@fedify/fedify 2.2.18 → 2.2.20

package/dist/federation/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as ActorAliasMapper, A as FederationKvPrefixes, B as Router, C as IdempotencyKeyCallback, Ct as SendActivityError, D as ObjectCallbackSetters, Dt as digest, E as InboxListenerSetters, Et as buildCollectionSynchronizationHeader, F as RetryContext, G as respondWithObject, H as RouterOptions, I as RetryPolicy, J as InProcessMessageQueueOptions, K as respondWithObjectIfAcceptable, L as createExponentialBackoffPolicy, M as FederationQueueOptions, N as createFederation, O as OutboxListenerSetters, P as CreateExponentialBackoffPolicyOptions, Q as ParallelMessageQueue, R as Message, S as FederationStartQueueOptions, St as WebFingerLinksDispatcher, T as InboxChallengePolicy, Tt as PageItems, U as RouterRouteResult, V as RouterError, W as RespondWithObjectOptions, X as MessageQueueEnqueueOptions, Y as MessageQueue, Z as MessageQueueListenOptions, _ as Federatable, _t as OutboxListenerErrorHandler, a as GetSignedKeyOptions, at as CollectionCursor, b as FederationFetchOptions, bt as UnverifiedActivityHandler, c as ParseUriResult, ct as CustomCollectionCursor, d as SendActivityOptions, dt as InboxListener, et as ActorDispatcher, f as SendActivityOptionsForCollection, ft as NodeInfoDispatcher, g as CustomCollectionCallbackSetters, gt as OutboxListener, h as ConstructorWithTypeId, ht as OutboxErrorHandler, i as GetActorOptions, it as CollectionCounter, j as FederationOrigin, k as Rfc6570Expression, l as RequestContext, lt as CustomCollectionDispatcher, m as CollectionCallbackSetters, mt as ObjectDispatcher, n as Context, nt as ActorKeyPairsDispatcher, o as InboxContext, ot as CollectionDispatcher, p as ActorCallbackSetters, pt as ObjectAuthorizePredicate, q as InProcessMessageQueue, r as ForwardActivityOptions, rt as AuthorizePredicate, s as OutboxContext, st as CustomCollectionCounter, t as ActorKeyPair, tt as ActorHandleMapper, u as RouteActivityOptions, ut as InboxErrorHandler, v as Federation, vt as OutboxPermanentFailureHandler, w as IdempotencyStrategy, wt as SenderKeyPair, x as FederationOptions, xt as UnverifiedActivityReason, y as FederationBuilder, yt as SharedInboxKeyDispatcher, z as createFederationBuilder } from "../context-tJbL_Hkw.cjs";
+import { $ as ActorAliasMapper, A as FederationKvPrefixes, B as Router, C as IdempotencyKeyCallback, Ct as SendActivityError, D as ObjectCallbackSetters, Dt as digest, E as InboxListenerSetters, Et as buildCollectionSynchronizationHeader, F as RetryContext, G as respondWithObject, H as RouterOptions, I as RetryPolicy, J as InProcessMessageQueueOptions, K as respondWithObjectIfAcceptable, L as createExponentialBackoffPolicy, M as FederationQueueOptions, N as createFederation, O as OutboxListenerSetters, P as CreateExponentialBackoffPolicyOptions, Q as ParallelMessageQueue, R as Message, S as FederationStartQueueOptions, St as WebFingerLinksDispatcher, T as InboxChallengePolicy, Tt as PageItems, U as RouterRouteResult, V as RouterError, W as RespondWithObjectOptions, X as MessageQueueEnqueueOptions, Y as MessageQueue, Z as MessageQueueListenOptions, _ as Federatable, _t as OutboxListenerErrorHandler, a as GetSignedKeyOptions, at as CollectionCursor, b as FederationFetchOptions, bt as UnverifiedActivityHandler, c as ParseUriResult, ct as CustomCollectionCursor, d as SendActivityOptions, dt as InboxListener, et as ActorDispatcher, f as SendActivityOptionsForCollection, ft as NodeInfoDispatcher, g as CustomCollectionCallbackSetters, gt as OutboxListener, h as ConstructorWithTypeId, ht as OutboxErrorHandler, i as GetActorOptions, it as CollectionCounter, j as FederationOrigin, k as Rfc6570Expression, l as RequestContext, lt as CustomCollectionDispatcher, m as CollectionCallbackSetters, mt as ObjectDispatcher, n as Context, nt as ActorKeyPairsDispatcher, o as InboxContext, ot as CollectionDispatcher, p as ActorCallbackSetters, pt as ObjectAuthorizePredicate, q as InProcessMessageQueue, r as ForwardActivityOptions, rt as AuthorizePredicate, s as OutboxContext, st as CustomCollectionCounter, t as ActorKeyPair, tt as ActorHandleMapper, u as RouteActivityOptions, ut as InboxErrorHandler, v as Federation, vt as OutboxPermanentFailureHandler, w as IdempotencyStrategy, wt as SenderKeyPair, x as FederationOptions, xt as UnverifiedActivityReason, y as FederationBuilder, yt as SharedInboxKeyDispatcher, z as createFederationBuilder } from "../context-CFQGaq5x.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-CZKl1IUS.cjs";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-a6kmB8xD.cjs";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-CVSKw-5H.cjs";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetActorOptions, GetSignedKeyOptions, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MemoryKvStore, Message, MessageQueue, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriResult, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, UnverifiedActivityHandler, UnverifiedActivityReason, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as ActorAliasMapper, A as FederationKvPrefixes, B as Router, C as IdempotencyKeyCallback, Ct as SendActivityError, D as ObjectCallbackSetters, Dt as digest, E as InboxListenerSetters, Et as buildCollectionSynchronizationHeader, F as RetryContext, G as respondWithObject, H as RouterOptions, I as RetryPolicy, J as InProcessMessageQueueOptions, K as respondWithObjectIfAcceptable, L as createExponentialBackoffPolicy, M as FederationQueueOptions, N as createFederation, O as OutboxListenerSetters, P as CreateExponentialBackoffPolicyOptions, Q as ParallelMessageQueue, R as Message, S as FederationStartQueueOptions, St as WebFingerLinksDispatcher, T as InboxChallengePolicy, Tt as PageItems, U as RouterRouteResult, V as RouterError, W as RespondWithObjectOptions, X as MessageQueueEnqueueOptions, Y as MessageQueue, Z as MessageQueueListenOptions, _ as Federatable, _t as OutboxListenerErrorHandler, a as GetSignedKeyOptions, at as CollectionCursor, b as FederationFetchOptions, bt as UnverifiedActivityHandler, c as ParseUriResult, ct as CustomCollectionCursor, d as SendActivityOptions, dt as InboxListener, et as ActorDispatcher, f as SendActivityOptionsForCollection, ft as NodeInfoDispatcher, g as CustomCollectionCallbackSetters, gt as OutboxListener, h as ConstructorWithTypeId, ht as OutboxErrorHandler, i as GetActorOptions, it as CollectionCounter, j as FederationOrigin, k as Rfc6570Expression, l as RequestContext, lt as CustomCollectionDispatcher, m as CollectionCallbackSetters, mt as ObjectDispatcher, n as Context, nt as ActorKeyPairsDispatcher, o as InboxContext, ot as CollectionDispatcher, p as ActorCallbackSetters, pt as ObjectAuthorizePredicate, q as InProcessMessageQueue, r as ForwardActivityOptions, rt as AuthorizePredicate, s as OutboxContext, st as CustomCollectionCounter, t as ActorKeyPair, tt as ActorHandleMapper, u as RouteActivityOptions, ut as InboxErrorHandler, v as Federation, vt as OutboxPermanentFailureHandler, w as IdempotencyStrategy, wt as SenderKeyPair, x as FederationOptions, xt as UnverifiedActivityReason, y as FederationBuilder, yt as SharedInboxKeyDispatcher, z as createFederationBuilder } from "../context-OkwEpc3-.js";
+import { $ as ActorAliasMapper, A as FederationKvPrefixes, B as Router, C as IdempotencyKeyCallback, Ct as SendActivityError, D as ObjectCallbackSetters, Dt as digest, E as InboxListenerSetters, Et as buildCollectionSynchronizationHeader, F as RetryContext, G as respondWithObject, H as RouterOptions, I as RetryPolicy, J as InProcessMessageQueueOptions, K as respondWithObjectIfAcceptable, L as createExponentialBackoffPolicy, M as FederationQueueOptions, N as createFederation, O as OutboxListenerSetters, P as CreateExponentialBackoffPolicyOptions, Q as ParallelMessageQueue, R as Message, S as FederationStartQueueOptions, St as WebFingerLinksDispatcher, T as InboxChallengePolicy, Tt as PageItems, U as RouterRouteResult, V as RouterError, W as RespondWithObjectOptions, X as MessageQueueEnqueueOptions, Y as MessageQueue, Z as MessageQueueListenOptions, _ as Federatable, _t as OutboxListenerErrorHandler, a as GetSignedKeyOptions, at as CollectionCursor, b as FederationFetchOptions, bt as UnverifiedActivityHandler, c as ParseUriResult, ct as CustomCollectionCursor, d as SendActivityOptions, dt as InboxListener, et as ActorDispatcher, f as SendActivityOptionsForCollection, ft as NodeInfoDispatcher, g as CustomCollectionCallbackSetters, gt as OutboxListener, h as ConstructorWithTypeId, ht as OutboxErrorHandler, i as GetActorOptions, it as CollectionCounter, j as FederationOrigin, k as Rfc6570Expression, l as RequestContext, lt as CustomCollectionDispatcher, m as CollectionCallbackSetters, mt as ObjectDispatcher, n as Context, nt as ActorKeyPairsDispatcher, o as InboxContext, ot as CollectionDispatcher, p as ActorCallbackSetters, pt as ObjectAuthorizePredicate, q as InProcessMessageQueue, r as ForwardActivityOptions, rt as AuthorizePredicate, s as OutboxContext, st as CustomCollectionCounter, t as ActorKeyPair, tt as ActorHandleMapper, u as RouteActivityOptions, ut as InboxErrorHandler, v as Federation, vt as OutboxPermanentFailureHandler, w as IdempotencyStrategy, wt as SenderKeyPair, x as FederationOptions, xt as UnverifiedActivityReason, y as FederationBuilder, yt as SharedInboxKeyDispatcher, z as createFederationBuilder } from "../context-DdbLVV_k.js";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-CxaI4eGo.js";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-DQGjRJUG.js";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-BuRRdsfD.js";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetActorOptions, GetSignedKeyOptions, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MemoryKvStore, Message, MessageQueue, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriResult, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, UnverifiedActivityHandler, UnverifiedActivityReason, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-aNUajYPY.js";
+import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-sjhz30sm.js";
 import { isEqual } from "es-toolkit";
 //#region src/federation/kv.ts
 /**

package/dist/federation/send.test.mjs

@@ -8,15 +8,19 @@ import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-BkxW5QJI.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { l as verifyRequest } from "../http-lCmKCZBI.mjs";
+import { u as verifyRequest } from "../http-CQMVisM0.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-BAK-tUlf.mjs";
-import { t as doesActorOwnKey } from "../owner-BUTMEkbn.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-fnPrh9Zm.mjs";
+import { t as doesActorOwnKey } from "../owner-B8kXzD0q.mjs";
+import { i as sendActivity, n as extractInboxes, r as fetchWithValidatedRedirects, t as SendActivityError } from "../send-DRpisX_f.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";
-import dns from "node:dns/promises";
+import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";
+import { configure, reset } from "@logtape/logtape";
 //#region src/federation/send.test.ts
+function sendDirect(options) {
+	return sendActivity(options, { openHop: openDirectFetch });
+}
 test("extractInboxes()", () => {
 	const recipients = [
 		new Person({
@@ -152,7 +156,7 @@ test("sendActivity()", async (t) => {
 			"id": "https://example.com/activity",
 			"actor": "https://example.com/person"
 		};
-		await sendActivity({
+		await sendDirect({
 			activity,
 			keys: [{
 				privateKey: rsaPrivateKey2,
@@ -168,7 +172,7 @@ test("sendActivity()", async (t) => {
 		assertEquals(request?.headers.get("Content-Type"), "application/activity+json");
 		assertEquals(request?.headers.get("X-Test"), "test");
 		httpSigVerified = null;
-		await assertRejects(() => sendActivity({
+		await assertRejects(() => sendDirect({
 			activity: {
 				...activity,
 				actor: "https://example.com/person2"
@@ -196,7 +200,7 @@ test("sendActivity()", async (t) => {
 			"id": "https://example.com/activity",
 			"actor": "https://example.com/person"
 		};
-		await assertRejects(() => sendActivity({
+		await assertRejects(() => sendDirect({
 			activity,
 			activityId: "https://example.com/activity",
 			keys: [{
@@ -214,7 +218,7 @@ test("sendActivity()", async (t) => {
 			"actor": "https://example.com/person"
 		};
 		try {
-			await sendActivity({
+			await sendDirect({
 				activity,
 				activityId: "https://example.com/activity",
 				keys: [{
@@ -243,7 +247,7 @@ test("sendActivity()", async (t) => {
 			"actor": "https://example.com/person"
 		};
 		try {
-			await sendActivity({
+			await sendDirect({
 				activity,
 				activityId: "https://example.com/activity",
 				keys: [{
@@ -272,7 +276,7 @@ test("sendActivity()", async (t) => {
 			"actor": "https://example.com/person"
 		};
 		try {
-			await sendActivity({
+			await sendDirect({
 				activity,
 				activityId: "https://example.com/activity",
 				keys: [{
@@ -302,7 +306,7 @@ test("sendActivity()", async (t) => {
 			"actor": "https://example.com/person"
 		};
 		try {
-			await sendActivity({
+			await sendDirect({
 				activity,
 				activityId: "https://example.com/activity",
 				keys: [{
@@ -329,7 +333,7 @@ test("sendActivity()", async (t) => {
 			"actor": "https://example.com/person"
 		};
 		try {
-			await sendActivity({
+			await sendDirect({
 				activity,
 				activityId: "https://example.com/activity",
 				keys: [{
@@ -358,7 +362,7 @@ test("sendActivity()", async (t) => {
 			"actor": "https://example.com/person"
 		};
 		try {
-			await sendActivity({
+			await sendDirect({
 				activity,
 				activityId: "https://example.com/activity",
 				keys: [{
@@ -382,7 +386,7 @@ test("sendActivity() records OpenTelemetry span events", async (t) => {
 	await t.step("successful send", async () => {
 		esm_default.get("https://example.com/", { status: 404 });
 		esm_default.post("https://example.com/inbox", { status: 202 });
-		await sendActivity({
+		await sendDirect({
 			activity: {
 				"@context": "https://www.w3.org/ns/activitystreams",
 				type: "Create",
@@ -549,67 +553,438 @@ for (const signed of [false, true]) {
 		});
 	});
 }
-for (const signed of [false, true]) test({
-	name: `sendActivity() classifies DNS failures (signed: ${signed})`,
-	ignore: "Deno" in globalThis && (await Deno.permissions.query({ name: "net" })).state !== "granted",
-	async fn(t) {
-		const activity = {
-			type: "Create",
-			id: "https://example.com/activity"
+for (const signed of [false, true]) test(`sendActivity() classifies DNS failures (signed: ${signed})`, async (t) => {
+	const activity = {
+		type: "Create",
+		id: "https://example.com/activity"
+	};
+	const destination = "https://delivery.invalid/inbox";
+	const publicInbox = "https://8.8.8.8/inbox";
+	const keys = signed ? [{
+		privateKey: rsaPrivateKey2,
+		keyId: rsaPublicKey2.id
+	}] : [];
+	for (const result of [
+		"throws",
+		"empty",
+		"cname",
+		"private"
+	]) for (const redirected of [false, true]) await t.step(`${result}, redirected: ${redirected}`, async () => {
+		const resolverError = /* @__PURE__ */ new Error("Resolver unavailable");
+		const lookups = [];
+		const lookup = (hostname) => {
+			lookups.push(hostname);
+			assertEquals(hostname, "delivery.invalid");
+			if (result === "throws") return Promise.reject(resolverError);
+			return Promise.resolve(result === "empty" ? [] : [{
+				address: result === "private" ? "127.0.0.1" : "alias.invalid.",
+				family: 4
+			}]);
 		};
-		const destination = "https://delivery.invalid/inbox";
-		const publicInbox = "https://8.8.8.8/inbox";
-		const keys = signed ? [{
-			privateKey: rsaPrivateKey2,
-			keyId: rsaPublicKey2.id
-		}] : [];
-		for (const result of [
-			"throws",
-			"empty",
-			"cname",
-			"private"
-		]) for (const redirected of [false, true]) await t.step(`${result}, redirected: ${redirected}`, async () => {
-			const originalLookup = dns.lookup;
-			const resolverError = /* @__PURE__ */ new Error("Resolver unavailable");
-			const lookups = [];
-			dns.lookup = ((hostname, options) => {
-				lookups.push(hostname);
-				assertEquals(hostname, "delivery.invalid");
-				assertEquals(options, { all: true });
-				if (result === "throws") return Promise.reject(resolverError);
-				return Promise.resolve(result === "empty" ? [] : [{
-					address: result === "private" ? "127.0.0.1" : "alias.invalid.",
-					family: 4
-				}]);
+		try {
+			esm_default.mockGlobal().catch(202);
+			if (redirected) esm_default.route(publicInbox, {
+				status: 307,
+				headers: { Location: destination }
 			});
-			try {
-				esm_default.mockGlobal().catch(202);
-				if (redirected) esm_default.route(publicInbox, {
-					status: 307,
-					headers: { Location: destination }
-				});
-				const send = () => sendActivity({
-					activity,
-					keys,
-					inbox: new URL(redirected ? publicInbox : destination)
-				});
-				if (result === "private") assertEquals((await assertRejects(send, UrlError)).reason, "disallowed");
-				else {
-					const error = await assertRejects(send, FetchError);
-					assertEquals(error.url.href, destination);
-					assertInstanceOf(error.cause, UrlError);
-					assertEquals(error.cause.reason, "dns");
-					assertEquals(error.cause.cause, result === "throws" ? resolverError : void 0);
-				}
-				assertEquals(lookups, ["delivery.invalid"]);
-				assertEquals(esm_default.callHistory.calls(destination).length, 0);
-				assertEquals(esm_default.callHistory.calls().length, redirected ? 1 : 0);
-			} finally {
-				dns.lookup = originalLookup;
-				esm_default.hardReset();
+			const send = () => sendActivity({
+				activity,
+				keys,
+				inbox: new URL(redirected ? publicInbox : destination)
+			}, { openHop: (url) => openPublicFetch(url, { lookup }) });
+			if (result === "private") assertEquals((await assertRejects(send, UrlError)).reason, "disallowed");
+			else {
+				const error = await assertRejects(send, FetchError);
+				assertEquals(error.url.href, destination);
+				assertInstanceOf(error.cause, UrlError);
+				assertEquals(error.cause.reason, "dns");
+				assertEquals(error.cause.cause, result === "throws" ? resolverError : void 0);
 			}
+			assertEquals(lookups, ["delivery.invalid"]);
+			assertEquals(esm_default.callHistory.calls(destination).length, 0);
+			assertEquals(esm_default.callHistory.calls().length, redirected ? 1 : 0);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
+const lifecycleActivity = {
+	"@context": "https://www.w3.org/ns/activitystreams",
+	type: "Create",
+	id: "https://example.com/activity",
+	actor: "https://example.com/person"
+};
+const signedKeys = [{
+	privateKey: rsaPrivateKey2,
+	keyId: rsaPublicKey2.id
+}];
+const unsignedKeys = [{
+	privateKey: ed25519PrivateKey,
+	keyId: ed25519Multikey.id
+}];
+test("sendActivity() cancels a successful response body", async (t) => {
+	for (const signed of [true, false]) await t.step(`signed: ${signed}`, async () => {
+		const inbox = "https://example.com/lifecycle/inbox";
+		const hops = recordHops(() => ({
+			status: 202,
+			body: "Accepted"
+		}));
+		await sendActivity({
+			activity: lifecycleActivity,
+			keys: signed ? signedKeys : unsignedKeys,
+			inbox: new URL(inbox)
+		}, { openHop: hops.openHop });
+		assertEquals(hops.events, [
+			`open ${inbox}`,
+			`fetch #1 ${inbox}`,
+			"cancel #1",
+			`close ${inbox}`
+		]);
+		hops.assertInvariants();
+	});
+});
+test("sendActivity() reads at most 1 KiB of an error response body", async (t) => {
+	for (const signed of [true, false]) await t.step(`signed: ${signed}`, async () => {
+		const inbox = "https://example.com/lifecycle/error";
+		const hops = recordHops(() => ({
+			status: 500,
+			body: "x".repeat(4096)
+		}));
+		const error = await assertRejects(() => sendActivity({
+			activity: lifecycleActivity,
+			activityId: lifecycleActivity.id,
+			keys: signed ? signedKeys : unsignedKeys,
+			inbox: new URL(inbox)
+		}, { openHop: hops.openHop }), SendActivityError);
+		assertEquals(error.responseBody, "x".repeat(1024) + "… (truncated)");
+		assert(error.message.includes("… (truncated)"));
+		assertEquals(hops.events, [
+			`open ${inbox}`,
+			`fetch #1 ${inbox}`,
+			"cancel #1",
+			...signed ? [`fetch #2 ${inbox}`, "cancel #2"] : [],
+			`close ${inbox}`
+		]);
+		hops.assertInvariants();
+	});
+});
+test("sendActivity() closes each redirect hop before opening the next", async (t) => {
+	for (const [signed, status] of [[true, 307], [false, 308]]) await t.step(`signed: ${signed}, ${status}`, async () => {
+		const inbox = "https://example.com/lifecycle/redirect";
+		const next = "https://example.com/lifecycle/redirected";
+		const hops = recordHops((request) => request.url === inbox ? {
+			status,
+			headers: { Location: next },
+			body: "Moved"
+		} : {
+			status: 202,
+			body: "Accepted"
 		});
+		await sendActivity({
+			activity: lifecycleActivity,
+			keys: signed ? signedKeys : unsignedKeys,
+			inbox: new URL(inbox)
+		}, { openHop: hops.openHop });
+		assertEquals(hops.events, [
+			`open ${inbox}`,
+			`fetch #1 ${inbox}`,
+			"cancel #1",
+			`close ${inbox}`,
+			`open ${next}`,
+			`fetch #2 ${next}`,
+			"cancel #2",
+			`close ${next}`
+		]);
+		assertEquals(hops.requests[1].method, "POST");
+		assertEquals(await hops.requests[1].text(), JSON.stringify(lifecycleActivity));
+		hops.assertInvariants();
+	});
+});
+async function captureLogs(fn) {
+	const records = [];
+	await configure({
+		sinks: { buffer: (record) => records.push(record) },
+		loggers: [{
+			category: "fedify",
+			sinks: ["buffer"],
+			lowestLevel: "debug"
+		}, {
+			category: ["logtape", "meta"],
+			sinks: []
+		}],
+		reset: true
+	});
+	try {
+		await fn();
+		await new Promise((resolve) => setTimeout(resolve, 0));
+	} finally {
+		await reset();
 	}
+	return records;
+}
+function getCancelFailureUrls(records) {
+	return records.filter((r) => r.rawMessage === "Failed to cancel the response body from {url}: {error}").map((r) => r.properties.url);
+}
+test("fetchWithValidatedRedirects() logs a redirect body failing to cancel and follows the redirect", async (t) => {
+	const url = "https://example.com/lifecycle/cancel-failure";
+	const next = "https://example.com/lifecycle/cancel-failure-final";
+	const respond = (_, index) => index === 1 ? {
+		status: 302,
+		headers: { Location: next },
+		body: "Found",
+		failCancel: true
+	} : {
+		status: 202,
+		body: "Accepted"
+	};
+	await t.step("fetchWithValidatedRedirects()", async () => {
+		const hops = recordHops(respond);
+		let result;
+		const records = await captureLogs(async () => {
+			result = await fetchWithValidatedRedirects(new Request(url, {
+				method: "POST",
+				body: "activity"
+			}), hops.openHop, (response) => response.text());
+		});
+		assertEquals(result, "Accepted");
+		assertEquals(hops.events, [
+			`open ${url}`,
+			`fetch #1 ${url}`,
+			"cancel #1",
+			`close ${url}`,
+			`open ${next}`,
+			`fetch #2 ${next}`,
+			"consumed #2",
+			`close ${next}`
+		]);
+		assertEquals(getCancelFailureUrls(records), [url]);
+		hops.assertInvariants();
+	});
+	for (const signed of [true, false]) await t.step(`signed sendActivity(): ${signed}`, async () => {
+		const hops = recordHops(respond);
+		const records = await captureLogs(() => sendActivity({
+			activity: lifecycleActivity,
+			keys: signed ? signedKeys : unsignedKeys,
+			inbox: new URL(url)
+		}, { openHop: hops.openHop }));
+		assertEquals(hops.events, [
+			`open ${url}`,
+			`fetch #1 ${url}`,
+			"cancel #1",
+			`close ${url}`,
+			`open ${next}`,
+			`fetch #2 ${next}`,
+			"cancel #2",
+			`close ${next}`
+		]);
+		assertEquals(getCancelFailureUrls(records), [url]);
+		hops.assertInvariants();
+	});
+});
+test("fetchWithValidatedRedirects() closes the session when consuming fails", async () => {
+	const url = "https://example.com/lifecycle/consume-failure";
+	const hops = recordHops(() => ({
+		status: 200,
+		body: "x".repeat(1024)
+	}));
+	await assertRejects(() => fetchWithValidatedRedirects(new Request(url, {
+		method: "POST",
+		body: "activity"
+	}), hops.openHop, () => Promise.reject(/* @__PURE__ */ new Error("consume failed"))), Error, "consume failed");
+	assertEquals(hops.events, [
+		`open ${url}`,
+		`fetch #1 ${url}`,
+		"cancel #1 by close",
+		`close ${url}`
+	]);
+	hops.assertInvariants();
+});
+test("sendActivity() logs a successful response body failing to cancel", async (t) => {
+	for (const signed of [true, false]) await t.step(`signed: ${signed}`, async () => {
+		const inbox = "https://example.com/lifecycle/cancel-failure-inbox";
+		const hops = recordHops(() => ({
+			status: 202,
+			body: "Accepted",
+			failCancel: true
+		}));
+		const records = await captureLogs(() => sendActivity({
+			activity: lifecycleActivity,
+			keys: signed ? signedKeys : unsignedKeys,
+			inbox: new URL(inbox)
+		}, { openHop: hops.openHop }));
+		assertEquals(hops.events, [
+			`open ${inbox}`,
+			`fetch #1 ${inbox}`,
+			"cancel #1",
+			`close ${inbox}`
+		]);
+		assertEquals(getCancelFailureUrls(records), [inbox]);
+		hops.assertInvariants();
+	});
+});
+test("sendActivity() is not blocked by a body cancellation that never settles", async (t) => {
+	for (const signed of [true, false]) await t.step(`signed: ${signed}`, async () => {
+		const inbox = "https://example.com/lifecycle/hanging-cancel";
+		const next = "https://example.com/lifecycle/hanging-cancel-final";
+		const hops = recordHops((request) => request.url === inbox ? {
+			status: 302,
+			headers: { Location: next },
+			body: "Found",
+			hangCancel: true
+		} : {
+			status: 202,
+			body: "Accepted",
+			hangCancel: true
+		});
+		await sendActivity({
+			activity: lifecycleActivity,
+			keys: signed ? signedKeys : unsignedKeys,
+			inbox: new URL(inbox)
+		}, { openHop: hops.openHop });
+		assertEquals(hops.events, [
+			`open ${inbox}`,
+			`fetch #1 ${inbox}`,
+			"cancel #1",
+			`close ${inbox}`,
+			`open ${next}`,
+			`fetch #2 ${next}`,
+			"cancel #2",
+			`close ${next}`
+		]);
+		hops.assertInvariants();
+	});
+	await t.step("truncated error body", async () => {
+		const inbox = "https://example.com/lifecycle/hanging-error";
+		const hops = recordHops(() => ({
+			status: 500,
+			body: "x".repeat(4096),
+			hangCancel: true
+		}));
+		assertEquals((await assertRejects(() => sendActivity({
+			activity: lifecycleActivity,
+			keys: unsignedKeys,
+			inbox: new URL(inbox)
+		}, { openHop: hops.openHop }), SendActivityError)).responseBody, "x".repeat(1024) + "… (truncated)");
+		assertEquals(hops.events, [
+			`open ${inbox}`,
+			`fetch #1 ${inbox}`,
+			"cancel #1",
+			`close ${inbox}`
+		]);
+		hops.assertInvariants();
+	});
 });
+test("sendActivity() completes with responses cloned by fetch-mock", async (t) => {
+	for (const signed of [true, false]) await t.step(`signed: ${signed}`, async () => {
+		esm_default.spyGlobal();
+		try {
+			esm_default.post("https://example.com/tee/inbox", () => new Response("Moved", {
+				status: 307,
+				headers: { Location: "https://example.com/tee/final" }
+			}));
+			esm_default.post("https://example.com/tee/final", () => new Response("Accepted", { status: 202 }));
+			esm_default.post("https://example.com/tee/error", () => new Response("x".repeat(4096), { status: 404 }));
+			const keys = signed ? signedKeys : unsignedKeys;
+			await sendDirect({
+				activity: lifecycleActivity,
+				keys,
+				inbox: new URL("https://example.com/tee/inbox")
+			});
+			assertEquals(esm_default.callHistory.calls("https://example.com/tee/final").length, 1);
+			const error = await assertRejects(() => sendDirect({
+				activity: lifecycleActivity,
+				keys,
+				inbox: new URL("https://example.com/tee/error")
+			}), SendActivityError);
+			assertEquals(error.statusCode, 404);
+			assertEquals(error.responseBody, "x".repeat(1024) + "… (truncated)");
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
+function createRecordedResponse(events, index, init, cancelSuffix = () => "") {
+	const bytes = new TextEncoder().encode(init.body ?? "");
+	const chunkSize = init.chunkSize ?? 256;
+	let offset = 0;
+	let settled = false;
+	const body = new ReadableStream({
+		pull(controller) {
+			if (offset >= bytes.length) {
+				settled = true;
+				events.push(`consumed #${index}`);
+				controller.close();
+				return;
+			}
+			controller.enqueue(bytes.slice(offset, offset + chunkSize));
+			offset += chunkSize;
+		},
+		cancel() {
+			settled = true;
+			events.push(`cancel #${index}${cancelSuffix()}`);
+			if (init.failCancel) throw new Error(`cancel #${index} failed`);
+			if (init.hangCancel) return new Promise(() => {});
+		}
+	}, { highWaterMark: 0 });
+	return {
+		response: new Response(body, {
+			status: init.status ?? 200,
+			headers: init.headers
+		}),
+		settled: () => settled
+	};
+}
+function recordHops(respond) {
+	const events = [];
+	const requests = [];
+	const unsettledAtClose = [];
+	let opens = 0;
+	let closes = 0;
+	let fetches = 0;
+	return {
+		events,
+		requests,
+		openHop(url) {
+			opens++;
+			events.push(`open ${url}`);
+			const tracked = [];
+			let closed = false;
+			let closing = false;
+			return Promise.resolve({
+				url: new URL(url),
+				async fetch(input, init) {
+					if (closed) throw new TypeError("The session is closed.");
+					const request = new Request(input instanceof Request ? input.clone() : input, init);
+					const index = ++fetches;
+					requests.push(request);
+					events.push(`fetch #${index} ${request.url}`);
+					const recorded = createRecordedResponse(events, index, await respond(request, index), () => closing ? " by close" : "");
+					tracked.push({
+						...recorded,
+						index
+					});
+					return recorded.response;
+				},
+				close() {
+					if (closed) return Promise.resolve();
+					closed = true;
+					closes++;
+					closing = true;
+					for (const { response, settled, index } of tracked) {
+						if (settled()) continue;
+						if (response.body?.locked) unsettledAtClose.push(index);
+						else response.body?.cancel().catch(() => {});
+					}
+					events.push(`close ${url}`);
+					return Promise.resolve();
+				}
+			});
+		},
+		assertInvariants() {
+			assertEquals(opens, closes);
+			assertEquals(unsettledAtClose, []);
+		}
+	};
+}
 //#endregion
 export {};

package/dist/federation/temporal.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import "../std__assert-DNZ4Liil.mjs";
 import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-Biz6zK6e.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-BQGEINad.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -5,7 +5,7 @@ import { r as createRequestContext } from "../context-Dk_tacqz.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-DNZ4Liil.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { o as createFederation, s as handleWebFinger } from "../middleware-CHoUjmJm.mjs";
+import { o as createFederation, s as handleWebFinger } from "../middleware-CYAaUTi5.mjs";
 import { test } from "@fedify/fixture";
 import { Image, Link, Person, Tombstone } from "@fedify/vocab";
 //#region src/federation/webfinger.test.ts