@fedify/fedify 2.4.0-dev.1964 → 2.4.0-dev.1995

package/dist/{federation-Drjlrrax.cjs → federation-DCEHQk4G.cjs}

@@ -1,20 +1,20 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-B3skRvGo.cjs");
-const require_proof = require("./proof-Dua0d906.cjs");
-const require_types = require("./types-RXm5YxpC.cjs");
-const require_kv_cache = require("./kv-cache-DtsjH_bY.cjs");
+const require_http = require("./http-CRFns-UE.cjs");
+const require_types = require("./types-Be2zbyeG.cjs");
+const require_owner = require("./owner-CVA7L9MA.cjs");
+const require_kv_cache = require("./kv-cache-DXT9vmIg.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
 let byte_encodings_hex = require("byte-encodings/hex");
-let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
-let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
+let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime_jsonld = require("@fedify/vocab-runtime/jsonld");
 _fedify_vocab_runtime_jsonld = require_rolldown_runtime.__toESM(_fedify_vocab_runtime_jsonld, 1);
+let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 let _fedify_webfinger = require("@fedify/webfinger");
 let _opentelemetry_sdk_metrics = require("@opentelemetry/sdk-metrics");
 let devalue = require("devalue");
@@ -1297,6 +1297,474 @@ async function buildCollectionSynchronizationHeader(collectionId, actorIds) {
 	return `collectionId="${collectionId}", url="${url}", digest="${(0, byte_encodings_hex.encodeHex)(await digest(actorIds))}"`;
 }
 //#endregion
+//#region src/sig/compound-proof.ts
+const textEncoder = new TextEncoder();
+const PORTABLE_OBJECT_ID_PATTERN = /^ap(?:\+ef61)?:\/\//i;
+function isJsonMap(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
+function isCompoundProofJsonObject(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
+function hasOnlyDataProperties(value) {
+	try {
+		return Reflect.ownKeys(value).every((key) => {
+			if (typeof key !== "string") return false;
+			const descriptor = Object.getOwnPropertyDescriptor(value, key);
+			return descriptor != null && "value" in descriptor && descriptor.enumerable;
+		});
+	} catch {
+		return false;
+	}
+}
+function hasOnlyJsonArrayProperties(value) {
+	try {
+		const keys = Reflect.ownKeys(value);
+		if (keys.length !== value.length + 1) return false;
+		for (const key of keys) {
+			if (key === "length") continue;
+			if (typeof key !== "string") return false;
+			const index = Number(key);
+			if (!Number.isInteger(index) || index < 0 || index >= value.length || String(index) !== key) return false;
+			const descriptor = Object.getOwnPropertyDescriptor(value, key);
+			if (descriptor == null || !descriptor.enumerable || !("value" in descriptor)) return false;
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}
+function escapeJsonPointerSegment(segment) {
+	return segment.replaceAll("~", "~0").replaceAll("/", "~1");
+}
+function childPath(path, segment) {
+	return `${path}/${escapeJsonPointerSegment(segment)}`;
+}
+function comparePaths(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+function encodedLength(value) {
+	return textEncoder.encode(value).byteLength;
+}
+function validateLimits(limits) {
+	for (const [name, value] of Object.entries(limits)) if (!Number.isSafeInteger(value) || value < 0) throw new RangeError(`${name} must be a non-negative safe integer.`);
+}
+function limitExceeded(limit, maximum, actual, path) {
+	return {
+		status: "unsupported",
+		reason: {
+			type: "limitExceeded",
+			limit,
+			maximum,
+			actual,
+			path
+		}
+	};
+}
+function addBytes(statistics, bytes, limits, path) {
+	statistics.byteLength += bytes;
+	if (statistics.byteLength > limits.maxBytes) return limitExceeded("bytes", limits.maxBytes, statistics.byteLength, path);
+}
+function inspectJsonTree(root, limits) {
+	if (!isJsonMap(root)) return {
+		status: "unsupported",
+		reason: {
+			type: "invalidJsonTree",
+			path: ""
+		}
+	};
+	const statistics = {
+		byteLength: 0,
+		mapCount: 0,
+		proofCount: 0,
+		maxDepth: 0
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const pending = [{
+		value: root,
+		path: "",
+		depth: 0,
+		insideProof: false,
+		insideContext: false
+	}];
+	while (pending.length > 0) {
+		const current = pending.pop();
+		statistics.maxDepth = Math.max(statistics.maxDepth, current.depth);
+		if (current.depth > limits.maxDepth) return limitExceeded("depth", limits.maxDepth, current.depth, current.path);
+		const value = current.value;
+		if (value === null) {
+			const failure = addBytes(statistics, 4, limits, current.path);
+			if (failure != null) return failure;
+		} else if (typeof value === "boolean") {
+			const failure = addBytes(statistics, value ? 4 : 5, limits, current.path);
+			if (failure != null) return failure;
+		} else if (typeof value === "string") {
+			const failure = addBytes(statistics, encodedLength(JSON.stringify(value)), limits, current.path);
+			if (failure != null) return failure;
+		} else if (typeof value === "number") {
+			if (!Number.isFinite(value)) return {
+				status: "unsupported",
+				reason: {
+					type: "invalidJsonTree",
+					path: current.path
+				}
+			};
+			const failure = addBytes(statistics, encodedLength(JSON.stringify(value)), limits, current.path);
+			if (failure != null) return failure;
+		} else if (Array.isArray(value)) {
+			if (seen.has(value) || !hasOnlyJsonArrayProperties(value)) return {
+				status: "unsupported",
+				reason: {
+					type: "invalidJsonTree",
+					path: current.path
+				}
+			};
+			seen.add(value);
+			const failure = addBytes(statistics, 2 + Math.max(0, value.length - 1), limits, current.path);
+			if (failure != null) return failure;
+			for (let index = value.length - 1; index >= 0; index--) pending.push({
+				value: value[index],
+				path: childPath(current.path, String(index)),
+				depth: current.depth + 1,
+				insideProof: current.insideProof,
+				insideContext: current.insideContext
+			});
+		} else if (isJsonMap(value)) {
+			const prototype = Object.getPrototypeOf(value);
+			if (seen.has(value) || !hasOnlyDataProperties(value) || prototype !== Object.prototype && prototype !== null) return {
+				status: "unsupported",
+				reason: {
+					type: "invalidJsonTree",
+					path: current.path
+				}
+			};
+			seen.add(value);
+			statistics.mapCount++;
+			if (statistics.mapCount > limits.maxMaps) return limitExceeded("maps", limits.maxMaps, statistics.mapCount, current.path);
+			const entries = Object.entries(value).sort(([left], [right]) => comparePaths(left, right));
+			let objectBytes = 2 + Math.max(0, entries.length - 1);
+			for (const [key] of entries) objectBytes += encodedLength(JSON.stringify(key)) + 1;
+			const failure = addBytes(statistics, objectBytes, limits, current.path);
+			if (failure != null) return failure;
+			const hasDirectProof = !current.insideProof && !current.insideContext && Object.hasOwn(value, "proof");
+			if (hasDirectProof) {
+				statistics.proofCount++;
+				if (statistics.proofCount > limits.maxProofs) return limitExceeded("proofs", limits.maxProofs, statistics.proofCount, childPath(current.path, "proof"));
+				if (!isJsonMap(value.proof)) return {
+					status: "unsupported",
+					reason: {
+						type: "unsupportedProofShape",
+						path: childPath(current.path, "proof")
+					}
+				};
+			}
+			for (let index = entries.length - 1; index >= 0; index--) {
+				const [key, child] = entries[index];
+				pending.push({
+					value: child,
+					path: childPath(current.path, key),
+					depth: current.depth + 1,
+					insideProof: current.insideProof || hasDirectProof && key === "proof",
+					insideContext: current.insideContext || key === "@context"
+				});
+			}
+		} else return {
+			status: "unsupported",
+			reason: {
+				type: "invalidJsonTree",
+				path: current.path
+			}
+		};
+	}
+	return statistics;
+}
+function freezeJsonTree(root) {
+	const pending = [root];
+	while (pending.length > 0) {
+		const value = pending.pop();
+		if (typeof value !== "object" || value == null) continue;
+		if (Array.isArray(value)) for (const child of value) pending.push(child);
+		else for (const child of Object.values(value)) pending.push(child);
+		Object.freeze(value);
+	}
+}
+function collectDocuments(snapshot) {
+	const documents = [];
+	const pending = [{
+		value: snapshot,
+		path: "",
+		depth: 0
+	}];
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (Array.isArray(current.value)) {
+			for (let index = current.value.length - 1; index >= 0; index--) pending.push({
+				value: current.value[index],
+				path: childPath(current.path, String(index)),
+				depth: current.depth + 1
+			});
+			continue;
+		}
+		if (!isCompoundProofJsonObject(current.value)) continue;
+		const document = current.value;
+		if (Object.hasOwn(document, "proof")) {
+			const proof = document.proof;
+			const id = typeof document.id === "string" ? document.id : typeof document["@id"] === "string" ? document["@id"] : void 0;
+			documents.push(Object.freeze({
+				path: current.path,
+				id,
+				depth: current.depth,
+				securedDocument: document,
+				proof
+			}));
+		}
+		const entries = Object.entries(document).sort(([left], [right]) => comparePaths(left, right));
+		for (let index = entries.length - 1; index >= 0; index--) {
+			const [key, value] = entries[index];
+			if (key === "proof" || key === "@context") continue;
+			pending.push({
+				value,
+				path: childPath(current.path, key),
+				depth: current.depth + 1
+			});
+		}
+	}
+	documents.sort((left, right) => right.depth - left.depth || comparePaths(left.path, right.path));
+	return documents;
+}
+function collectPortableObjects(snapshot) {
+	const objects = [];
+	const pending = [{
+		value: snapshot,
+		path: "",
+		depth: 0
+	}];
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (Array.isArray(current.value)) {
+			for (let index = current.value.length - 1; index >= 0; index--) pending.push({
+				value: current.value[index],
+				path: childPath(current.path, String(index)),
+				depth: current.depth + 1
+			});
+			continue;
+		}
+		if (!isCompoundProofJsonObject(current.value)) continue;
+		const document = current.value;
+		const id = [document.id, document["@id"]].find((value) => typeof value === "string" && PORTABLE_OBJECT_ID_PATTERN.test(value));
+		if (typeof id === "string") objects.push(Object.freeze({
+			path: current.path,
+			id,
+			depth: current.depth,
+			document
+		}));
+		const entries = Object.entries(document).sort(([left], [right]) => comparePaths(left, right));
+		for (let index = entries.length - 1; index >= 0; index--) {
+			const [key, value] = entries[index];
+			if (key === "proof" || key === "@context") continue;
+			pending.push({
+				value,
+				path: childPath(current.path, key),
+				depth: current.depth + 1
+			});
+		}
+	}
+	objects.sort((left, right) => right.depth - left.depth || comparePaths(left.path, right.path));
+	return objects;
+}
+/**
+* Determines whether a received JSON tree contains a portable object ID
+* outside a proof or context definition, without exceeding discovery limits.
+*
+* This is only an applicability check.  It does not authenticate the input;
+* callers must still use {@link verifyCompoundPortableObjectProofs} to obtain
+* an atomic result from an immutable snapshot.  `indeterminate` means the
+* applicability scan itself reached a limit, so a caller must not treat the
+* document as outside the compound profile.
+*
+* @internal
+*/
+function inspectCompoundPortableObjectApplicability(json, limits) {
+	validateLimits(limits);
+	let byteLength = 0;
+	let mapCount = 0;
+	const pending = [{
+		iterator: [json].values(),
+		depth: 0
+	}];
+	const addByteLength = (length) => {
+		byteLength += length;
+		return byteLength <= limits.maxBytes;
+	};
+	while (pending.length > 0) {
+		const frame = pending[pending.length - 1];
+		const next = frame.iterator.next();
+		if (next.done) {
+			pending.pop();
+			if (byteLength > limits.maxBytes) return "indeterminate";
+			continue;
+		}
+		const value = next.value;
+		if (frame.depth > limits.maxDepth) return "indeterminate";
+		if (value === null) {
+			if (!addByteLength(4)) return "indeterminate";
+		} else if (typeof value === "boolean") {
+			if (!addByteLength(value ? 4 : 5)) return "indeterminate";
+		} else if (typeof value === "string" || typeof value === "number") {
+			if (!addByteLength(encodedLength(JSON.stringify(value)))) return "indeterminate";
+		} else if (Array.isArray(value)) {
+			if (!addByteLength(2 + Math.max(0, value.length - 1))) return "indeterminate";
+			pending.push({
+				iterator: value.values(),
+				depth: frame.depth + 1
+			});
+		} else if (isJsonMap(value)) {
+			mapCount++;
+			if (mapCount > limits.maxMaps) return "indeterminate";
+			if ([value.id, value["@id"]].some((id) => typeof id === "string" && PORTABLE_OBJECT_ID_PATTERN.test(id))) return "present";
+			if (!addByteLength(2)) return "indeterminate";
+			const children = function* () {
+				let first = true;
+				for (const key in value) {
+					if (!Object.hasOwn(value, key)) continue;
+					if (key === "proof" || key === "@context") continue;
+					if (!first && !addByteLength(1)) return;
+					first = false;
+					if (!addByteLength(encodedLength(JSON.stringify(key)) + 1)) return;
+					yield value[key];
+				}
+			}();
+			pending.push({
+				iterator: children,
+				depth: frame.depth + 1
+			});
+		}
+		if (byteLength > limits.maxBytes) return "indeterminate";
+	}
+	return "absent";
+}
+/**
+* Discovers direct literal proof-bearing maps in an immutable JSON snapshot.
+*
+* Discovery is bounded and atomic.  Unsupported proof shapes, non-JSON input,
+* or a resource-limit failure return no partial candidate list.  Proof
+* configuration subtrees are validated and counted as JSON, but are not
+* themselves searched for secured documents.
+*/
+function discoverCompoundProofDocuments(json, limits) {
+	validateLimits(limits);
+	let inspected;
+	try {
+		inspected = inspectJsonTree(json, limits);
+	} catch {
+		return {
+			status: "unsupported",
+			reason: {
+				type: "invalidJsonTree",
+				path: ""
+			}
+		};
+	}
+	if ("status" in inspected) return inspected;
+	let snapshot;
+	try {
+		snapshot = structuredClone(json);
+	} catch {
+		return {
+			status: "unsupported",
+			reason: {
+				type: "invalidJsonTree",
+				path: ""
+			}
+		};
+	}
+	freezeJsonTree(snapshot);
+	return {
+		status: "ok",
+		snapshot,
+		documents: Object.freeze(collectDocuments(snapshot)),
+		statistics: Object.freeze({ ...inspected })
+	};
+}
+async function verifyDiscoveredProofDocuments(discovered, options) {
+	const documents = await Promise.all(discovered.documents.map(async (document) => {
+		const metadata = {
+			path: document.path,
+			...document.id == null ? {} : { id: document.id },
+			depth: document.depth
+		};
+		if (document.depth > 0 && !Object.hasOwn(document.securedDocument, "@context")) return Object.freeze({
+			...metadata,
+			verified: false,
+			reason: { type: "missingContext" }
+		});
+		const key = await require_owner.verifyMapLocalProof(document.securedDocument, options);
+		return key == null ? Object.freeze({
+			...metadata,
+			verified: false,
+			reason: { type: "invalidProof" }
+		}) : Object.freeze({
+			...metadata,
+			verified: true,
+			key
+		});
+	}));
+	return Object.freeze(documents);
+}
+/**
+* Applies FEP-ef61 portable-object policy to every portable map in a compound
+* snapshot without changing the map-local cryptographic inputs.
+*
+* @internal
+*/
+async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
+	const discovered = discoverCompoundProofDocuments(json, limits);
+	if (discovered.status !== "ok") return discovered;
+	const proofs = await verifyDiscoveredProofDocuments(discovered, options);
+	const proofByPath = new Map(proofs.map((proof) => [proof.path, proof]));
+	const portableObjects = await Promise.all(collectPortableObjects(discovered.snapshot).map(async (object) => {
+		const metadata = {
+			path: object.path,
+			id: object.id,
+			depth: object.depth
+		};
+		if (object.depth > 0 && !Object.hasOwn(object.document, "@context")) return Object.freeze({
+			...metadata,
+			verified: false,
+			reason: { type: "missingContext" }
+		});
+		const proof = proofByPath.get(object.path);
+		const key = proof?.verified === true ? proof.key : null;
+		try {
+			const policy = await require_owner.verifyPortableObjectProofPolicy(object.document, key, options);
+			return policy.verified ? Object.freeze({
+				...metadata,
+				id: policy.objectId,
+				verified: true,
+				keys: policy.keys
+			}) : Object.freeze({
+				...metadata,
+				verified: false,
+				reason: policy.reason
+			});
+		} catch {
+			return Object.freeze({
+				...metadata,
+				verified: false,
+				reason: { type: "invalidPortableObject" }
+			});
+		}
+	}));
+	return {
+		status: "ok",
+		verified: portableObjects.length > 0 && proofs.every((proof) => proof.verified) && portableObjects.every((object) => object.verified),
+		snapshot: discovered.snapshot,
+		proofs,
+		portableObjects: Object.freeze(portableObjects),
+		statistics: discovered.statistics
+	};
+}
+//#endregion
 //#region src/federation/inbox.ts
 const Temporal$9 = require_http.Temporal;
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
@@ -1458,6 +1926,7 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 //#endregion
 //#region src/federation/keycache.ts
 const Temporal$8 = require_http.Temporal;
+const KEY_CACHE_GENERATION = "2";
 var KvKeyCache = class {
 	kv;
 	prefix;
@@ -1480,13 +1949,20 @@ var KvKeyCache = class {
 			keyId.href
 		];
 	}
+	#entryKey(keyId) {
+		return [
+			...this.prefix,
+			KEY_CACHE_GENERATION,
+			keyId.href
+		];
+	}
 	async get(keyId) {
 		const negativeExpiration = this.nullKeys.get(keyId.href);
 		if (negativeExpiration != null) {
 			if (Temporal$8.Now.instant().until(negativeExpiration).sign >= 0) return null;
 			this.nullKeys.delete(keyId.href);
 		}
-		const serialized = await this.kv.get([...this.prefix, keyId.href]);
+		const serialized = await this.kv.get(this.#entryKey(keyId));
 		if (serialized === void 0) return void 0;
 		if (serialized === null) {
 			this.nullKeys.set(keyId.href, Temporal$8.Now.instant().add(this.unavailableKeyTtl));
@@ -1498,7 +1974,7 @@ var KvKeyCache = class {
 			try {
 				return await _fedify_vocab.Multikey.fromJsonLd(serialized, this.options);
 			} catch {
-				await this.kv.delete([...this.prefix, keyId.href]);
+				await this.kv.delete(this.#entryKey(keyId));
 				return;
 			}
 		}
@@ -1506,12 +1982,12 @@ var KvKeyCache = class {
 	async set(keyId, key) {
 		if (key == null) {
 			this.nullKeys.set(keyId.href, Temporal$8.Now.instant().add(this.unavailableKeyTtl));
-			await this.kv.set([...this.prefix, keyId.href], null, { ttl: this.unavailableKeyTtl });
+			await this.kv.set(this.#entryKey(keyId), null, { ttl: this.unavailableKeyTtl });
 			return;
 		}
 		this.nullKeys.delete(keyId.href);
 		const serialized = await key.toJsonLd(this.options);
-		await this.kv.set([...this.prefix, keyId.href], serialized, { ttl: this.keyTtl });
+		await this.kv.set(this.#entryKey(keyId), serialized, { ttl: this.keyTtl });
 	}
 	async getFetchError(keyId) {
 		const cached = await this.kv.get(this.#getFetchErrorKey(keyId));
@@ -1725,7 +2201,7 @@ function hasMalformedKnownTemporalLiteralInternal(value, visited) {
 async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
 	try {
 		return hasMalformedKnownTemporalLiteralInternal(await _fedify_vocab_runtime_jsonld.default.expand(value, {
-			documentLoader: require_proof.getNormalizationContextLoader(contextLoader),
+			documentLoader: require_owner.getNormalizationContextLoader(contextLoader),
 			keepFreeFloatingNodes: true
 		}), /* @__PURE__ */ new Set());
 	} catch {
@@ -1736,6 +2212,12 @@ async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
 //#region src/federation/handler.ts
 const Temporal$6 = require_http.Temporal;
 const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
+const INBOX_COMPOUND_PROOF_LIMITS = {
+	maxDepth: 64,
+	maxMaps: 1e4,
+	maxProofs: 32,
+	maxBytes: 10 * 1024 * 1024
+};
 function isRemoteContextLoadingFailure$1(error) {
 	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
 }
@@ -1743,15 +2225,15 @@ function isPermanentRemoteContextError$1(error) {
 	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
 	const details = error.details;
 	if (details?.code === "invalid remote context") return true;
-	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_proof.isClearlyMalformedContextReference(details.url);
+	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_owner.isClearlyMalformedContextReference(details.url);
 }
 function isInvalidJsonLdError(error) {
 	if (!(error instanceof Error)) return false;
 	const name = error.name;
-	return name === "UnsafeJsonLdError" || error instanceof require_proof.InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
+	return name === "UnsafeJsonLdError" || error instanceof require_owner.InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
 }
 function isValidationTypeError(error) {
-	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || require_proof.isInvalidUrlTypeError(error));
+	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || require_owner.isInvalidUrlTypeError(error));
 }
 function isPermanentActivityParseError(error) {
 	return isInvalidJsonLdError(error) || isValidationTypeError(error);
@@ -1860,13 +2342,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(require_http.name, require_http.version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -1907,7 +2389,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -1947,7 +2429,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: _opentelemetry_api.SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -1963,7 +2445,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -2516,8 +2998,16 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	let json;
 	try {
-		json = await request.clone().json();
+		json = JSON.parse(await require_types.readBoundedText(request.clone(), require_types.MAX_BODY_SIZE, request.url));
 	} catch (error) {
+		if (error instanceof require_types.BodyTooLargeError) {
+			request.body?.cancel(error).catch(() => {});
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			return new Response("Inbox body too large.", { status: 413 });
+		}
 		logger.error("Failed to parse JSON:\n{error}", {
 			recipient,
 			error
@@ -2546,8 +3036,8 @@ async function handleInboxInternal(request, parameters, span) {
 		tracerProvider,
 		keyTtl: publicKeyTtl
 	});
-	const jsonWithoutSig = require_proof.detachSignature(json);
-	const hasLdSignature = require_proof.hasSignature(json);
+	const jsonWithoutSig = require_owner.detachSignature(json);
+	const hasLdSignature = require_owner.hasSignature(json);
 	const canAttemptAlternateAuthAfterLdSignatureFailure = skipSignatureVerification || hasHttpSignatureHeaders(request) || hasObjectIntegrityProof(jsonWithoutSig);
 	let deferredLdSignatureError = void 0;
 	const respondInvalidActivity = async (error) => {
@@ -2579,7 +3069,7 @@ async function handleInboxInternal(request, parameters, span) {
 	let ldSigVerified = false;
 	if (hasLdSignature) {
 		try {
-			compactedJson = await require_proof.compactJsonLd(json, ctx.contextLoader);
+			compactedJson = await require_owner.compactJsonLd(json, ctx.contextLoader);
 		} catch (error) {
 			if (isInvalidJsonLdError(error)) {
 				logger.error("Failed to parse JSON-LD:\n{error}", {
@@ -2599,9 +3089,9 @@ async function handleInboxInternal(request, parameters, span) {
 			});
 		}
 		if (compactedJson !== json) {
-			compactedJsonWithoutSig = require_proof.detachSignature(compactedJson);
+			compactedJsonWithoutSig = require_owner.detachSignature(compactedJson);
 			try {
-				ldSigVerified = await require_proof.verifyCompactJsonLd(compactedJson, {
+				ldSigVerified = await require_owner.verifyCompactJsonLd(compactedJson, {
 					contextLoader: ctx.contextLoader,
 					documentLoader: ctx.documentLoader,
 					keyCache,
@@ -2623,7 +3113,7 @@ async function handleInboxInternal(request, parameters, span) {
 				if (!canAttemptAlternateAuthAfterLdSignatureFailure) throw error;
 				if (!skipSignatureVerification) try {
 					await _fedify_vocab.Object.fromJsonLd(compactedJson, {
-						contextLoader: require_proof.getNormalizationContextLoader(ctx.contextLoader),
+						contextLoader: require_owner.getNormalizationContextLoader(ctx.contextLoader),
 						documentLoader: ctx.documentLoader,
 						tracerProvider
 					});
@@ -2655,7 +3145,7 @@ async function handleInboxInternal(request, parameters, span) {
 		try {
 			activity = await _fedify_vocab.Activity.fromJsonLd(compactedJsonWithoutSig, {
 				...ctx,
-				contextLoader: require_proof.getNormalizationContextLoader(ctx.contextLoader)
+				contextLoader: require_owner.getNormalizationContextLoader(ctx.contextLoader)
 			});
 		} catch (error) {
 			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
@@ -2669,8 +3159,8 @@ async function handleInboxInternal(request, parameters, span) {
 			json
 		});
 		try {
-			activity = await require_proof.verifyObject(_fedify_vocab.Activity, jsonWithoutSig, {
-				contextLoader: require_proof.wrapContextLoaderForJsonLd(ctx.contextLoader),
+			activity = await require_owner.verifyObject(_fedify_vocab.Activity, jsonWithoutSig, {
+				contextLoader: require_owner.wrapContextLoaderForJsonLd(ctx.contextLoader),
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -2815,7 +3305,7 @@ async function handleInboxInternal(request, parameters, span) {
 		try {
 			activity = await _fedify_vocab.Activity.fromJsonLd(jsonWithoutSig, {
 				...ctx,
-				contextLoader: require_proof.wrapContextLoaderForJsonLd(ctx.contextLoader)
+				contextLoader: require_owner.wrapContextLoaderForJsonLd(ctx.contextLoader)
 			});
 		} catch (error) {
 			if (!isPermanentActivityParseError(error)) throw error;
@@ -2831,7 +3321,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (httpSigKey != null && !await require_proof.doesActorOwnKey(activity, httpSigKey, ctx)) {
+	if (httpSigKey != null && !await require_owner.doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		require_http.getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : require_http.getRemoteHost(httpSigKey.id));
 		logger.error("The signer ({keyId}) and the actor ({actorId}) do not match.", {
@@ -2849,6 +3339,31 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (!skipSignatureVerification) {
+		if (inspectCompoundPortableObjectApplicability(json, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
+			const compoundProof = await verifyCompoundPortableObjectProofs(json, INBOX_COMPOUND_PROOF_LIMITS, {
+				documentLoader: ctx.documentLoader,
+				keyCache,
+				meterProvider,
+				tracerProvider
+			});
+			if (compoundProof.status !== "ok" || !compoundProof.verified) {
+				logger.error("Failed to verify compound portable Object Integrity Proofs.", {
+					recipient,
+					activity: json,
+					reason: compoundProof.status === "unsupported" ? compoundProof.reason.type : "invalidProof"
+				});
+				span.setStatus({
+					code: _opentelemetry_api.SpanStatusCode.ERROR,
+					message: "Failed to verify compound portable Object Integrity Proofs."
+				});
+				return new Response("Failed to verify compound portable Object Integrity Proofs.", {
+					status: 401,
+					headers: { "Content-Type": "text/plain; charset=utf-8" }
+				});
+			}
+		}
+	}
 	if (pendingNonceLabel != null) {
 		if (!await verifySignatureNonce(request, kv, kvPrefixes.acceptSignatureNonce, pendingNonceLabel)) {
 			require_http.getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("invalidNonce", httpSigKey?.id == null ? void 0 : require_http.getRemoteHost(httpSigKey.id));
@@ -3023,8 +3538,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = _opentelemetry_api.trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = _opentelemetry_api.trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -3737,7 +4252,7 @@ async function readLimitedResponseBody(response, maxBytes) {
 	if (truncated) result += "… (truncated)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, headers, specDeterminer, meterProvider, tracerProvider }, span) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
@@ -3746,12 +4261,25 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 	const federationMetrics = require_http.getFederationMetrics(meterProvider);
 	const started = performance.now();
 	let deliverySuccess = false;
+	async function validateUrl(url) {
+		if (!allowPrivateAddress) try {
+			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
+		} catch (error) {
+			if (error instanceof _fedify_vocab_runtime.UrlError) logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	await validateUrl(inbox.href);
 	headers = new Headers(headers);
 	headers.set("Content-Type", "application/activity+json");
 	const request = new Request(inbox, {
 		method: "POST",
 		headers,
-		body: JSON.stringify(activity)
+		body: JSON.stringify(activity),
+		redirect: "manual"
 	});
 	let rsaKey = null;
 	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
@@ -3767,19 +4295,20 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 	});
 	let response;
 	try {
-		response = rsaKey == null ? await fetch(request) : await require_http.doubleKnock(request, rsaKey, {
+		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await require_http.doubleKnock(request, rsaKey, {
 			tracerProvider,
-			specDeterminer
+			specDeterminer,
+			validateRedirect: validateUrl
 		});
 	} catch (error) {
-		const transportError = error instanceof _fedify_vocab_runtime.FetchError ? error : createFetchError(inbox.href, error);
+		const failure = error instanceof _fedify_vocab_runtime.FetchError || error instanceof _fedify_vocab_runtime.UrlError ? error : createFetchError(inbox.href, error);
 		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
 			activityId,
 			inbox: inbox.href,
-			error: transportError
+			error: failure
 		});
 		federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), false, activityType);
-		throw transportError;
+		throw failure;
 	}
 	try {
 		if (!response.ok) {
@@ -3816,6 +4345,49 @@ function createFetchError(url, cause) {
 	error.cause = cause;
 	return error;
 }
+async function fetchWithValidatedRedirects(request, validateUrl) {
+	let body = await request.clone().text();
+	for (let redirects = 0;; redirects++) {
+		const response = await fetch(request, { redirect: "manual" });
+		const location = response.headers.get("Location");
+		if (![
+			301,
+			302,
+			303,
+			307,
+			308
+		].includes(response.status) || location == null) return response;
+		await response.body?.cancel();
+		if (redirects >= 20) throw new TypeError("Too many redirects");
+		const url = new URL(location, request.url);
+		await validateUrl(url.href);
+		const headers = new Headers(request.headers);
+		if (url.origin !== new URL(request.url).origin) {
+			headers.delete("Authorization");
+			headers.delete("Proxy-Authorization");
+			headers.delete("Cookie");
+			headers.delete("Host");
+		}
+		let method = request.method;
+		if ((response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD") {
+			method = "GET";
+			body = void 0;
+			for (const name of [
+				"Content-Encoding",
+				"Content-Language",
+				"Content-Length",
+				"Content-Location",
+				"Content-Type"
+			]) headers.delete(name);
+		}
+		request = new Request(url, {
+			method,
+			headers,
+			body,
+			redirect: "manual"
+		});
+	}
+}
 /**
 * An error that is thrown when an activity fails to send to a remote inbox.
 * It contains structured information about the failure, including the HTTP
@@ -4742,10 +5314,10 @@ function isPermanentRemoteContextError(error) {
 	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
 	const details = error.details;
 	if (details?.code === "invalid remote context") return true;
-	return isRemoteContextLoadingFailure(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_proof.isClearlyMalformedContextReference(details.url);
+	return isRemoteContextLoadingFailure(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_owner.isClearlyMalformedContextReference(details.url);
 }
 function isPermanentInboxParseError(error) {
-	return error instanceof Error && (error.name === "UnsafeJsonLdError" || error instanceof require_proof.InvalidContextReferenceError || isPermanentRemoteContextError(error) || error.name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure(error)) || error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || require_proof.isInvalidUrlTypeError(error));
+	return error instanceof Error && (error.name === "UnsafeJsonLdError" || error instanceof require_owner.InvalidContextReferenceError || isPermanentRemoteContextError(error) || error.name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure(error)) || error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || require_owner.isInvalidUrlTypeError(error));
 }
 function hasLinkedDataSignatureJsonLdProcessingError(error) {
 	if (error.message.startsWith("Maximum deep iterations exceeded")) return true;
@@ -5309,6 +5881,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				if (decision.stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, decision.stateChange);
 			}
 			await sendActivity({
+				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: message.activity,
 				activityId: message.activityId,
@@ -5596,22 +6169,22 @@ var FederationImpl = class extends FederationBuilderImpl {
 			let parseInput = void 0;
 			let parseContextLoader = context.contextLoader;
 			try {
-				const hasSignatureField = require_proof.hasSignature(message.activity);
+				const hasSignatureField = require_owner.hasSignature(message.activity);
 				const shouldParseFromNormalizedSignedPayload = message.ldSignatureVerified === true || message.normalizedActivity != null || message.ldSignatureVerified == null && hasSignatureField;
 				const parseContext = hasSignatureField ? {
 					...context,
-					contextLoader: require_proof.getNormalizationContextLoader(context.contextLoader)
+					contextLoader: require_owner.getNormalizationContextLoader(context.contextLoader)
 				} : {
 					...context,
-					contextLoader: require_proof.wrapContextLoaderForJsonLd(context.contextLoader)
+					contextLoader: require_owner.wrapContextLoaderForJsonLd(context.contextLoader)
 				};
 				parseContextLoader = parseContext.contextLoader;
 				let normalizedActivity;
 				if (shouldParseFromNormalizedSignedPayload) {
-					normalizedActivity = message.normalizedActivity ?? await require_proof.compactJsonLd(message.activity, context.contextLoader);
-					require_proof.assertSafeJsonLd(normalizedActivity);
+					normalizedActivity = message.normalizedActivity ?? await require_owner.compactJsonLd(message.activity, context.contextLoader);
+					require_owner.assertSafeJsonLd(normalizedActivity);
 				}
-				parseInput = shouldParseFromNormalizedSignedPayload ? require_proof.detachSignature(normalizedActivity) : hasSignatureField ? require_proof.detachSignature(message.activity) : message.activity;
+				parseInput = shouldParseFromNormalizedSignedPayload ? require_owner.detachSignature(normalizedActivity) : hasSignatureField ? require_owner.detachSignature(message.activity) : message.activity;
 				activity = await _fedify_vocab.Activity.fromJsonLd(parseInput, parseContext);
 				activityType = (0, _fedify_vocab.getTypeId)(activity).href;
 				span.setAttribute("activitypub.activity.type", activityType);
@@ -5880,7 +6453,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		if (!hasProof) {
 			for (const { keyId, privateKey } of keys) if (privateKey.algorithm.name === "Ed25519") {
-				activity = await require_proof.signObject(activity, privateKey, keyId, {
+				activity = await require_owner.signObject(activity, privateKey, keyId, {
 					contextLoader,
 					tracerProvider: this.tracerProvider
 				});
@@ -5892,7 +6465,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			format: "compact",
 			contextLoader
 		});
-		if (proofCreated || !hasProof || options.normalizeExistingProofs) jsonLd = await require_proof.normalizeOutgoingActivityJsonLd(jsonLd, contextLoader);
+		if (proofCreated || !hasProof || options.normalizeExistingProofs) jsonLd = await require_owner.normalizeOutgoingActivityJsonLd(jsonLd, contextLoader);
 		if (rsaKey == null) logger.warn("No supported key found to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.  In order to create a Linked Data signature, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 			activityId,
 			keys: keys.map((pair) => ({
@@ -5901,7 +6474,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}))
 		});
 		else try {
-			jsonLd = await require_proof.signJsonLd(jsonLd, rsaKey.privateKey, rsaKey.keyId, {
+			jsonLd = await require_owner.signJsonLd(jsonLd, rsaKey.privateKey, rsaKey.keyId, {
 				contextLoader,
 				tracerProvider: this.tracerProvider
 			});
@@ -5930,6 +6503,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			const promises = [];
 			for (const inbox in inboxes) promises.push(sendActivity({
+				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: jsonLd,
 				activityId: activity.id?.href,
@@ -6868,7 +7442,7 @@ var ContextImpl = class ContextImpl {
 			const contextLoader = this.contextLoader;
 			for (const kp of actorKeyPairs) {
 				if (kp.privateKey.algorithm.name !== "Ed25519" || kp.multikey.id == null) continue;
-				activity = await require_proof.signObject(activity, kp.privateKey, kp.multikey.id, {
+				activity = await require_owner.signObject(activity, kp.privateKey, kp.multikey.id, {
 					contextLoader,
 					tracerProvider: this.tracerProvider
 				});
@@ -6998,7 +7572,7 @@ var ContextImpl = class ContextImpl {
 			tracerProvider: this.tracerProvider,
 			keyTtl: this.federation.publicKeyTtl
 		});
-		if (await require_proof.verifyObject(_fedify_vocab.Activity, json, {
+		if (await require_owner.verifyObject(_fedify_vocab.Activity, json, {
 			contextLoader,
 			documentLoader: options.documentLoader ?? this.documentLoader,
 			meterProvider: this.meterProvider,
@@ -7155,7 +7729,7 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 		const key = await this.getSignedKey(options);
 		if (key == null) return this.#signedKeyOwner = null;
 		try {
-			return this.#signedKeyOwner = await require_proof.getKeyOwner(key, {
+			return this.#signedKeyOwner = await require_owner.getKeyOwner(key, {
 				contextLoader: options.contextLoader ?? this.contextLoader,
 				documentLoader: options.documentLoader ?? this.documentLoader,
 				tracerProvider: options.tracerProvider ?? this.tracerProvider
@@ -7225,8 +7799,8 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 		if (forwarder.length < 1) throw new Error("The forwarder's key pairs are empty.");
 		keys = forwarder;
 	} else keys = [forwarder];
-	if (!require_proof.hasSignatureLike(ctx.activity)) {
-		if (!require_proof.hasProofLike(ctx.activity)) {
+	if (!require_owner.hasSignatureLike(ctx.activity)) {
+		if (!require_owner.hasProofLike(ctx.activity)) {
 			if (options?.skipIfUnsigned) return false;
 			logger.warn("The activity {activityId} is not signed; even if it is forwarded to other servers as is, it may not be accepted by them due to the lack of a signature/proof.", {
 				activityId: ctx.activityId,
@@ -7264,6 +7838,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 		else logger.debug("Forwarding activity immediately without queue since queue is not set.");
 		const promises = [];
 		for (const inbox in inboxes) promises.push(sendActivity({
+			allowPrivateAddress: ctx.federation.allowPrivateAddress,
 			keys,
 			activity: ctx.activity,
 			activityId: ctx.activityId,