJsonLd } from "../ld-CVbwQ8Fz.mjs";
 import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { a as createFederation, c as handleCollection, d as handleObject, f as respondWithObject, l as handleCustomCollection, p as respondWithObjectIfAcceptable, s as handleActor, u as handleInbox } from "../middleware-DpEJSmjy.mjs";
-import { t as InboxListenerSet } from "../inbox-BZNyUPzW.mjs";
+import { a as createFederation, c as handleCollection, d as handleObject, f as respondWithObject, l as handleCustomCollection, p as respondWithObjectIfAcceptable, s as handleActor, u as handleInbox } from "../middleware-D3a1JsO1.mjs";
+import { t as InboxListenerSet } from "../inbox-DC8NbYIj.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, Note, Person } from "@fedify/vocab";
 //#region src/federation/handler.test.ts

package/dist/federation/idempotency.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-Duiq_YC9.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey, t as ed25519Multikey } from "../keys-CtZLJq76.mjs";
-import { n as signObject } from "../proof-CpEH24hi.mjs";
+import { n as signObject } from "../proof-DZWmoF6Z.mjs";
 import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { a as createFederation } from "../middleware-DpEJSmjy.mjs";
+import { a as createFederation } from "../middleware-D3a1JsO1.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, Follow, Person } from "@fedify/vocab";
 //#region src/federation/idempotency.test.ts

package/dist/federation/inbox.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
-import { t as InboxListenerSet } from "../inbox-BZNyUPzW.mjs";
+import { t as InboxListenerSet } from "../inbox-DC8NbYIj.mjs";
 import { test } from "@fedify/fixture";
 import { Activity, Create, Invite, Offer, Update } from "@fedify/vocab";
 //#region src/federation/inbox.test.ts

package/dist/federation/middleware.test.mjs

@@ -10,18 +10,18 @@ import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
 import { t as assertNotEquals } from "../assert_not_equals--wG9hV7u.mjs";
 import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { l as verifyRequest, s as signRequest } from "../http--P33qRwW.mjs";
+import { l as verifyRequest, s as signRequest } from "../http-Bn3-am6C.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CtZLJq76.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-_hXTUC-b.mjs";
-import { a as compactJsonLd, f as signJsonLd, m as verifyJsonLd, s as detachSignature } from "../ld-CN2nacLy.mjs";
-import { t as doesActorOwnKey } from "../owner-CFgyZgkz.mjs";
-import { n as signObject, r as verifyObject } from "../proof-CpEH24hi.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-DIk3fEXZ.mjs";
+import { a as compactJsonLd, f as signJsonLd, m as verifyJsonLd, s as detachSignature } from "../ld-CVbwQ8Fz.mjs";
+import { t as doesActorOwnKey } from "../owner-D9CjMxWb.mjs";
+import { n as signObject, r as verifyObject } from "../proof-DZWmoF6Z.mjs";
 import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { a as createFederation, i as KvSpecDeterminer, n as FederationImpl, r as InboxContextImpl, t as ContextImpl } from "../middleware-DpEJSmjy.mjs";
+import { a as createFederation, i as KvSpecDeterminer, n as FederationImpl, r as InboxContextImpl, t as ContextImpl } from "../middleware-D3a1JsO1.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import * as vocab from "@fedify/vocab";
 import { Create, Offer, Person, getTypeId, lookupObject } from "@fedify/vocab";
-import { getDocumentLoader } from "@fedify/vocab-runtime";
+import { UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
 //#region ../fixture/src/fixtures/example.com/create.json
 var id$2 = "https://example.com/create";
 var create_default = {
@@ -2816,6 +2816,7 @@ test("FederationImpl.processQueuedTask() permanent failure", async (t) => {
 					return Promise.resolve();
 				}
 			},
+			allowPrivateAddress: true,
 			...options.permanentFailureStatusCodes ? { permanentFailureStatusCodes: options.permanentFailureStatusCodes } : {}
 		});
 		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox");
@@ -3667,5 +3668,36 @@ test("KvSpecDeterminer", async (t) => {
 		assertEquals(spec, "rfc9421");
 	});
 });
+test("ContextImpl.sendActivity() honors the private-address policy", async (t) => {
+	for (const allowPrivateAddress of [false, true]) await t.step(`allowPrivateAddress: ${allowPrivateAddress}`, async () => {
+		const inbox = "http://127.0.0.1/inbox";
+		esm_default.mockGlobal().post(inbox, 202);
+		try {
+			const ctx = createFederation({
+				kv: new MemoryKvStore(),
+				allowPrivateAddress
+			}).createContext(new URL("https://example.com/"));
+			const send = () => ctx.sendActivity({
+				privateKey: ed25519PrivateKey,
+				keyId: ed25519Multikey.id
+			}, new Person({
+				id: new URL("https://example.com/recipient"),
+				inbox: new URL(inbox)
+			}), new Create({
+				id: new URL("https://example.com/activity"),
+				actor: new URL("https://example.com/person")
+			}), { immediate: true });
+			if (allowPrivateAddress) {
+				await send();
+				assertEquals(esm_default.callHistory.calls(inbox).length, 1);
+			} else {
+				await assertRejects(send, UrlError);
+				assertEquals(esm_default.callHistory.calls(inbox).length, 0);
+			}
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
 //#endregion
 export {};

package/dist/federation/mod.cjs

@@ -2,7 +2,7 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../chunk-DDcVe30Y.cjs");
-const require_middleware = require("../middleware-BXwn4gnl.cjs");
+const require_middleware = require("../middleware-Fcpx7tz6.cjs");
 let es_toolkit = require("es-toolkit");
 //#region src/federation/kv.ts
 /**

package/dist/federation/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as AuthorizePredicate, A as CreateExponentialBackoffPolicyOptions, B as RespondWithObjectOptions, C as InboxListenerSetters, D as FederationOrigin, E as FederationKvPrefixes, F as createFederationBuilder, G as MessageQueue, H as respondWithObjectIfAcceptable, I as Router, J as ParallelMessageQueue, K as MessageQueueEnqueueOptions, L as RouterError, M as RetryPolicy, N as createExponentialBackoffPolicy, O as FederationQueueOptions, P as Message, Q as ActorKeyPairsDispatcher, R as RouterOptions, S as IdempotencyStrategy, T as Rfc6570Expression, U as InProcessMessageQueue, V as respondWithObject, W as InProcessMessageQueueOptions, X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, _ as FederationBuilder, _t as PageItems, a as InboxContext, at as CustomCollectionDispatcher, b as FederationStartQueueOptions, c as RouteActivityOptions, ct as NodeInfoDispatcher, d as ActorCallbackSetters, dt as OutboxErrorHandler, et as CollectionCounter, f as CollectionCallbackSetters, ft as OutboxPermanentFailureHandler, g as Federation, gt as SenderKeyPair, h as Federatable, ht as SendActivityError, i as GetSignedKeyOptions, it as CustomCollectionCursor, j as RetryContext, k as createFederation, l as SendActivityOptions, lt as ObjectAuthorizePredicate, m as CustomCollectionCallbackSetters, mt as WebFingerLinksDispatcher, n as Context, nt as CollectionDispatcher, o as ParseUriResult, ot as InboxErrorHandler, p as ConstructorWithTypeId, pt as SharedInboxKeyDispatcher, q as MessageQueueListenOptions, r as ForwardActivityOptions, rt as CustomCollectionCounter, s as RequestContext, st as InboxListener, t as ActorKeyPair, tt as CollectionCursor, u as SendActivityOptionsForCollection, ut as ObjectDispatcher, v as FederationFetchOptions, vt as buildCollectionSynchronizationHeader, w as ObjectCallbackSetters, x as IdempotencyKeyCallback, y as FederationOptions, yt as digest, z as RouterRouteResult } from "../context-CJZHWLmz.cjs";
+import { $ as AuthorizePredicate, A as CreateExponentialBackoffPolicyOptions, B as RespondWithObjectOptions, C as InboxListenerSetters, D as FederationOrigin, E as FederationKvPrefixes, F as createFederationBuilder, G as MessageQueue, H as respondWithObjectIfAcceptable, I as Router, J as ParallelMessageQueue, K as MessageQueueEnqueueOptions, L as RouterError, M as RetryPolicy, N as createExponentialBackoffPolicy, O as FederationQueueOptions, P as Message, Q as ActorKeyPairsDispatcher, R as RouterOptions, S as IdempotencyStrategy, T as Rfc6570Expression, U as InProcessMessageQueue, V as respondWithObject, W as InProcessMessageQueueOptions, X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, _ as FederationBuilder, _t as PageItems, a as InboxContext, at as CustomCollectionDispatcher, b as FederationStartQueueOptions, c as RouteActivityOptions, ct as NodeInfoDispatcher, d as ActorCallbackSetters, dt as OutboxErrorHandler, et as CollectionCounter, f as CollectionCallbackSetters, ft as OutboxPermanentFailureHandler, g as Federation, gt as SenderKeyPair, h as Federatable, ht as SendActivityError, i as GetSignedKeyOptions, it as CustomCollectionCursor, j as RetryContext, k as createFederation, l as SendActivityOptions, lt as ObjectAuthorizePredicate, m as CustomCollectionCallbackSetters, mt as WebFingerLinksDispatcher, n as Context, nt as CollectionDispatcher, o as ParseUriResult, ot as InboxErrorHandler, p as ConstructorWithTypeId, pt as SharedInboxKeyDispatcher, q as MessageQueueListenOptions, r as ForwardActivityOptions, rt as CustomCollectionCounter, s as RequestContext, st as InboxListener, t as ActorKeyPair, tt as CollectionCursor, u as SendActivityOptionsForCollection, ut as ObjectDispatcher, v as FederationFetchOptions, vt as buildCollectionSynchronizationHeader, w as ObjectCallbackSetters, x as IdempotencyKeyCallback, y as FederationOptions, yt as digest, z as RouterRouteResult } from "../context-zLLwVY_G.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-gJ8LYbxX.cjs";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-43DJyETz.cjs";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-BtvLkCgb.cjs";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetSignedKeyOptions, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MemoryKvStore, Message, MessageQueue, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxErrorHandler, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriResult, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as AuthorizePredicate, A as CreateExponentialBackoffPolicyOptions, B as RespondWithObjectOptions, C as InboxListenerSetters, D as FederationOrigin, E as FederationKvPrefixes, F as createFederationBuilder, G as MessageQueue, H as respondWithObjectIfAcceptable, I as Router, J as ParallelMessageQueue, K as MessageQueueEnqueueOptions, L as RouterError, M as RetryPolicy, N as createExponentialBackoffPolicy, O as FederationQueueOptions, P as Message, Q as ActorKeyPairsDispatcher, R as RouterOptions, S as IdempotencyStrategy, T as Rfc6570Expression, U as InProcessMessageQueue, V as respondWithObject, W as InProcessMessageQueueOptions, X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, _ as FederationBuilder, _t as PageItems, a as InboxContext, at as CustomCollectionDispatcher, b as FederationStartQueueOptions, c as RouteActivityOptions, ct as NodeInfoDispatcher, d as ActorCallbackSetters, dt as OutboxErrorHandler, et as CollectionCounter, f as CollectionCallbackSetters, ft as OutboxPermanentFailureHandler, g as Federation, gt as SenderKeyPair, h as Federatable, ht as SendActivityError, i as GetSignedKeyOptions, it as CustomCollectionCursor, j as RetryContext, k as createFederation, l as SendActivityOptions, lt as ObjectAuthorizePredicate, m as CustomCollectionCallbackSetters, mt as WebFingerLinksDispatcher, n as Context, nt as CollectionDispatcher, o as ParseUriResult, ot as InboxErrorHandler, p as ConstructorWithTypeId, pt as SharedInboxKeyDispatcher, q as MessageQueueListenOptions, r as ForwardActivityOptions, rt as CustomCollectionCounter, s as RequestContext, st as InboxListener, t as ActorKeyPair, tt as CollectionCursor, u as SendActivityOptionsForCollection, ut as ObjectDispatcher, v as FederationFetchOptions, vt as buildCollectionSynchronizationHeader, w as ObjectCallbackSetters, x as IdempotencyKeyCallback, y as FederationOptions, yt as digest, z as RouterRouteResult } from "../context-DnsFj3yK.js";
+import { $ as AuthorizePredicate, A as CreateExponentialBackoffPolicyOptions, B as RespondWithObjectOptions, C as InboxListenerSetters, D as FederationOrigin, E as FederationKvPrefixes, F as createFederationBuilder, G as MessageQueue, H as respondWithObjectIfAcceptable, I as Router, J as ParallelMessageQueue, K as MessageQueueEnqueueOptions, L as RouterError, M as RetryPolicy, N as createExponentialBackoffPolicy, O as FederationQueueOptions, P as Message, Q as ActorKeyPairsDispatcher, R as RouterOptions, S as IdempotencyStrategy, T as Rfc6570Expression, U as InProcessMessageQueue, V as respondWithObject, W as InProcessMessageQueueOptions, X as ActorDispatcher, Y as ActorAliasMapper, Z as ActorHandleMapper, _ as FederationBuilder, _t as PageItems, a as InboxContext, at as CustomCollectionDispatcher, b as FederationStartQueueOptions, c as RouteActivityOptions, ct as NodeInfoDispatcher, d as ActorCallbackSetters, dt as OutboxErrorHandler, et as CollectionCounter, f as CollectionCallbackSetters, ft as OutboxPermanentFailureHandler, g as Federation, gt as SenderKeyPair, h as Federatable, ht as SendActivityError, i as GetSignedKeyOptions, it as CustomCollectionCursor, j as RetryContext, k as createFederation, l as SendActivityOptions, lt as ObjectAuthorizePredicate, m as CustomCollectionCallbackSetters, mt as WebFingerLinksDispatcher, n as Context, nt as CollectionDispatcher, o as ParseUriResult, ot as InboxErrorHandler, p as ConstructorWithTypeId, pt as SharedInboxKeyDispatcher, q as MessageQueueListenOptions, r as ForwardActivityOptions, rt as CustomCollectionCounter, s as RequestContext, st as InboxListener, t as ActorKeyPair, tt as CollectionCursor, u as SendActivityOptionsForCollection, ut as ObjectDispatcher, v as FederationFetchOptions, vt as buildCollectionSynchronizationHeader, w as ObjectCallbackSetters, x as IdempotencyKeyCallback, y as FederationOptions, yt as digest, z as RouterRouteResult } from "../context-DJ5oMnte.js";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-D6hNiMTK.js";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-COgmn-UO.js";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-Du-UVCX_.js";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetSignedKeyOptions, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MemoryKvStore, Message, MessageQueue, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxErrorHandler, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriResult, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-CwIT91Nc.js";
+import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-2Qp34eTb.js";
 import { isEqual } from "es-toolkit";
 //#region src/federation/kv.ts
 /**

package/dist/federation/send.test.mjs

@@ -8,12 +8,13 @@ import { n as assertFalse, t as assertRejects } from "../assert_rejects-B-qJtC9Z
 import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
 import { t as assertNotEquals } from "../assert_not_equals--wG9hV7u.mjs";
 import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { l as verifyRequest } from "../http--P33qRwW.mjs";
+import { l as verifyRequest } from "../http-Bn3-am6C.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CtZLJq76.mjs";
-import { t as doesActorOwnKey } from "../owner-CFgyZgkz.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-pXXMu19o.mjs";
+import { t as doesActorOwnKey } from "../owner-D9CjMxWb.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-IMhmEkun.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
+import { UrlError } from "@fedify/vocab-runtime";
 //#region src/federation/send.test.ts
 test("extractInboxes()", () => {
 	const recipients = [
@@ -415,5 +416,137 @@ test("sendActivity() records OpenTelemetry span events", async (t) => {
 		esm_default.hardReset();
 	});
 });
+for (const signed of [false, true]) {
+	const keys = [{
+		privateKey: signed ? rsaPrivateKey2 : ed25519PrivateKey,
+		keyId: signed ? rsaPublicKey2.id : ed25519Multikey.id
+	}];
+	test(`sendActivity() validates destinations (signed: ${signed})`, async (t) => {
+		const activity = {
+			type: "Create",
+			id: "https://example.com/activity"
+		};
+		const publicInbox = "https://8.8.8.8/inbox";
+		const privateInbox = "http://127.0.0.1/inbox";
+		for (const target of [
+			privateInbox,
+			"http://169.254.169.254/",
+			"http://[::1]/"
+		]) await t.step(`rejects ${target} before fetching`, async () => {
+			esm_default.mockGlobal().catch(202);
+			try {
+				await assertRejects(() => sendActivity({
+					activity,
+					keys,
+					inbox: new URL(target)
+				}), UrlError);
+				assertEquals(esm_default.callHistory.calls().length, 0);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		for (const status of [
+			301,
+			302,
+			303,
+			307,
+			308
+		]) for (const allowPrivateAddress of [false, true]) await t.step(`${status} private redirect, opt-in: ${allowPrivateAddress}`, async () => {
+			esm_default.mockGlobal();
+			esm_default.route(publicInbox, {
+				status,
+				headers: { Location: privateInbox }
+			});
+			esm_default.route(privateInbox, 202);
+			try {
+				const send = () => sendActivity({
+					activity,
+					keys,
+					inbox: new URL(publicInbox),
+					allowPrivateAddress
+				});
+				if (allowPrivateAddress) {
+					await send();
+					const calls = esm_default.callHistory.calls(privateInbox);
+					assertEquals(calls.length, 1);
+					const request = calls[0].request;
+					const preservesBody = signed || status === 307 || status === 308;
+					assertEquals(request.method, preservesBody ? "POST" : "GET");
+					assertEquals(await request.clone().text(), preservesBody ? JSON.stringify(activity) : "");
+				} else {
+					await assertRejects(send, UrlError);
+					assertEquals(esm_default.callHistory.calls(privateInbox).length, 0);
+				}
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		await t.step("rejects a private destination after a public redirect", async () => {
+			esm_default.mockGlobal().route(publicInbox, {
+				status: 307,
+				headers: { Location: "/next" }
+			}).route("https://8.8.8.8/next", {
+				status: 308,
+				headers: { Location: privateInbox }
+			}).route(privateInbox, 202);
+			try {
+				await assertRejects(() => sendActivity({
+					activity,
+					keys,
+					inbox: new URL(publicInbox)
+				}), UrlError);
+				assertEquals(esm_default.callHistory.calls(privateInbox).length, 0);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		await t.step("limits redirect loops", async () => {
+			esm_default.mockGlobal().route(publicInbox, {
+				status: 307,
+				headers: { Location: publicInbox }
+			});
+			try {
+				await assertRejects(() => sendActivity({
+					activity,
+					keys,
+					inbox: new URL(publicInbox)
+				}));
+				assert(esm_default.callHistory.calls().length <= 21);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		await t.step("allows a direct private inbox with opt-in", async () => {
+			esm_default.mockGlobal().route(privateInbox, 202);
+			try {
+				await sendActivity({
+					activity,
+					keys,
+					inbox: new URL(privateInbox),
+					allowPrivateAddress: true
+				});
+				assertEquals(esm_default.callHistory.calls(privateInbox).length, 1);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+		await t.step("allows relative public redirects", async () => {
+			esm_default.mockGlobal().route(publicInbox, {
+				status: 307,
+				headers: { Location: "/next" }
+			}).route("https://8.8.8.8/next", 202);
+			try {
+				await sendActivity({
+					activity,
+					keys,
+					inbox: new URL(publicInbox)
+				});
+				assertEquals(esm_default.callHistory.calls("https://8.8.8.8/next").length, 1);
+			} finally {
+				esm_default.hardReset();
+			}
+		});
+	});
+}
 //#endregion
 export {};

package/dist/federation/temporal.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import "../std__assert-Duiq_YC9.mjs";
 import { n as assertFalse } from "../assert_rejects-B-qJtC9Z.mjs";
 import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-B4rBDksp.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-BovRWwqL.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -5,7 +5,7 @@ import { n as createRequestContext } from "../context-Juj6bdHC.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-Duiq_YC9.mjs";
 import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { a as createFederation, o as handleWebFinger } from "../middleware-DpEJSmjy.mjs";
+import { a as createFederation, o as handleWebFinger } from "../middleware-D3a1JsO1.mjs";
 import { test } from "@fedify/fixture";
 import { Image, Link, Person } from "@fedify/vocab";
 //#region src/federation/webfinger.test.ts

package/dist/{http-BuaGj55w.cjs → http-BLqv_3ue.cjs}

@@ -11,7 +11,7 @@ let byte_encodings_base64 = require("byte-encodings/base64");
 let structured_field_values = require("structured-field-values");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.28-dev.1974+d70e3148";
+var version = "2.0.28-dev.1979+d0048bc7";
 //#endregion
 //#region src/sig/key.ts
 /**

package/dist/{http--P33qRwW.mjs → http-Bn3-am6C.mjs}

@@ -1,8 +1,8 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CGtm12Ft.mjs";
-import { a as validateCryptoKey, n as fetchKey } from "./key-rC9mW1U5.mjs";
+import { n as version, t as name } from "./deno-D3gZ1DsB.mjs";
+import { a as validateCryptoKey, n as fetchKey } from "./key-BQUnVMwc.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";

package/dist/{http-BP1pVF9m.js → http-Cx5dD1D_.js}

@@ -10,7 +10,7 @@ import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { Item, decodeDict, encodeItem } from "structured-field-values";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.28-dev.1974+d70e3148";
+var version = "2.0.28-dev.1979+d0048bc7";
 //#endregion
 //#region src/sig/key.ts
 /**

package/dist/{inbox-BZNyUPzW.mjs → inbox-DC8NbYIj.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CGtm12Ft.mjs";
+import { n as version, t as name } from "./deno-D3gZ1DsB.mjs";
 import { Activity, getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";

package/dist/{key-rC9mW1U5.mjs → key-BQUnVMwc.mjs}

@@ -1,7 +1,7 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CGtm12Ft.mjs";
+import { n as version, t as name } from "./deno-D3gZ1DsB.mjs";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { getDocumentLoader } from "@fedify/vocab-runtime";

package/dist/{kv-cache-BVqMp1RC.cjs → kv-cache-CCEitzFw.cjs}

@@ -1,7 +1,7 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 require("./chunk-DDcVe30Y.cjs");
-const require_http = require("./http-BuaGj55w.cjs");
+const require_http = require("./http-BLqv_3ue.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");

package/dist/{kv-cache-CKg5W012.js → kv-cache-DI4m-4xy.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { c as validateCryptoKey, t as doubleKnock } from "./http-BP1pVF9m.js";
+import { c as validateCryptoKey, t as doubleKnock } from "./http-Cx5dD1D_.js";
 import { getLogger } from "@logtape/logtape";
 import { curry } from "es-toolkit";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/{ld-CN2nacLy.mjs → ld-CVbwQ8Fz.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CGtm12Ft.mjs";
-import { a as validateCryptoKey, n as fetchKey } from "./key-rC9mW1U5.mjs";
+import { n as version, t as name } from "./deno-D3gZ1DsB.mjs";
+import { a as validateCryptoKey, n as fetchKey } from "./key-BQUnVMwc.mjs";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { getDocumentLoader } from "@fedify/vocab-runtime";