@fedify/fedify 2.2.19 → 2.2.20

package/dist/federation/middleware.test.mjs

@@ -10,21 +10,21 @@ import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-BkxW5QJI.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
 import { t as assertStrictEquals } from "../assert_strict_equals-Dmjbg-bA.mjs";
-import { l as verifyRequest, s as signRequest } from "../http-BBBUbwKh.mjs";
+import { c as signRequest, u as verifyRequest } from "../http-CQMVisM0.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-BAK-tUlf.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-D1ghurDJ.mjs";
+import { n as getAuthenticatedDocumentLoader } from "../docloader-CbtF_0cD.mjs";
 import { t as MemoryKvStore } from "../kv-mI4Ix2EU.mjs";
-import { a as compactJsonLd, h as verifyJsonLd, p as signJsonLd, s as detachSignature } from "../ld-rTdIfZ63.mjs";
-import { t as doesActorOwnKey } from "../owner-CVfzyM5V.mjs";
-import { i as verifyObject, r as signObject } from "../proof-gOGM-sJS.mjs";
-import { i as KvSpecDeterminer, n as FederationImpl, o as createFederation, r as InboxContextImpl, t as ContextImpl } from "../middleware-CpXoRHs3.mjs";
+import { a as compactJsonLd, h as verifyJsonLd, p as signJsonLd, s as detachSignature } from "../ld-ijSr-0AB.mjs";
+import { t as doesActorOwnKey } from "../owner-B8kXzD0q.mjs";
+import { i as verifyObject, r as signObject } from "../proof-CBQOjOgA.mjs";
+import { i as KvSpecDeterminer, n as FederationImpl, o as createFederation, r as InboxContextImpl, t as ContextImpl } from "../middleware-CYAaUTi5.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import * as vocab from "@fedify/vocab";
 import { Create, Offer, Person, getTypeId, lookupObject } from "@fedify/vocab";
 import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
 import { configure, reset } from "@logtape/logtape";
-import dns from "node:dns/promises";
 import serialize from "json-canon";
+import dns from "node:dns/promises";
 //#region ../fixture/src/fixtures/example.com/create.json
 var id$2 = "https://example.com/create";
 var create_default = {
@@ -89,7 +89,7 @@ var person2_default = {
 };
 //#endregion
 //#region src/federation/middleware.test.ts
-const documentLoader = getDocumentLoader();
+const documentLoader = getDocumentLoader({ allowPrivateAddress: true });
 let logtapeLock = Promise.resolve();
 async function withLogtapeLock(fn) {
 	const run = logtapeLock.then(fn, fn);
@@ -225,7 +225,8 @@ test({
 			const federation = createFederation({
 				kv,
 				documentLoaderFactory: () => rejectingLoader,
-				contextLoaderFactory: () => mockDocumentLoader
+				contextLoaderFactory: () => mockDocumentLoader,
+				authenticatedDocumentLoaderFactory: (identity) => getAuthenticatedDocumentLoader(identity, { allowPrivateAddress: true })
 			});
 			let ctx = federation.createContext(new URL("https://example.com:1234/"), 123);
 			assertEquals(ctx.data, 123);
@@ -330,7 +331,7 @@ test({
 				documentUrl: "https://example.com/auth-check",
 				document: true
 			});
-			assertEquals(await ctx.lookupObject("https://example.com/object"), null);
+			assertEquals(await withDnsLookup(() => Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")), () => ctx.lookupObject("https://example.com/object")), null);
 			await assertRejects(() => ctx.sendActivity({ identifier: "handle" }, [], new vocab.Create({})), TypeError, "The activity to send must have at least one actor property.");
 			await ctx.sendActivity({ identifier: "handle" }, [], new vocab.Create({ actor: new URL("https://example.com/users/handle") }));
 			esm_default.get("https://example.com/object", () => new Response(JSON.stringify({
@@ -579,7 +580,7 @@ test({
 			assertStrictEquals(clone.contextLoader, ctx.contextLoader);
 			assertStrictEquals(clone.federation, ctx.federation);
 		});
-		esm_default.get("https://example.com/.well-known/nodeinfo", (cl) => {
+		esm_default.get("path:/.well-known/nodeinfo", (cl) => {
 			const headers = cl.options.headers ?? {};
 			assertEquals(new Headers(headers).get("User-Agent"), "CustomUserAgent/1.2.3");
 			return new Response(JSON.stringify({ links: [{
@@ -587,7 +588,7 @@ test({
 				href: "https://example.com/nodeinfo/2.1"
 			}] }));
 		});
-		esm_default.get("https://example.com/nodeinfo/2.1", (cl) => {
+		esm_default.get("path:/nodeinfo/2.1", (cl) => {
 			const headers = cl.options.headers ?? {};
 			assertEquals(new Headers(headers).get("User-Agent"), "CustomUserAgent/1.2.3");
 			return new Response(JSON.stringify({
@@ -608,7 +609,11 @@ test({
 				kv,
 				userAgent: "CustomUserAgent/1.2.3"
 			}).createContext(new URL("https://example.com/"), 123);
-			assertEquals(await ctx.lookupNodeInfo("https://example.com/"), {
+			const lookupExample = () => Promise.resolve([{
+				address: "93.184.215.14",
+				family: 4
+			}]);
+			assertEquals(await withDnsLookup(lookupExample, () => ctx.lookupNodeInfo("https://example.com/")), {
 				software: {
 					name: "foo",
 					version: "1.2.3"
@@ -620,7 +625,7 @@ test({
 					localComments: 456
 				}
 			});
-			assertEquals(await ctx.lookupNodeInfo("https://example.com/", { parse: "none" }), {
+			assertEquals(await withDnsLookup(lookupExample, () => ctx.lookupNodeInfo("https://example.com/", { parse: "none" })), {
 				software: {
 					name: "foo",
 					version: "1.2.3"
@@ -739,6 +744,343 @@ test({
 		esm_default.hardReset();
 	}
 });
+test("RequestContext signature checks", async (t) => {
+	const [tracerProvider, exporter] = createTestTracerProvider();
+	const keyId = rsaPublicKey3.id.href;
+	const ownerId = rsaPublicKey3.ownerId.href;
+	const request = await signRequest(new Request("https://example.com/"), rsaPrivateKey3, rsaPublicKey3.id);
+	function setup(options = {}) {
+		const loads = {
+			key: 0,
+			owner: 0
+		};
+		const loader = async (url, loaderOptions) => {
+			if (url === keyId) loads.key++;
+			else if (url === ownerId) loads.owner++;
+			await options.gate;
+			return await (options.load ?? mockDocumentLoader)(url, loaderOptions);
+		};
+		const federation = createFederation({
+			kv: new MemoryKvStore(),
+			documentLoaderFactory: () => loader,
+			contextLoaderFactory: () => mockDocumentLoader,
+			tracerProvider: options.tracerProvider ?? tracerProvider
+		});
+		return {
+			ctx: federation.createContext(options.request ?? new Request(request), void 0),
+			loads,
+			loader,
+			federation
+		};
+	}
+	try {
+		for (const mode of [
+			"keys",
+			"owners",
+			"warm owners",
+			"mixed"
+		]) await t.step(`coalesces ${mode}`, async () => {
+			exporter.clear();
+			let release;
+			const { ctx, loads, loader } = setup({ gate: new Promise((resolve) => release = resolve) });
+			if (mode === "warm owners") {
+				release();
+				assert(await ctx.getSignedKey());
+			}
+			const results = Promise.all(Array.from({ length: 8 }, (_, i) => {
+				const options = i % 2 === 0 ? {} : {
+					documentLoader: loader,
+					contextLoader: ctx.contextLoader,
+					tracerProvider
+				};
+				return mode === "keys" || mode === "mixed" && i % 2 === 0 ? ctx.getSignedKey(options) : ctx.getSignedKeyOwner(options);
+			}));
+			release();
+			for (const result of await results) assert(result != null);
+			assertEquals(loads, {
+				key: 1,
+				owner: mode === "keys" ? 0 : 1
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 1);
+			assert(await ctx.getSignedKey());
+			if (mode !== "keys") assert(await ctx.getSignedKeyOwner());
+			assertEquals(loads, {
+				key: 1,
+				owner: mode === "keys" ? 0 : 1
+			});
+		});
+		await t.step("memoizes null keys", async () => {
+			exporter.clear();
+			const { ctx, loads } = setup({ load: () => Promise.reject(/* @__PURE__ */ new Error("unavailable")) });
+			for (let i = 0; i < 3; i++) {
+				assertEquals(await ctx.getSignedKey(), null);
+				assertEquals(await ctx.getSignedKeyOwner(), null);
+			}
+			assertEquals(loads, {
+				key: 1,
+				owner: 0
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 1);
+			assert(await ctx.getSignedKey({ documentLoader: mockDocumentLoader }));
+			assert(await ctx.getSignedKeyOwner({ documentLoader: mockDocumentLoader }));
+		});
+		await t.step("coalesces key-owner FetchError results", async () => {
+			const { ctx, loads } = setup({ load: async (url, options) => {
+				if (url === ownerId) throw new FetchError(new URL(url), "HTTP 401: Unauthorized");
+				return await mockDocumentLoader(url, options);
+			} });
+			assert(await ctx.getSignedKey());
+			assertEquals(await Promise.all(Array.from({ length: 8 }, () => ctx.getSignedKeyOwner())), Array(8).fill(null));
+			assertEquals(await ctx.getSignedKeyOwner(), null);
+			assertEquals(loads, {
+				key: 1,
+				owner: 1
+			});
+			assert(await ctx.getSignedKeyOwner({ documentLoader: mockDocumentLoader }));
+		});
+		await t.step("memoizes unsigned requests", async () => {
+			exporter.clear();
+			const { ctx, loads } = setup({ request: new Request("https://example.com/") });
+			for (let i = 0; i < 3; i++) {
+				assertEquals(await ctx.getSignedKey(), null);
+				assertEquals(await ctx.getSignedKeyOwner(), null);
+			}
+			assertEquals(loads, {
+				key: 0,
+				owner: 0
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 1);
+		});
+		await t.step("memoizes null owners without trusting a key's owner claim", async () => {
+			const { ctx, loads } = setup({ load: async (url, options) => url === ownerId ? {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					...person2_default,
+					publicKey: []
+				}
+			} : await mockDocumentLoader(url, options) });
+			assert(await ctx.getSignedKey());
+			assertEquals(await Promise.all(Array.from({ length: 8 }, () => ctx.getSignedKeyOwner())), Array(8).fill(null));
+			for (let i = 0; i < 3; i++) assertEquals(await ctx.getSignedKeyOwner(), null);
+			assertEquals(loads, {
+				key: 1,
+				owner: 1
+			});
+			assert(await ctx.getSignedKeyOwner({ documentLoader: mockDocumentLoader }));
+			assert(await ctx.getSignedKeyOwner());
+		});
+		await t.step("isolates concurrent document loaders before success", async () => {
+			const { ctx, loads } = setup();
+			let otherLoads = 0;
+			const otherLoader = async (url, options) => {
+				otherLoads++;
+				if (url === ownerId) return {
+					documentUrl: url,
+					contextUrl: null,
+					document: {
+						...person2_default,
+						name: "Other view"
+					}
+				};
+				return await mockDocumentLoader(url, options);
+			};
+			const [first, second] = await Promise.all([ctx.getSignedKeyOwner(), ctx.getSignedKeyOwner({ documentLoader: otherLoader })]);
+			assertEquals(first?.name, "Jane Doe");
+			assertEquals(second?.name, "Other view");
+			const cached = await ctx.getSignedKeyOwner();
+			assert(cached === first || cached === second);
+			assertStrictEquals(await ctx.getSignedKeyOwner({ documentLoader: otherLoader }), cached);
+			assertEquals(loads, {
+				key: 1,
+				owner: 1
+			});
+			assertEquals(otherLoads, 2);
+		});
+		await t.step("preserves in-flight null while another loader succeeds", async () => {
+			exporter.clear();
+			let release;
+			const gate = new Promise((resolve) => release = resolve);
+			const { ctx, loads } = setup({ load: async () => {
+				await gate;
+				throw new TypeError("fetch failed");
+			} });
+			const failed = Promise.all([ctx.getSignedKey(), ctx.getSignedKeyOwner()]);
+			const owner = await ctx.getSignedKeyOwner({ documentLoader: mockDocumentLoader });
+			assert(owner);
+			release();
+			assertEquals(await failed, [null, null]);
+			assertStrictEquals(await ctx.getSignedKeyOwner(), owner);
+			assert(await ctx.getSignedKey());
+			assertEquals(loads, {
+				key: 1,
+				owner: 0
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 2);
+		});
+		await t.step("isolates context loaders", async () => {
+			exporter.clear();
+			const { ctx, loads } = setup();
+			const otherContextLoader = (url, options) => mockDocumentLoader(url, options);
+			await Promise.all([ctx.getSignedKeyOwner(), ctx.getSignedKeyOwner({ contextLoader: otherContextLoader })]);
+			assertEquals(loads, {
+				key: 2,
+				owner: 2
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 2);
+		});
+		await t.step("shares work across tracer providers", async () => {
+			exporter.clear();
+			const [otherProvider, otherExporter] = createTestTracerProvider();
+			try {
+				const { ctx, loads } = setup();
+				await Promise.all([
+					ctx.getSignedKeyOwner(),
+					ctx.getSignedKeyOwner({ tracerProvider: otherProvider }),
+					ctx.getSignedKey(),
+					ctx.getSignedKey({ tracerProvider: otherProvider })
+				]);
+				assert(await ctx.getSignedKeyOwner({ tracerProvider: otherProvider }));
+				assertEquals(loads, {
+					key: 1,
+					owner: 1
+				});
+				assertEquals(exporter.getSpans("http_signatures.verify").length, 1);
+				assertEquals(otherExporter.getSpans("http_signatures.verify").length, 0);
+			} finally {
+				await otherProvider.shutdown();
+			}
+		});
+		await t.step("reuses success with a fresh authorization loader", async () => {
+			exporter.clear();
+			const { ctx, loads } = setup();
+			let freshLoads = 0;
+			const freshLoader = (url, options) => {
+				freshLoads++;
+				return mockDocumentLoader(url, options);
+			};
+			const key = await ctx.getSignedKey({ documentLoader: freshLoader });
+			assert(key);
+			assertStrictEquals(await ctx.getSignedKey(), key);
+			const owner = await ctx.getSignedKeyOwner();
+			assert(owner);
+			assertStrictEquals(await ctx.getSignedKeyOwner({ documentLoader: freshLoader }), owner);
+			assertEquals(loads, {
+				key: 0,
+				owner: 1
+			});
+			assertEquals(freshLoads, 1);
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 1);
+		});
+		await t.step("retains a transient owner lookup failure as null", async () => {
+			let fail = true;
+			const { ctx, loads } = setup({ load: async (url, options) => {
+				if (url === ownerId && fail) throw new TypeError("fetch failed");
+				return await mockDocumentLoader(url, options);
+			} });
+			assert(await ctx.getSignedKey());
+			assertEquals(await ctx.getSignedKeyOwner(), null);
+			fail = false;
+			assertEquals(await ctx.getSignedKeyOwner(), null);
+			assertEquals(loads, {
+				key: 1,
+				owner: 1
+			});
+			assert(await ctx.getSignedKeyOwner({ documentLoader: mockDocumentLoader }));
+		});
+		await t.step("rechecks an owner after another loader verifies the key", async () => {
+			let fail = true;
+			const { ctx, loads } = setup({ load: async (url, options) => {
+				if (url === keyId && fail) throw new TypeError("fetch failed");
+				return await mockDocumentLoader(url, options);
+			} });
+			assertEquals(await ctx.getSignedKeyOwner(), null);
+			fail = false;
+			assertEquals(await ctx.getSignedKeyOwner(), null);
+			assertEquals(loads, {
+				key: 1,
+				owner: 0
+			});
+			assert(await ctx.getSignedKey({ documentLoader: mockDocumentLoader }));
+			assertEquals((await ctx.getSignedKeyOwner())?.id?.href, ownerId);
+			assertEquals(loads, {
+				key: 1,
+				owner: 1
+			});
+		});
+		await t.step("retries unexpected key rejections from a rejection handler", async () => {
+			exporter.clear();
+			const failure = /* @__PURE__ */ new Error("transient context loader failure");
+			let rejectContext = true;
+			const contextLoader = async (url, options) => {
+				if (rejectContext) throw failure;
+				return await mockDocumentLoader(url, options);
+			};
+			const { ctx, loads } = setup();
+			const options = { contextLoader };
+			const failedKeys = Promise.allSettled([
+				ctx.getSignedKey(options),
+				ctx.getSignedKeyOwner(options),
+				ctx.getSignedKey(options)
+			]);
+			const recovery = ctx.getSignedKey(options).catch(() => {
+				rejectContext = false;
+				return ctx.getSignedKey(options);
+			});
+			for (const result of await failedKeys) assertEquals(result.status, "rejected");
+			assert(await recovery);
+			assertEquals(loads, {
+				key: 2,
+				owner: 0
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 2);
+		});
+		await t.step("retries owner rejections while retaining the verified key", async () => {
+			exporter.clear();
+			let rejectContext = false;
+			const contextLoader = async (url, options) => {
+				if (rejectContext) throw new Error("transient owner context failure");
+				return await mockDocumentLoader(url, options);
+			};
+			const { ctx, loads } = setup();
+			const options = { contextLoader };
+			assert(await ctx.getSignedKey(options));
+			assertEquals(loads, {
+				key: 1,
+				owner: 0
+			});
+			rejectContext = true;
+			const failures = await Promise.allSettled([ctx.getSignedKeyOwner(options), ctx.getSignedKeyOwner(options)]);
+			for (const result of failures) assertEquals(result.status, "rejected");
+			assertEquals(loads, {
+				key: 1,
+				owner: 1
+			});
+			rejectContext = false;
+			assert(await ctx.getSignedKeyOwner(options));
+			assertEquals(loads, {
+				key: 1,
+				owner: 2
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 1);
+		});
+		await t.step("keeps clones and separate requests independent", async () => {
+			exporter.clear();
+			const { ctx, loads, federation } = setup();
+			assert(await ctx.getSignedKeyOwner());
+			const clone = ctx.clone(void 0);
+			const separate = federation.createContext(new Request(request), void 0);
+			await Promise.all([clone.getSignedKeyOwner(), separate.getSignedKeyOwner()]);
+			assertEquals(loads, {
+				key: 3,
+				owner: 3
+			});
+			assertEquals(exporter.getSpans("http_signatures.verify").length, 3);
+		});
+	} finally {
+		await tracerProvider.shutdown();
+	}
+});
 test("Federation.fetch() [rfc9421] multiple POST signatures", async (t) => {
 	for (const validSecond of [true, false]) await t.step(validSecond ? "valid second signature" : "both signatures invalid", async () => {
 		const inbox = [];
@@ -782,7 +1124,7 @@ test("Federation.fetch()", async (t) => {
 			kv,
 			documentLoaderFactory: () => mockDocumentLoader,
 			authenticatedDocumentLoaderFactory(identity) {
-				const docLoader = getAuthenticatedDocumentLoader(identity);
+				const docLoader = getAuthenticatedDocumentLoader(identity, { allowPrivateAddress: true });
 				return (url) => {
 					if (new URL(url).host === "example.com") return docLoader(url);
 					return mockDocumentLoader(url);
@@ -988,7 +1330,7 @@ test("Federation.setInboxListeners()", async (t) => {
 			kv,
 			documentLoaderFactory: () => mockDocumentLoader,
 			authenticatedDocumentLoaderFactory(identity) {
-				const docLoader = getAuthenticatedDocumentLoader(identity);
+				const docLoader = getAuthenticatedDocumentLoader(identity, { allowPrivateAddress: true });
 				return (url) => {
 					const urlObj = new URL(url);
 					authenticatedRequests.push([url, identity.keyId.href]);
@@ -1311,7 +1653,7 @@ test("Federation.setInboxListeners()", async (t) => {
 			kv,
 			documentLoaderFactory: () => mockDocumentLoader,
 			authenticatedDocumentLoaderFactory(identity) {
-				const docLoader = getAuthenticatedDocumentLoader(identity);
+				const docLoader = getAuthenticatedDocumentLoader(identity, { allowPrivateAddress: true });
 				return (url) => {
 					if (new URL(url).host === "example.com") return docLoader(url);
 					return mockDocumentLoader(url);
@@ -1524,10 +1866,11 @@ test("Federation.setOutboxListeners()", async (t) => {
 						sinks: ["buffer"]
 					}]
 				});
-				const federation = createFederation({
+				const federation = new FederationImpl({
 					kv,
 					documentLoaderFactory: () => mockDocumentLoader
 				});
+				federation.allowPrivateAddress = true;
 				federation.setActorDispatcher("/users/{identifier}", (_ctx, identifier) => identifier === "john" ? new vocab.Person({}) : null).setKeyPairsDispatcher(() => [{
 					privateKey: rsaPrivateKey2,
 					publicKey: rsaPublicKey2.publicKey
@@ -1630,10 +1973,11 @@ test("Federation.setOutboxListeners()", async (t) => {
 						sinks: ["buffer"]
 					}]
 				});
-				const federation = createFederation({
+				const federation = new FederationImpl({
 					kv,
 					documentLoaderFactory: () => mockDocumentLoader
 				});
+				federation.allowPrivateAddress = true;
 				federation.setActorDispatcher("/{identifier}", (_ctx, identifier) => identifier === "person2" ? new vocab.Person({}) : null).setKeyPairsDispatcher(() => [{
 					privateKey: rsaPrivateKey2,
 					publicKey: rsaPublicKey2.publicKey
@@ -1858,7 +2202,7 @@ test("FederationImpl.sendActivity()", async (t) => {
 	});
 	const federation = new FederationImpl({
 		kv: new MemoryKvStore(),
-		contextLoaderFactory: () => mockDocumentLoader
+		allowPrivateAddress: true
 	});
 	const context = federation.createContext(new URL("https://example.com/"));
 	await t.step("success", async () => {
@@ -3900,7 +4244,7 @@ test("ContextImpl.sendActivity()", async (t) => {
 	const kv = new MemoryKvStore();
 	const federation = new FederationImpl({
 		kv,
-		contextLoaderFactory: () => mockDocumentLoader
+		allowPrivateAddress: true
 	});
 	federation.setActorDispatcher("/{identifier}", async (ctx, identifier) => {
 		if (identifier !== "1") return null;
@@ -4023,11 +4367,13 @@ test("ContextImpl.sendActivity()", async (t) => {
 	});
 	await t.step("records recipient span attributes correctly", async () => {
 		const [tracerProvider, exporter] = createTestTracerProvider();
-		const ctx = new FederationImpl({
+		const federation3 = new FederationImpl({
 			kv,
 			contextLoaderFactory: () => mockDocumentLoader,
 			tracerProvider
-		}).createContext(new URL("https://example.com/"), void 0);
+		});
+		federation3.allowPrivateAddress = true;
+		const ctx = federation3.createContext(new URL("https://example.com/"), void 0);
 		const activity = new vocab.Create({
 			id: new URL("https://example.com/activity/telemetry"),
 			actor: new URL("https://example.com/person"),
@@ -4061,7 +4407,7 @@ test("ContextImpl.sendActivity()", async (t) => {
 	};
 	const federation2 = new FederationImpl({
 		kv,
-		contextLoaderFactory: () => mockDocumentLoader,
+		allowPrivateAddress: true,
 		queue
 	});
 	federation2.setActorDispatcher("/{identifier}", async (ctx, identifier) => {
@@ -4232,7 +4578,7 @@ test("ContextImpl.sendActivity()", async (t) => {
 		const asyncEnqueued = [];
 		const fed = new FederationImpl({
 			kv,
-			contextLoaderFactory: () => mockDocumentLoader,
+			allowPrivateAddress: true,
 			queue: {
 				enqueue(message) {
 					return new Promise((resolve) => {
@@ -4399,10 +4745,10 @@ test({
 		const signedInvite = await signObject(new vocab.Invite({ actor: new URL("https://example.com/person2") }), ed25519PrivateKey, ed25519Multikey.id);
 		assert(await ctx.routeActivity("id", signedInvite));
 		assertEquals(activities, [[null, signedOffer], ["id", signedInvite]]);
-		assertFalse(await ctx.routeActivity(null, new vocab.Create({
+		assertFalse(await withDnsLookup(() => Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")), () => ctx.routeActivity(null, new vocab.Create({
 			id: new URL("https://example.com/not-found"),
 			actor: new URL("https://example.com/person")
-		})));
+		}))));
 		assertEquals(activities, [[null, signedOffer], ["id", signedInvite]]);
 		assertFalse(await ctx.routeActivity(null, new vocab.Create({
 			id: new URL("https://example.com/person"),
@@ -4761,7 +5107,7 @@ test("InboxContextImpl.forwardActivity()", async (t) => {
 	const kv = new MemoryKvStore();
 	const federation = new FederationImpl({
 		kv,
-		contextLoaderFactory: () => mockDocumentLoader
+		allowPrivateAddress: true
 	});
 	await t.step("skip", async () => {
 		await new InboxContextImpl(null, {
@@ -4884,6 +5230,7 @@ test("InboxContextImpl.forwardActivity()", async (t) => {
 			contextLoaderFactory: () => mockDocumentLoader,
 			tracerProvider
 		});
+		federationWithTracing.allowPrivateAddress = true;
 		await new InboxContextImpl(null, await signJsonLd({
 			"@context": "https://www.w3.org/ns/activitystreams",
 			"type": "Create",
@@ -5018,5 +5365,19 @@ test("Federation.fetch() bounds inbox bodies before dispatch", async () => {
 	}), { contextData: void 0 })).status, 202);
 	assert(dispatched);
 });
+/**
+* Runs the given function while `node:dns/promises`' `lookup()`, which the
+* default public fetch resolves hostnames with, is replaced, so that no test
+* depends on the real DNS.
+*/
+async function withDnsLookup(lookup, fn) {
+	const originalLookup = dns.lookup;
+	dns.lookup = lookup;
+	try {
+		return await fn();
+	} finally {
+		dns.lookup = originalLookup;
+	}
+}
 //#endregion
 export {};

package/dist/federation/mod.cjs

@@ -2,7 +2,7 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../chunk-DDcVe30Y.cjs");
-const require_middleware = require("../middleware-BWOwEGpy.cjs");
+const require_middleware = require("../middleware-DNueR0GD.cjs");
 let es_toolkit = require("es-toolkit");
 //#region src/federation/kv.ts
 /**

package/dist/federation/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as ActorAliasMapper, A as FederationKvPrefixes, B as Router, C as IdempotencyKeyCallback, Ct as SendActivityError, D as ObjectCallbackSetters, Dt as digest, E as InboxListenerSetters, Et as buildCollectionSynchronizationHeader, F as RetryContext, G as respondWithObject, H as RouterOptions, I as RetryPolicy, J as InProcessMessageQueueOptions, K as respondWithObjectIfAcceptable, L as createExponentialBackoffPolicy, M as FederationQueueOptions, N as createFederation, O as OutboxListenerSetters, P as CreateExponentialBackoffPolicyOptions, Q as ParallelMessageQueue, R as Message, S as FederationStartQueueOptions, St as WebFingerLinksDispatcher, T as InboxChallengePolicy, Tt as PageItems, U as RouterRouteResult, V as RouterError, W as RespondWithObjectOptions, X as MessageQueueEnqueueOptions, Y as MessageQueue, Z as MessageQueueListenOptions, _ as Federatable, _t as OutboxListenerErrorHandler, a as GetSignedKeyOptions, at as CollectionCursor, b as FederationFetchOptions, bt as UnverifiedActivityHandler, c as ParseUriResult, ct as CustomCollectionCursor, d as SendActivityOptions, dt as InboxListener, et as ActorDispatcher, f as SendActivityOptionsForCollection, ft as NodeInfoDispatcher, g as CustomCollectionCallbackSetters, gt as OutboxListener, h as ConstructorWithTypeId, ht as OutboxErrorHandler, i as GetActorOptions, it as CollectionCounter, j as FederationOrigin, k as Rfc6570Expression, l as RequestContext, lt as CustomCollectionDispatcher, m as CollectionCallbackSetters, mt as ObjectDispatcher, n as Context, nt as ActorKeyPairsDispatcher, o as InboxContext, ot as CollectionDispatcher, p as ActorCallbackSetters, pt as ObjectAuthorizePredicate, q as InProcessMessageQueue, r as ForwardActivityOptions, rt as AuthorizePredicate, s as OutboxContext, st as CustomCollectionCounter, t as ActorKeyPair, tt as ActorHandleMapper, u as RouteActivityOptions, ut as InboxErrorHandler, v as Federation, vt as OutboxPermanentFailureHandler, w as IdempotencyStrategy, wt as SenderKeyPair, x as FederationOptions, xt as UnverifiedActivityReason, y as FederationBuilder, yt as SharedInboxKeyDispatcher, z as createFederationBuilder } from "../context-tJbL_Hkw.cjs";
+import { $ as ActorAliasMapper, A as FederationKvPrefixes, B as Router, C as IdempotencyKeyCallback, Ct as SendActivityError, D as ObjectCallbackSetters, Dt as digest, E as InboxListenerSetters, Et as buildCollectionSynchronizationHeader, F as RetryContext, G as respondWithObject, H as RouterOptions, I as RetryPolicy, J as InProcessMessageQueueOptions, K as respondWithObjectIfAcceptable, L as createExponentialBackoffPolicy, M as FederationQueueOptions, N as createFederation, O as OutboxListenerSetters, P as CreateExponentialBackoffPolicyOptions, Q as ParallelMessageQueue, R as Message, S as FederationStartQueueOptions, St as WebFingerLinksDispatcher, T as InboxChallengePolicy, Tt as PageItems, U as RouterRouteResult, V as RouterError, W as RespondWithObjectOptions, X as MessageQueueEnqueueOptions, Y as MessageQueue, Z as MessageQueueListenOptions, _ as Federatable, _t as OutboxListenerErrorHandler, a as GetSignedKeyOptions, at as CollectionCursor, b as FederationFetchOptions, bt as UnverifiedActivityHandler, c as ParseUriResult, ct as CustomCollectionCursor, d as SendActivityOptions, dt as InboxListener, et as ActorDispatcher, f as SendActivityOptionsForCollection, ft as NodeInfoDispatcher, g as CustomCollectionCallbackSetters, gt as OutboxListener, h as ConstructorWithTypeId, ht as OutboxErrorHandler, i as GetActorOptions, it as CollectionCounter, j as FederationOrigin, k as Rfc6570Expression, l as RequestContext, lt as CustomCollectionDispatcher, m as CollectionCallbackSetters, mt as ObjectDispatcher, n as Context, nt as ActorKeyPairsDispatcher, o as InboxContext, ot as CollectionDispatcher, p as ActorCallbackSetters, pt as ObjectAuthorizePredicate, q as InProcessMessageQueue, r as ForwardActivityOptions, rt as AuthorizePredicate, s as OutboxContext, st as CustomCollectionCounter, t as ActorKeyPair, tt as ActorHandleMapper, u as RouteActivityOptions, ut as InboxErrorHandler, v as Federation, vt as OutboxPermanentFailureHandler, w as IdempotencyStrategy, wt as SenderKeyPair, x as FederationOptions, xt as UnverifiedActivityReason, y as FederationBuilder, yt as SharedInboxKeyDispatcher, z as createFederationBuilder } from "../context-CFQGaq5x.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-CZKl1IUS.cjs";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-a6kmB8xD.cjs";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-CVSKw-5H.cjs";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetActorOptions, GetSignedKeyOptions, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MemoryKvStore, Message, MessageQueue, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriResult, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, UnverifiedActivityHandler, UnverifiedActivityReason, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as ActorAliasMapper, A as FederationKvPrefixes, B as Router, C as IdempotencyKeyCallback, Ct as SendActivityError, D as ObjectCallbackSetters, Dt as digest, E as InboxListenerSetters, Et as buildCollectionSynchronizationHeader, F as RetryContext, G as respondWithObject, H as RouterOptions, I as RetryPolicy, J as InProcessMessageQueueOptions, K as respondWithObjectIfAcceptable, L as createExponentialBackoffPolicy, M as FederationQueueOptions, N as createFederation, O as OutboxListenerSetters, P as CreateExponentialBackoffPolicyOptions, Q as ParallelMessageQueue, R as Message, S as FederationStartQueueOptions, St as WebFingerLinksDispatcher, T as InboxChallengePolicy, Tt as PageItems, U as RouterRouteResult, V as RouterError, W as RespondWithObjectOptions, X as MessageQueueEnqueueOptions, Y as MessageQueue, Z as MessageQueueListenOptions, _ as Federatable, _t as OutboxListenerErrorHandler, a as GetSignedKeyOptions, at as CollectionCursor, b as FederationFetchOptions, bt as UnverifiedActivityHandler, c as ParseUriResult, ct as CustomCollectionCursor, d as SendActivityOptions, dt as InboxListener, et as ActorDispatcher, f as SendActivityOptionsForCollection, ft as NodeInfoDispatcher, g as CustomCollectionCallbackSetters, gt as OutboxListener, h as ConstructorWithTypeId, ht as OutboxErrorHandler, i as GetActorOptions, it as CollectionCounter, j as FederationOrigin, k as Rfc6570Expression, l as RequestContext, lt as CustomCollectionDispatcher, m as CollectionCallbackSetters, mt as ObjectDispatcher, n as Context, nt as ActorKeyPairsDispatcher, o as InboxContext, ot as CollectionDispatcher, p as ActorCallbackSetters, pt as ObjectAuthorizePredicate, q as InProcessMessageQueue, r as ForwardActivityOptions, rt as AuthorizePredicate, s as OutboxContext, st as CustomCollectionCounter, t as ActorKeyPair, tt as ActorHandleMapper, u as RouteActivityOptions, ut as InboxErrorHandler, v as Federation, vt as OutboxPermanentFailureHandler, w as IdempotencyStrategy, wt as SenderKeyPair, x as FederationOptions, xt as UnverifiedActivityReason, y as FederationBuilder, yt as SharedInboxKeyDispatcher, z as createFederationBuilder } from "../context-OkwEpc3-.js";
+import { $ as ActorAliasMapper, A as FederationKvPrefixes, B as Router, C as IdempotencyKeyCallback, Ct as SendActivityError, D as ObjectCallbackSetters, Dt as digest, E as InboxListenerSetters, Et as buildCollectionSynchronizationHeader, F as RetryContext, G as respondWithObject, H as RouterOptions, I as RetryPolicy, J as InProcessMessageQueueOptions, K as respondWithObjectIfAcceptable, L as createExponentialBackoffPolicy, M as FederationQueueOptions, N as createFederation, O as OutboxListenerSetters, P as CreateExponentialBackoffPolicyOptions, Q as ParallelMessageQueue, R as Message, S as FederationStartQueueOptions, St as WebFingerLinksDispatcher, T as InboxChallengePolicy, Tt as PageItems, U as RouterRouteResult, V as RouterError, W as RespondWithObjectOptions, X as MessageQueueEnqueueOptions, Y as MessageQueue, Z as MessageQueueListenOptions, _ as Federatable, _t as OutboxListenerErrorHandler, a as GetSignedKeyOptions, at as CollectionCursor, b as FederationFetchOptions, bt as UnverifiedActivityHandler, c as ParseUriResult, ct as CustomCollectionCursor, d as SendActivityOptions, dt as InboxListener, et as ActorDispatcher, f as SendActivityOptionsForCollection, ft as NodeInfoDispatcher, g as CustomCollectionCallbackSetters, gt as OutboxListener, h as ConstructorWithTypeId, ht as OutboxErrorHandler, i as GetActorOptions, it as CollectionCounter, j as FederationOrigin, k as Rfc6570Expression, l as RequestContext, lt as CustomCollectionDispatcher, m as CollectionCallbackSetters, mt as ObjectDispatcher, n as Context, nt as ActorKeyPairsDispatcher, o as InboxContext, ot as CollectionDispatcher, p as ActorCallbackSetters, pt as ObjectAuthorizePredicate, q as InProcessMessageQueue, r as ForwardActivityOptions, rt as AuthorizePredicate, s as OutboxContext, st as CustomCollectionCounter, t as ActorKeyPair, tt as ActorHandleMapper, u as RouteActivityOptions, ut as InboxErrorHandler, v as Federation, vt as OutboxPermanentFailureHandler, w as IdempotencyStrategy, wt as SenderKeyPair, x as FederationOptions, xt as UnverifiedActivityReason, y as FederationBuilder, yt as SharedInboxKeyDispatcher, z as createFederationBuilder } from "../context-DdbLVV_k.js";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-CxaI4eGo.js";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-DQGjRJUG.js";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "../mod-BuRRdsfD.js";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetActorOptions, GetSignedKeyOptions, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MemoryKvStore, Message, MessageQueue, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriResult, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, UnverifiedActivityHandler, UnverifiedActivityReason, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-BimXKBcP.js";
+import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, d as Router, f as RouterError, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "../middleware-sjhz30sm.js";
 import { isEqual } from "es-toolkit";
 //#region src/federation/kv.ts
 /**