@fedify/fedify 2.0.28-dev.1974 → 2.0.28-dev.1982

package/dist/{http-RYvZHWMc.d.cts → http-CDupyfOc.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
-import { CryptographicKey, Multikey } from "@fedify/vocab";
-import { DocumentLoader } from "@fedify/vocab-runtime";
+import { Actor, CryptographicKey, Multikey } from "@fedify/vocab";
 import { TracerProvider } from "@opentelemetry/api";
+import { DocumentLoader } from "@fedify/vocab-runtime";
 
 //#region src/sig/key.d.ts
 /**

package/dist/{http-BP1pVF9m.js → http-CwcG2wDs.js}

@@ -10,7 +10,7 @@ import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { Item, decodeDict, encodeItem } from "structured-field-values";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.28-dev.1974+d70e3148";
+var version = "2.0.28-dev.1982+a57dec3f";
 //#endregion
 //#region src/sig/key.ts
 /**
@@ -92,6 +92,118 @@ async function importJwk(jwk, type) {
 	return key;
 }
 /**
+* Fetches the document that the given actor URI dereferences to, and returns
+* the actor only if the host that served the document is authoritative for
+* the id the document claims.
+*
+* Only the origin that serves an actor id can speak for it.  Without that
+* rule any host could serve a document describing somebody else's actor—and
+* listing its own keys as that actor's.
+*
+* @param actorId The URI of the actor to fetch.
+* @param options Options for fetching the document.
+* @returns The actor, or `null` if the document cannot be fetched, is not an
+*          actor, or belongs to another origin.
+* @internal
+*/
+async function fetchActorDocument(actorId, options = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	const { tracerProvider } = options;
+	let document;
+	let documentUrl = actorId;
+	try {
+		const remoteDocument = await documentLoader(actorId.href);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", actorId);
+	} catch (error) {
+		logger.debug("Failed to fetch the actor {actorId}: {error}", {
+			actorId: actorId.href,
+			error
+		});
+		return null;
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider,
+			baseUrl: documentUrl
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+			documentUrl: documentUrl.href,
+			error
+		});
+		return null;
+	}
+	if (!isActor(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
+	return object;
+}
+/**
+* Resolves the owner that the given key claims, and returns it only if the
+* claim holds.
+*
+* The `owner` of a {@link CryptographicKey}, like the `controller` of
+* a {@link Multikey}, proves nothing on its own: the key document and the
+* claim inside it are served by the same host, so anyone able to serve a key
+* document can name any actor in the world as its owner.  The claim becomes
+* meaningful only once the named actor's own document is fetched and turns
+* out to link back to the key.  This function performs that mutual-link
+* check, which is the only sound way to learn a fetched key's owner.
+*
+* The claimed owner is always dereferenced, never read out of the key
+* document: an owner embedded there is written by whoever wrote the key.
+*
+* @param key The key whose ownership claim is to be verified.  It must carry
+*            an `id`, as that is what the owner has to link back to.
+* @param options Options for fetching the claimed owner.
+* @returns The verified owner, or `null` if the key claims no owner, the
+*          owner cannot be fetched, or the owner does not link back to
+*          the key.
+* @internal
+*/
+async function verifyKeyOwnership(key, options = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const keyId = key.id;
+	if (keyId == null) return null;
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (claimedOwnerId == null) return null;
+	const owner = await fetchActorDocument(claimedOwnerId, options);
+	if (owner == null) {
+		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
+			keyId: keyId.href,
+			claimedOwnerId: claimedOwnerId.href
+		});
+		return null;
+	}
+	const linkedKeyIds = key instanceof CryptographicKey ? owner.publicKeyIds : owner.assertionMethodIds;
+	for (const linkedKeyId of linkedKeyIds) if (linkedKeyId.href === keyId.href) return owner;
+	logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims does not list the key as its own.", {
+		keyId: keyId.href,
+		claimedOwnerId: claimedOwnerId.href
+	});
+	return null;
+}
+/**
 * Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
 * If the given URL contains an {@link Actor} object, it tries to find
 * the corresponding key in the `publicKey` or `assertionMethod` property.
@@ -160,8 +272,11 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 	}
 	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 	let document;
+	let documentUrl = cacheKey;
 	try {
-		document = (await (documentLoader ?? getDocumentLoader())(keyId)).document;
+		const remoteDocument = await (documentLoader ?? getDocumentLoader())(keyId);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
 	} catch (_) {
 		logger.debug("Failed to fetch key {keyId}.", { keyId });
 		await keyCache?.set(cacheKey, null);
@@ -198,8 +313,22 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 		}
 	}
 	let key = null;
-	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object;
+	let ownerDocument = null;
+	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
 	else if (isActor(object)) {
+		if (object.id == null || object.id.origin !== documentUrl.origin) {
+			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
+				keyId,
+				documentUrl: documentUrl.href,
+				actorId: object.id?.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		ownerDocument = object;
 		const keys = cls === CryptographicKey ? object.getPublicKeys({
 			documentLoader,
 			contextLoader,
@@ -258,6 +387,25 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 			cached: false
 		};
 	}
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
+	else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
+		if (await verifyKeyOwnership(key, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		}) == null) {
+			logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
+				keyId,
+				claimedOwnerId: claimedOwnerId.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	}
 	if (keyCache != null) {
 		await keyCache.set(cacheKey, key);
 		logger.debug("Key {keyId} cached.", { keyId });
@@ -1109,4 +1257,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { fetchKey as a, validateCryptoKey as c, exportJwk as i, name as l, signRequest as n, generateCryptoKeyPair as o, verifyRequest as r, importJwk as s, doubleKnock as t, version as u };
+export { fetchActorDocument as a, importJwk as c, name as d, version as f, exportJwk as i, validateCryptoKey as l, signRequest as n, fetchKey as o, verifyRequest as r, generateCryptoKeyPair as s, doubleKnock as t, verifyKeyOwnership as u };

package/dist/{inbox-BZNyUPzW.mjs → inbox-Hou2ZAjv.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CGtm12Ft.mjs";
+import { n as version, t as name } from "./deno-eqaJj6JL.mjs";
 import { Activity, getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";

package/dist/{key-rC9mW1U5.mjs → key-bSphUqhB.mjs}

@@ -1,7 +1,7 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CGtm12Ft.mjs";
+import { n as version, t as name } from "./deno-eqaJj6JL.mjs";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { getDocumentLoader } from "@fedify/vocab-runtime";
@@ -86,6 +86,118 @@ async function importJwk(jwk, type) {
 	return key;
 }
 /**
+* Fetches the document that the given actor URI dereferences to, and returns
+* the actor only if the host that served the document is authoritative for
+* the id the document claims.
+*
+* Only the origin that serves an actor id can speak for it.  Without that
+* rule any host could serve a document describing somebody else's actor—and
+* listing its own keys as that actor's.
+*
+* @param actorId The URI of the actor to fetch.
+* @param options Options for fetching the document.
+* @returns The actor, or `null` if the document cannot be fetched, is not an
+*          actor, or belongs to another origin.
+* @internal
+*/
+async function fetchActorDocument(actorId, options = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const documentLoader = options.documentLoader ?? getDocumentLoader();
+	const contextLoader = options.contextLoader ?? getDocumentLoader();
+	const { tracerProvider } = options;
+	let document;
+	let documentUrl = actorId;
+	try {
+		const remoteDocument = await documentLoader(actorId.href);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", actorId);
+	} catch (error) {
+		logger.debug("Failed to fetch the actor {actorId}: {error}", {
+			actorId: actorId.href,
+			error
+		});
+		return null;
+	}
+	let object;
+	try {
+		object = await Object$1.fromJsonLd(document, {
+			documentLoader,
+			contextLoader,
+			tracerProvider,
+			baseUrl: documentUrl
+		});
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.debug("The document served at {documentUrl} is not a valid object: {error}", {
+			documentUrl: documentUrl.href,
+			error
+		});
+		return null;
+	}
+	if (!isActor(object)) return null;
+	if (object.id == null || object.id.origin !== documentUrl.origin) {
+		logger.debug("The document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin; refusing to treat it as that actor's document.", {
+			documentUrl: documentUrl.href,
+			actorId: object.id?.href
+		});
+		return null;
+	}
+	return object;
+}
+/**
+* Resolves the owner that the given key claims, and returns it only if the
+* claim holds.
+*
+* The `owner` of a {@link CryptographicKey}, like the `controller` of
+* a {@link Multikey}, proves nothing on its own: the key document and the
+* claim inside it are served by the same host, so anyone able to serve a key
+* document can name any actor in the world as its owner.  The claim becomes
+* meaningful only once the named actor's own document is fetched and turns
+* out to link back to the key.  This function performs that mutual-link
+* check, which is the only sound way to learn a fetched key's owner.
+*
+* The claimed owner is always dereferenced, never read out of the key
+* document: an owner embedded there is written by whoever wrote the key.
+*
+* @param key The key whose ownership claim is to be verified.  It must carry
+*            an `id`, as that is what the owner has to link back to.
+* @param options Options for fetching the claimed owner.
+* @returns The verified owner, or `null` if the key claims no owner, the
+*          owner cannot be fetched, or the owner does not link back to
+*          the key.
+* @internal
+*/
+async function verifyKeyOwnership(key, options = {}) {
+	const logger = getLogger([
+		"fedify",
+		"sig",
+		"key"
+	]);
+	const keyId = key.id;
+	if (keyId == null) return null;
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (claimedOwnerId == null) return null;
+	const owner = await fetchActorDocument(claimedOwnerId, options);
+	if (owner == null) {
+		logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims could not be resolved.", {
+			keyId: keyId.href,
+			claimedOwnerId: claimedOwnerId.href
+		});
+		return null;
+	}
+	const linkedKeyIds = key instanceof CryptographicKey ? owner.publicKeyIds : owner.assertionMethodIds;
+	for (const linkedKeyId of linkedKeyIds) if (linkedKeyId.href === keyId.href) return owner;
+	logger.debug("The owner ({claimedOwnerId}) that key {keyId} claims does not list the key as its own.", {
+		keyId: keyId.href,
+		claimedOwnerId: claimedOwnerId.href
+	});
+	return null;
+}
+/**
 * Fetches a {@link CryptographicKey} or {@link Multikey} from the given URL.
 * If the given URL contains an {@link Actor} object, it tries to find
 * the corresponding key in the `publicKey` or `assertionMethod` property.
@@ -154,8 +266,11 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 	}
 	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
 	let document;
+	let documentUrl = cacheKey;
 	try {
-		document = (await (documentLoader ?? getDocumentLoader())(keyId)).document;
+		const remoteDocument = await (documentLoader ?? getDocumentLoader())(keyId);
+		document = remoteDocument.document;
+		documentUrl = new URL(remoteDocument.documentUrl ?? "", cacheKey);
 	} catch (_) {
 		logger.debug("Failed to fetch key {keyId}.", { keyId });
 		await keyCache?.set(cacheKey, null);
@@ -192,8 +307,22 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 		}
 	}
 	let key = null;
-	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object;
+	let ownerDocument = null;
+	if (object instanceof cls && (object.id == null || object.id.href === keyId)) key = object.id == null ? object.clone({ id: cacheKey }) : object;
 	else if (isActor(object)) {
+		if (object.id == null || object.id.origin !== documentUrl.origin) {
+			logger.debug("Failed to verify; the document served at {documentUrl} claims to be the actor {actorId}, which belongs to another origin.", {
+				keyId,
+				documentUrl: documentUrl.href,
+				actorId: object.id?.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+		ownerDocument = object;
 		const keys = cls === CryptographicKey ? object.getPublicKeys({
 			documentLoader,
 			contextLoader,
@@ -252,6 +381,25 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 			cached: false
 		};
 	}
+	const claimedOwnerId = key instanceof CryptographicKey ? key.ownerId : key.controllerId;
+	if (ownerDocument != null && claimedOwnerId == null) key = key instanceof CryptographicKey ? key.clone({ owner: ownerDocument.id }) : key.clone({ controller: ownerDocument.id });
+	else if (claimedOwnerId != null && claimedOwnerId.href !== ownerDocument?.id?.href) {
+		if (await verifyKeyOwnership(key, {
+			documentLoader,
+			contextLoader,
+			tracerProvider
+		}) == null) {
+			logger.debug("Failed to verify; the owner {claimedOwnerId} that key {keyId} claims does not list the key as its own.", {
+				keyId,
+				claimedOwnerId: claimedOwnerId.href
+			});
+			await keyCache?.set(cacheKey, null);
+			return {
+				key: null,
+				cached: false
+			};
+		}
+	}
 	if (keyCache != null) {
 		await keyCache.set(cacheKey, key);
 		logger.debug("Key {keyId} cached.", { keyId });
@@ -262,4 +410,4 @@ async function fetchKeyInternal(keyId, cls, { documentLoader, contextLoader, key
 	};
 }
 //#endregion
-export { validateCryptoKey as a, importJwk as i, fetchKey as n, generateCryptoKeyPair as r, exportJwk as t };
+export { importJwk as a, generateCryptoKeyPair as i, fetchActorDocument as n, validateCryptoKey as o, fetchKey as r, verifyKeyOwnership as s, exportJwk as t };

package/dist/{keycache-DaQ3ndaJ.mjs → keycache-D239uGT9.mjs}

@@ -5,6 +5,7 @@ import { CryptographicKey, Multikey } from "@fedify/vocab";
 //#region src/federation/keycache.ts
 const NULL_KEY_CACHE_VALUE = { _fedify: "key-unavailable" };
 const NULL_KEY_CACHE_TTL = Temporal.Duration.from({ minutes: 5 });
+const KEY_CACHE_GENERATION = "2";
 function isNullKeyCacheValue(value) {
 	return typeof value === "object" && value != null && "_fedify" in value && value._fedify === NULL_KEY_CACHE_VALUE._fedify;
 }
@@ -19,9 +20,16 @@ var KvKeyCache = class {
 		this.nullKeys = /* @__PURE__ */ new Set();
 		this.options = options;
 	}
+	#entryKey(keyId) {
+		return [
+			...this.prefix,
+			KEY_CACHE_GENERATION,
+			keyId.href
+		];
+	}
 	async get(keyId) {
 		if (this.nullKeys.has(keyId.href)) return null;
-		const serialized = await this.kv.get([...this.prefix, keyId.href]);
+		const serialized = await this.kv.get(this.#entryKey(keyId));
 		if (serialized == null) return void 0;
 		if (isNullKeyCacheValue(serialized)) {
 			this.nullKeys.add(keyId.href);
@@ -33,7 +41,7 @@ var KvKeyCache = class {
 			try {
 				return await Multikey.fromJsonLd(serialized, this.options);
 			} catch {
-				await this.kv.delete([...this.prefix, keyId.href]);
+				await this.kv.delete(this.#entryKey(keyId));
 				return;
 			}
 		}
@@ -41,12 +49,12 @@ var KvKeyCache = class {
 	async set(keyId, key) {
 		if (key == null) {
 			this.nullKeys.add(keyId.href);
-			await this.kv.set([...this.prefix, keyId.href], NULL_KEY_CACHE_VALUE, { ttl: NULL_KEY_CACHE_TTL });
+			await this.kv.set(this.#entryKey(keyId), NULL_KEY_CACHE_VALUE, { ttl: NULL_KEY_CACHE_TTL });
 			return;
 		}
 		this.nullKeys.delete(keyId.href);
 		const serialized = await key.toJsonLd(this.options);
-		await this.kv.set([...this.prefix, keyId.href], serialized);
+		await this.kv.set(this.#entryKey(keyId), serialized);
 	}
 };
 //#endregion

package/dist/{kv-cache-BVqMp1RC.cjs → kv-cache-B8GaLaNy.cjs}

@@ -1,7 +1,7 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 require("./chunk-DDcVe30Y.cjs");
-const require_http = require("./http-BuaGj55w.cjs");
+const require_http = require("./http-BgOlx4n1.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");

package/dist/{kv-cache-CKg5W012.js → kv-cache-lbswb9pg.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { c as validateCryptoKey, t as doubleKnock } from "./http-BP1pVF9m.js";
+import { l as validateCryptoKey, t as doubleKnock } from "./http-CwcG2wDs.js";
 import { getLogger } from "@logtape/logtape";
 import { curry } from "es-toolkit";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/{ld-CN2nacLy.mjs → ld-D0uFMLmq.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CGtm12Ft.mjs";
-import { a as validateCryptoKey, n as fetchKey } from "./key-rC9mW1U5.mjs";
+import { n as version, t as name } from "./deno-eqaJj6JL.mjs";
+import { o as validateCryptoKey, r as fetchKey } from "./key-bSphUqhB.mjs";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { getDocumentLoader } from "@fedify/vocab-runtime";

package/dist/{middleware-DcmlYd2c.cjs → middleware-BKpP3cnZ.cjs}

@@ -1,4 +1,4 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
-const require_middleware = require("./middleware-BXwn4gnl.cjs");
+const require_middleware = require("./middleware-D_7wZH27.cjs");
 exports.FederationImpl = require_middleware.FederationImpl;

package/dist/{middleware-DpEJSmjy.mjs → middleware-BuVM1K-J.mjs}

@@ -2,24 +2,24 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError } from "./router-CrMLXoOr.mjs";
-import { n as version, t as name } from "./deno-CGtm12Ft.mjs";
-import { a as validateCryptoKey, i as importJwk, t as exportJwk } from "./key-rC9mW1U5.mjs";
-import { l as verifyRequest } from "./http--P33qRwW.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-_hXTUC-b.mjs";
-import { n as kvCache } from "./kv-cache-DqEKe5E0.mjs";
-import { a as compactJsonLd, c as getNormalizationContextLoader, d as isInvalidUrlTypeError, f as signJsonLd, g as wrapContextLoaderForJsonLd, l as hasSignature, p as verifyCompactJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as isClearlyMalformedContextReference } from "./ld-CN2nacLy.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CFgyZgkz.mjs";
-import { n as signObject, r as verifyObject } from "./proof-CpEH24hi.mjs";
-import { t as getNodeInfo } from "./client-HLLGHiTU.mjs";
-import { t as nodeInfoToJson } from "./types-C37hquWI.mjs";
-import { n as routeActivity } from "./inbox-BZNyUPzW.mjs";
-import { t as FederationBuilderImpl } from "./builder-DBKy92BX.mjs";
-import { t as buildCollectionSynchronizationHeader } from "./collection-ChgDTHLz.mjs";
-import { t as KvKeyCache } from "./keycache-DaQ3ndaJ.mjs";
-import { t as acceptsJsonLd } from "./negotiation-BehA2uul.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-B4rBDksp.mjs";
-import { t as createExponentialBackoffPolicy } from "./retry-B_E3V_Dx.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-pXXMu19o.mjs";
+import { n as version, t as name } from "./deno-eqaJj6JL.mjs";
+import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-bSphUqhB.mjs";
+import { l as verifyRequest } from "./http-Bu3NxfGb.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-BXUqhXNd.mjs";
+import { n as kvCache } from "./kv-cache-BrjuJue8.mjs";
+import { a as compactJsonLd, c as getNormalizationContextLoader, d as isInvalidUrlTypeError, f as signJsonLd, g as wrapContextLoaderForJsonLd, l as hasSignature, p as verifyCompactJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as isClearlyMalformedContextReference } from "./ld-D0uFMLmq.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-Bzg6w7eA.mjs";
+import { n as signObject, r as verifyObject } from "./proof-CgLA51pO.mjs";
+import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-glFHmpn4.mjs";
+import { t as nodeInfoToJson } from "./types-MNlFfxjv.mjs";
+import { n as routeActivity } from "./inbox-Hou2ZAjv.mjs";
+import { t as FederationBuilderImpl } from "./builder-DG5rS_Zv.mjs";
+import { t as buildCollectionSynchronizationHeader } from "./collection-DI6YzYpd.mjs";
+import { t as KvKeyCache } from "./keycache-D239uGT9.mjs";
+import { t as acceptsJsonLd } from "./negotiation-TWEs6Cl8.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-DPJlkHh3.mjs";
+import { t as createExponentialBackoffPolicy } from "./retry-Ddbq3AcK.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-D89-FDX-.mjs";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
@@ -474,8 +474,16 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	let json;
 	try {
-		json = await request.clone().json();
+		json = JSON.parse(await readBoundedText(request.clone(), MAX_BODY_SIZE, request.url));
 	} catch (error) {
+		if (error instanceof BodyTooLargeError) {
+			request.body?.cancel(error).catch(() => {});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			return new Response("Inbox body too large.", { status: 413 });
+		}
 		logger.error("Failed to parse JSON:\n{error}", {
 			recipient,
 			error
@@ -1656,6 +1664,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		try {
 			await sendActivity({
+				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: message.activity,
 				activityId: message.activityId,
@@ -2047,6 +2056,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			const promises = [];
 			for (const inbox in inboxes) promises.push(sendActivity({
+				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: jsonLd,
 				activityId: activity.id?.href,
@@ -3187,6 +3197,7 @@ var InboxContextImpl = class InboxContextImpl extends ContextImpl {
 			else logger.debug("Forwarding activity immediately without queue since queue is not set.");
 			const promises = [];
 			for (const inbox in inboxes) promises.push(sendActivity({
+				allowPrivateAddress: this.federation.allowPrivateAddress,
 				keys,
 				activity: this.activity,
 				activityId: this.activityId,

package/dist/{middleware-sbzAVAzo.mjs → middleware-DXPBIbm6.mjs}

@@ -1,5 +1,5 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-DpEJSmjy.mjs";
+import { n as FederationImpl } from "./middleware-BuVM1K-J.mjs";
 export { FederationImpl };