@fedify/fedify 2.4.0-dev.2164 → 2.4.0-dev.2190

package/dist/federation/middleware.test.mjs

@@ -16,15 +16,15 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assertStrictEquals } from "../assert_strict_equals-CYvBmkpC.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { g as recordInboxActivity } from "../metrics-CFBEehTc.mjs";
-import { a as compactJsonLd, h as verifyJsonLd, p as signJsonLd, s as detachSignature } from "../ld-CyliEU48.mjs";
-import { a as signObject, s as verifyObject } from "../proof-CRTPWbVh.mjs";
-import { d as verifyRequest, l as signRequest } from "../http-DRH0n8TD.mjs";
+import { g as recordInboxActivity } from "../metrics-zMe834ID.mjs";
+import { a as compactJsonLd, h as verifyJsonLd, p as signJsonLd, s as detachSignature } from "../ld-oQj6j_hP.mjs";
+import { a as signObject, s as verifyObject } from "../proof-C9115DX_.mjs";
+import { f as verifyRequest, l as signRequest } from "../http-Y1ObT1A8.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-BBFAItNB.mjs";
-import { S as handleBenchmarkTrigger, i as KvSpecDeterminer, n as FederationImpl, o as createFederation, r as InboxContextImpl, t as ContextImpl } from "../middleware-B99JjvFn.mjs";
-import { t as doesActorOwnKey } from "../owner-DKdtsrEq.mjs";
-import { t as CircuitBreaker } from "../circuit-breaker-C5NqoLBJ.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-u6zzOExF.mjs";
+import { S as handleBenchmarkTrigger, i as KvSpecDeterminer, n as FederationImpl, o as createFederation, r as InboxContextImpl, t as ContextImpl } from "../middleware-Bdu2-OPD.mjs";
+import { t as doesActorOwnKey } from "../owner-Dem4fbwc.mjs";
+import { t as CircuitBreaker } from "../circuit-breaker-XJ53md4S.mjs";
 import { t as TaskCodec } from "../codec-C6rTrpIp.mjs";
 import { t as markCircuitBreakerLegacySweepDone } from "../circuit-breaker-test-utils-DW6YC_Pe.mjs";
 import { configure, reset } from "@logtape/logtape";
@@ -35,7 +35,7 @@ import { SpanStatusCode, metrics } from "@opentelemetry/api";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
 import dns from "node:dns/promises";
-import { deepStrictEqual, ok, rejects, strictEqual } from "node:assert/strict";
+import { deepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert/strict";
 import serialize from "json-canon";
 import { DataPointType, MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 //#region ../fixture/src/fixtures/example.com/create.json
@@ -1177,12 +1177,29 @@ test({
 	}
 });
 test("Federation.fetch() [rfc9421] multiple POST signatures", async (t) => {
-	for (const validSecond of [true, false]) await t.step(validSecond ? "valid second signature" : "both signatures invalid", async () => {
+	for (const [name, validSecond, maxHttpSignatures] of [
+		[
+			"valid second signature",
+			true,
+			void 0
+		],
+		[
+			"both signatures invalid",
+			false,
+			void 0
+		],
+		[
+			"valid second signature beyond maxHttpSignatures",
+			true,
+			1
+		]
+	]) await t.step(name, async () => {
 		const inbox = [];
 		const federation = createFederation({
 			kv: new MemoryKvStore(),
 			documentLoaderFactory: () => mockDocumentLoader,
-			contextLoaderFactory: () => mockDocumentLoader
+			contextLoaderFactory: () => mockDocumentLoader,
+			maxHttpSignatures
 		});
 		federation.setActorDispatcher("/users/{identifier}", (ctx, identifier) => new vocab.Person({ id: ctx.getActorUri(identifier) }));
 		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(vocab.Create, (_ctx, activity) => {
@@ -1197,8 +1214,50 @@ test("Federation.fetch() [rfc9421] multiple POST signatures", async (t) => {
 		const signature = signed.headers.get("Signature");
 		signed.headers.set("Signature-Input", `${input}, ${input.replace(/^sig1=/, "sig2=")}`);
 		signed.headers.set("Signature", `sig1=:AAAAAA==:, ${validSecond ? signature.replace(/^sig1=/, "sig2=") : "sig2=:AAAAAA==:"}`);
-		assertEquals((await federation.fetch(signed, { contextData: void 0 })).status, validSecond ? 202 : 401);
-		assertEquals(inbox, validSecond ? [create_default.id] : []);
+		const response = await federation.fetch(signed, { contextData: void 0 });
+		const accepted = validSecond && maxHttpSignatures == null;
+		assertEquals(response.status, accepted ? 202 : 401);
+		assertEquals(inbox, accepted ? [create_default.id] : []);
+	});
+});
+test("FederationOptions.maxHttpSignatures", async (t) => {
+	const kv = new MemoryKvStore();
+	await t.step("defaults to three", () => {
+		const federation = createFederation({ kv });
+		assertInstanceOf(federation, FederationImpl);
+		assertEquals(federation.maxHttpSignatures, 3);
+	});
+	await t.step("rejects invalid values", () => {
+		for (const maxHttpSignatures of [
+			0,
+			-1,
+			1.5,
+			NaN,
+			2 ** 53,
+			null
+		]) assertThrows(() => createFederation({
+			kv,
+			maxHttpSignatures
+		}), RangeError);
+		const federation = createFederation({
+			kv,
+			maxHttpSignatures: Infinity
+		});
+		assertInstanceOf(federation, FederationImpl);
+		assertEquals(federation.maxHttpSignatures, Infinity);
+	});
+	await t.step("applies to RequestContext.getSignedKey()", async () => {
+		let request = new Request("https://example.com/", { headers: { "Accept": "application/ld+json" } });
+		for (const [label, keyId] of [["sig1", new URL("https://example.com/missing-key")], ["sig2", rsaPublicKey2.id]]) request = await signRequest(request, rsaPrivateKey2, keyId, {
+			spec: "rfc9421",
+			rfc9421: { label }
+		});
+		for (const maxHttpSignatures of [void 0, 1]) assertEquals(await createFederation({
+			kv,
+			documentLoaderFactory: () => mockDocumentLoader,
+			contextLoaderFactory: () => mockDocumentLoader,
+			maxHttpSignatures
+		}).createContext(request, void 0).getSignedKey(), maxHttpSignatures == null ? rsaPublicKey2 : null);
 	});
 });
 test("Federation.fetch()", async (t) => {
@@ -8236,5 +8295,70 @@ test("Federation.fetch() serves tombstones of objects", async (t) => {
 		});
 	});
 });
+test("createFederation() applies documentLoaderTimeout to built-in loaders", async (t) => {
+	esm_default.mockGlobal();
+	let requests = 0;
+	esm_default.get("begin:https://slow.example/", () => {
+		requests++;
+		return new Promise(() => {});
+	});
+	const isTimeout = (error) => {
+		ok(error instanceof FetchError, String(error));
+		strictEqual(error.response, void 0);
+		ok(error.cause instanceof DOMException);
+		strictEqual(error.cause.name, "TimeoutError");
+		ok(error.message.endsWith("Timed out after 100 ms"), error.message);
+		return true;
+	};
+	try {
+		await t.step("built-in loaders", async () => {
+			const ctx = createFederation({
+				kv: new MemoryKvStore(),
+				allowPrivateAddress: true,
+				documentLoaderTimeout: { milliseconds: 100 }
+			}).createContext(new URL("https://example.com/"), void 0);
+			await rejects(ctx.documentLoader("https://slow.example/object"), isTimeout);
+			await rejects(ctx.contextLoader("https://slow.example/context"), isTimeout);
+			await rejects(ctx.getDocumentLoader({
+				keyId: new URL("https://example.com/key2"),
+				privateKey: rsaPrivateKey2
+			})("https://slow.example/private"), isTimeout);
+			strictEqual(requests, 3);
+		});
+		await t.step("per-call override and null", async () => {
+			const federation = createFederation({
+				kv: new MemoryKvStore(),
+				allowPrivateAddress: true,
+				documentLoaderTimeout: null
+			});
+			await rejects(federation.documentLoaderFactory({ timeout: 100 })("https://slow.example/object"), isTimeout);
+			await rejects(federation.authenticatedDocumentLoaderFactory({
+				keyId: new URL("https://example.com/key2"),
+				privateKey: rsaPrivateKey2
+			}, { timeout: 100 })("https://slow.example/private"), isTimeout);
+			const controller = new AbortController();
+			const reason = /* @__PURE__ */ new Error("Canceled by the caller");
+			setTimeout(() => controller.abort(reason), 150);
+			await rejects(federation.documentLoaderFactory()("https://slow.example/object", { signal: controller.signal }), (error) => error === reason || error instanceof Error && error.name === "AbortError");
+		});
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("createFederation() validates documentLoaderTimeout", () => {
+	for (const documentLoaderTimeout of [
+		{ milliseconds: 0 },
+		{ seconds: -1 },
+		{ days: 25 },
+		{ months: 1 }
+	]) throws(() => createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderTimeout
+	}), RangeError);
+	createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderTimeout: Temporal.Duration.from({ seconds: 30 })
+	});
+});
 //#endregion
 export {};

package/dist/federation/mod.cjs

@@ -1,6 +1,6 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_federation = require("../federation-DFCnp94y.cjs");
+const require_federation = require("../federation-BSS2dUO7.cjs");
 exports.CircuitBreaker = require_federation.CircuitBreaker;
 exports.InProcessMessageQueue = require_federation.InProcessMessageQueue;
 exports.MemoryKvStore = require_federation.MemoryKvStore;

package/dist/federation/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as respondWithObjectIfAcceptable, A as InboxListenerSetters, At as HashlinkMediaDispatcher, B as Message, Bt as OutboxListenerErrorHandler, C as FederationBuilder, Ct as AuthorizePredicate, D as IdempotencyKeyCallback, Dt as CustomCollectionCounter, E as FederationStartQueueOptions, Et as CollectionDispatcher, F as Rfc6570Expression, Ft as NodeInfoDispatcher, G as TaskHandler, Gt as UnverifiedActivityHandler, H as TaskDefinition, Ht as PortableActorIdMapper, I as FederationKvPrefixes, It as ObjectAuthorizePredicate, J as RetryContext, Jt as SendActivityError, K as TaskRegistry, Kt as UnverifiedActivityReason, L as FederationOrigin, Lt as ObjectDispatcher, M as ObjectCallbackSetters, Mt as InboxErrorHandler, N as OutboxListenerSetters, Nt as InboxListener, O as IdempotencyStrategy, Ot as CustomCollectionCursor, P as PortableInboxForwardingOptions, Pt as MediaUploaderCallback, Q as respondWithObject, Qt as digest, R as FederationQueueOptions, Rt as OutboxErrorHandler, S as FederationBenchmarkOptions, St as ActorKeyPairsDispatcher, T as FederationOptions, Tt as CollectionCursor, U as TaskDefinitionOptions, Ut as PortableCollectionOwnerMapper, V as createFederationBuilder, Vt as OutboxPermanentFailureHandler, W as TaskEnqueueOptions, Wt as SharedInboxKeyDispatcher, X as createExponentialBackoffPolicy, Xt as PageItems, Y as RetryPolicy, Yt as SenderKeyPair, Z as RespondWithObjectOptions, Zt as buildCollectionSynchronizationHeader, _ as CollectionCallbackSetters, _t as normalizeCircuitBreakerOptions, a as GetObjectOptions, at as MessageQueueListenOptions, b as Federatable, bt as ActorDispatcher, c as OutboxContext, ct as CircuitBreakerActivityDrop, d as PortableRequest, dt as CircuitBreakerFailurePolicy, et as InProcessMessageQueue, f as RequestContext, ft as CircuitBreakerKvState, g as ActorCallbackSetters, gt as NormalizedCircuitBreakerOptions, h as SendActivityOptionsForCollection, ht as CircuitBreakerStateChange, i as GetActorOptions, it as MessageQueueEnqueueOptions, j as MediaUploaderSetters, jt as HashlinkMediaRequest, k as InboxChallengePolicy, kt as CustomCollectionDispatcher, l as ParseUriOptions, lt as CircuitBreakerBeforeSendDecision, m as SendActivityOptions, mt as CircuitBreakerState, n as Context, nt as MessageQueue, o as GetSignedKeyOptions, ot as ParallelMessageQueue, p as RouteActivityOptions, pt as CircuitBreakerOptions, q as CreateExponentialBackoffPolicyOptions, qt as WebFingerLinksDispatcher, r as ForwardActivityOptions, rt as MessageQueueDepth, s as InboxContext, st as CircuitBreaker, t as ActorKeyPair, tt as InProcessMessageQueueOptions, u as ParseUriResult, ut as CircuitBreakerCreateOptions, v as ConstructorWithTypeId, vt as parseCircuitBreakerKvState, w as FederationFetchOptions, wt as CollectionCounter, x as Federation, xt as ActorHandleMapper, y as CustomCollectionCallbackSetters, yt as ActorAliasMapper, z as createFederation, zt as OutboxListener } from "../context-L0Fnib9j.cjs";
+import { $ as respondWithObjectIfAcceptable, A as InboxListenerSetters, At as HashlinkMediaDispatcher, B as Message, Bt as OutboxListenerErrorHandler, C as FederationBuilder, Ct as AuthorizePredicate, D as IdempotencyKeyCallback, Dt as CustomCollectionCounter, E as FederationStartQueueOptions, Et as CollectionDispatcher, F as Rfc6570Expression, Ft as NodeInfoDispatcher, G as TaskHandler, Gt as UnverifiedActivityHandler, H as TaskDefinition, Ht as PortableActorIdMapper, I as FederationKvPrefixes, It as ObjectAuthorizePredicate, J as RetryContext, Jt as SendActivityError, K as TaskRegistry, Kt as UnverifiedActivityReason, L as FederationOrigin, Lt as ObjectDispatcher, M as ObjectCallbackSetters, Mt as InboxErrorHandler, N as OutboxListenerSetters, Nt as InboxListener, O as IdempotencyStrategy, Ot as CustomCollectionCursor, P as PortableInboxForwardingOptions, Pt as MediaUploaderCallback, Q as respondWithObject, Qt as digest, R as FederationQueueOptions, Rt as OutboxErrorHandler, S as FederationBenchmarkOptions, St as ActorKeyPairsDispatcher, T as FederationOptions, Tt as CollectionCursor, U as TaskDefinitionOptions, Ut as PortableCollectionOwnerMapper, V as createFederationBuilder, Vt as OutboxPermanentFailureHandler, W as TaskEnqueueOptions, Wt as SharedInboxKeyDispatcher, X as createExponentialBackoffPolicy, Xt as PageItems, Y as RetryPolicy, Yt as SenderKeyPair, Z as RespondWithObjectOptions, Zt as buildCollectionSynchronizationHeader, _ as CollectionCallbackSetters, _t as normalizeCircuitBreakerOptions, a as GetObjectOptions, at as MessageQueueListenOptions, b as Federatable, bt as ActorDispatcher, c as OutboxContext, ct as CircuitBreakerActivityDrop, d as PortableRequest, dt as CircuitBreakerFailurePolicy, et as InProcessMessageQueue, f as RequestContext, ft as CircuitBreakerKvState, g as ActorCallbackSetters, gt as NormalizedCircuitBreakerOptions, h as SendActivityOptionsForCollection, ht as CircuitBreakerStateChange, i as GetActorOptions, it as MessageQueueEnqueueOptions, j as MediaUploaderSetters, jt as HashlinkMediaRequest, k as InboxChallengePolicy, kt as CustomCollectionDispatcher, l as ParseUriOptions, lt as CircuitBreakerBeforeSendDecision, m as SendActivityOptions, mt as CircuitBreakerState, n as Context, nt as MessageQueue, o as GetSignedKeyOptions, ot as ParallelMessageQueue, p as RouteActivityOptions, pt as CircuitBreakerOptions, q as CreateExponentialBackoffPolicyOptions, qt as WebFingerLinksDispatcher, r as ForwardActivityOptions, rt as MessageQueueDepth, s as InboxContext, st as CircuitBreaker, t as ActorKeyPair, tt as InProcessMessageQueueOptions, u as ParseUriResult, ut as CircuitBreakerCreateOptions, v as ConstructorWithTypeId, vt as parseCircuitBreakerKvState, w as FederationFetchOptions, wt as CollectionCounter, x as Federation, xt as ActorHandleMapper, y as CustomCollectionCallbackSetters, yt as ActorAliasMapper, z as createFederation, zt as OutboxListener } from "../context-CDcAgm4l.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-BhNbN8Ed.cjs";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "../mod-BLOXGs6m.cjs";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "../mod-D58KCqUg.cjs";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetActorOptions, GetObjectOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriOptions, ParseUriResult, PortableActorIdMapper, PortableCollectionOwnerMapper, PortableInboxForwardingOptions, PortableRequest, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, normalizeCircuitBreakerOptions, parseCircuitBreakerKvState, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $ as respondWithObjectIfAcceptable, A as InboxListenerSetters, At as HashlinkMediaDispatcher, B as Message, Bt as OutboxListenerErrorHandler, C as FederationBuilder, Ct as AuthorizePredicate, D as IdempotencyKeyCallback, Dt as CustomCollectionCounter, E as FederationStartQueueOptions, Et as CollectionDispatcher, F as Rfc6570Expression, Ft as NodeInfoDispatcher, G as TaskHandler, Gt as UnverifiedActivityHandler, H as TaskDefinition, Ht as PortableActorIdMapper, I as FederationKvPrefixes, It as ObjectAuthorizePredicate, J as RetryContext, Jt as SendActivityError, K as TaskRegistry, Kt as UnverifiedActivityReason, L as FederationOrigin, Lt as ObjectDispatcher, M as ObjectCallbackSetters, Mt as InboxErrorHandler, N as OutboxListenerSetters, Nt as InboxListener, O as IdempotencyStrategy, Ot as CustomCollectionCursor, P as PortableInboxForwardingOptions, Pt as MediaUploaderCallback, Q as respondWithObject, Qt as digest, R as FederationQueueOptions, Rt as OutboxErrorHandler, S as FederationBenchmarkOptions, St as ActorKeyPairsDispatcher, T as FederationOptions, Tt as CollectionCursor, U as TaskDefinitionOptions, Ut as PortableCollectionOwnerMapper, V as createFederationBuilder, Vt as OutboxPermanentFailureHandler, W as TaskEnqueueOptions, Wt as SharedInboxKeyDispatcher, X as createExponentialBackoffPolicy, Xt as PageItems, Y as RetryPolicy, Yt as SenderKeyPair, Z as RespondWithObjectOptions, Zt as buildCollectionSynchronizationHeader, _ as CollectionCallbackSetters, _t as normalizeCircuitBreakerOptions, a as GetObjectOptions, at as MessageQueueListenOptions, b as Federatable, bt as ActorDispatcher, c as OutboxContext, ct as CircuitBreakerActivityDrop, d as PortableRequest, dt as CircuitBreakerFailurePolicy, et as InProcessMessageQueue, f as RequestContext, ft as CircuitBreakerKvState, g as ActorCallbackSetters, gt as NormalizedCircuitBreakerOptions, h as SendActivityOptionsForCollection, ht as CircuitBreakerStateChange, i as GetActorOptions, it as MessageQueueEnqueueOptions, j as MediaUploaderSetters, jt as HashlinkMediaRequest, k as InboxChallengePolicy, kt as CustomCollectionDispatcher, l as ParseUriOptions, lt as CircuitBreakerBeforeSendDecision, m as SendActivityOptions, mt as CircuitBreakerState, n as Context, nt as MessageQueue, o as GetSignedKeyOptions, ot as ParallelMessageQueue, p as RouteActivityOptions, pt as CircuitBreakerOptions, q as CreateExponentialBackoffPolicyOptions, qt as WebFingerLinksDispatcher, r as ForwardActivityOptions, rt as MessageQueueDepth, s as InboxContext, st as CircuitBreaker, t as ActorKeyPair, tt as InProcessMessageQueueOptions, u as ParseUriResult, ut as CircuitBreakerCreateOptions, v as ConstructorWithTypeId, vt as parseCircuitBreakerKvState, w as FederationFetchOptions, wt as CollectionCounter, x as Federation, xt as ActorHandleMapper, y as CustomCollectionCallbackSetters, yt as ActorAliasMapper, z as createFederation, zt as OutboxListener } from "../context-BykNUf04.js";
+import { $ as respondWithObjectIfAcceptable, A as InboxListenerSetters, At as HashlinkMediaDispatcher, B as Message, Bt as OutboxListenerErrorHandler, C as FederationBuilder, Ct as AuthorizePredicate, D as IdempotencyKeyCallback, Dt as CustomCollectionCounter, E as FederationStartQueueOptions, Et as CollectionDispatcher, F as Rfc6570Expression, Ft as NodeInfoDispatcher, G as TaskHandler, Gt as UnverifiedActivityHandler, H as TaskDefinition, Ht as PortableActorIdMapper, I as FederationKvPrefixes, It as ObjectAuthorizePredicate, J as RetryContext, Jt as SendActivityError, K as TaskRegistry, Kt as UnverifiedActivityReason, L as FederationOrigin, Lt as ObjectDispatcher, M as ObjectCallbackSetters, Mt as InboxErrorHandler, N as OutboxListenerSetters, Nt as InboxListener, O as IdempotencyStrategy, Ot as CustomCollectionCursor, P as PortableInboxForwardingOptions, Pt as MediaUploaderCallback, Q as respondWithObject, Qt as digest, R as FederationQueueOptions, Rt as OutboxErrorHandler, S as FederationBenchmarkOptions, St as ActorKeyPairsDispatcher, T as FederationOptions, Tt as CollectionCursor, U as TaskDefinitionOptions, Ut as PortableCollectionOwnerMapper, V as createFederationBuilder, Vt as OutboxPermanentFailureHandler, W as TaskEnqueueOptions, Wt as SharedInboxKeyDispatcher, X as createExponentialBackoffPolicy, Xt as PageItems, Y as RetryPolicy, Yt as SenderKeyPair, Z as RespondWithObjectOptions, Zt as buildCollectionSynchronizationHeader, _ as CollectionCallbackSetters, _t as normalizeCircuitBreakerOptions, a as GetObjectOptions, at as MessageQueueListenOptions, b as Federatable, bt as ActorDispatcher, c as OutboxContext, ct as CircuitBreakerActivityDrop, d as PortableRequest, dt as CircuitBreakerFailurePolicy, et as InProcessMessageQueue, f as RequestContext, ft as CircuitBreakerKvState, g as ActorCallbackSetters, gt as NormalizedCircuitBreakerOptions, h as SendActivityOptionsForCollection, ht as CircuitBreakerStateChange, i as GetActorOptions, it as MessageQueueEnqueueOptions, j as MediaUploaderSetters, jt as HashlinkMediaRequest, k as InboxChallengePolicy, kt as CustomCollectionDispatcher, l as ParseUriOptions, lt as CircuitBreakerBeforeSendDecision, m as SendActivityOptions, mt as CircuitBreakerState, n as Context, nt as MessageQueue, o as GetSignedKeyOptions, ot as ParallelMessageQueue, p as RouteActivityOptions, pt as CircuitBreakerOptions, q as CreateExponentialBackoffPolicyOptions, qt as WebFingerLinksDispatcher, r as ForwardActivityOptions, rt as MessageQueueDepth, s as InboxContext, st as CircuitBreaker, t as ActorKeyPair, tt as InProcessMessageQueueOptions, u as ParseUriResult, ut as CircuitBreakerCreateOptions, v as ConstructorWithTypeId, vt as parseCircuitBreakerKvState, w as FederationFetchOptions, wt as CollectionCounter, x as Federation, xt as ActorHandleMapper, y as CustomCollectionCallbackSetters, yt as ActorAliasMapper, z as createFederation, zt as OutboxListener } from "../context-9T--NSo4.js";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "../kv-BhNbN8Ed.js";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "../mod-DK0y9fd-.js";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "../mod-B3OBLj5g.js";
 export { ActorAliasMapper, ActorCallbackSetters, ActorDispatcher, ActorHandleMapper, ActorKeyPair, ActorKeyPairsDispatcher, AuthorizePredicate, CircuitBreaker, CircuitBreakerActivityDrop, CircuitBreakerBeforeSendDecision, CircuitBreakerCreateOptions, CircuitBreakerFailurePolicy, CircuitBreakerKvState, CircuitBreakerOptions, CircuitBreakerState, CircuitBreakerStateChange, CollectionCallbackSetters, CollectionCounter, CollectionCursor, CollectionDispatcher, ConstructorWithTypeId, Context, CreateExponentialBackoffPolicyOptions, CustomCollectionCallbackSetters, CustomCollectionCounter, CustomCollectionCursor, CustomCollectionDispatcher, Federatable, Federation, FederationBenchmarkOptions, FederationBuilder, FederationFetchOptions, FederationKvPrefixes, FederationOptions, FederationOrigin, FederationQueueOptions, FederationStartQueueOptions, ForwardActivityOptions, GetActorOptions, GetObjectOptions, GetSignedKeyOptions, HashlinkMediaDispatcher, HashlinkMediaRequest, IdempotencyKeyCallback, IdempotencyStrategy, InProcessMessageQueue, InProcessMessageQueueOptions, InboxChallengePolicy, InboxContext, InboxErrorHandler, InboxListener, InboxListenerSetters, KvKey, KvStore, KvStoreListEntry, KvStoreSetOptions, MediaUploaderCallback, MediaUploaderSetters, MemoryKvStore, Message, MessageQueue, MessageQueueDepth, MessageQueueEnqueueOptions, MessageQueueListenOptions, NodeInfoDispatcher, NormalizedCircuitBreakerOptions, ObjectAuthorizePredicate, ObjectCallbackSetters, ObjectDispatcher, OutboxContext, OutboxErrorHandler, OutboxListener, OutboxListenerErrorHandler, OutboxListenerSetters, OutboxPermanentFailureHandler, PageItems, ParallelMessageQueue, ParseUriOptions, ParseUriResult, PortableActorIdMapper, PortableCollectionOwnerMapper, PortableInboxForwardingOptions, PortableRequest, RequestContext, RespondWithObjectOptions, RetryContext, RetryPolicy, Rfc6570Expression, RouteActivityOptions, Router, RouterError, RouterOptions, RouterRouteResult, SendActivityError, SendActivityOptions, SendActivityOptionsForCollection, SenderKeyPair, SharedInboxKeyDispatcher, TaskDefinition, TaskDefinitionOptions, TaskEnqueueOptions, TaskHandler, TaskRegistry, UnverifiedActivityHandler, UnverifiedActivityReason, WebFingerHandlerParameters, WebFingerLinksDispatcher, buildCollectionSynchronizationHeader, createExponentialBackoffPolicy, createFederation, createFederationBuilder, digest, handleWebFinger, normalizeCircuitBreakerOptions, parseCircuitBreakerKvState, respondWithObject, respondWithObjectIfAcceptable };

package/dist/federation/mod.js

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { a as respondWithObjectIfAcceptable, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as respondWithObject, l as CircuitBreaker, n as handleWebFinger, o as SendActivityError, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "../middleware-CdpTFsa2.js";
+import { a as respondWithObjectIfAcceptable, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as respondWithObject, l as CircuitBreaker, n as handleWebFinger, o as SendActivityError, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "../middleware-CaR2MRWY.js";
 import { getLogger } from "@logtape/logtape";
 import { Router as Router$1, RouterError as RouterError$1, assertPath, isPath } from "@fedify/uri-template";
 import { isEqual } from "es-toolkit";

package/dist/federation/outgoing-proof.test.mjs

@@ -7,12 +7,12 @@ import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as exportJwk } from "../key-D5awqp7u.mjs";
-import { s as detachSignature } from "../ld-CyliEU48.mjs";
-import { a as signObject } from "../proof-CRTPWbVh.mjs";
+import { n as exportJwk } from "../key-DyXf88bq.mjs";
+import { s as detachSignature } from "../ld-oQj6j_hP.mjs";
+import { a as signObject } from "../proof-C9115DX_.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { c as assertPortableActorActivity, n as FederationImpl, o as createFederation } from "../middleware-B99JjvFn.mjs";
-import { a as verifyCompoundPortableObjectProofs } from "../compound-proof-CxDBdtNz.mjs";
+import { c as assertPortableActorActivity, n as FederationImpl, o as createFederation } from "../middleware-Bdu2-OPD.mjs";
+import { a as verifyCompoundPortableObjectProofs } from "../compound-proof-F2jjkrt0.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { Create, Note, Person } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";

package/dist/federation/portable-actor.test.mjs

@@ -8,10 +8,10 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as signObject, c as verifyPortableObjectProof } from "../proof-CRTPWbVh.mjs";
-import { d as verifyRequest, l as signRequest } from "../http-DRH0n8TD.mjs";
+import { a as signObject, c as verifyPortableObjectProof } from "../proof-C9115DX_.mjs";
+import { f as verifyRequest, l as signRequest } from "../http-Y1ObT1A8.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { b as PORTABLE_OBJECT_CONTENT_TYPE, o as createFederation } from "../middleware-B99JjvFn.mjs";
+import { b as PORTABLE_OBJECT_CONTENT_TYPE, o as createFederation } from "../middleware-Bdu2-OPD.mjs";
 import { n as RouterError } from "../router-u5O5KCQr.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { Note, Person, Tombstone, lookupObject } from "@fedify/vocab";

package/dist/federation/portable-chain.test.mjs

@@ -7,10 +7,10 @@ import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as exportJwk } from "../key-D5awqp7u.mjs";
-import { c as verifyPortableObjectProof, s as verifyObject } from "../proof-CRTPWbVh.mjs";
+import { n as exportJwk } from "../key-DyXf88bq.mjs";
+import { c as verifyPortableObjectProof, s as verifyObject } from "../proof-C9115DX_.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as FederationImpl } from "../middleware-B99JjvFn.mjs";
+import { n as FederationImpl } from "../middleware-Bdu2-OPD.mjs";
 import { Create, DataIntegrityProof, Note, OrderedCollection, Person, traverseCollection } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, encodeMultibase, exportDidKey } from "@fedify/vocab-runtime";

package/dist/federation/portable-collection.test.mjs

@@ -7,11 +7,11 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as signObject } from "../proof-CRTPWbVh.mjs";
+import { a as signObject } from "../proof-C9115DX_.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { b as PORTABLE_OBJECT_CONTENT_TYPE, o as createFederation } from "../middleware-B99JjvFn.mjs";
-import { t as verifyPortableObject } from "../portable-collection-Cb5cdPIU.mjs";
-import { s as verifyServedPortableObjects } from "../compound-proof-CxDBdtNz.mjs";
+import { b as PORTABLE_OBJECT_CONTENT_TYPE, o as createFederation } from "../middleware-Bdu2-OPD.mjs";
+import { t as verifyPortableObject } from "../portable-collection-BL6aZlQ0.mjs";
+import { s as verifyServedPortableObjects } from "../compound-proof-F2jjkrt0.mjs";
 import { n as RouterError } from "../router-u5O5KCQr.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { Create, Note, Object as Object$1, OrderedCollection, Person, Tombstone, lookupObject, traverseCollection } from "@fedify/vocab";

package/dist/federation/portable-gateway-keys.test.mjs

@@ -7,14 +7,14 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { r as getVerifiedKeyOwnerEvidence } from "../key-owner-evidence-Bo3yaeL5.mjs";
-import { p as signJsonLd } from "../ld-CyliEU48.mjs";
-import { d as verifyRequest, f as verifyRequestDetailed, l as signRequest } from "../http-DRH0n8TD.mjs";
+import { r as getVerifiedKeyOwnerEvidence } from "../key-owner-evidence-APB6NpSk.mjs";
+import { p as signJsonLd } from "../ld-oQj6j_hP.mjs";
+import { f as verifyRequest, l as signRequest, p as verifyRequestDetailed } from "../http-Y1ObT1A8.mjs";
 import { a as rsaPrivateKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { f as handleInbox, n as FederationImpl, o as createFederation } from "../middleware-B99JjvFn.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DKdtsrEq.mjs";
+import { f as handleInbox, n as FederationImpl, o as createFederation } from "../middleware-Bdu2-OPD.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-Dem4fbwc.mjs";
 import { t as ActivityListenerSet } from "../activity-listener-C-BSbKI7.mjs";
-import { t as KvKeyCache } from "../keycache-PiOM9pM0.mjs";
+import { t as KvKeyCache } from "../keycache-Da8A8mZa.mjs";
 import { Create, CryptographicKey, Person } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, encodeMultibase, exportDidKey, parseIri } from "@fedify/vocab-runtime";

package/dist/federation/portable-inbox.test.mjs

@@ -8,11 +8,11 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { p as signJsonLd } from "../ld-CyliEU48.mjs";
-import { a as signObject } from "../proof-CRTPWbVh.mjs";
-import { f as verifyRequestDetailed, l as signRequest } from "../http-DRH0n8TD.mjs";
+import { p as signJsonLd } from "../ld-oQj6j_hP.mjs";
+import { a as signObject } from "../proof-C9115DX_.mjs";
+import { l as signRequest, p as verifyRequestDetailed } from "../http-Y1ObT1A8.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { _ as coversDelivery, o as createFederation, v as forwardPortableInboxActivity, y as resolvePortableInboxForwardingOptions } from "../middleware-B99JjvFn.mjs";
+import { _ as coversDelivery, o as createFederation, v as forwardPortableInboxActivity, y as resolvePortableInboxForwardingOptions } from "../middleware-Bdu2-OPD.mjs";
 import { Create, CryptographicKey, Follow, Note, Person, Tombstone } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { exportDidKey, formatIri, parseIri } from "@fedify/vocab-runtime";
@@ -964,13 +964,14 @@ async function signDelivery(body, { keyId = gateway2KeyId, privateKey = rsaGatew
 		body: JSON.stringify(body)
 	});
 }
-async function deliverToGateway(request, { loader, kv, maxTargets }) {
+async function deliverToGateway(request, { loader, kv, maxTargets, maxHttpSignatures }) {
 	const queue = new RecordingQueue();
 	const { federation, received, kv: store } = setup({
 		queue,
 		kv,
 		options: {
 			documentLoaderFactory: () => loader,
+			maxHttpSignatures,
 			...maxTargets == null ? {} : { portableInboxForwarding: { maxTargets } }
 		}
 	});
@@ -1030,6 +1031,35 @@ test("Federation.fetch() does not forward portable inbox deliveries back to the
 		assertEquals(forwardedGateways(queue), [GATEWAY3]);
 		assertFalse(urls.some((u) => u.startsWith("https://unrelated.example/")));
 	});
+	await t.step("with the gateway's signature beyond maxHttpSignatures", async () => {
+		const json = await signedFollow();
+		const unrelated = await signDelivery(json, {
+			spec: "rfc9421",
+			keyId: new URL("https://unrelated.example/key"),
+			privateKey: rsaPrivateKey3,
+			label: "sig1"
+		});
+		const gateway = await signDelivery(json, {
+			spec: "rfc9421",
+			label: "sig2"
+		});
+		const headers = new Headers(gateway.headers);
+		for (const name of ["Signature-Input", "Signature"]) headers.set(name, `${unrelated.headers.get(name)}, ${gateway.headers.get(name)}`);
+		const request = () => new Request(gateway.url, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(json)
+		});
+		for (const [maxHttpSignatures, expected] of [[2, [GATEWAY3]], [1, [GATEWAY2, GATEWAY3]]]) {
+			const { loader, urls } = recordLoader(gatewayLoader);
+			const { queue } = await deliverToGateway(request(), {
+				loader,
+				maxHttpSignatures
+			});
+			assertEquals(forwardedGateways(queue), [...expected].sort());
+			assertEquals(urls.some((u) => u.startsWith(GATEWAY2)), maxHttpSignatures > 1);
+		}
+	});
 	await t.step("activity authenticated by a Linked Data Signature", async () => {
 		const { queue } = await deliverToGateway(await signDelivery(await signJsonLd({
 			"@context": "https://www.w3.org/ns/activitystreams",

package/dist/federation/portable-parse-uri.test.mjs

@@ -7,7 +7,7 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { o as createFederation } from "../middleware-B99JjvFn.mjs";
+import { o as createFederation } from "../middleware-Bdu2-OPD.mjs";
 import { Note, Object as Object$1, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 import { exportDidKey, parseIri } from "@fedify/vocab-runtime";

package/dist/federation/portable-route-activity.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";