@fedify/fedify 2.4.0-dev.2155 → 2.4.0-dev.2159

package/dist/sig/compound-proof.test.mjs

@@ -6,9 +6,9 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as signObject, d as verifyProof } from "../proof-vZ04IAjq.mjs";
+import { a as signObject, d as verifyProof } from "../proof-BdO3BbLh.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { o as verifyCompoundProofDocuments } from "../compound-proof-nhrXTRQO.mjs";
+import { o as verifyCompoundProofDocuments } from "../compound-proof-B02Os8h2.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";

package/dist/sig/http.test.mjs

@@ -11,8 +11,8 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as exportJwk } from "../key-BZ-Z4uez.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-CXnNbRe_.mjs";
+import { n as exportJwk } from "../key-C6jnekFI.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, i as formatRfc9421SignatureParameters, l as signRequest, n as doubleKnock, o as parseRfc9421Signature, r as formatRfc9421Signature, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as timingSafeEqual } from "../http-DV_yW4dv.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";
@@ -655,6 +655,46 @@ test("verifyRequest() [rfc9421] successful GET verification", async () => {
 		currentTime: Temporal.Instant.from(`${(/* @__PURE__ */ new Date(currentTimestamp * 1e3)).toISOString()}`)
 	}), rsaPublicKey2, "Valid signature should verify to the correct public key");
 });
+for (const failure of [
+	"missing key",
+	"invalid signature",
+	"digest mismatch",
+	"empty body",
+	"cached key"
+]) test(`verifyRequest() [rfc9421] multiple POST signatures: ${failure}`, async () => {
+	const body = failure === "empty body" ? "" : "Hello, world!";
+	const currentTime = Temporal.Instant.from("2024-03-05T08:09:44Z");
+	const signed = await signRequest(new Request("https://example.com/inbox", {
+		method: "POST",
+		body
+	}), rsaPrivateKey2, new URL("https://example.com/key2"), {
+		spec: "rfc9421",
+		currentTime
+	});
+	const input = signed.headers.get("Signature-Input");
+	const signature = signed.headers.get("Signature");
+	const firstInput = failure === "missing key" ? input.replace("https://example.com/key2", "https://example.com/missing-key") : input;
+	signed.headers.set("Signature-Input", `${firstInput}, ${input.replace(/^sig1=/, "sig2=")}`);
+	signed.headers.set("Signature", `sig1=:AAAAAA==:, ${signature.replace(/^sig1=/, "sig2=")}`);
+	const request = failure === "digest mismatch" ? new Request(signed, { body: "Tampered body" }) : signed;
+	const loaded = [];
+	assertEquals(await verifyRequest(request, {
+		keyCache: failure === "cached key" ? {
+			get: () => Promise.resolve(rsaPublicKey1),
+			set: async () => {}
+		} : void 0,
+		spec: "rfc9421",
+		currentTime,
+		contextLoader: mockDocumentLoader,
+		documentLoader: (url, options) => {
+			loaded.push(url);
+			return mockDocumentLoader(url, options);
+		}
+	}), failure === "digest mismatch" ? null : rsaPublicKey2);
+	assertEquals(loaded, failure === "digest mismatch" ? [] : failure === "missing key" ? ["https://example.com/missing-key", "https://example.com/key2"] : ["https://example.com/key2", "https://example.com/key2"]);
+	assertFalse(request.bodyUsed);
+	assertEquals(await request.text(), failure === "digest mismatch" ? "Tampered body" : body);
+});
 test("verifyRequest() [rfc9421] manual POST verification", async () => {
 	const currentTimestamp = 1709626184;
 	const currentTime = Temporal.Instant.from("2024-03-05T08:09:44Z");

package/dist/sig/key.test.mjs

@@ -6,7 +6,7 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-BZ-Z4uez.mjs";
+import { a as fetchKeyDetailed, c as validateCryptoKey, i as fetchKey, n as exportJwk, o as generateCryptoKeyPair, s as importJwk } from "../key-C6jnekFI.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/ld.test.mjs

@@ -8,14 +8,17 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { o as generateCryptoKeyPair } from "../key-BZ-Z4uez.mjs";
-import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-Djxsq6JR.mjs";
+import { o as generateCryptoKeyPair } from "../key-C6jnekFI.mjs";
+import { a as compactJsonLd, f as isInvalidUrlTypeError, g as verifySignature, h as verifyJsonLd, i as attachSignature, n as UnsafeJsonLdError, o as createSignature, p as signJsonLd, s as detachSignature, u as hasSignatureLike } from "../ld-ya2C1Xip.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { encodeBase64 } from "byte-encodings/base64";
 //#region src/sig/ld.test.ts
 test("isInvalidUrlTypeError()", () => {
+	assert(isInvalidUrlTypeError(/* @__PURE__ */ new TypeError("Invalid URL string.")));
+	assertFalse(isInvalidUrlTypeError(/* @__PURE__ */ new Error("Invalid URL string.")));
+	assertFalse(isInvalidUrlTypeError(/* @__PURE__ */ new TypeError("Invalid URL string. Other error")));
 	assert(isInvalidUrlTypeError(/* @__PURE__ */ new TypeError("Invalid URL: http://[")));
 	assert(isInvalidUrlTypeError(/* @__PURE__ */ new TypeError("\"http://[\" cannot be parsed as a URL.")));
 	const error = /* @__PURE__ */ new TypeError("Failed to parse URL");

package/dist/sig/mod.cjs

@@ -1,7 +1,7 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-eqYXHRkz.cjs");
-const require_portable_collection = require("../portable-collection-wBWbuHOH.cjs");
+const require_http = require("../http-wdsia0-O.cjs");
+const require_portable_collection = require("../portable-collection-C65SwL2l.cjs");
 exports.attachSignature = require_http.attachSignature;
 exports.createProof = require_http.createProof;
 exports.createSignature = require_http.createSignature;

package/dist/sig/mod.js

@@ -1,5 +1,5 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { A as hasSignatureLike, B as fetchKey, D as detachSignature, E as createSignature, F as verifyJsonLd, H as generateCryptoKeyPair, I as verifySignature, N as signJsonLd, R as exportJwk, U as importJwk, V as fetchKeyDetailed, _ as verifyPortableObjectProof, a as signRequest, b as verifyProof, dt as fulfillAcceptSignature, f as createProof, ft as parseAcceptSignature, g as verifyObject, m as signObject, o as verifyRequest, p as hasProofLike, pt as validateAcceptSignature, s as verifyRequestDetailed, ut as formatAcceptSignature, w as attachSignature } from "../http-Dk4O3WM0.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-BCy06GiS.js";
+import { A as hasSignatureLike, B as fetchKey, D as detachSignature, E as createSignature, F as verifyJsonLd, H as generateCryptoKeyPair, I as verifySignature, N as signJsonLd, R as exportJwk, U as importJwk, V as fetchKeyDetailed, _ as verifyPortableObjectProof, a as signRequest, b as verifyProof, dt as fulfillAcceptSignature, f as createProof, ft as parseAcceptSignature, g as verifyObject, m as signObject, o as verifyRequest, p as hasProofLike, pt as validateAcceptSignature, s as verifyRequestDetailed, ut as formatAcceptSignature, w as attachSignature } from "../http-nTZuTacw.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-B-mU1F1-.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-OdWSE8am.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-C6Nv5yyw.mjs";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/owner.test.ts

package/dist/sig/portable-collection.test.mjs

@@ -2,12 +2,12 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { t as verifyPortableObject } from "../portable-collection-DAV7Ho3m.mjs";
+import { t as verifyPortableObject } from "../portable-collection-uWj3hfzv.mjs";
 import { Collection, CollectionPage, Note, OrderedCollection, Person, traverseCollection } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 import { FetchError, encodeMultibase, exportDidKey, preloadedContexts } from "@fedify/vocab-runtime";
-import serialize from "json-canon";
 import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import serialize from "json-canon";
 //#region src/sig/portable-collection.test.ts
 const AS = "https://www.w3.org/ns/activitystreams#";
 const context = [

package/dist/sig/portable-key.test.mjs

@@ -2,18 +2,18 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
-import { i as fetchKey } from "../key-BZ-Z4uez.mjs";
-import { h as verifyJsonLd, p as signJsonLd } from "../ld-Djxsq6JR.mjs";
-import { d as verifyProof, r as createProof } from "../proof-vZ04IAjq.mjs";
-import { d as verifyRequest, f as verifyRequestDetailed, l as signRequest } from "../http-CXnNbRe_.mjs";
+import { i as fetchKey } from "../key-C6jnekFI.mjs";
+import { h as verifyJsonLd, p as signJsonLd } from "../ld-ya2C1Xip.mjs";
+import { d as verifyProof, r as createProof } from "../proof-BdO3BbLh.mjs";
+import { d as verifyRequest, f as verifyRequestDetailed, l as signRequest } from "../http-DV_yW4dv.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-OdWSE8am.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-C6Nv5yyw.mjs";
 import { t as KvKeyCache } from "../keycache-BInaECGj.mjs";
 import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 import { FetchError, encodeMultibase, exportDidKey, exportSpki, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
-import serialize from "json-canon";
 import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import serialize from "json-canon";
 //#region src/sig/portable-key.test.ts
 const did = await exportDidKey(ed25519PublicKey.publicKey);
 const didKeyId = `${did}#${did.slice(8)}`;

package/dist/sig/proof.test.mjs

@@ -10,10 +10,10 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as signObject, c as verifyPortableObjectProof, d as verifyProof, i as hasProofLike, r as createProof, s as verifyObject } from "../proof-vZ04IAjq.mjs";
-import { d as verifyRequest } from "../http-CXnNbRe_.mjs";
+import { a as signObject, c as verifyPortableObjectProof, d as verifyProof, i as hasProofLike, r as createProof, s as verifyObject } from "../proof-BdO3BbLh.mjs";
+import { d as verifyRequest } from "../http-DV_yW4dv.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-vc-pSu9-.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-C5p26tpa.mjs";
 import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place, Translation } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";

package/dist/{tasks-dbCShlCb.mjs → tasks-IG3pHfvZ.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { t as mockDocumentLoader } from "./dist-BQvArojP.mjs";
+import { t as mockDocumentLoader } from "./dist-DJQM4u7i.mjs";
 import { t as MemoryKvStore } from "./kv-DCHkaJ9-.mjs";
 import { Note } from "@fedify/vocab";
 //#region src/testing/tasks.ts

package/dist/{temporal-BTD4f_mZ.mjs → temporal-CbPfRGZq.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-Djxsq6JR.mjs";
+import { c as getNormalizationContextLoader } from "./ld-ya2C1Xip.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/context.test.mjs

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as test } from "../dist-BQvArojP.mjs";
+import { n as test } from "../dist-DJQM4u7i.mjs";
 import { strictEqual } from "node:assert/strict";
 //#region src/testing/context.test.ts
 test("ignored nested test steps return false", async (t) => {

package/dist/testing/kv.test.mjs

@@ -1,12 +1,12 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as test } from "../dist-BQvArojP.mjs";
+import { n as test } from "../dist-DJQM4u7i.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
-import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
+import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-IG3pHfvZ.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
-import { o as createFederation } from "../middleware-DDa8pCUa.mjs";
+import { o as createFederation } from "../middleware-Bdwd_Gg8.mjs";
 //#region src/testing/kv.test.ts
 test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
 	const kv = new ManualClockKvStore();

package/dist/testing/mod.d.mts

@@ -3317,12 +3317,38 @@ interface Context<TContextData> {
   getPortableFeaturedTagsUri(identifier: string, authority: string): URL;
   /**
    * Determines the type of the URI and extracts the associated data.
+   *
+   * By default, only URIs on this server's origin are recognized.  With
+   * the `portable` option, [FEP-ef61] portable IDs, e.g.,
+   * `ap+ef61://did:key:z6Mk.../users/alice`, and their compatible
+   * identifiers on any gateway, e.g.,
+   * `https://example.com/.well-known/apgateway/did:key:z6Mk.../users/alice`,
+   * are also recognized by the same paths that the gateway endpoint routes
+   * to the dispatchers, and the result has the DID in its `authority`
+   * property.
+   *
+   * The DID of a portable ID is anyone's to choose, so recognizing it does
+   * not mean that this server hosts anything for the DID.  Check that
+   * `authority` is the DID that the application stores for the actor or
+   * object before acting on it:
+   *
+   * ~~~~ typescript
+   * const parsed = ctx.parseUri(follow.objectId, { portable: true });
+   * if (parsed?.type !== "actor") return;
+   * const user = await getUser(parsed.identifier);
+   * if (user == null) return;
+   * if (parsed.authority != null && parsed.authority !== user.did) return;
+   * ~~~~
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
    * @param uri The URI to parse.
+   * @param options Options for parsing the URI.  Since 2.4.0.
    * @returns The result of parsing the URI.  If `null` is given or
    *          the URI is not recognized, `null` is returned.
    * @since 0.9.0
    */
-  parseUri(uri: URL | null): ParseUriResult | null;
+  parseUri(uri: URL | null, options?: ParseUriOptions): ParseUriResult | null;
   /**
    * Gets the key pairs for an actor.
    * @param identifier The actor's identifier.
@@ -4220,6 +4246,30 @@ interface OutboxContext<TContextData> extends Context<TContextData> {
    */
   clone(data: TContextData): OutboxContext<TContextData>;
 }
+/**
+ * Options for {@link Context.parseUri}.
+ * @since 2.4.0
+ */
+interface ParseUriOptions {
+  /**
+   * Whether to also recognize [FEP-ef61] portable IDs, i.e., `ap:` and
+   * `ap+ef61:` URIs, and their compatible identifiers on any gateway.
+   * The result of a portable ID has its DID, without percent-encoding, in
+   * the `authority` property, which the caller has to compare with the DID
+   * that it stores for the actor or object, since anyone can make a portable
+   * ID with the same path under another DID.
+   *
+   * Like URIs on this server's origin, a portable ID is recognized by its
+   * path, and its query, e.g., location hints, and fragment are ignored.
+   * A shared inbox is never recognized in a portable ID, and a portable ID
+   * with a malformed DID, or with a `did:key` DID that is not encoded in
+   * base58-btc, is not recognized either.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @default `false`
+   */
+  readonly portable?: boolean;
+}
 /**
  * A result of parsing an URI.
  */
@@ -4230,6 +4280,12 @@ type ParseUriResult =
 {
   readonly type: "actor";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of an object URI.
@@ -4239,6 +4295,12 @@ type ParseUriResult =
   readonly class: ConstructorWithTypeId<Object$1>;
   readonly typeId: URL;
   readonly values: Record<string, string>;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of an shared inbox URI.
@@ -4246,6 +4308,7 @@ type ParseUriResult =
 | {
   readonly type: "inbox";
   readonly identifier: undefined;
+  readonly authority?: undefined;
 }
 /**
  * The case of an personal inbox URI.
@@ -4253,6 +4316,12 @@ type ParseUriResult =
 | {
   readonly type: "inbox";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of an outbox collection URI.
@@ -4260,6 +4329,12 @@ type ParseUriResult =
 | {
   readonly type: "outbox";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a following collection URI.
@@ -4267,6 +4342,12 @@ type ParseUriResult =
 | {
   readonly type: "following";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a followers collection URI.
@@ -4274,6 +4355,12 @@ type ParseUriResult =
 | {
   readonly type: "followers";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a liked collection URI.
@@ -4282,6 +4369,12 @@ type ParseUriResult =
 | {
   readonly type: "liked";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a featured collection URI.
@@ -4290,6 +4383,12 @@ type ParseUriResult =
 | {
   readonly type: "featured";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a featured tags collection URI.
@@ -4298,6 +4397,12 @@ type ParseUriResult =
 | {
   readonly type: "featuredTags";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a custom collection URI.
@@ -4309,6 +4414,12 @@ type ParseUriResult =
   readonly class: ConstructorWithTypeId<Object$1>;
   readonly typeId: URL;
   readonly values: Record<string, string>;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a custom ordered collection URI.
@@ -4320,6 +4431,12 @@ type ParseUriResult =
   readonly class: ConstructorWithTypeId<Object$1>;
   readonly typeId: URL;
   readonly values: Record<string, string>;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 };
 /**
  * Options for {@link Context.sendActivity} method.

package/dist/testing/mod.mjs

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { r as testDefinitions } from "../dist-BQvArojP.mjs";
-import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-OrnjnuMq.mjs";
+import { r as testDefinitions } from "../dist-DJQM4u7i.mjs";
+import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-B2rlkkyJ.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
-import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, r as envelopeSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
-import "../testing-CKaJhcA0.mjs";
+import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, r as envelopeSchema, t as MockQueue } from "../tasks-IG3pHfvZ.mjs";
+import "../testing-C1itIjqW.mjs";
 export { ManualClockKvStore, MockQueue, baseOptions, createInboxContext, createOutboxContext, createRequestContext, envelopeSchema, makeSchema, numberSchema, stringSchema, testDefinitions };

package/dist/{testing-CKaJhcA0.mjs → testing-C1itIjqW.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import "./dist-BQvArojP.mjs";
-import "./context-OrnjnuMq.mjs";
+import "./dist-DJQM4u7i.mjs";
+import "./context-B2rlkkyJ.mjs";
 import "./kv-DBRWVx3Q.mjs";
-import "./tasks-dbCShlCb.mjs";
+import "./tasks-IG3pHfvZ.mjs";
 export {};

package/dist/{types-C_cNlNVK.js → types-_S2_MeLF.js}

@@ -92,8 +92,8 @@ const DEFAULT_MAX_REDIRECTION = 5;
 * bounce the request to an internal address.
 * @param url The URL to fetch.
 * @param headers The request headers.
-* @returns The final response, or `null` if the URL is disallowed or there
-*          are too many redirects.
+* @returns The final response, or `null` if the URL is disallowed, its
+*          hostname cannot be resolved, or there are too many redirects.
 */
 async function fetchPublicUrl(url, headers) {
 	let current = url instanceof URL ? url : new URL(url);
@@ -103,7 +103,11 @@ async function fetchPublicUrl(url, headers) {
 			await validatePublicUrl(current.href);
 		} catch (e) {
 			if (e instanceof UrlError) {
-				logger.error("Refused to fetch a private or invalid URL {url}: {error}", {
+				if (e.reason === "dns") logger.error("DNS lookup failed for {url}: {error}", {
+					url: current.href,
+					error: e
+				});
+				else logger.error("Refused to fetch a private or invalid URL {url}: {error}", {
 					url: current.href,
 					error: e
 				});

package/dist/{types-Be2zbyeG.cjs → types-poIao40f.cjs}

@@ -91,8 +91,8 @@ const DEFAULT_MAX_REDIRECTION = 5;
 * bounce the request to an internal address.
 * @param url The URL to fetch.
 * @param headers The request headers.
-* @returns The final response, or `null` if the URL is disallowed or there
-*          are too many redirects.
+* @returns The final response, or `null` if the URL is disallowed, its
+*          hostname cannot be resolved, or there are too many redirects.
 */
 async function fetchPublicUrl(url, headers) {
 	let current = url instanceof URL ? url : new URL(url);
@@ -102,7 +102,11 @@ async function fetchPublicUrl(url, headers) {
 			await (0, _fedify_vocab_runtime.validatePublicUrl)(current.href);
 		} catch (e) {
 			if (e instanceof _fedify_vocab_runtime.UrlError) {
-				logger.error("Refused to fetch a private or invalid URL {url}: {error}", {
+				if (e.reason === "dns") logger.error("DNS lookup failed for {url}: {error}", {
+					url: current.href,
+					error: e
+				});
+				else logger.error("Refused to fetch a private or invalid URL {url}: {error}", {
 					url: current.href,
 					error: e
 				});