@fedify/fedify 2.1.24 → 2.1.26

package/dist/{builder-BatYe9a2.mjs → builder-9KbL1CoC.mjs}

@@ -2,8 +2,8 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError, t as Router } from "./router-CrMLXoOr.mjs";
-import { n as version, t as name } from "./deno-BXkm_rws.mjs";
-import { t as InboxListenerSet } from "./inbox-ByQ2iD14.mjs";
+import { n as version, t as name } from "./deno-ChmEXNOv.mjs";
+import { t as InboxListenerSet } from "./inbox-B_O6TjZS.mjs";
 import { getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";
@@ -35,6 +35,7 @@ var FederationBuilderImpl = class {
 	* Symbol registry for unique identification of unnamed symbols.
 	*/
 	#symbolRegistry = /* @__PURE__ */ new Map();
+	#collectionNames = /* @__PURE__ */ new Map();
 	constructor() {
 		this.router = new Router();
 		this.objectCallbacks = {};
@@ -43,7 +44,7 @@ var FederationBuilderImpl = class {
 		this.collectionTypeIds = {};
 	}
 	async build(options) {
-		const { FederationImpl } = await import("./middleware-DvxNTKpl.mjs");
+		const { FederationImpl } = await import("./middleware-DmTWC5VG.mjs");
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();
@@ -56,6 +57,8 @@ var FederationBuilderImpl = class {
 		f.objectTypeIds = { ...this.objectTypeIds };
 		f.collectionCallbacks = { ...this.collectionCallbacks };
 		f.collectionTypeIds = { ...this.collectionTypeIds };
+		f.#symbolRegistry = new Map(this.#symbolRegistry);
+		f.#collectionNames = new Map(this.#collectionNames);
 		f.inboxPath = this.inboxPath;
 		f.inboxCallbacks = this.inboxCallbacks == null ? void 0 : { ...this.inboxCallbacks };
 		f.outboxCallbacks = this.outboxCallbacks == null ? void 0 : { ...this.outboxCallbacks };
@@ -468,6 +471,7 @@ var FederationBuilderImpl = class {
 		if (this.router.has(routeName)) throw new RouterError(`Collection dispatcher for ${strName} already set.`);
 		if (this.collectionCallbacks[name] != null) throw new RouterError(`Collection dispatcher for ${strName} already set.`);
 		if (this.router.add(path, routeName).size < 1) throw new RouterError("Path for collection dispatcher must have at least one variable.");
+		this.#collectionNames.set(routeName, name);
 		const callbacks = { dispatcher };
 		this.collectionCallbacks[name] = callbacks;
 		this.collectionTypeIds[name] = itemType;
@@ -504,6 +508,10 @@ var FederationBuilderImpl = class {
 		const routeName = this.#uniqueCollectionId(name);
 		return this.router.build(`collection:${routeName}`, values) ?? this.router.build(`orderedCollection:${routeName}`, values);
 	}
+	/** Resolves a custom collection route to its original name. */
+	getCollectionName(routeName) {
+		return this.#collectionNames.get(routeName) ?? routeName.replace(/^(collection|orderedCollection):/, "");
+	}
 	setOutboxPermanentFailureHandler(handler) {
 		this.outboxPermanentFailureHandler = handler;
 	}

package/dist/{client-DNiBssfx.mjs → client-DM72NZuk.mjs}

@@ -93,8 +93,8 @@ const DEFAULT_MAX_REDIRECTION = 5;
 * bounce the request to an internal address.
 * @param url The URL to fetch.
 * @param headers The request headers.
-* @returns The final response, or `null` if the URL is disallowed or there
-*          are too many redirects.
+* @returns The final response, or `null` if the URL is disallowed, its
+*          hostname cannot be resolved, or there are too many redirects.
 */
 async function fetchPublicUrl(url, headers) {
 	let current = url instanceof URL ? url : new URL(url);
@@ -104,7 +104,11 @@ async function fetchPublicUrl(url, headers) {
 			await validatePublicUrl(current.href);
 		} catch (e) {
 			if (e instanceof UrlError) {
-				logger.error("Refused to fetch a private or invalid URL {url}: {error}", {
+				if (e.reason === "dns") logger.error("DNS lookup failed for {url}: {error}", {
+					url: current.href,
+					error: e
+				});
+				else logger.error("Refused to fetch a private or invalid URL {url}: {error}", {
 					url: current.href,
 					error: e
 				});

package/dist/compat/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Ct as ActivityTransformer, n as Context } from "../context-D4s0Wk3N.cjs";
+import { Ct as ActivityTransformer, n as Context } from "../context-BNwv9Q1v.cjs";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Ct as ActivityTransformer, n as Context } from "../context-BgU5UWTx.js";
+import { Ct as ActivityTransformer, n as Context } from "../context-DLLaDau8.js";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/transformers.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { _ as autoIdAssigner, g as actorDehydrator, n as FederationImpl } from "../middleware-Dy18K1xP.mjs";
+import { _ as autoIdAssigner, g as actorDehydrator, n as FederationImpl } from "../middleware-Co_QOX9H.mjs";
 import { test } from "@fedify/fixture";
 import { Follow, Person } from "@fedify/vocab";
 //#region src/compat/transformers.test.ts

package/dist/{context-D4s0Wk3N.d.cts → context-BNwv9Q1v.d.cts}

@@ -2,7 +2,7 @@
 import { o as JsonValue, s as NodeInfo, t as GetNodeInfoOptions } from "./client-CAM_bQXx.cjs";
 import { o as VerifyRequestFailureReason, t as HttpMessageSignaturesSpec } from "./http-DqZhyEso.cjs";
 import { n as GetKeyOwnerOptions } from "./owner-B3hNQCG8.cjs";
-import { n as KvStore, t as KvKey } from "./kv-gJ8LYbxX.cjs";
+import { n as KvStore, t as KvKey } from "./kv-CZKl1IUS.cjs";
 import { Activity, Actor, Collection, CryptographicKey, Hashtag, Link, LookupObjectOptions, Multikey, Object as Object$1, Recipient, TraverseCollectionOptions } from "@fedify/vocab";
 import { AuthenticatedDocumentLoaderFactory, DocumentLoader, DocumentLoaderFactory, GetUserAgentOptions } from "@fedify/vocab-runtime";
 import { Link as Link$1, LookupWebFingerOptions, ResourceDescriptor } from "@fedify/webfinger";

package/dist/{context-BgU5UWTx.d.ts → context-DLLaDau8.d.ts}

@@ -2,7 +2,7 @@
 import { o as JsonValue, s as NodeInfo, t as GetNodeInfoOptions } from "./client-CSddvgWN.js";
 import { o as VerifyRequestFailureReason, t as HttpMessageSignaturesSpec } from "./http-Dl00HXr4.js";
 import { n as GetKeyOwnerOptions } from "./owner-CiBPcC6F.js";
-import { n as KvStore, t as KvKey } from "./kv-D6hNiMTK.js";
+import { n as KvStore, t as KvKey } from "./kv-CxaI4eGo.js";
 import { Activity, Actor, Collection, CryptographicKey, Hashtag, Link, LookupObjectOptions, Multikey, Object as Object$1, Recipient, TraverseCollectionOptions } from "@fedify/vocab";
 import { Span, Tracer, TracerProvider } from "@opentelemetry/api";
 import { AuthenticatedDocumentLoaderFactory, DocumentLoader, DocumentLoaderFactory, GetUserAgentOptions } from "@fedify/vocab-runtime";

package/dist/{deno-BXkm_rws.mjs → deno-ChmEXNOv.mjs}

@@ -3,6 +3,6 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.1.24";
+var version = "2.1.26";
 //#endregion
 export { version as n, name as t };

package/dist/docloader-DEVImb5e.mjs

@@ -0,0 +1,78 @@
+import "@js-temporal/polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { s as validateCryptoKey } from "./key-BJcK-1Av.mjs";
+import { n as doubleKnock } from "./http-B_M80hBW.mjs";
+import { curry } from "es-toolkit";
+import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, validatePublicUrl } from "@fedify/vocab-runtime";
+import { getLogger } from "@logtape/logtape";
+//#region src/utils/docloader.ts
+const logger = getLogger([
+	"fedify",
+	"utils",
+	"docloader"
+]);
+const DEFAULT_MAX_REDIRECTION = 20;
+/**
+* Gets an authenticated {@link DocumentLoader} for the given identity.
+* Note that an authenticated document loader intentionally does not cache
+* the fetched documents.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
+* @param identity The identity to get the document loader for.
+*                 The actor's key pair.
+* @param options The options for the document loader.
+* @returns The authenticated document loader.
+* @throws {TypeError} If the key is invalid or unsupported.
+* @since 0.4.0
+*/
+function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, userAgent, specDeterminer, tracerProvider } = {}) {
+	validateCryptoKey(identity.privateKey);
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
+		options?.signal?.throwIfAborted();
+		let currentUrl = new URL(url).href;
+		await validateUrl(currentUrl);
+		visited.add(currentUrl);
+		const originalRequest = createActivityPubRequest(currentUrl, { userAgent });
+		function follow(nextUrl) {
+			options?.signal?.throwIfAborted();
+			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+			if (visited.has(nextUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
+			redirected++;
+		}
+		const response = await doubleKnock(originalRequest, identity, {
+			specDeterminer,
+			log: curry(logRequest)(logger),
+			tracerProvider,
+			signal: options?.signal,
+			validateRedirect: async (nextUrl) => {
+				follow(nextUrl);
+				await validateUrl(nextUrl);
+				visited.add(nextUrl);
+				currentUrl = nextUrl;
+			}
+		});
+		return getRemoteDocument(currentUrl, response, (alternateUrl) => {
+			follow(alternateUrl);
+			return load(alternateUrl, options, redirected, visited);
+		});
+	}
+	async function validateUrl(url) {
+		if (!allowPrivateAddress) try {
+			await validatePublicUrl(url);
+		} catch (error) {
+			if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	return (url, options) => load(url, options);
+}
+//#endregion
+export { getAuthenticatedDocumentLoader as t };

package/dist/federation/builder.test.mjs

@@ -2,10 +2,10 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import { a as assertExists } from "../std__assert-Duiq_YC9.mjs";
+import { i as assertExists, n as assertStrictEquals } from "../std__assert-BUOJXi-Z.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
 import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { n as createFederationBuilder } from "../builder-BatYe9a2.mjs";
+import { n as createFederationBuilder } from "../builder-9KbL1CoC.mjs";
 import { test } from "@fedify/fixture";
 import { Activity, Note, Person } from "@fedify/vocab";
 //#region src/federation/builder.test.ts
@@ -168,6 +168,41 @@ test("FederationBuilder", async (t) => {
 		assertEquals(impl.collectionTypeIds["test"], Note);
 		assertEquals((await impl.fetch(new Request("https://example.com/c/x", { headers: { accept: "application/activity+json" } }), { contextData: void 0 })).status, 200);
 	});
+	await t.step("preserves symbol-named collections through build()", async () => {
+		const builder = createFederationBuilder();
+		const collection = Symbol("saved");
+		const ordered = Symbol("saved");
+		builder.setCollectionDispatcher(collection, Note, "/users/{identifier}/saved", () => ({ items: [] }));
+		builder.setOrderedCollectionDispatcher(ordered, Note, "/users/{identifier}/ordered-saved", () => ({ items: [] }));
+		for (let build = 0; build < 2; build++) {
+			const federation = await builder.build({ kv: new MemoryKvStore() });
+			const ctx = federation.createContext(new URL("https://example.com/"));
+			for (const [name, path, type] of [[
+				collection,
+				"/users/alice/saved",
+				"collection"
+			], [
+				ordered,
+				"/users/alice/ordered-saved",
+				"orderedCollection"
+			]]) {
+				const uri = ctx.getCollectionUri(name, { identifier: "alice" });
+				assertEquals(uri.pathname, path);
+				const parsed = ctx.parseUri(uri);
+				assertEquals(parsed?.type, type);
+				if (parsed?.type !== "collection" && parsed?.type !== "orderedCollection") throw new Error("Expected a custom collection URI");
+				assertStrictEquals(parsed.name, name);
+				assertStrictEquals(parsed.class, Note);
+				assertEquals(parsed.values, { identifier: "alice" });
+				for (const cursor of [null, "next"]) {
+					const pageUri = new URL(uri);
+					if (cursor != null) pageUri.searchParams.set("cursor", cursor);
+					assertEquals((await federation.fetch(new Request(pageUri, { headers: { accept: "application/activity+json" } }), { contextData: void 0 })).status, 200);
+				}
+			}
+			assertThrows(() => federation.setCollectionDispatcher(collection, Note, "/users/{identifier}/duplicate", () => ({ items: [] })));
+		}
+	});
 });
 //#endregion
 export {};

package/dist/federation/collection.test.mjs

@@ -2,7 +2,7 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-Duiq_YC9.mjs";
+import "../std__assert-BUOJXi-Z.mjs";
 import { n as digest, t as buildCollectionSynchronizationHeader } from "../collection-ChgDTHLz.mjs";
 import { test } from "@fedify/fixture";
 import { decodeHex } from "byte-encodings/hex";

package/dist/federation/handler.test.mjs

@@ -3,18 +3,18 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as createRequestContext, t as createInboxContext } from "../context-Juj6bdHC.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-Duiq_YC9.mjs";
+import "../std__assert-BUOJXi-Z.mjs";
 import { t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { r as parseAcceptSignature } from "../accept-BavzedPB.mjs";
-import { a as generateCryptoKeyPair } from "../key-A8SuFznD.mjs";
-import { s as signRequest } from "../http-UyebnM2c.mjs";
+import { a as generateCryptoKeyPair } from "../key-BJcK-1Av.mjs";
+import { s as signRequest } from "../http-B_M80hBW.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, s as rsaPublicKey2 } from "../keys-CtZLJq76.mjs";
-import { a as compactJsonLd, f as signJsonLd } from "../ld-BSvHU-S0.mjs";
-import { n as signObject } from "../proof-_AyA4r7z.mjs";
+import { a as compactJsonLd, f as signJsonLd } from "../ld-YAXn6sG8.mjs";
+import { n as signObject } from "../proof-DIGrz49z.mjs";
 import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { a as createFederation, c as handleCollection, d as handleObject, f as respondWithObject, l as handleCustomCollection, p as respondWithObjectIfAcceptable, s as handleActor, u as handleInbox } from "../middleware-Dy18K1xP.mjs";
-import { t as InboxListenerSet } from "../inbox-ByQ2iD14.mjs";
+import { a as createFederation, c as handleCollection, d as handleObject, f as respondWithObject, l as handleCustomCollection, p as respondWithObjectIfAcceptable, s as handleActor, u as handleInbox } from "../middleware-Co_QOX9H.mjs";
+import { t as InboxListenerSet } from "../inbox-B_O6TjZS.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 import { FetchError } from "@fedify/vocab-runtime";

package/dist/federation/idempotency.test.mjs

@@ -2,11 +2,11 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-Duiq_YC9.mjs";
+import "../std__assert-BUOJXi-Z.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey, t as ed25519Multikey } from "../keys-CtZLJq76.mjs";
-import { n as signObject } from "../proof-_AyA4r7z.mjs";
+import { n as signObject } from "../proof-DIGrz49z.mjs";
 import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { a as createFederation } from "../middleware-Dy18K1xP.mjs";
+import { a as createFederation } from "../middleware-Co_QOX9H.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, Follow, Person } from "@fedify/vocab";
 //#region src/federation/idempotency.test.ts

package/dist/federation/inbox.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
-import { t as InboxListenerSet } from "../inbox-ByQ2iD14.mjs";
+import { t as InboxListenerSet } from "../inbox-B_O6TjZS.mjs";
 import { test } from "@fedify/fixture";
 import { Activity, Create, Invite, Offer, Update } from "@fedify/vocab";
 //#region src/federation/inbox.test.ts

package/dist/federation/kv.test.mjs

@@ -2,7 +2,7 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-Duiq_YC9.mjs";
+import "../std__assert-BUOJXi-Z.mjs";
 import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/kv.test.ts

package/dist/federation/middleware.test.mjs

@@ -4,23 +4,24 @@ globalThis.addEventListener = () => {};
 import { t as esm_default } from "../esm-DVILvP5e.mjs";
 import { n as RouterError } from "../router-CrMLXoOr.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import { n as assertStrictEquals } from "../std__assert-Duiq_YC9.mjs";
+import { n as assertStrictEquals } from "../std__assert-BUOJXi-Z.mjs";
 import { n as assertFalse, t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
 import { t as assertNotEquals } from "../assert_not_equals--wG9hV7u.mjs";
-import { l as verifyRequest, s as signRequest } from "../http-UyebnM2c.mjs";
+import { l as verifyRequest, s as signRequest } from "../http-B_M80hBW.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CtZLJq76.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-DdEK2tXP.mjs";
-import { a as compactJsonLd, f as signJsonLd, m as verifyJsonLd, s as detachSignature } from "../ld-BSvHU-S0.mjs";
-import { t as doesActorOwnKey } from "../owner-CaaCVHsG.mjs";
-import { n as signObject, r as verifyObject } from "../proof-_AyA4r7z.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-DEVImb5e.mjs";
+import { a as compactJsonLd, f as signJsonLd, m as verifyJsonLd, s as detachSignature } from "../ld-YAXn6sG8.mjs";
+import { t as doesActorOwnKey } from "../owner-B3ZkY-Ov.mjs";
+import { n as signObject, r as verifyObject } from "../proof-DIGrz49z.mjs";
 import { t as MemoryKvStore } from "../kv-BrZHNugx.mjs";
-import { a as createFederation, i as KvSpecDeterminer, n as FederationImpl, r as InboxContextImpl, t as ContextImpl } from "../middleware-Dy18K1xP.mjs";
+import { a as createFederation, i as KvSpecDeterminer, n as FederationImpl, r as InboxContextImpl, t as ContextImpl } from "../middleware-Co_QOX9H.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import * as vocab from "@fedify/vocab";
 import { Create, Offer, Person, getTypeId, lookupObject } from "@fedify/vocab";
 import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
+import dns from "node:dns/promises";
 //#region ../fixture/src/fixtures/example.com/create.json
 var id$2 = "https://example.com/create";
 var create_default = {
@@ -717,6 +718,31 @@ test({
 		esm_default.hardReset();
 	}
 });
+test("Federation.fetch() [rfc9421] multiple POST signatures", async (t) => {
+	for (const validSecond of [true, false]) await t.step(validSecond ? "valid second signature" : "both signatures invalid", async () => {
+		const inbox = [];
+		const federation = createFederation({
+			kv: new MemoryKvStore(),
+			documentLoaderFactory: () => mockDocumentLoader,
+			contextLoaderFactory: () => mockDocumentLoader
+		});
+		federation.setActorDispatcher("/users/{identifier}", (ctx, identifier) => new vocab.Person({ id: ctx.getActorUri(identifier) }));
+		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(vocab.Create, (_ctx, activity) => {
+			inbox.push(activity.id.href);
+		});
+		const signed = await signRequest(new Request("https://example.com/inbox", {
+			method: "POST",
+			headers: { "Content-Type": "application/activity+json" },
+			body: JSON.stringify(create_default)
+		}), rsaPrivateKey2, rsaPublicKey2.id, { spec: "rfc9421" });
+		const input = signed.headers.get("Signature-Input");
+		const signature = signed.headers.get("Signature");
+		signed.headers.set("Signature-Input", `${input}, ${input.replace(/^sig1=/, "sig2=")}`);
+		signed.headers.set("Signature", `sig1=:AAAAAA==:, ${validSecond ? signature.replace(/^sig1=/, "sig2=") : "sig2=:AAAAAA==:"}`);
+		assertEquals((await federation.fetch(signed, { contextData: void 0 })).status, validSecond ? 202 : 401);
+		assertEquals(inbox, validSecond ? [id$2] : []);
+	});
+});
 test("Federation.fetch()", async (t) => {
 	esm_default.spyGlobal();
 	esm_default.get("https://example.com/key2", {
@@ -1426,6 +1452,7 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 		const kv = new MemoryKvStore();
 		const queuedMessages = [];
 		const federation = new FederationImpl({
+			allowPrivateAddress: true,
 			kv,
 			queue: {
 				nativeRetrial: true,
@@ -1488,6 +1515,7 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 		const kv = new MemoryKvStore();
 		let queuedMessages = [];
 		const federation = new FederationImpl({
+			allowPrivateAddress: true,
 			kv,
 			queue: {
 				enqueue(message, _options) {
@@ -2982,6 +3010,105 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 		assertEquals(queuedMessages, []);
 	});
 });
+test({
+	name: "FederationImpl.processQueuedTask() retries DNS failures",
+	ignore: "Deno" in globalThis && (await Deno.permissions.query({ name: "net" })).state !== "granted",
+	async fn(t) {
+		for (const redirected of [false, true]) await t.step(`redirected: ${redirected}`, async () => {
+			const destination = "https://delivery.invalid/inbox";
+			const publicInbox = "https://8.8.8.8/inbox";
+			const queuedMessages = [];
+			const delays = [];
+			const errors = [];
+			const activities = [];
+			const attempts = [];
+			const delay = Temporal.Duration.from({ seconds: 5 });
+			const federation = new FederationImpl({
+				kv: new MemoryKvStore(),
+				queue: {
+					enqueue(message, options) {
+						queuedMessages.push(message);
+						delays.push(options?.delay);
+						return Promise.resolve();
+					},
+					listen() {
+						return Promise.resolve();
+					}
+				},
+				documentLoaderFactory: () => mockDocumentLoader,
+				contextLoaderFactory: () => mockDocumentLoader,
+				onOutboxError(error, activity) {
+					errors.push(error);
+					activities.push(activity);
+				},
+				outboxRetryPolicy(options) {
+					attempts.push(options.attempts);
+					return delay;
+				}
+			});
+			const message = {
+				type: "outbox",
+				id: crypto.randomUUID(),
+				baseUrl: "https://example.com",
+				keys: [],
+				activity: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Create",
+					id: "https://example.com/activities/dns-failure",
+					actor: "https://example.com/users/alice",
+					object: {
+						type: "Note",
+						content: "test"
+					}
+				},
+				activityType: "https://www.w3.org/ns/activitystreams#Create",
+				inbox: redirected ? publicInbox : destination,
+				sharedInbox: false,
+				started: (/* @__PURE__ */ new Date()).toISOString(),
+				attempt: 0,
+				headers: {},
+				traceContext: {}
+			};
+			const originalLookup = dns.lookup;
+			const resolverError = /* @__PURE__ */ new Error("Resolver unavailable");
+			const lookups = [];
+			dns.lookup = ((hostname) => {
+				lookups.push(hostname);
+				return Promise.reject(resolverError);
+			});
+			try {
+				esm_default.mockGlobal().catch(202);
+				if (redirected) esm_default.route(publicInbox, {
+					status: 307,
+					headers: { Location: destination }
+				});
+				await federation.processQueuedTask(void 0, message);
+				assertEquals(errors.length, 1);
+				const error = errors[0];
+				assertInstanceOf(error, FetchError);
+				assertEquals(error.url.href, destination);
+				assertInstanceOf(error.cause, UrlError);
+				assertEquals(error.cause.reason, "dns");
+				assertStrictEquals(error.cause.cause, resolverError);
+				assertEquals(activities.length, 1);
+				assertInstanceOf(activities[0], Create);
+				assertEquals(activities[0].id?.href, "https://example.com/activities/dns-failure");
+				assertEquals(attempts, [0]);
+				assertEquals(queuedMessages, [{
+					...message,
+					attempt: 1
+				}]);
+				assertEquals(delays, [delay]);
+				assertEquals(lookups, ["delivery.invalid"]);
+				assertEquals(esm_default.callHistory.calls(destination).length, 0);
+				assertEquals(esm_default.callHistory.calls().length, redirected ? 1 : 0);
+			} finally {
+				dns.lookup = originalLookup;
+				esm_default.hardReset();
+			}
+		});
+	}
+});
 test("FederationImpl.processQueuedTask() permanent failure", async (t) => {
 	esm_default.spyGlobal();
 	esm_default.post("https://gone.example/inbox", {
@@ -3670,6 +3797,80 @@ test({
 		]);
 	}
 });
+for (const queued of [false, true]) test(`ContextImpl.routeActivity() routes the fetched document (queued: ${queued})`, async () => {
+	const id = new URL("https://example.com/verified-create");
+	const genuine = new Create({
+		id,
+		actor: new URL("https://example.com/person"),
+		object: new vocab.Note({ content: "Genuine content" }),
+		to: new URL("https://example.com/recipient")
+	});
+	const genuineJson = await genuine.toJsonLd({ contextLoader: mockDocumentLoader });
+	const forged = new Create({
+		id,
+		actor: new URL("https://victim.example/actor"),
+		object: new vocab.Note({ content: "Forged content" }),
+		to: new URL("https://attacker.example/recipient")
+	});
+	const messages = [];
+	const queue = {
+		enqueue(message) {
+			messages.push(message);
+			return Promise.resolve();
+		},
+		async listen() {}
+	};
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderFactory: () => async (url, options) => url === id.href ? {
+			document: genuineJson,
+			documentUrl: id.href,
+			contextUrl: null
+		} : await mockDocumentLoader(url, options),
+		contextLoaderFactory: () => mockDocumentLoader,
+		queue: {
+			inbox: queued ? queue : void 0,
+			outbox: queue
+		},
+		manuallyStartQueue: true
+	});
+	const received = [];
+	const contextDocuments = [];
+	federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Create, async (ctx, activity) => {
+		received.push(await activity.toJsonLd({ contextLoader: mockDocumentLoader }));
+		assertInstanceOf(ctx, InboxContextImpl);
+		contextDocuments.push(ctx.activity);
+		await ctx.forwardActivity({
+			privateKey: ed25519PrivateKey,
+			keyId: ed25519Multikey.id
+		}, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		});
+	});
+	const ctx = federation.createContext(new URL("https://local.example/"));
+	async function processInbox() {
+		const inboxMessages = messages.filter((message) => message.type === "inbox");
+		for (const message of inboxMessages) await federation.processQueuedTask(void 0, message);
+	}
+	assert(await ctx.routeActivity(null, forged));
+	if (queued) {
+		assertEquals(received, []);
+		assertEquals(messages.length, 1);
+		assertEquals(messages[0].activity, genuineJson);
+		await processInbox();
+	}
+	assertEquals(received, [genuineJson]);
+	assertEquals(contextDocuments, [genuineJson]);
+	const forwarded = messages.filter((message) => message.type === "outbox");
+	assertEquals(forwarded.length, 1);
+	assertEquals(forwarded[0].activity, genuineJson);
+	assert(await ctx.routeActivity(null, genuine));
+	if (queued) await processInbox();
+	assertEquals(received, [genuineJson]);
+	assertEquals(contextDocuments, [genuineJson]);
+	assertEquals(messages.filter((message) => message.type === "outbox").length, 1);
+});
 test("ContextImpl.routeActivity() marks queued signed activities as non-LDS", async () => {
 	let queuedMessage = null;
 	const federation = new FederationImpl({
@@ -3729,6 +3930,47 @@ test("ContextImpl.getCollectionUri()", () => {
 	assertThrows(() => ctx.getCollectionUri(Symbol(notReg), values));
 	assertThrows(() => ctx.getCollectionUri(Symbol.for(notReg), values));
 });
+test("symbol-named custom collections are served and parsed", async () => {
+	const federation = createFederation({ kv: new MemoryKvStore() });
+	const names = [Symbol("bookmarks"), Symbol("bookmarks")];
+	const paths = ["bookmarks", "ordered-bookmarks"];
+	const calls = [];
+	federation.setCollectionDispatcher(names[0], vocab.Object, "/users/{identifier}/bookmarks", (_ctx, _values, cursor) => {
+		calls.push([0, cursor]);
+		return { items: [] };
+	});
+	federation.setOrderedCollectionDispatcher(names[1], vocab.Object, "/users/{identifier}/ordered-bookmarks", (_ctx, _values, cursor) => {
+		calls.push([1, cursor]);
+		return { items: [] };
+	});
+	const ctx = federation.createContext(new URL("https://example.com/"));
+	for (const [index, name] of names.entries()) {
+		const uri = ctx.getCollectionUri(name, { identifier: "alice" });
+		assertEquals(uri.pathname, `/users/alice/${paths[index]}`);
+		const parsed = ctx.parseUri(uri);
+		assertEquals(parsed?.type, index === 0 ? "collection" : "orderedCollection");
+		if (parsed?.type !== "collection" && parsed?.type !== "orderedCollection") throw new Error("Expected a custom collection URI");
+		assertStrictEquals(parsed.name, name);
+		assertStrictEquals(parsed.class, vocab.Object);
+		assertEquals(parsed.typeId, vocab.Object.typeId);
+		assertEquals(parsed.values, { identifier: "alice" });
+		for (const cursor of [null, "next"]) {
+			const pageUri = new URL(uri);
+			if (cursor != null) pageUri.searchParams.set("cursor", cursor);
+			const response = await federation.fetch(new Request(pageUri, { headers: { accept: "application/activity+json" } }), { contextData: void 0 });
+			assertEquals(response.status, 200);
+			const body = await response.json();
+			assert(body !== null && typeof body === "object" && "type" in body);
+			assertEquals(body.type, `${index === 0 ? "Collection" : "OrderedCollection"}${cursor == null ? "" : "Page"}`);
+		}
+	}
+	assertEquals(calls, [
+		[0, null],
+		[0, "next"],
+		[1, null],
+		[1, "next"]
+	]);
+});
 test("InboxContextImpl.forwardActivity()", async (t) => {
 	esm_default.spyGlobal();
 	let verified = null;