@fedify/fedify 2.4.0-dev.2169 → 2.4.0-dev.2190

package/dist/federation/portable-route-activity.test.mjs

@@ -0,0 +1,259 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { a as signObject } from "../proof-C9115DX_.mjs";
+import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
+import { o as createFederation } from "../middleware-Bdu2-OPD.mjs";
+import { Create, Note } from "@fedify/vocab";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+import { exportDidKey, formatIri, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+//#region src/federation/portable-route-activity.test.ts
+const did = await exportDidKey(ed25519PublicKey.publicKey);
+const keyId = new URL(`${did}#${did.slice(8)}`);
+const otherKeyPair = await crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+const otherDid = await exportDidKey(otherKeyPair.publicKey);
+const otherKeyId = new URL(`${otherDid}#${otherDid.slice(8)}`);
+const GATEWAY = "https://gw.example";
+function portableId(authority, path) {
+	return parseIri(`ap+ef61://${authority}${path}`);
+}
+function compatibleId(authority, path, gateway = GATEWAY) {
+	return new URL(`${gateway}/.well-known/apgateway/${authority}${path}`);
+}
+async function sign(activity, signer) {
+	return await signObject(activity, signer === "did" ? ed25519PrivateKey : otherKeyPair.privateKey, signer === "did" ? keyId : otherKeyId, { contextLoader: mockDocumentLoader });
+}
+/**
+* Routes a `Create` activity with the given ID through
+* `Context.routeActivity()`.  Unless `activity` is an `Activity`, the routed
+* activity has no proof, so that it is trusted only if it can be dereferenced
+* by its ID, which serves `served`.
+* @returns Whether the activity was routed, and the IDs of the actors of
+*          the activities that reached the inbox listener.
+*/
+async function route(activity, { served, actors } = {}) {
+	const documents = /* @__PURE__ */ new Map();
+	if (served != null && activity instanceof URL) {
+		const document = await served.toJsonLd({ contextLoader: mockDocumentLoader });
+		documents.set(activity.href, document);
+		if (activity.protocol === "ap+ef61:") {
+			documents.set(formatIri(activity), document);
+			documents.set(toCompatibleEf61Id(activity, GATEWAY).href, document);
+		}
+	}
+	const documentLoader = (url, options) => {
+		if (documents.has(url)) return Promise.resolve({
+			contextUrl: null,
+			documentUrl: url,
+			document: documents.get(url)
+		});
+		return mockDocumentLoader(url, options);
+	};
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderFactory: () => documentLoader,
+		contextLoaderFactory: () => mockDocumentLoader
+	});
+	const received = [];
+	federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Create, (_ctx, create) => {
+		received.push(...create.actorIds.map((id) => id.href));
+	});
+	return {
+		routed: await federation.createContext(new URL("https://example.com/")).routeActivity(null, activity instanceof URL ? new Create({
+			id: activity,
+			actors: [...actors ?? served?.actorIds ?? []]
+		}) : activity),
+		received
+	};
+}
+async function portableCreate(id, actors, signer = "did") {
+	return await sign(new Create({
+		id,
+		actors: [...actors],
+		object: new Note({ content: "Hello" })
+	}), signer);
+}
+test("Context.routeActivity() rejects portable activities attributed to other DIDs", async (t) => {
+	const cases = [
+		[
+			"ap+ef61: IDs",
+			portableId(did, "/activities/1"),
+			[portableId(otherDid, "/actor")]
+		],
+		[
+			"compatible identifiers on one gateway",
+			compatibleId(did, "/activities/1"),
+			[compatibleId(otherDid, "/actor")]
+		],
+		[
+			"compatible activity ID and ap+ef61: actor ID",
+			compatibleId(did, "/activities/1"),
+			[portableId(otherDid, "/actor")]
+		],
+		[
+			"ap+ef61: activity ID and compatible actor ID",
+			portableId(did, "/activities/1"),
+			[compatibleId(otherDid, "/actor")]
+		],
+		[
+			"one of multiple actors with another DID",
+			portableId(did, "/activities/1"),
+			[portableId(did, "/actor"), portableId(otherDid, "/actor")]
+		],
+		[
+			"ap+ef61: activity ID and HTTP(S) actor ID",
+			portableId(did, "/activities/1"),
+			[new URL("https://example.com/person")]
+		],
+		[
+			"compatible activity ID and HTTP(S) actor ID on the gateway",
+			compatibleId(did, "/activities/1"),
+			[new URL(`${GATEWAY}/users/alice`)]
+		]
+	];
+	for (const [name, id, actors] of cases) await t.step(name, async () => {
+		const served = await portableCreate(id, actors);
+		assertEquals(await route(id, { served }), {
+			routed: false,
+			received: []
+		});
+		assertEquals(await route(served), {
+			routed: false,
+			received: []
+		});
+	});
+});
+test("Context.routeActivity() accepts portable activities of the same DID", async (t) => {
+	const cases = [
+		[
+			"ap+ef61: IDs",
+			portableId(did, "/activities/1"),
+			[portableId(did, "/actor")]
+		],
+		[
+			"compatible identifiers on one gateway",
+			compatibleId(did, "/activities/1"),
+			[compatibleId(did, "/actor")]
+		],
+		[
+			"compatible identifiers on different gateways",
+			compatibleId(did, "/activities/1"),
+			[compatibleId(did, "/actor", "https://gw2.example")]
+		],
+		[
+			"compatible activity ID and ap+ef61: actor ID",
+			compatibleId(did, "/activities/1"),
+			[portableId(did, "/actor")]
+		],
+		[
+			"ap+ef61: activity ID and compatible actor ID",
+			portableId(did, "/activities/1"),
+			[compatibleId(did, "/actor")]
+		],
+		[
+			"actor ID with a location hint",
+			portableId(did, "/activities/1"),
+			[portableId(did, `/actor?@gateway=${encodeURIComponent(GATEWAY)}`)]
+		]
+	];
+	for (const [name, id, actors] of cases) await t.step(name, async () => {
+		const served = await portableCreate(id, actors);
+		const expected = {
+			routed: true,
+			received: actors.map((actor) => actor.href)
+		};
+		assertEquals(await route(id, { served }), expected);
+		assertEquals(await route(served), expected);
+	});
+});
+test("Context.routeActivity() compares portable activity IDs canonically", async (t) => {
+	const id = portableId(did, "/activities/1");
+	const actors = [portableId(did, "/actor")];
+	await t.step("compatible ID serving an ap+ef61: ID", async () => {
+		const served = await portableCreate(id, actors);
+		const { routed } = await route(compatibleId(did, "/activities/1"), { served });
+		assert(routed);
+	});
+	await t.step("ap+ef61: ID serving a compatible ID", async () => {
+		const served = await portableCreate(compatibleId(did, "/activities/1"), actors);
+		const { routed } = await route(id, { served });
+		assert(routed);
+	});
+	await t.step("ap+ef61: ID with a location hint", async () => {
+		const served = await portableCreate(id, actors);
+		const { routed } = await route(portableId(did, `/activities/1?@gateway=${encodeURIComponent(GATEWAY)}`), { served });
+		assert(routed);
+	});
+	await t.step("another path of the same DID", async () => {
+		const served = await portableCreate(portableId(did, "/activities/2"), actors);
+		const { routed } = await route(id, { served });
+		assertFalse(routed);
+	});
+	await t.step("another fragment of the same DID", async () => {
+		const served = await portableCreate(portableId(did, "/activities/1#other"), actors);
+		const { routed } = await route(id, { served });
+		assertFalse(routed);
+	});
+});
+test("Context.routeActivity() rejects proofs of other DIDs for portable actors", async () => {
+	const id = portableId(did, "/activities/1");
+	const actors = [portableId(did, "/actor")];
+	assertEquals(await route(await portableCreate(id, actors, "otherDid")), {
+		routed: false,
+		received: []
+	});
+	assertEquals(await route(await portableCreate(id, actors)), {
+		routed: true,
+		received: actors.map((actor) => actor.href)
+	});
+});
+test("Context.routeActivity() keeps comparing web origins of HTTP(S) IDs", async (t) => {
+	const cases = [
+		[
+			"same origin",
+			new URL("https://remote.example/activities/1"),
+			new URL("https://remote.example/users/alice"),
+			true
+		],
+		[
+			"same origin with an explicit default port",
+			new URL("https://remote.example/activities/1"),
+			new URL("https://remote.example:443/users/alice"),
+			true
+		],
+		[
+			"another origin",
+			new URL("https://remote.example/activities/1"),
+			new URL("https://other.example/users/alice"),
+			false
+		],
+		[
+			"another port",
+			new URL("https://remote.example/activities/1"),
+			new URL("https://remote.example:8443/users/alice"),
+			false
+		],
+		[
+			"compatible actor ID on the same host",
+			new URL("https://remote.example/activities/1"),
+			compatibleId(did, "/actor", "https://remote.example"),
+			false
+		]
+	];
+	for (const [name, id, actor, expected] of cases) await t.step(name, async () => {
+		const served = new Create({
+			id,
+			actor
+		});
+		const { routed, received } = await route(id, { served });
+		assertEquals(routed, expected);
+		assertEquals(received, expected ? [actor.href] : []);
+	});
+});
+//#endregion
+export {};

package/dist/federation/portable.test.mjs

@@ -8,10 +8,10 @@ import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertStrictEquals } from "../assert_strict_equals-CYvBmkpC.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { a as signObject, c as verifyPortableObjectProof } from "../proof-CQAYqWdj.mjs";
-import { l as signRequest } from "../http-Bd6rZlJX.mjs";
+import { a as signObject, c as verifyPortableObjectProof } from "../proof-C9115DX_.mjs";
+import { l as signRequest } from "../http-Y1ObT1A8.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { b as PORTABLE_OBJECT_CONTENT_TYPE, o as createFederation } from "../middleware-Coqgp-K0.mjs";
+import { b as PORTABLE_OBJECT_CONTENT_TYPE, o as createFederation } from "../middleware-Bdu2-OPD.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { Collection, Create, Note, Object as Object$1, Person, Tombstone, lookupObject } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";

package/dist/federation/send.test.mjs

@@ -10,10 +10,10 @@ import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { d as verifyRequest } from "../http-Bd6rZlJX.mjs";
+import { f as verifyRequest } from "../http-Y1ObT1A8.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as doesActorOwnKey } from "../owner-D3GoetXS.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-DjkQrxt5.mjs";
+import { t as doesActorOwnKey } from "../owner-Dem4fbwc.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-D0hxFFRB.mjs";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";

package/dist/federation/tasks/enqueue.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../../kv-DCHkaJ9-.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, t as MockQueue } from "../../tasks-IG3pHfvZ.mjs";
 import "../../testing-C1itIjqW.mjs";
-import { o as createFederation } from "../../middleware-Coqgp-K0.mjs";
+import { o as createFederation } from "../../middleware-Bdu2-OPD.mjs";
 import { n as ParallelMessageQueue } from "../../mq-Dm1Wmtm-.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { delay } from "es-toolkit";

package/dist/federation/tasks/tasks.test.mjs

@@ -4,8 +4,8 @@ globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../../kv-DCHkaJ9-.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, t as MockQueue } from "../../tasks-IG3pHfvZ.mjs";
 import "../../testing-C1itIjqW.mjs";
-import { o as createFederation } from "../../middleware-Coqgp-K0.mjs";
-import { r as createFederationBuilder } from "../../builder-B2d_Pt0j.mjs";
+import { o as createFederation } from "../../middleware-Bdu2-OPD.mjs";
+import { r as createFederationBuilder } from "../../builder-CFF0YNTp.mjs";
 import { t as TaskCodec } from "../../codec-C6rTrpIp.mjs";
 import { t as InProcessMessageQueue } from "../../mq-Dm1Wmtm-.mjs";
 import { W3CTraceContextPropagator } from "@opentelemetry/core";

package/dist/federation/temporal.test.mjs

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "../temporal-oRKP803M.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "../temporal-DKchpKyp.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/temporal.test.ts
 test("hasMalformedKnownTemporalLiteral() detects expanded proof timestamps", async () => {

package/dist/federation/webfinger.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { o as createFederation, s as handleWebFinger } from "../middleware-Coqgp-K0.mjs";
+import { o as createFederation, s as handleWebFinger } from "../middleware-Bdu2-OPD.mjs";
 import { Image, Link, Person, Tombstone } from "@fedify/vocab";
 import { createTestMeterProvider, test } from "@fedify/fixture";
 import { parseIri } from "@fedify/vocab-runtime";

package/dist/{federation-DrNgkLfJ.cjs → federation-BSS2dUO7.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-5CJBdU8n.cjs");
+const require_http = require("./http-CCr2_ipG.cjs");
 const require_types = require("./types-poIao40f.cjs");
-const require_portable_collection = require("./portable-collection-CnlCamup.cjs");
-const require_kv_cache = require("./kv-cache-YRi_g8GB.cjs");
+const require_portable_collection = require("./portable-collection-DJe_bk50.cjs");
+const require_kv_cache = require("./kv-cache-DUXluAc0.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -886,7 +886,7 @@ var CircuitBreaker = class {
 		};
 		let lastConflictingState;
 		for (let attempt = 0; attempt < 10; attempt++) {
-			const oldState = await this.#get(remoteHost);
+			const { state: oldState, raw: oldValue } = await this.#get(remoteHost);
 			if (oldState == null || oldState.state === "closed") return {
 				type: "send",
 				probe: false
@@ -912,7 +912,7 @@ var CircuitBreaker = class {
 					state: "half-open",
 					halfOpened: now.toString()
 				};
-				if (await this.#replace(remoteHost, oldState, newState)) return {
+				if (await this.#replace(remoteHost, oldValue, newState)) return {
 					type: "send",
 					probe: true
 				};
@@ -934,7 +934,7 @@ var CircuitBreaker = class {
 				state: "half-open",
 				halfOpened: now.toString()
 			};
-			if (await this.#replace(remoteHost, oldState, newState)) {
+			if (await this.#replace(remoteHost, oldValue, newState)) {
 				await this.#notifyStateChange(remoteHost, "open", "half-open");
 				return {
 					type: "send",
@@ -961,9 +961,9 @@ var CircuitBreaker = class {
 	async recordSuccess(remoteHost) {
 		this.#sweepLegacyStates();
 		for (let attempt = 0; attempt < 10; attempt++) {
-			const oldState = await this.#get(remoteHost);
+			const { state: oldState, raw: oldValue } = await this.#get(remoteHost);
 			if (oldState == null) return void 0;
-			if (await this.#replace(remoteHost, oldState, void 0)) {
+			if (await this.#replace(remoteHost, oldValue, void 0)) {
 				if (oldState.state !== "closed") {
 					await this.#notifyStateChange(remoteHost, oldState.state, "closed");
 					return {
@@ -983,7 +983,7 @@ var CircuitBreaker = class {
 		this.#sweepLegacyStates();
 		const now = this.#now();
 		for (let attempt = 0; attempt < 10; attempt++) {
-			const oldState = await this.#get(remoteHost);
+			const { state: oldState, raw: oldValue } = await this.#get(remoteHost);
 			if (oldState?.state === "open") return void 0;
 			const oldFailures = oldState?.failures.map(Temporal$11.Instant.from) ?? [];
 			const failures = this.#options.pruneFailures([...oldFailures, now], now);
@@ -1000,7 +1000,7 @@ var CircuitBreaker = class {
 				state: "closed",
 				failures: failures.map((t) => t.toString())
 			};
-			if (await this.#replace(remoteHost, oldState, newState)) {
+			if (await this.#replace(remoteHost, oldValue, newState)) {
 				if (transition != null) {
 					await this.#notifyStateChange(remoteHost, transition[0], transition[1]);
 					return {
@@ -1029,7 +1029,7 @@ var CircuitBreaker = class {
 	}
 	async getState(remoteHost) {
 		this.#sweepLegacyStates();
-		return stripStoredCircuitBreakerState(await this.#get(remoteHost));
+		return stripStoredCircuitBreakerState((await this.#get(remoteHost)).state);
 	}
 	/**
 	* The currently running background legacy sweep, if any.
@@ -1149,9 +1149,14 @@ var CircuitBreaker = class {
 		return Temporal$11.Instant.compare(expiresAt, retryAt) < 0 ? expiresAt : retryAt;
 	}
 	async #get(remoteHost) {
-		return parseStoredCircuitBreakerKvState(await this.#kv.get(this.#key(remoteHost)));
+		const value = await this.#kv.get(this.#key(remoteHost));
+		const state = parseStoredCircuitBreakerKvState(value);
+		return {
+			state,
+			raw: state == null ? void 0 : value
+		};
 	}
-	async #replace(remoteHost, oldState, newState) {
+	async #replace(remoteHost, oldValue, newState) {
 		const key = this.#key(remoteHost);
 		const storedState = newState == null ? void 0 : markCircuitBreakerState(newState);
 		if (this.#kv.cas == null) {
@@ -1159,7 +1164,7 @@ var CircuitBreaker = class {
 			else await this.#kv.set(key, storedState, this.#setOptions());
 			return true;
 		}
-		return await this.#kv.cas(key, oldState, storedState, storedState == null ? void 0 : this.#setOptions());
+		return await this.#kv.cas(key, oldValue, storedState, storedState == null ? void 0 : this.#setOptions());
 	}
 	#setOptions() {
 		return this.#options.stateTtl == null ? void 0 : { ttl: this.#options.stateTtl };
@@ -4667,7 +4672,7 @@ async function handleInbox(request, options) {
 * @returns A promise that resolves to an HTTP response.
 */
 async function handleInboxInternal(request, parameters, span) {
-	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider, portableInbox } = parameters;
+	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, maxHttpSignatures, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider, portableInbox } = parameters;
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
@@ -4953,6 +4958,7 @@ async function handleInboxInternal(request, parameters, span) {
 				contextLoader: ctx.contextLoader,
 				documentLoader: ctx.documentLoader,
 				timeWindow: signatureTimeWindow,
+				maxSignatures: maxHttpSignatures,
 				keyCache,
 				meterProvider,
 				tracerProvider
@@ -5175,7 +5181,7 @@ async function handleInboxInternal(request, parameters, span) {
 		inbox: portableInbox.recipient.canonicalInboxId
 	});
 	else try {
-		await portableInbox.forward(json, activity.id, (0, _fedify_vocab.getTypeId)(activity).href, require_http.listRequestSignatures(request).map((signature) => ({
+		await portableInbox.forward(json, activity.id, (0, _fedify_vocab.getTypeId)(activity).href, require_http.listRequestSignatures(request, maxHttpSignatures).map((signature) => ({
 			keyId: signature.keyId,
 			coversDelivery: coversDelivery(signature),
 			verify: async () => {
@@ -7246,6 +7252,8 @@ function isLinkedDataSignatureJsonLdProcessingError(error) {
 * @returns A new {@link Federation} instance.
 * @throws {TypeError} If benchmark mode and `meterProvider` are both
 * specified.
+* @throws {RangeError} If {@link FederationOptions.maxHttpSignatures} is not
+* a positive integer or `Infinity`.
 * @since 0.10.0
 */
 function createFederation(options) {
@@ -7272,6 +7280,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	onOutboxError;
 	permanentFailureStatusCodes;
 	signatureTimeWindow;
+	maxHttpSignatures;
 	skipSignatureVerification;
 	outboxRetryPolicy;
 	inboxRetryPolicy;
@@ -7300,6 +7309,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const hasCustomLoaderFactory = options.documentLoaderFactory != null || options.contextLoaderFactory != null;
 		const allowPrivateAddress = options.allowPrivateAddress ?? (benchmarkMode && !hasCustomLoaderFactory ? true : false);
 		const signatureTimeWindow = options.signatureTimeWindow ?? (benchmarkMode ? false : { hours: 1 });
+		if (options.maxHttpSignatures !== void 0) require_http.validateMaxSignatures(options.maxHttpSignatures, "maxHttpSignatures");
 		if (benchmarkMode && options.meterProvider != null) throw new TypeError("benchmarkMode requires Fedify to own the meterProvider; OpenTelemetry metric readers cannot be added after a MeterProvider is constructed.");
 		if (benchmarkMode) {
 			const relaxations = getBenchmarkRelaxations(allowPrivateAddress, signatureTimeWindow);
@@ -7392,13 +7402,15 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		const { userAgent } = options;
 		this.allowPrivateAddress = allowPrivateAddress;
+		const documentLoaderTimeout = (0, _fedify_vocab_runtime.resolveDocumentLoaderTimeout)(options.documentLoaderTimeout == null ? options.documentLoaderTimeout : Temporal$2.Duration.from(options.documentLoaderTimeout).total("millisecond"));
 		const userDocumentLoaderFactory = options.documentLoaderFactory;
 		const userContextLoaderFactory = options.contextLoaderFactory;
 		const userAuthFactory = options.authenticatedDocumentLoaderFactory;
 		const builtinDocumentLoaderFactory = (opts) => require_kv_cache.kvCache({
 			loader: (0, _fedify_vocab_runtime.getDocumentLoader)({
 				allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
-				userAgent: opts?.userAgent ?? userAgent
+				userAgent: opts?.userAgent ?? userAgent,
+				timeout: opts?.timeout !== void 0 ? opts.timeout : documentLoaderTimeout
 			}),
 			kv: options.kv,
 			prefix: this.kvPrefixes.remoteDocument,
@@ -7408,7 +7420,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const builtinContextLoaderFactory = (opts) => require_kv_cache.kvCache({
 			loader: (0, _fedify_vocab_runtime.getDocumentLoader)({
 				allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
-				userAgent: opts?.userAgent ?? userAgent
+				userAgent: opts?.userAgent ?? userAgent,
+				timeout: opts?.timeout !== void 0 ? opts.timeout : documentLoaderTimeout
 			}),
 			kv: options.kv,
 			prefix: this.kvPrefixes.remoteDocument,
@@ -7429,6 +7442,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		this.authenticatedDocumentLoaderFactory = (identity, factoryOpts) => require_http.instrumentDocumentLoader(userAuthFactory != null ? userAuthFactory(identity, factoryOpts) : require_kv_cache.getAuthenticatedDocumentLoader(identity, {
 			allowPrivateAddress: factoryOpts?.allowPrivateAddress ?? allowPrivateAddress,
 			userAgent: factoryOpts?.userAgent ?? userAgent,
+			timeout: factoryOpts?.timeout !== void 0 ? factoryOpts.timeout : documentLoaderTimeout,
 			specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, options.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 			tracerProvider: this.tracerProvider
 		}), {
@@ -7440,6 +7454,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		this.onOutboxError = options.onOutboxError;
 		this.permanentFailureStatusCodes = options.permanentFailureStatusCodes ?? [404, 410];
 		this.signatureTimeWindow = signatureTimeWindow;
+		this.maxHttpSignatures = options.maxHttpSignatures ?? 3;
 		this.skipSignatureVerification = options.skipSignatureVerification ?? false;
 		this.inboxChallengePolicy = options.inboxChallengePolicy;
 		this.outboxRetryPolicy = options.outboxRetryPolicy ?? createExponentialBackoffPolicy();
@@ -9065,6 +9080,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			unverifiedActivityHandler: this.unverifiedActivityHandler,
 			onNotFound,
 			signatureTimeWindow: this.signatureTimeWindow,
+			maxHttpSignatures: this.maxHttpSignatures,
 			skipSignatureVerification: this.skipSignatureVerification,
 			inboxChallengePolicy: this.inboxChallengePolicy,
 			meterProvider: this.meterProvider,
@@ -10053,7 +10069,7 @@ var ContextImpl = class ContextImpl {
 					activity: await fetched.toJsonLd({ contextLoader })
 				});
 				return false;
-			} else if (fetched.id?.href !== activity.id.href) {
+			} else if (fetched.id == null || !require_http.isSameObjectId(fetched.id, activity.id)) {
 				logger.debug("Fetched activity object has a different ID; failed to verify.", {
 					recipient,
 					activity: await fetched.toJsonLd({ contextLoader })
@@ -10066,8 +10082,8 @@ var ContextImpl = class ContextImpl {
 				});
 				return false;
 			}
-			const activityId = fetched.id;
-			if (!fetched.actorIds.every((actor) => actor.origin === activityId.origin)) {
+			const activityOrigin = require_http.getAuthenticationOrigin(fetched.id);
+			if (activityOrigin == null || !fetched.actorIds.every((actor) => require_http.getAuthenticationOrigin(actor) === activityOrigin)) {
 				logger.debug("Fetched activity object has actors from different origins; unable to verify.", {
 					recipient,
 					activity: await fetched.toJsonLd({ contextLoader })
@@ -10203,6 +10219,7 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 			contextLoader: options.contextLoader ?? this.contextLoader,
 			documentLoader: options.documentLoader ?? this.documentLoader,
 			timeWindow: this.federation.signatureTimeWindow,
+			maxSignatures: this.federation.maxHttpSignatures,
 			meterProvider: this.meterProvider,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider
 		});