@fedify/fedify 2.4.0-dev.2099 → 2.4.0-dev.2103

package/dist/federation/portable-actor.test.mjs

@@ -0,0 +1,446 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
+import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
+import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { i as signObject, s as verifyPortableObjectProof } from "../proof-BE4T5zF6.mjs";
+import { d as verifyRequest, l as signRequest } from "../http-BU-8fUrz.mjs";
+import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { b as PORTABLE_OBJECT_CONTENT_TYPE, o as createFederation } from "../middleware-FnITXhtz.mjs";
+import { n as RouterError } from "../router-u5O5KCQr.mjs";
+import { configure, reset } from "@logtape/logtape";
+import { Note, Person, Tombstone, lookupObject } from "@fedify/vocab";
+import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
+import { exportDidKey, formatIri, fromCompatibleEf61Id, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+//#region src/federation/portable-actor.test.ts
+const did = await exportDidKey(ed25519PublicKey.publicKey);
+const keyId = new URL(`${did}#${did.slice(8)}`);
+const otherKeyPair = await crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+const otherDid = await exportDidKey(otherKeyPair.publicKey);
+const otherKeyId = new URL(`${otherDid}#${otherDid.slice(8)}`);
+const ORIGIN = "https://example.com";
+const ACCEPT = "application/activity+json";
+function gatewayUrl(path, authority = did) {
+	return `${ORIGIN}/.well-known/apgateway/${authority}${path}`;
+}
+function gatewayRequest(path, init = {}) {
+	const { authority, ...rest } = init;
+	return new Request(gatewayUrl(path, authority), {
+		...rest,
+		headers: {
+			Accept: ACCEPT,
+			...rest.headers
+		}
+	});
+}
+async function sign(object, privateKey = ed25519PrivateKey, key = keyId) {
+	return await signObject(object, privateKey, key, { contextLoader: mockDocumentLoader });
+}
+/**
+* The DIDs of the users that this server hosts, which the actor dispatcher
+* looks up by identifier, like an application would in its database.
+*/
+const users = {
+	alice: did,
+	instance: did,
+	unsigned: did,
+	"wrong-key": did,
+	tampered: did,
+	https: did,
+	tombstone: did,
+	"mutated-id": did,
+	compatible: did,
+	"a b/ç": did
+};
+async function portableActor(ctx, identifier, authority) {
+	const keys = await ctx.getActorKeyPairs(identifier);
+	return new Person({
+		id: ctx.getPortableActorUri(identifier, authority),
+		preferredUsername: identifier,
+		inbox: ctx.getPortableInboxUri(identifier, authority),
+		gateways: [new URL(ORIGIN)],
+		publicKeys: keys.map((key) => key.cryptographicKey),
+		assertionMethods: keys.map((key) => key.multikey)
+	});
+}
+function createTestFederation(options = {}) {
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderFactory: () => mockDocumentLoader,
+		contextLoaderFactory: () => mockDocumentLoader,
+		...options
+	});
+	const contexts = [];
+	const setters = federation.setActorDispatcher("/users/{identifier}", async (ctx, identifier) => {
+		contexts.push(ctx);
+		const userDid = users[identifier];
+		if (userDid == null) return null;
+		if (ctx.portableRequest != null && ctx.portableRequest.authority !== userDid) return null;
+		switch (identifier) {
+			case "https": return new Person({ id: ctx.getActorUri(identifier) });
+			case "compatible": {
+				const actor = await portableActor(ctx, identifier, userDid);
+				return await sign(actor.clone({ id: toCompatibleEf61Id(actor.id, ORIGIN) }));
+			}
+			case "tombstone": return new Tombstone({ id: ctx.getPortableActorUri(identifier, userDid) });
+			case "unsigned": return await portableActor(ctx, identifier, userDid);
+			case "wrong-key": return await sign(await portableActor(ctx, identifier, userDid), otherKeyPair.privateKey, otherKeyId);
+			case "tampered": return (await sign(await portableActor(ctx, identifier, userDid))).clone({ name: "Tampered" });
+			case "mutated-id": {
+				const signed = await sign(await portableActor(ctx, "alice", userDid));
+				const actor = await Person.fromJsonLd(await signed.toJsonLd({ contextLoader: mockDocumentLoader }), {
+					contextLoader: mockDocumentLoader,
+					documentLoader: mockDocumentLoader
+				});
+				actor.id.pathname = "/users/mutated-id";
+				return actor;
+			}
+		}
+		return await sign(await portableActor(ctx, identifier, userDid));
+	}).setKeyPairsDispatcher(() => [{
+		privateKey: rsaPrivateKey2,
+		publicKey: rsaPublicKey2.publicKey
+	}]).mapPortableActorId((ctx, identifier) => {
+		const userDid = users[identifier];
+		return userDid == null ? null : ctx.getPortableActorUri(identifier, userDid);
+	}).mapHandle((_ctx, username) => username).mapActorAlias("/actor", "instance");
+	federation.setInboxListeners("/users/{identifier}/inbox", "/inbox");
+	return {
+		federation,
+		setters,
+		contexts
+	};
+}
+test("Context.getPortableActorUri()", async (t) => {
+	const { federation } = createTestFederation();
+	const ctx = federation.createContext(new URL(`${ORIGIN}/`), void 0);
+	await t.step("builds a portable ID from the actor path", () => {
+		const uri = ctx.getPortableActorUri("alice", did);
+		assertInstanceOf(uri, URL);
+		assertEquals(uri.protocol, "ap+ef61:");
+		assertEquals(formatIri(uri), `ap+ef61://${did}/users/alice`);
+		assertEquals(uri.href, `ap+ef61://${encodeURIComponent(did)}/users/alice`);
+		assertEquals(ctx.getActorUri("alice"), new URL(`${ORIGIN}/users/alice`));
+	});
+	await t.step("uses the same path as getActorUri()", () => {
+		for (const identifier of [
+			"alice",
+			"instance",
+			"a b/ç",
+			"100%"
+		]) assertEquals(ctx.getPortableActorUri(identifier, did).pathname, ctx.getActorUri(identifier).pathname, identifier);
+		assertEquals(formatIri(ctx.getPortableActorUri("instance", did)), `ap+ef61://${did}/actor`);
+	});
+	await t.step("is serialized in the canonical form", async () => {
+		assertEquals((await new Person({ id: ctx.getPortableActorUri("alice", did) }).toJsonLd({ contextLoader: mockDocumentLoader })).id, `ap+ef61://${did}/users/alice`);
+	});
+	await t.step("converts to and from compatible identifiers", () => {
+		const uri = ctx.getPortableActorUri("a b/ç", did);
+		const compatible = toCompatibleEf61Id(uri, ORIGIN);
+		assertEquals(compatible.href, gatewayUrl(ctx.getActorUri("a b/ç").pathname));
+		assertEquals(fromCompatibleEf61Id(compatible)?.href, uri.href);
+	});
+	await t.step("requires a bare DID authority", () => {
+		for (const authority of [
+			`${did}/extra`,
+			`${did}?query`,
+			`${did}#fragment`,
+			"did:key:",
+			"https://example.com",
+			""
+		]) assertThrows(() => ctx.getPortableActorUri("alice", authority), TypeError, void 0, authority);
+		assertThrows(() => ctx.getPortableActorUri("alice"), TypeError);
+	});
+	await t.step("requires an authority outside gateway requests", () => {
+		const requestCtx = federation.createContext(new Request(`${ORIGIN}/`), void 0);
+		assertThrows(() => requestCtx.getPortableActorUri("alice"), TypeError);
+		assertEquals(formatIri(requestCtx.getPortableActorUri("alice", did)), `ap+ef61://${did}/users/alice`);
+	});
+	await t.step("requires an actor dispatcher", () => {
+		const emptyCtx = createFederation({ kv: new MemoryKvStore() }).createContext(new URL(`${ORIGIN}/`), void 0);
+		assertThrows(() => emptyCtx.getPortableActorUri("alice", did), RouterError);
+	});
+});
+test("Context portable ID helpers require base58-btc did:key DIDs", async (t) => {
+	const { federation } = createTestFederation();
+	federation.setObjectDispatcher(Note, "/notes/{id}", () => null);
+	const ctx = federation.createContext(new URL(`${ORIGIN}/`), void 0);
+	const helpers = {
+		getPortableActorUri: (authority) => ctx.getPortableActorUri("alice", authority),
+		getPortableObjectUri: (authority) => ctx.getPortableObjectUri(Note, { id: "1" }, authority),
+		getPortableInboxUri: (authority) => ctx.getPortableInboxUri("alice", authority)
+	};
+	const base64url = `did:key:u${did.slice(9)}`;
+	for (const [name, helper] of Object.entries(helpers)) await t.step(name, () => {
+		for (const authority of [
+			base64url,
+			base64url.replace("did:key:", "DID:KEY:"),
+			`did:key:%75${did.slice(9)}`,
+			"did:key:z",
+			"did:key:z0OIl"
+		]) assertThrows(() => helper(authority), TypeError, void 0, authority);
+		assertEquals(formatIri(helper(did)).startsWith(`ap+ef61://${did}/`), true);
+		assertEquals(formatIri(helper(did.replace("did:key:", "DID:KEY:"))), formatIri(helper(did)));
+		assertEquals(formatIri(helper("did:web:example.com")).startsWith("ap+ef61://did:web:example.com/"), true);
+	});
+});
+test("RequestContext.getPortableActorUri() in gateway requests", async () => {
+	const { federation, contexts } = createTestFederation();
+	assertEquals((await federation.fetch(gatewayRequest("/users/alice"), { contextData: void 0 })).status, 200);
+	const ctx = contexts[0];
+	assertEquals(ctx.portableRequest?.authority, did);
+	assertEquals(formatIri(ctx.getPortableActorUri("alice")), `ap+ef61://${did}/users/alice`);
+	assertEquals(formatIri(ctx.getPortableActorUri("alice", otherDid)), `ap+ef61://${otherDid}/users/alice`);
+});
+test("Federation.fetch() serves portable actors through the actor dispatcher", async (t) => {
+	const { federation, contexts } = createTestFederation();
+	await t.step("serves a portable actor", async () => {
+		contexts.length = 0;
+		const response = await federation.fetch(gatewayRequest("/users/alice"), { contextData: void 0 });
+		assertEquals(response.status, 200);
+		assertEquals(response.headers.get("Content-Type"), PORTABLE_OBJECT_CONTENT_TYPE);
+		const json = await response.json();
+		assertEquals(json.id, `ap+ef61://${did}/users/alice`);
+		assertEquals(json.inbox, `ap+ef61://${did}/users/alice/inbox`);
+		assertEquals((await verifyPortableObjectProof(json, { contextLoader: mockDocumentLoader })).verified, true);
+		assertEquals(contexts.length, 1);
+		assertEquals(contexts[0].portableRequest?.authority, did);
+		assertEquals(formatIri(contexts[0].portableRequest.id), `ap+ef61://${did}/users/alice`);
+	});
+	await t.step("serves an actor with a compatible identifier", async () => {
+		const response = await federation.fetch(gatewayRequest("/users/compatible"), { contextData: void 0 });
+		assertEquals(response.status, 200);
+		assertEquals((await response.json()).id, gatewayUrl("/users/compatible"));
+	});
+	await t.step("serves an actor with reserved characters", async () => {
+		const ctx = federation.createContext(new URL(`${ORIGIN}/`), void 0);
+		assertEquals((await federation.fetch(gatewayRequest(ctx.getActorUri("a b/ç").pathname), { contextData: void 0 })).status, 200);
+	});
+	await t.step("serves an actor alias", async () => {
+		let response = await federation.fetch(gatewayRequest("/actor"), { contextData: void 0 });
+		assertEquals(response.status, 200);
+		assertEquals((await response.json()).id, `ap+ef61://${did}/actor`);
+		response = await federation.fetch(gatewayRequest("/users/instance"), { contextData: void 0 });
+		assertEquals(response.status, 404);
+	});
+	await t.step("responds with 400 for non-base58-btc did:key DIDs", async () => {
+		contexts.length = 0;
+		const base64url = `did:key:u${did.slice(9)}`;
+		for (const method of ["GET", "POST"]) assertEquals((await federation.fetch(gatewayRequest(method === "GET" ? "/users/alice" : "/users/alice/inbox", {
+			method,
+			authority: base64url,
+			...method === "POST" ? { body: "{}" } : {}
+		}), { contextData: void 0 })).status, 400, method);
+		assertEquals(contexts.length, 0);
+	});
+	await t.step("responds to HEAD without a body", async () => {
+		const response = await federation.fetch(gatewayRequest("/users/alice", { method: "HEAD" }), { contextData: void 0 });
+		assertEquals(response.status, 200);
+		assertEquals(response.headers.get("Content-Type"), PORTABLE_OBJECT_CONTENT_TYPE);
+		assertEquals(response.body, null);
+	});
+	await t.step("responds with 406 without a JSON-LD Accept header", async () => {
+		let notAcceptable = false;
+		assertEquals((await federation.fetch(gatewayRequest("/users/alice", { headers: { Accept: "text/html" } }), {
+			contextData: void 0,
+			onNotAcceptable() {
+				notAcceptable = true;
+				return new Response("Not acceptable", { status: 406 });
+			}
+		})).status, 406);
+		assertEquals(notAcceptable, true);
+	});
+	await t.step("responds with 404 for actors it does not serve", async () => {
+		for (const request of [
+			gatewayRequest("/users/missing"),
+			gatewayRequest("/users/https"),
+			gatewayRequest("/users/tombstone"),
+			gatewayRequest("/users/alice", { authority: otherDid }),
+			gatewayRequest("/users/mutated-id")
+		]) {
+			let notFound = false;
+			assertEquals((await federation.fetch(request, {
+				contextData: void 0,
+				onNotFound() {
+					notFound = true;
+					return new Response("Not found", { status: 404 });
+				}
+			})).status, 404, request.url);
+			assertEquals(notFound, true, request.url);
+		}
+	});
+	await t.step("refuses actors that violate the proof policy", async () => {
+		for (const identifier of [
+			"unsigned",
+			"wrong-key",
+			"tampered"
+		]) {
+			const response = await federation.fetch(gatewayRequest(`/users/${identifier}`), { contextData: void 0 });
+			assertEquals(response.status, 500, identifier);
+			assertEquals(await response.text(), "Internal server error.");
+		}
+	});
+	await t.step("keeps ordinary actor requests unchanged", async () => {
+		const response = await federation.fetch(new Request(`${ORIGIN}/users/https`, { headers: { Accept: ACCEPT } }), { contextData: void 0 });
+		assertEquals(response.status, 200);
+		assertEquals((await response.json()).id, `${ORIGIN}/users/https`);
+	});
+	await t.step("leaves POST requests to the actor path alone", async () => {
+		let notFound = false;
+		assertEquals((await federation.fetch(gatewayRequest("/users/alice", {
+			method: "POST",
+			body: "{}"
+		}), {
+			contextData: void 0,
+			onNotFound() {
+				notFound = true;
+				return new Response("Not found", { status: 404 });
+			}
+		})).status, 404);
+		assertEquals(notFound, true);
+	});
+});
+test("Federation.fetch() authorizes portable actor requests", async (t) => {
+	const { federation, setters } = createTestFederation();
+	const identifiers = [];
+	setters.authorize(async (ctx, identifier) => {
+		identifiers.push(identifier);
+		assertEquals(ctx.portableRequest?.authority, did);
+		return (await ctx.getSignedKeyOwner())?.id?.href === "https://example.com/person2";
+	});
+	await t.step("allows a signed request", async () => {
+		const request = await signRequest(gatewayRequest("/users/alice?x=1"), rsaPrivateKey3, rsaPublicKey3.id);
+		assertEquals((await federation.fetch(request, { contextData: void 0 })).status, 200);
+		assertEquals(identifiers, ["alice"]);
+	});
+	await t.step("denies an unsigned request", async () => {
+		let unauthorized = false;
+		assertEquals((await federation.fetch(gatewayRequest("/users/alice"), {
+			contextData: void 0,
+			onUnauthorized() {
+				unauthorized = true;
+				return new Response("Unauthorized", { status: 401 });
+			}
+		})).status, 401);
+		assertEquals(unauthorized, true);
+	});
+	await t.step("denies a request whose target was tampered with", async () => {
+		const signed = await signRequest(gatewayRequest("/users/alice"), rsaPrivateKey3, rsaPublicKey3.id);
+		assertEquals((await federation.fetch(new Request(gatewayUrl("/actor"), { headers: signed.headers }), { contextData: void 0 })).status, 401);
+	});
+});
+test("Federation.fetch() serves portable actors found through WebFinger", async () => {
+	const { federation } = createTestFederation();
+	const webFinger = await federation.fetch(new Request(`${ORIGIN}/.well-known/webfinger?resource=acct:alice@example.com`), { contextData: void 0 });
+	assertEquals(webFinger.status, 200);
+	const jrd = await webFinger.json();
+	assertEquals(jrd.subject, "acct:alice@example.com");
+	assertEquals(jrd.links?.[0], {
+		rel: "self",
+		href: gatewayUrl("/users/alice"),
+		type: "application/activity+json"
+	});
+	const actor = await lookupObject(jrd.links[0].href, {
+		documentLoader: federationLoader(federation),
+		contextLoader: mockDocumentLoader,
+		verifyPortableObject: verifyPortableObjectProof
+	});
+	assertInstanceOf(actor, Person);
+	assertEquals(formatIri(actor.id), `ap+ef61://${did}/users/alice`);
+});
+function federationLoader(federation) {
+	return async (url) => {
+		const response = await federation.fetch(new Request(url.replace(/#.*$/, ""), { headers: { Accept: ACCEPT } }), { contextData: void 0 });
+		if (!response.ok) throw new Error(`HTTP ${response.status}: ${url}`);
+		return {
+			contextUrl: null,
+			documentUrl: url,
+			document: await response.json()
+		};
+	};
+}
+test("Gateway keys of portable actors dereference to the actor dispatcher", async (t) => {
+	for (const [label, options] of [["default origin", {}], ["canonical origin", { origin: ORIGIN }]]) await t.step(label, async () => {
+		const { federation } = createTestFederation(options);
+		const ctx = federation.createContext(new URL("origin" in options ? "https://internal.example/" : `${ORIGIN}/`), void 0);
+		for (const identifier of ["alice", "instance"]) {
+			const [keyPair] = await ctx.getActorKeyPairs(identifier);
+			assertEquals(keyPair.keyId.href, `${toCompatibleEf61Id(ctx.getPortableActorUri(identifier, did), ORIGIN).href}#main-key`);
+			const key = await verifyRequest(await signRequest(new Request("https://recipient.example/inbox", {
+				method: "POST",
+				body: "{}",
+				headers: { "Content-Type": "application/activity+json" }
+			}), keyPair.privateKey, keyPair.keyId), {
+				documentLoader: federationLoader(federation),
+				contextLoader: mockDocumentLoader
+			});
+			assert(key != null, identifier);
+			assertEquals(key.id?.href, keyPair.keyId.href);
+			assertEquals(key.ownerId?.href, ctx.getPortableActorUri(identifier, did).href);
+		}
+	});
+});
+test("Federation.fetch() records metrics for portable actor requests", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
+	const { federation } = createTestFederation({ meterProvider });
+	let response = await federation.fetch(gatewayRequest("/users/alice"), { contextData: void 0 });
+	assertEquals(response.status, 200);
+	let counts = recorder.getMeasurements("fedify.http.server.request.count");
+	assertEquals(counts.length, 1);
+	assertEquals(counts[0].attributes["fedify.endpoint"], "actor");
+	const template = counts[0].attributes["fedify.route.template"];
+	assertEquals(template, "/.well-known/apgateway/{did}/users/{identifier}");
+	response = await federation.fetch(gatewayRequest("/users/alice", { headers: { Accept: "text/html" } }), { contextData: void 0 });
+	assertEquals(response.status, 406);
+	counts = recorder.getMeasurements("fedify.http.server.request.count");
+	assertEquals(counts.length, 2);
+	assertEquals(counts[1].attributes["fedify.endpoint"], "not_acceptable");
+});
+test("Federation.fetch() warns about recursive actor dispatches in gateway requests", async () => {
+	const records = [];
+	await reset();
+	try {
+		await configure({
+			sinks: { buffer: (record) => records.push(record) },
+			filters: {},
+			loggers: [{
+				category: [
+					"fedify",
+					"federation",
+					"actor"
+				],
+				sinks: ["buffer"]
+			}, {
+				category: ["logtape", "meta"],
+				sinks: [],
+				lowestLevel: "warning"
+			}]
+		});
+		const { federation } = createTestFederation();
+		let response = await federation.fetch(gatewayRequest("/users/alice"), { contextData: void 0 });
+		assertEquals(response.status, 200);
+		const isRecursionWarning = (record) => record.level === "warning" && record.rawMessage.toString().includes("infinite loop");
+		assertFalse(records.some(isRecursionWarning));
+		const recursive = createFederation({
+			kv: new MemoryKvStore(),
+			documentLoaderFactory: () => mockDocumentLoader,
+			contextLoaderFactory: () => mockDocumentLoader
+		});
+		recursive.setActorDispatcher("/users/{identifier}", async (ctx, identifier) => {
+			if (identifier === "alice") await ctx.getActor("bob");
+			return null;
+		});
+		response = await recursive.fetch(gatewayRequest("/users/alice"), { contextData: void 0 });
+		assertEquals(response.status, 404);
+		assert(records.some(isRecursionWarning));
+	} finally {
+		await reset();
+	}
+});
+//#endregion
+export {};

package/dist/federation/portable-gateway-keys.test.mjs

@@ -2,15 +2,15 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
-import { r as createRequestContext, t as createInboxContext } from "../context-DlZhxdFT.mjs";
+import { r as createRequestContext, t as createInboxContext } from "../context-CoNRxGYp.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { p as signJsonLd } from "../ld-B00wWHzc.mjs";
-import { l as signRequest } from "../http-DsgawTd8.mjs";
+import { p as signJsonLd } from "../ld-wiJbqJHa.mjs";
+import { l as signRequest } from "../http-BU-8fUrz.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { f as handleInbox, n as FederationImpl, o as createFederation } from "../middleware-Br1_d-Ga.mjs";
+import { f as handleInbox, n as FederationImpl, o as createFederation } from "../middleware-FnITXhtz.mjs";
 import { t as ActivityListenerSet } from "../activity-listener-C-BSbKI7.mjs";
 import { t as KvKeyCache } from "../keycache-BUDHB5rY.mjs";
 import { Create, CryptographicKey, Person } from "@fedify/vocab";

package/dist/federation/portable-inbox.test.mjs

@@ -8,11 +8,11 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { p as signJsonLd } from "../ld-B00wWHzc.mjs";
-import { i as signObject } from "../proof-ChjBwnep.mjs";
-import { f as verifyRequestDetailed, l as signRequest } from "../http-DsgawTd8.mjs";
+import { p as signJsonLd } from "../ld-wiJbqJHa.mjs";
+import { i as signObject } from "../proof-BE4T5zF6.mjs";
+import { f as verifyRequestDetailed, l as signRequest } from "../http-BU-8fUrz.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { _ as coversDelivery, o as createFederation, v as forwardPortableInboxActivity, y as resolvePortableInboxForwardingOptions } from "../middleware-Br1_d-Ga.mjs";
+import { _ as coversDelivery, o as createFederation, v as forwardPortableInboxActivity, y as resolvePortableInboxForwardingOptions } from "../middleware-FnITXhtz.mjs";
 import { Create, CryptographicKey, Follow, Note, Person, Tombstone } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { exportDidKey, formatIri, parseIri } from "@fedify/vocab-runtime";
@@ -1407,6 +1407,27 @@ test("Context.getPortableInboxUri()", async (t) => {
 		assertEquals(formatIri(ctx.getPortableInboxUri("alice", did)), `ap+ef61://${did}/users/alice/inbox`);
 	});
 });
+test("Federation.fetch() serves and delivers to one portable actor dispatcher", async () => {
+	const { federation, received } = setup({ actor: async (ctx, identifier) => {
+		if (identifier !== "alice") return null;
+		if (ctx.portableRequest != null && ctx.portableRequest.authority !== did) return null;
+		return await signObject(new Person({
+			id: ctx.getPortableActorUri(identifier, did),
+			inbox: ctx.getPortableInboxUri(identifier, did),
+			gateways: [new URL(LOCAL)]
+		}), ed25519PrivateKey, keyId, { contextLoader: mockDocumentLoader });
+	} });
+	assertEquals((await federation.fetch(post(inboxUrl(), await signedFollow()), { contextData: void 0 })).status, 202);
+	assertEquals(received.length, 1);
+	assertEquals(received[0].recipient, "alice");
+	const get = (authority) => federation.fetch(new Request(inboxUrl(authority, "/users/alice"), { headers: { Accept: "application/activity+json" } }), { contextData: void 0 });
+	const actor = await get(did);
+	assertEquals(actor.status, 200);
+	const json = await actor.json();
+	assertEquals(json.id, `ap+ef61://${did}/users/alice`);
+	assertEquals(json.inbox, `ap+ef61://${did}/users/alice/inbox`);
+	assertEquals((await get(otherDid)).status, 404);
+});
 test("Federation.fetch() keeps ordinary inbox deliveries unchanged", async () => {
 	const queue = new RecordingQueue();
 	const { federation, received } = setup({ queue });

package/dist/federation/portable.test.mjs

@@ -8,10 +8,10 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertStrictEquals } from "../assert_strict_equals-CYvBmkpC.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { i as signObject, s as verifyPortableObjectProof } from "../proof-ChjBwnep.mjs";
-import { l as signRequest } from "../http-DsgawTd8.mjs";
+import { i as signObject, s as verifyPortableObjectProof } from "../proof-BE4T5zF6.mjs";
+import { l as signRequest } from "../http-BU-8fUrz.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { b as PORTABLE_OBJECT_CONTENT_TYPE, o as createFederation } from "../middleware-Br1_d-Ga.mjs";
+import { b as PORTABLE_OBJECT_CONTENT_TYPE, o as createFederation } from "../middleware-FnITXhtz.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { Collection, Create, Note, Object as Object$1, Person, Tombstone, lookupObject } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";

package/dist/federation/send.test.mjs

@@ -10,10 +10,10 @@ import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { d as verifyRequest } from "../http-DsgawTd8.mjs";
+import { d as verifyRequest } from "../http-BU-8fUrz.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as doesActorOwnKey } from "../owner-BJPDRDRq.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-yFX0E-ye.mjs";
+import { t as doesActorOwnKey } from "../owner-BJp47LxN.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-BFITuKHw.mjs";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";

package/dist/federation/tasks/enqueue.test.mjs

@@ -3,8 +3,8 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../../kv-DCHkaJ9-.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, t as MockQueue } from "../../tasks-dbCShlCb.mjs";
-import "../../testing-CO_cEvQc.mjs";
-import { o as createFederation } from "../../middleware-Br1_d-Ga.mjs";
+import "../../testing-BWq1dCzx.mjs";
+import { o as createFederation } from "../../middleware-FnITXhtz.mjs";
 import { n as ParallelMessageQueue } from "../../mq-Dm1Wmtm-.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { delay } from "es-toolkit";

package/dist/federation/tasks/tasks.test.mjs

@@ -3,9 +3,9 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../../kv-DCHkaJ9-.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, t as MockQueue } from "../../tasks-dbCShlCb.mjs";
-import "../../testing-CO_cEvQc.mjs";
-import { o as createFederation } from "../../middleware-Br1_d-Ga.mjs";
-import { r as createFederationBuilder } from "../../builder-Bno54o_-.mjs";
+import "../../testing-BWq1dCzx.mjs";
+import { o as createFederation } from "../../middleware-FnITXhtz.mjs";
+import { r as createFederationBuilder } from "../../builder-CHht75pX.mjs";
 import { t as TaskCodec } from "../../codec-C6rTrpIp.mjs";
 import { t as InProcessMessageQueue } from "../../mq-Dm1Wmtm-.mjs";
 import { W3CTraceContextPropagator } from "@opentelemetry/core";

package/dist/federation/temporal.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-Dl9x-Qw4.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-CyDDbE4i.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -1,12 +1,12 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { r as createRequestContext } from "../context-DlZhxdFT.mjs";
+import { r as createRequestContext } from "../context-CoNRxGYp.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { o as createFederation, s as handleWebFinger } from "../middleware-Br1_d-Ga.mjs";
+import { o as createFederation, s as handleWebFinger } from "../middleware-FnITXhtz.mjs";
 import { Image, Link, Person, Tombstone } from "@fedify/vocab";
 import { createTestMeterProvider, test } from "@fedify/fixture";
 import { parseIri } from "@fedify/vocab-runtime";