@fedify/fedify 2.4.0-dev.1599 → 2.4.0-dev.1634

package/dist/{middleware-DLzOFLD5.cjs → middleware-BPHpdYl4.cjs}

@@ -1,11 +1,11 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_chunk = require("./chunk-Czpeue4M.cjs");
 const require_transformers = require("./transformers-DGwl-hD1.cjs");
-const require_http = require("./http-zJsVCnKu.cjs");
+const require_http = require("./http-DiMJDFtd.cjs");
 const require_temporal_polyfill = require("./temporal-polyfill-BCdTHexd.cjs");
-const require_proof = require("./proof-BkQosXrd.cjs");
+const require_proof = require("./proof-BI4Wn6Ur.cjs");
 const require_types = require("./types-CPym83zc.cjs");
-const require_kv_cache = require("./kv-cache-BPu_M3-N.cjs");
+const require_kv_cache = require("./kv-cache-BInLi0Ro.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -103,6 +103,9 @@ var FederationBuilderImpl = class {
 	inboxErrorHandler;
 	outboxListenerErrorHandler;
 	outboxAuthorizePredicate;
+	mediaUploaderPath;
+	mediaUploaderCallback;
+	mediaUploaderAuthorizePredicate;
 	sharedInboxKeyDispatcher;
 	unverifiedActivityHandler;
 	outboxPermanentFailureHandler;
@@ -155,6 +158,9 @@ var FederationBuilderImpl = class {
 		f.inboxErrorHandler = this.inboxErrorHandler;
 		f.outboxListenerErrorHandler = this.outboxListenerErrorHandler;
 		f.outboxAuthorizePredicate = this.outboxAuthorizePredicate;
+		f.mediaUploaderPath = this.mediaUploaderPath;
+		f.mediaUploaderCallback = this.mediaUploaderCallback;
+		f.mediaUploaderAuthorizePredicate = this.mediaUploaderAuthorizePredicate;
 		f.sharedInboxKeyDispatcher = this.sharedInboxKeyDispatcher;
 		f.unverifiedActivityHandler = this.unverifiedActivityHandler;
 		f.outboxPermanentFailureHandler = this.outboxPermanentFailureHandler;
@@ -233,6 +239,10 @@ var FederationBuilderImpl = class {
 				if (actor.publicKeyId == null) logger.warn("You configured a key pairs dispatcher, but the actor does not have a publicKey property.  Set the property with Context.getActorKeyPairs(identifier).");
 				if (actor.assertionMethodId == null) logger.warn("You configured a key pairs dispatcher, but the actor does not have an assertionMethod property.  Set the property with Context.getActorKeyPairs(identifier).");
 			}
+			if (this.mediaUploaderCallback != null) {
+				if (actor.endpoints == null || actor.endpoints.uploadMedia == null) logger.warn("You configured a media uploader, but the actor does not have a endpoints.uploadMedia property.  Set the property with Context.getMediaUploaderUri(identifier).");
+				else if (actor.endpoints.uploadMedia.href != context.getMediaUploaderUri(identifier).href) logger.warn("You configured a media uploader, but the actor's endpoints.uploadMedia property does not match the media upload endpoint URI.  Set the property with Context.getMediaUploaderUri(identifier).");
+			}
 			return actor;
 		} };
 		this.actorCallbacks = callbacks;
@@ -445,6 +455,18 @@ var FederationBuilderImpl = class {
 		};
 		return setters;
 	}
+	setMediaUploader(path, callback) {
+		if (this.mediaUploaderCallback != null) throw new _fedify_uri_template.RouterError("Media uploader already set.");
+		(0, _fedify_uri_template.assertPath)(path);
+		this.router.add(path, "mediaUploader", identifierSingular);
+		this.mediaUploaderPath = path;
+		this.mediaUploaderCallback = callback;
+		const setters = { authorize: (predicate) => {
+			this.mediaUploaderAuthorizePredicate = predicate;
+			return setters;
+		} };
+		return setters;
+	}
 	setFollowingDispatcher(path, dispatcher) {
 		if (this.router.has("following")) throw new _fedify_uri_template.RouterError("Following collection dispatcher already set.");
 		(0, _fedify_uri_template.assertPath)(path);
@@ -2020,6 +2042,193 @@ async function handleOutbox(request, { identifier, context: ctx, outboxContextFa
 		headers: { "Content-Type": "text/plain; charset=utf-8" }
 	});
 }
+const plainTextHeaders = { "Content-Type": "text/plain; charset=utf-8" };
+/**
+* Handles a media upload request (the [ActivityPub Media Upload
+* extension](https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload)).
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the request.
+* @returns A promise that resolves to an HTTP response.
+* @since 2.4.0
+*/
+async function handleMediaUpload(request, { identifier, context: ctx, mediaUploaderCallback, actorDispatcher, authorizePredicate, isRegisteredObjectUri, onUnauthorized, onNotFound }) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"mediaUploader"
+	]);
+	if (request.bodyUsed) {
+		logger.error("Request body has already been read.", { identifier });
+		return new Response("Internal server error.", {
+			status: 500,
+			headers: plainTextHeaders
+		});
+	} else if (request.body?.locked) {
+		logger.error("Request body is locked.", { identifier });
+		return new Response("Internal server error.", {
+			status: 500,
+			headers: plainTextHeaders
+		});
+	}
+	const contentType = request.headers.get("content-type");
+	if (contentType == null || !contentType.toLowerCase().startsWith("multipart/form-data")) {
+		logger.error("The media upload request is not multipart/form-data (got {contentType}).", {
+			identifier,
+			contentType
+		});
+		return new Response("Unsupported media type.", {
+			status: 415,
+			headers: plainTextHeaders
+		});
+	}
+	if (actorDispatcher == null) {
+		logger.error("Actor dispatcher is not set.", { identifier });
+		return await onNotFound(request);
+	}
+	const actor = await actorDispatcher(ctx, identifier);
+	if (actor == null || actor instanceof _fedify_vocab.Tombstone) {
+		logger.error("Actor {identifier} not found.", { identifier });
+		return await onNotFound(request);
+	}
+	if (authorizePredicate != null) {
+		let body;
+		try {
+			body = await request.arrayBuffer();
+		} catch (error) {
+			logger.error("Failed to read the multipart/form-data body:\n{error}", {
+				identifier,
+				error
+			});
+			return new Response("Invalid multipart/form-data body.", {
+				status: 400,
+				headers: plainTextHeaders
+			});
+		}
+		const rebuild = () => new Request(request.url, {
+			method: request.method,
+			headers: request.headers,
+			body: body.byteLength > 0 ? body : void 0
+		});
+		const authorizeContext = ctx.clone(ctx.data);
+		authorizeContext.request = rebuild();
+		if (!await authorizePredicate(authorizeContext, identifier)) return await onUnauthorized(rebuild());
+		request = rebuild();
+	}
+	let form;
+	try {
+		form = await request.formData();
+	} catch (error) {
+		logger.error("Failed to parse the multipart/form-data body:\n{error}", {
+			identifier,
+			error
+		});
+		return new Response("Invalid multipart/form-data body.", {
+			status: 400,
+			headers: plainTextHeaders
+		});
+	}
+	const file = form.get("file");
+	if (!(file instanceof File)) {
+		logger.error("The media upload request has no file field.", { identifier });
+		return new Response("Missing file field.", {
+			status: 400,
+			headers: plainTextHeaders
+		});
+	}
+	const objectField = form.get("object");
+	if (objectField == null) {
+		logger.error("The media upload request has no object field.", { identifier });
+		return new Response("Missing object field.", {
+			status: 400,
+			headers: plainTextHeaders
+		});
+	}
+	let object;
+	try {
+		const objectText = typeof objectField === "string" ? objectField : await objectField.text();
+		object = await _fedify_vocab.Object.fromJsonLd(JSON.parse(objectText), ctx);
+	} catch (error) {
+		logger.error("Failed to parse the object field:\n{error}", {
+			identifier,
+			error
+		});
+		return new Response("Invalid object field.", {
+			status: 400,
+			headers: plainTextHeaders
+		});
+	}
+	let result;
+	try {
+		result = await mediaUploaderCallback(ctx, identifier, file, object);
+	} catch (error) {
+		logger.error("Failed to process the media upload:\n{error}", {
+			identifier,
+			error
+		});
+		return new Response("Internal server error.", {
+			status: 500,
+			headers: plainTextHeaders
+		});
+	}
+	if (result == null) {
+		logger.error("The media uploader callback for {identifier} returned null or undefined; it must return an object (201 Created) or a URL (202 Accepted).", { identifier });
+		return new Response("Internal server error.", {
+			status: 500,
+			headers: plainTextHeaders
+		});
+	}
+	const warnUnlessRegistered = (target) => {
+		if (isRegisteredObjectUri(target)) return;
+		logger.warn("The media uploader callback for {identifier} returned {target}, which does not point at a registered object dispatcher route; derive the returned id/URL from Context.getObjectUri().  The upload still succeeded.", {
+			identifier,
+			target: target.href
+		});
+	};
+	if (result instanceof URL) {
+		warnUnlessRegistered(result);
+		logger.info("The media upload for {identifier} is still being processed; responding 202 Accepted.", {
+			identifier,
+			location: result.href
+		});
+		return new Response(null, {
+			status: 202,
+			headers: { Location: result.href }
+		});
+	}
+	if (result.id == null) {
+		logger.error("The media uploader callback for {identifier} returned an object without an id, so a 201 Created response cannot include the required Location header.  Set the object's id with Context.getObjectUri(), or return the eventual URL to respond 202 Accepted instead.", { identifier });
+		return new Response("Internal server error.", {
+			status: 500,
+			headers: plainTextHeaders
+		});
+	}
+	warnUnlessRegistered(result.id);
+	let jsonLd;
+	try {
+		jsonLd = await result.toJsonLd(ctx);
+	} catch (error) {
+		logger.error("Failed to serialize the uploaded object to JSON-LD:\n{error}", {
+			identifier,
+			error
+		});
+		return new Response("Internal server error.", {
+			status: 500,
+			headers: plainTextHeaders
+		});
+	}
+	logger.info("The media upload for {identifier} is ready; responding 201 Created.", {
+		identifier,
+		location: result.id.href
+	});
+	return new Response(JSON.stringify(jsonLd), {
+		status: 201,
+		headers: {
+			"Content-Type": "application/activity+json",
+			Location: result.id.href
+		}
+	});
+}
 /**
 * Handles an inbox request for ActivityPub activities.
 * @template TContextData The context data to pass to the context.
@@ -4527,6 +4736,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	benchmarkMode;
 	benchmarkMetricReader;
 	benchmarkTriggerOptions;
+	#mediaUploaderNoAuthWarned = false;
 	#queueDepthGaugeSourceId = `fedify-${(++nextQueueDepthGaugeSourceId).toString(36)}`;
 	#queueDepthGaugeEntries = [];
 	#queueDepthGaugeMeterProvider;
@@ -5842,6 +6052,32 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			case "benchmarkStats": return await handleBenchmarkStats(request, this.benchmarkMetricReader);
 			case "benchmarkTrigger": return await handleBenchmarkTrigger(request, context, this.benchmarkTriggerOptions);
+			case "mediaUploader":
+				if (request.method !== "POST" || this.mediaUploaderCallback == null) return new Response("Method not allowed.", {
+					status: 405,
+					headers: {
+						Allow: "POST",
+						"Content-Type": "text/plain; charset=utf-8"
+					}
+				});
+				if (this.mediaUploaderAuthorizePredicate == null && !this.#mediaUploaderNoAuthWarned) {
+					this.#mediaUploaderNoAuthWarned = true;
+					(0, _logtape_logtape.getLogger)([
+						"fedify",
+						"federation",
+						"mediaUploader"
+					]).warn("The media uploader is registered without an authorize() hook, so it accepts uploads from anyone who can reach the endpoint.  Protect it with .authorize() unless a public upload endpoint is intended.");
+				}
+				return await handleMediaUpload(request, {
+					identifier: route.values.identifier,
+					context,
+					mediaUploaderCallback: this.mediaUploaderCallback,
+					actorDispatcher: this.actorCallbacks?.dispatcher,
+					authorizePredicate: this.mediaUploaderAuthorizePredicate,
+					isRegisteredObjectUri: (uri) => context.parseUri(uri)?.type === "object",
+					onUnauthorized,
+					onNotFound
+				});
 		}
 		if (request.method !== "POST" && !acceptsJsonLd(request)) {
 			metricState.endpoint = "not_acceptable";
@@ -6076,6 +6312,7 @@ function getEndpointCategory(routeName) {
 		case "inbox": return "inbox";
 		case "sharedInbox": return "shared_inbox";
 		case "outbox": return "outbox";
+		case "mediaUploader": return "media_upload";
 		case "following": return "following";
 		case "followers": return "followers";
 		case "liked": return "liked";
@@ -6209,6 +6446,11 @@ var ContextImpl = class ContextImpl {
 		if (path == null) throw new _fedify_uri_template.RouterError("No outbox dispatcher registered.");
 		return new URL(path, this.canonicalOrigin);
 	}
+	getMediaUploaderUri(identifier) {
+		const path = this.federation.router.build("mediaUploader", { identifier });
+		if (path == null) throw new _fedify_uri_template.RouterError("No media uploader registered.");
+		return new URL(path, this.canonicalOrigin);
+	}
 	getInboxUri(identifier) {
 		if (identifier == null) {
 			const path = this.federation.router.build("sharedInbox", {});

package/dist/{middleware-DGEQ07xT.mjs → middleware-CPlgpBML.mjs}

@@ -1,26 +1,26 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BCt09TJn.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-C-pKLuAU.mjs";
+import { n as version, t as name } from "./deno-C30u61BX.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-De7b7Hgb.mjs";
 import { t as formatAcceptSignature } from "./accept-8PiolDP7.mjs";
-import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-DcLwG7x4.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-yainOC9t.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-BrRjFwOp.mjs";
-import { n as kvCache } from "./kv-cache-SZL9uu3V.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-B-jskR-q.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CeJuB8wq.mjs";
+import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-C1tsoBAW.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-DJEaNMSB.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-C8JfZ3bD.mjs";
+import { n as kvCache } from "./kv-cache-D9Tia3Td.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-CDBNQmZD.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CB3dPva0.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-URuqsICz.mjs";
-import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-917XYw_e.mjs";
+import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-BqDtIxGz.mjs";
 import { t as getNodeInfo } from "./client-CjF5IYQS.mjs";
 import { t as nodeInfoToJson } from "./types-CrtdVuDP.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-CDi3XQ0V.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-BvCI7Xch.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-ClWims8x.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-DYAAegyy.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-CBGyz5F7.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-BIhlldqK.mjs";
 import { t as KvKeyCache } from "./keycache-_DHqz5z_.mjs";
 import { t as acceptsJsonLd } from "./negotiation-RuwrPFqi.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-jusSJxbN.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-DyITEDcU.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-DgFqeS5k.mjs";
 import { t as TaskCodec } from "./codec-BBga-FWI.mjs";
 import { n as ParallelMessageQueue } from "./mq-llHKivST.mjs";
@@ -1025,6 +1025,193 @@ async function handleOutbox(request, { identifier, context: ctx, outboxContextFa
 		headers: { "Content-Type": "text/plain; charset=utf-8" }
 	});
 }
+const plainTextHeaders = { "Content-Type": "text/plain; charset=utf-8" };
+/**
+* Handles a media upload request (the [ActivityPub Media Upload
+* extension](https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload)).
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the request.
+* @returns A promise that resolves to an HTTP response.
+* @since 2.4.0
+*/
+async function handleMediaUpload(request, { identifier, context: ctx, mediaUploaderCallback, actorDispatcher, authorizePredicate, isRegisteredObjectUri, onUnauthorized, onNotFound }) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"mediaUploader"
+	]);
+	if (request.bodyUsed) {
+		logger.error("Request body has already been read.", { identifier });
+		return new Response("Internal server error.", {
+			status: 500,
+			headers: plainTextHeaders
+		});
+	} else if (request.body?.locked) {
+		logger.error("Request body is locked.", { identifier });
+		return new Response("Internal server error.", {
+			status: 500,
+			headers: plainTextHeaders
+		});
+	}
+	const contentType = request.headers.get("content-type");
+	if (contentType == null || !contentType.toLowerCase().startsWith("multipart/form-data")) {
+		logger.error("The media upload request is not multipart/form-data (got {contentType}).", {
+			identifier,
+			contentType
+		});
+		return new Response("Unsupported media type.", {
+			status: 415,
+			headers: plainTextHeaders
+		});
+	}
+	if (actorDispatcher == null) {
+		logger.error("Actor dispatcher is not set.", { identifier });
+		return await onNotFound(request);
+	}
+	const actor = await actorDispatcher(ctx, identifier);
+	if (actor == null || actor instanceof Tombstone) {
+		logger.error("Actor {identifier} not found.", { identifier });
+		return await onNotFound(request);
+	}
+	if (authorizePredicate != null) {
+		let body;
+		try {
+			body = await request.arrayBuffer();
+		} catch (error) {
+			logger.error("Failed to read the multipart/form-data body:\n{error}", {
+				identifier,
+				error
+			});
+			return new Response("Invalid multipart/form-data body.", {
+				status: 400,
+				headers: plainTextHeaders
+			});
+		}
+		const rebuild = () => new Request(request.url, {
+			method: request.method,
+			headers: request.headers,
+			body: body.byteLength > 0 ? body : void 0
+		});
+		const authorizeContext = ctx.clone(ctx.data);
+		authorizeContext.request = rebuild();
+		if (!await authorizePredicate(authorizeContext, identifier)) return await onUnauthorized(rebuild());
+		request = rebuild();
+	}
+	let form;
+	try {
+		form = await request.formData();
+	} catch (error) {
+		logger.error("Failed to parse the multipart/form-data body:\n{error}", {
+			identifier,
+			error
+		});
+		return new Response("Invalid multipart/form-data body.", {
+			status: 400,
+			headers: plainTextHeaders
+		});
+	}
+	const file = form.get("file");
+	if (!(file instanceof File)) {
+		logger.error("The media upload request has no file field.", { identifier });
+		return new Response("Missing file field.", {
+			status: 400,
+			headers: plainTextHeaders
+		});
+	}
+	const objectField = form.get("object");
+	if (objectField == null) {
+		logger.error("The media upload request has no object field.", { identifier });
+		return new Response("Missing object field.", {
+			status: 400,
+			headers: plainTextHeaders
+		});
+	}
+	let object;
+	try {
+		const objectText = typeof objectField === "string" ? objectField : await objectField.text();
+		object = await Object$1.fromJsonLd(JSON.parse(objectText), ctx);
+	} catch (error) {
+		logger.error("Failed to parse the object field:\n{error}", {
+			identifier,
+			error
+		});
+		return new Response("Invalid object field.", {
+			status: 400,
+			headers: plainTextHeaders
+		});
+	}
+	let result;
+	try {
+		result = await mediaUploaderCallback(ctx, identifier, file, object);
+	} catch (error) {
+		logger.error("Failed to process the media upload:\n{error}", {
+			identifier,
+			error
+		});
+		return new Response("Internal server error.", {
+			status: 500,
+			headers: plainTextHeaders
+		});
+	}
+	if (result == null) {
+		logger.error("The media uploader callback for {identifier} returned null or undefined; it must return an object (201 Created) or a URL (202 Accepted).", { identifier });
+		return new Response("Internal server error.", {
+			status: 500,
+			headers: plainTextHeaders
+		});
+	}
+	const warnUnlessRegistered = (target) => {
+		if (isRegisteredObjectUri(target)) return;
+		logger.warn("The media uploader callback for {identifier} returned {target}, which does not point at a registered object dispatcher route; derive the returned id/URL from Context.getObjectUri().  The upload still succeeded.", {
+			identifier,
+			target: target.href
+		});
+	};
+	if (result instanceof URL) {
+		warnUnlessRegistered(result);
+		logger.info("The media upload for {identifier} is still being processed; responding 202 Accepted.", {
+			identifier,
+			location: result.href
+		});
+		return new Response(null, {
+			status: 202,
+			headers: { Location: result.href }
+		});
+	}
+	if (result.id == null) {
+		logger.error("The media uploader callback for {identifier} returned an object without an id, so a 201 Created response cannot include the required Location header.  Set the object's id with Context.getObjectUri(), or return the eventual URL to respond 202 Accepted instead.", { identifier });
+		return new Response("Internal server error.", {
+			status: 500,
+			headers: plainTextHeaders
+		});
+	}
+	warnUnlessRegistered(result.id);
+	let jsonLd;
+	try {
+		jsonLd = await result.toJsonLd(ctx);
+	} catch (error) {
+		logger.error("Failed to serialize the uploaded object to JSON-LD:\n{error}", {
+			identifier,
+			error
+		});
+		return new Response("Internal server error.", {
+			status: 500,
+			headers: plainTextHeaders
+		});
+	}
+	logger.info("The media upload for {identifier} is ready; responding 201 Created.", {
+		identifier,
+		location: result.id.href
+	});
+	return new Response(JSON.stringify(jsonLd), {
+		status: 201,
+		headers: {
+			"Content-Type": "application/activity+json",
+			Location: result.id.href
+		}
+	});
+}
 /**
 * Handles an inbox request for ActivityPub activities.
 * @template TContextData The context data to pass to the context.
@@ -2641,6 +2828,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	benchmarkMode;
 	benchmarkMetricReader;
 	benchmarkTriggerOptions;
+	#mediaUploaderNoAuthWarned = false;
 	#queueDepthGaugeSourceId = `fedify-${(++nextQueueDepthGaugeSourceId).toString(36)}`;
 	#queueDepthGaugeEntries = [];
 	#queueDepthGaugeMeterProvider;
@@ -3956,6 +4144,32 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			case "benchmarkStats": return await handleBenchmarkStats(request, this.benchmarkMetricReader);
 			case "benchmarkTrigger": return await handleBenchmarkTrigger(request, context, this.benchmarkTriggerOptions);
+			case "mediaUploader":
+				if (request.method !== "POST" || this.mediaUploaderCallback == null) return new Response("Method not allowed.", {
+					status: 405,
+					headers: {
+						Allow: "POST",
+						"Content-Type": "text/plain; charset=utf-8"
+					}
+				});
+				if (this.mediaUploaderAuthorizePredicate == null && !this.#mediaUploaderNoAuthWarned) {
+					this.#mediaUploaderNoAuthWarned = true;
+					getLogger([
+						"fedify",
+						"federation",
+						"mediaUploader"
+					]).warn("The media uploader is registered without an authorize() hook, so it accepts uploads from anyone who can reach the endpoint.  Protect it with .authorize() unless a public upload endpoint is intended.");
+				}
+				return await handleMediaUpload(request, {
+					identifier: route.values.identifier,
+					context,
+					mediaUploaderCallback: this.mediaUploaderCallback,
+					actorDispatcher: this.actorCallbacks?.dispatcher,
+					authorizePredicate: this.mediaUploaderAuthorizePredicate,
+					isRegisteredObjectUri: (uri) => context.parseUri(uri)?.type === "object",
+					onUnauthorized,
+					onNotFound
+				});
 		}
 		if (request.method !== "POST" && !acceptsJsonLd(request)) {
 			metricState.endpoint = "not_acceptable";
@@ -4190,6 +4404,7 @@ function getEndpointCategory(routeName) {
 		case "inbox": return "inbox";
 		case "sharedInbox": return "shared_inbox";
 		case "outbox": return "outbox";
+		case "mediaUploader": return "media_upload";
 		case "following": return "following";
 		case "followers": return "followers";
 		case "liked": return "liked";
@@ -4323,6 +4538,11 @@ var ContextImpl = class ContextImpl {
 		if (path == null) throw new RouterError("No outbox dispatcher registered.");
 		return new URL(path, this.canonicalOrigin);
 	}
+	getMediaUploaderUri(identifier) {
+		const path = this.federation.router.build("mediaUploader", { identifier });
+		if (path == null) throw new RouterError("No media uploader registered.");
+		return new URL(path, this.canonicalOrigin);
+	}
 	getInboxUri(identifier) {
 		if (identifier == null) {
 			const path = this.federation.router.build("sharedInbox", {});

package/dist/{middleware-HFQkD-r8.mjs → middleware-DloBgcWp.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-DGEQ07xT.mjs";
+import { n as FederationImpl } from "./middleware-CPlgpBML.mjs";
 export { FederationImpl };

package/dist/{mod-Cmr39iWq.d.ts → mod-DLc2Ot6f.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { At as WebFingerLinksDispatcher, ct as ActorDispatcher, l as RequestContext, lt as ActorHandleMapper, st as ActorAliasMapper } from "./context-GfQA-CqB.js";
+import { Mt as WebFingerLinksDispatcher, ct as ActorAliasMapper, l as RequestContext, lt as ActorDispatcher, ut as ActorHandleMapper } from "./context-Zii1f5xS.js";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 

package/dist/{mod-B8Efb9qp.d.cts → mod-gOlPDuT8.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { At as WebFingerLinksDispatcher, ct as ActorDispatcher, l as RequestContext, lt as ActorHandleMapper, st as ActorAliasMapper } from "./context-BLe0NPtZ.cjs";
+import { Mt as WebFingerLinksDispatcher, ct as ActorAliasMapper, l as RequestContext, lt as ActorDispatcher, ut as ActorHandleMapper } from "./context-lxX6I7as.cjs";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 

package/dist/mod.cjs

@@ -3,11 +3,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-Czpeue4M.cjs");
 const require_transformers = require("./transformers-DGwl-hD1.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-zJsVCnKu.cjs");
-const require_middleware = require("./middleware-DLzOFLD5.cjs");
-const require_proof = require("./proof-BkQosXrd.cjs");
+const require_http = require("./http-DiMJDFtd.cjs");
+const require_middleware = require("./middleware-BPHpdYl4.cjs");
+const require_proof = require("./proof-BI4Wn6Ur.cjs");
 const require_types = require("./types-CPym83zc.cjs");
-const require_kv_cache = require("./kv-cache-BPu_M3-N.cjs");
+const require_kv_cache = require("./kv-cache-BInLi0Ro.cjs");
 const require_federation_mod = require("./federation/mod.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");