@fedify/fedify 2.4.0-dev.2169 → 2.4.0-dev.2193

package/dist/{builder-B2d_Pt0j.mjs → builder-0onlMY4u.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DU8dvnWk.mjs";
-import { c as isPortableId, r as getPortableDid, t as getCanonicalPortableId } from "./portable-key-id-Bg259c4Z.mjs";
+import { n as version, t as name } from "./deno-DB_Sh0LK.mjs";
+import { i as getPortableDid, l as isPortableId, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
 import { t as ActivityListenerSet } from "./activity-listener-C-BSbKI7.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
@@ -89,7 +89,7 @@ var FederationBuilderImpl = class {
 	* specified.
 	*/
 	async build(options) {
-		const { FederationImpl } = await import("./middleware-Dq-OCmb6.mjs");
+		const { FederationImpl } = await import("./middleware-BZQnf0nI.mjs");
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();
@@ -165,6 +165,7 @@ var FederationBuilderImpl = class {
 			if (actor.id == null) logger.warn("Actor dispatcher returned an actor without an id property.  Set the property with Context.getActorUri(identifier).");
 			else if (!portable && actor.id.href != context.getActorUri(identifier).href) logger.warn("Actor dispatcher returned an actor with an id property that does not match the actor URI.  Set the property with Context.getActorUri(identifier).");
 			if (actor instanceof Tombstone) return actor;
+			if (portable && actor.id != null) warnPortableActorGateways(actor.id, actor.gateways);
 			if (actor.id != null && isCompatibleEf61Iri(actor.id)) warnCompatibleActorId(actor.id, actor.gateway);
 			if (portable) this.#warnPortableCollectionIds(context, identifier, actor);
 			if (this.followingCallbacks != null && this.followingCallbacks.dispatcher != null) {
@@ -768,9 +769,28 @@ function warnMismatchedTombstoneId(context, cls, values, tombstone) {
 	});
 }
 /**
+* Warns about an FEP-ef61 portable actor whose `gateways` is empty or has
+* an item that is not an HTTP(S) origin, which FEP-ef61 does not allow.
+* Every item is checked, since the list and its URLs can be mutated after
+* the actor is constructed.
+*/
+function warnPortableActorGateways(actorId, gateways) {
+	if (gateways.length > 0 && gateways.every(isGatewayUrl)) return;
+	getLogger([
+		"fedify",
+		"federation",
+		"actor"
+	]).warn("Actor dispatcher returned an FEP-ef61 portable actor, {actorId}, whose gateways property is empty or has an item that is not an HTTP(S) origin.  FEP-ef61 requires a portable actor to have at least one gateway, and every gateway to be an HTTP(S) URI with an empty path, query, and fragment.  Set the gateways property.", {
+		actorId: actorId.href,
+		gateways: gateways.map((g) => g.href)
+	});
+}
+/**
 * Warns about an FEP-ef61 portable actor identified by a compatible identifier
 * that is malformed, or is not on the actor's first gateway, where FEP-ef61
-* requires publishers to construct compatible identifiers.
+* requires publishers to construct compatible identifiers.  A missing or
+* invalid first gateway is reported by {@link warnPortableActorGateways}
+* instead.
 */
 function warnCompatibleActorId(actorId, gateway) {
 	const logger = getLogger([
@@ -788,8 +808,8 @@ function warnCompatibleActorId(actorId, gateway) {
 		});
 		return;
 	}
-	if (gateway == null || !isGatewayUrl(gateway)) logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is an FEP-ef61 compatible identifier, but whose first gateway is not an HTTP(S) origin.  Set the gateways property, and construct the compatible identifier with its first gateway.", { actorId: actorId.href });
-	else if (actorId.origin !== gateway.origin) logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is an FEP-ef61 compatible identifier on another gateway than its first gateway, {gateway}.  FEP-ef61 requires publishers to construct compatible identifiers with the first gateway in the actor's gateways.", {
+	if (gateway == null || !isGatewayUrl(gateway)) return;
+	if (actorId.origin !== gateway.origin) logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is an FEP-ef61 compatible identifier on another gateway than its first gateway, {gateway}.  FEP-ef61 requires publishers to construct compatible identifiers with the first gateway in the actor's gateways.", {
 		actorId: actorId.href,
 		gateway: gateway.origin
 	});

package/dist/{circuit-breaker-C5NqoLBJ.mjs → circuit-breaker-XJ53md4S.mjs}

@@ -47,7 +47,7 @@ var CircuitBreaker = class {
 		};
 		let lastConflictingState;
 		for (let attempt = 0; attempt < 10; attempt++) {
-			const oldState = await this.#get(remoteHost);
+			const { state: oldState, raw: oldValue } = await this.#get(remoteHost);
 			if (oldState == null || oldState.state === "closed") return {
 				type: "send",
 				probe: false
@@ -73,7 +73,7 @@ var CircuitBreaker = class {
 					state: "half-open",
 					halfOpened: now.toString()
 				};
-				if (await this.#replace(remoteHost, oldState, newState)) return {
+				if (await this.#replace(remoteHost, oldValue, newState)) return {
 					type: "send",
 					probe: true
 				};
@@ -95,7 +95,7 @@ var CircuitBreaker = class {
 				state: "half-open",
 				halfOpened: now.toString()
 			};
-			if (await this.#replace(remoteHost, oldState, newState)) {
+			if (await this.#replace(remoteHost, oldValue, newState)) {
 				await this.#notifyStateChange(remoteHost, "open", "half-open");
 				return {
 					type: "send",
@@ -122,9 +122,9 @@ var CircuitBreaker = class {
 	async recordSuccess(remoteHost) {
 		this.#sweepLegacyStates();
 		for (let attempt = 0; attempt < 10; attempt++) {
-			const oldState = await this.#get(remoteHost);
+			const { state: oldState, raw: oldValue } = await this.#get(remoteHost);
 			if (oldState == null) return void 0;
-			if (await this.#replace(remoteHost, oldState, void 0)) {
+			if (await this.#replace(remoteHost, oldValue, void 0)) {
 				if (oldState.state !== "closed") {
 					await this.#notifyStateChange(remoteHost, oldState.state, "closed");
 					return {
@@ -144,7 +144,7 @@ var CircuitBreaker = class {
 		this.#sweepLegacyStates();
 		const now = this.#now();
 		for (let attempt = 0; attempt < 10; attempt++) {
-			const oldState = await this.#get(remoteHost);
+			const { state: oldState, raw: oldValue } = await this.#get(remoteHost);
 			if (oldState?.state === "open") return void 0;
 			const oldFailures = oldState?.failures.map(Temporal.Instant.from) ?? [];
 			const failures = this.#options.pruneFailures([...oldFailures, now], now);
@@ -161,7 +161,7 @@ var CircuitBreaker = class {
 				state: "closed",
 				failures: failures.map((t) => t.toString())
 			};
-			if (await this.#replace(remoteHost, oldState, newState)) {
+			if (await this.#replace(remoteHost, oldValue, newState)) {
 				if (transition != null) {
 					await this.#notifyStateChange(remoteHost, transition[0], transition[1]);
 					return {
@@ -190,7 +190,7 @@ var CircuitBreaker = class {
 	}
 	async getState(remoteHost) {
 		this.#sweepLegacyStates();
-		return stripStoredCircuitBreakerState(await this.#get(remoteHost));
+		return stripStoredCircuitBreakerState((await this.#get(remoteHost)).state);
 	}
 	/**
 	* The currently running background legacy sweep, if any.
@@ -310,9 +310,14 @@ var CircuitBreaker = class {
 		return Temporal.Instant.compare(expiresAt, retryAt) < 0 ? expiresAt : retryAt;
 	}
 	async #get(remoteHost) {
-		return parseStoredCircuitBreakerKvState(await this.#kv.get(this.#key(remoteHost)));
+		const value = await this.#kv.get(this.#key(remoteHost));
+		const state = parseStoredCircuitBreakerKvState(value);
+		return {
+			state,
+			raw: state == null ? void 0 : value
+		};
 	}
-	async #replace(remoteHost, oldState, newState) {
+	async #replace(remoteHost, oldValue, newState) {
 		const key = this.#key(remoteHost);
 		const storedState = newState == null ? void 0 : markCircuitBreakerState(newState);
 		if (this.#kv.cas == null) {
@@ -320,7 +325,7 @@ var CircuitBreaker = class {
 			else await this.#kv.set(key, storedState, this.#setOptions());
 			return true;
 		}
-		return await this.#kv.cas(key, oldState, storedState, storedState == null ? void 0 : this.#setOptions());
+		return await this.#kv.cas(key, oldValue, storedState, storedState == null ? void 0 : this.#setOptions());
 	}
 	#setOptions() {
 		return this.#options.stateTtl == null ? void 0 : { ttl: this.#options.stateTtl };

package/dist/compat/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $t as ActivityTransformer, n as Context } from "../context-L0Fnib9j.cjs";
+import { $t as ActivityTransformer, n as Context } from "../context-CDcAgm4l.cjs";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $t as ActivityTransformer, n as Context } from "../context-BykNUf04.js";
+import { $t as ActivityTransformer, n as Context } from "../context-9T--NSo4.js";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/transformers.test.mjs

@@ -5,7 +5,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { E as autoIdAssigner, T as actorDehydrator, n as FederationImpl } from "../middleware-Coqgp-K0.mjs";
+import { E as autoIdAssigner, T as actorDehydrator, n as FederationImpl } from "../middleware-BqqycC0P.mjs";
 import { Follow, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 //#region src/compat/transformers.test.ts

package/dist/{compound-proof-D28gMFqP.mjs → compound-proof-B-Fk6Slo.mjs}

@@ -1,10 +1,10 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as isPortableId, i as getRawCanonicalPortableId, t as getCanonicalPortableId } from "./portable-key-id-Bg259c4Z.mjs";
+import { a as getRawCanonicalPortableId, l as isPortableId, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
-import { c as getNormalizationContextLoader } from "./ld-BsTkRrwF.mjs";
-import { l as verifyPortableObjectProofPolicy, n as classifyFep2277CoreType, o as verifyMapLocalProof } from "./proof-CQAYqWdj.mjs";
+import { c as getNormalizationContextLoader } from "./ld-C15yzuY6.mjs";
+import { l as verifyPortableObjectProofPolicy, n as classifyFep2277CoreType, o as verifyMapLocalProof } from "./proof-DrJWKeOl.mjs";
 import { parseIri, preloadedContexts } from "@fedify/vocab-runtime";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/sig/compound-proof.ts

package/dist/{context-BykNUf04.d.ts → context-9T--NSo4.d.ts}

@@ -1,6 +1,6 @@
 /// <reference lib="esnext.temporal" />
 import { o as JsonValue, s as NodeInfo, t as GetNodeInfoOptions } from "./client-D-XP_Ccb.js";
-import { o as VerifyRequestFailureReason, t as HttpMessageSignaturesSpec } from "./http-Cok5-vIC.js";
+import { o as VerifyRequestFailureReason, t as HttpMessageSignaturesSpec } from "./http-DGx0KOws.js";
 import { n as GetKeyOwnerOptions } from "./owner-BSzr5-I8.js";
 import { n as KvStore, t as KvKey } from "./kv-BhNbN8Ed.js";
 import { Router } from "@fedify/uri-template";
@@ -1485,6 +1485,8 @@ interface FederationOrigin {
 * @returns A new {@link Federation} instance.
 * @throws {TypeError} If benchmark mode and `meterProvider` are both
 * specified.
+* @throws {RangeError} If {@link FederationOptions.maxHttpSignatures} is not
+* a positive integer or `Infinity`.
 * @since 0.10.0
 */
 declare function createFederation<TContextData>(options: FederationOptions<TContextData>): Federation<TContextData>;
@@ -2309,6 +2311,35 @@ interface FederationOptions<TContextData> {
   */
   userAgent?: GetUserAgentOptions | string;
   /**
+  * The timeout for each call of the built-in document loader, context
+  * loader, and authenticated document loader, e.g., when Fedify fetches
+  * a key to verify a signature.  The timeout is shared by all the steps of
+  * a call, including every redirect it follows, retries, and reading the
+  * response body.  It does not cover the time spent reading from or
+  * writing to the cache.
+  *
+  * A timed-out call throws a `FetchError` without a response, whose
+  * `cause` is a `DOMException` named `"TimeoutError"`, so that, e.g.,
+  * a key fetch that times out is reported as a `keyFetchError` and cached
+  * like other failures to fetch a key.
+  *
+  * It does not affect loaders made by
+  * {@link FederationOptions.documentLoaderFactory},
+  * {@link FederationOptions.contextLoaderFactory}, or
+  * {@link FederationOptions.authenticatedDocumentLoaderFactory}.
+  * Note that if only {@link FederationOptions.documentLoaderFactory} is
+  * set, it also makes context loaders.
+  *
+  * Set it to `null` to turn off the timeout.
+  *
+  * 10 seconds by default.
+  * @throws {RangeError} If the duration is not positive, is longer than
+  *                      about 24.8 days, or is given in calendar units
+  *                      such as months.
+  * @since 2.4.0
+  */
+  documentLoaderTimeout?: Temporal.Duration | Temporal.DurationLike | null;
+  /**
   * A callback that handles errors during outbox processing.  Note that this
   * callback can be called multiple times for the same activity, because
   * the delivery is retried according to the backoff schedule until it
@@ -2337,6 +2368,29 @@ interface FederationOptions<TContextData> {
   */
   signatureTimeWindow?: Temporal.Duration | Temporal.DurationLike | false;
   /**
+  * The maximum number of [RFC 9421] signatures of an incoming request to
+  * verify, e.g., in the inbox and in
+  * {@link RequestContext.getSignedKey}.  A request can carry several
+  * signatures, each of which may make Fedify fetch the key that it names,
+  * so only the first ones in the order of the `Signature-Input` header are
+  * verified, and the rest are ignored as if they were absent.  Every
+  * signature among the first ones counts, even if it fails before its key
+  * is fetched.  See also the `maxSignatures` option of `verifyRequest()`.
+  *
+  * It has to be a positive integer, or `Infinity` to verify every
+  * signature, which lets a single request make Fedify fetch any number of
+  * keys.  Draft-cavage HTTP Signatures carry a single signature, so this
+  * option does not affect them.
+  *
+  * Three by default.
+  *
+  * [RFC 9421]: https://www.rfc-editor.org/rfc/rfc9421
+  * @throws {RangeError} Thrown when the federation is created if the value
+  *         is not a positive integer or `Infinity`.
+  * @since 2.4.0
+  */
+  maxHttpSignatures?: number;
+  /**
   * Whether to skip HTTP Signatures verification for incoming activities.
   * This is useful for testing purposes, but should not be used in production.
   *

package/dist/{context-L0Fnib9j.d.cts → context-CDcAgm4l.d.cts}

@@ -1,6 +1,6 @@
 /// <reference lib="esnext.temporal" />
 import { o as JsonValue, s as NodeInfo, t as GetNodeInfoOptions } from "./client-D-XP_Ccb.cjs";
-import { o as VerifyRequestFailureReason, t as HttpMessageSignaturesSpec } from "./http-DC1cqAQ2.cjs";
+import { o as VerifyRequestFailureReason, t as HttpMessageSignaturesSpec } from "./http-BrwKINQn.cjs";
 import { n as GetKeyOwnerOptions } from "./owner-BF0L9cMt.cjs";
 import { n as KvStore, t as KvKey } from "./kv-BhNbN8Ed.cjs";
 import { Activity, Actor, Collection, CryptographicKey, Hashtag, Link, LookupObjectOptions, Multikey, Object as Object$1, Recipient, Tombstone, TraverseCollectionOptions } from "@fedify/vocab";
@@ -1483,6 +1483,8 @@ interface FederationOrigin {
 * @returns A new {@link Federation} instance.
 * @throws {TypeError} If benchmark mode and `meterProvider` are both
 * specified.
+* @throws {RangeError} If {@link FederationOptions.maxHttpSignatures} is not
+* a positive integer or `Infinity`.
 * @since 0.10.0
 */
 declare function createFederation<TContextData>(options: FederationOptions<TContextData>): Federation<TContextData>;
@@ -2307,6 +2309,35 @@ interface FederationOptions<TContextData> {
   */
   userAgent?: GetUserAgentOptions | string;
   /**
+  * The timeout for each call of the built-in document loader, context
+  * loader, and authenticated document loader, e.g., when Fedify fetches
+  * a key to verify a signature.  The timeout is shared by all the steps of
+  * a call, including every redirect it follows, retries, and reading the
+  * response body.  It does not cover the time spent reading from or
+  * writing to the cache.
+  *
+  * A timed-out call throws a `FetchError` without a response, whose
+  * `cause` is a `DOMException` named `"TimeoutError"`, so that, e.g.,
+  * a key fetch that times out is reported as a `keyFetchError` and cached
+  * like other failures to fetch a key.
+  *
+  * It does not affect loaders made by
+  * {@link FederationOptions.documentLoaderFactory},
+  * {@link FederationOptions.contextLoaderFactory}, or
+  * {@link FederationOptions.authenticatedDocumentLoaderFactory}.
+  * Note that if only {@link FederationOptions.documentLoaderFactory} is
+  * set, it also makes context loaders.
+  *
+  * Set it to `null` to turn off the timeout.
+  *
+  * 10 seconds by default.
+  * @throws {RangeError} If the duration is not positive, is longer than
+  *                      about 24.8 days, or is given in calendar units
+  *                      such as months.
+  * @since 2.4.0
+  */
+  documentLoaderTimeout?: Temporal.Duration | Temporal.DurationLike | null;
+  /**
   * A callback that handles errors during outbox processing.  Note that this
   * callback can be called multiple times for the same activity, because
   * the delivery is retried according to the backoff schedule until it
@@ -2335,6 +2366,29 @@ interface FederationOptions<TContextData> {
   */
   signatureTimeWindow?: Temporal.Duration | Temporal.DurationLike | false;
   /**
+  * The maximum number of [RFC 9421] signatures of an incoming request to
+  * verify, e.g., in the inbox and in
+  * {@link RequestContext.getSignedKey}.  A request can carry several
+  * signatures, each of which may make Fedify fetch the key that it names,
+  * so only the first ones in the order of the `Signature-Input` header are
+  * verified, and the rest are ignored as if they were absent.  Every
+  * signature among the first ones counts, even if it fails before its key
+  * is fetched.  See also the `maxSignatures` option of `verifyRequest()`.
+  *
+  * It has to be a positive integer, or `Infinity` to verify every
+  * signature, which lets a single request make Fedify fetch any number of
+  * keys.  Draft-cavage HTTP Signatures carry a single signature, so this
+  * option does not affect them.
+  *
+  * Three by default.
+  *
+  * [RFC 9421]: https://www.rfc-editor.org/rfc/rfc9421
+  * @throws {RangeError} Thrown when the federation is created if the value
+  *         is not a positive integer or `Infinity`.
+  * @since 2.4.0
+  */
+  maxHttpSignatures?: number;
+  /**
   * Whether to skip HTTP Signatures verification for incoming activities.
   * This is useful for testing purposes, but should not be used in production.
   *

package/dist/{deno-DU8dvnWk.mjs → deno-DB_Sh0LK.mjs}

@@ -3,6 +3,6 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2169+0a45df07";
+var version = "2.4.0-dev.2193+402149b5";
 //#endregion
 export { version as n, name as t };

package/dist/{docloader-CghLH7Zi.mjs → docloader-DpWYYY6a.mjs}

@@ -1,11 +1,11 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as validateCryptoKey } from "./key-gIhVZO3p.mjs";
-import { n as doubleKnock } from "./http-Bd6rZlJX.mjs";
+import { c as validateCryptoKey } from "./key-DA3Yx8p2.mjs";
+import { n as doubleKnock } from "./http-DQf9Mw4V.mjs";
 import { getLogger } from "@logtape/logtape";
 import { curry } from "es-toolkit";
-import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, resolveDocumentLoaderTimeout, validatePublicUrl, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
 //#region src/utils/docloader.ts
 const logger = getLogger([
 	"fedify",
@@ -19,15 +19,19 @@ const DEFAULT_MAX_REDIRECTION = 20;
 * the fetched documents.
 * At most 20 HTTP redirects and alternate document links are followed in total
 * per call.  Revisiting a URL within that chain throws a {@link FetchError}.
+* Each call, including its double-knocking retries, times out after
+* 10 seconds by default; see {@link DocumentLoaderFactoryOptions.timeout}.
 * @param identity The identity to get the document loader for.
 *                 The actor's key pair.
 * @param options The options for the document loader.
 * @returns The authenticated document loader.
 * @throws {TypeError} If the key is invalid or unsupported.
+* @throws {RangeError} If the `timeout` option is invalid.
 * @since 0.4.0
 */
-function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, tracerProvider } = {}) {
+function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, timeout, tracerProvider } = {}) {
 	validateCryptoKey(identity.privateKey);
+	const resolvedTimeout = resolveDocumentLoaderTimeout(timeout);
 	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
 		let currentUrl = new URL(url).href;
@@ -53,27 +57,31 @@ function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedi
 				currentUrl = nextUrl;
 			}
 		});
+		options?.signal?.throwIfAborted();
 		return getRemoteDocument(currentUrl, response, (alternateUrl) => {
 			follow(alternateUrl);
 			return load(alternateUrl, options, redirected, visited);
 		}, options);
 	}
 	async function validateUrl(url, options) {
-		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
-		} catch (error) {
-			if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
-				url,
-				error
-			});
-			else logger[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
-				url,
-				error
-			});
-			throw error;
+		if (!allowPrivateAddress) {
+			try {
+				await validatePublicUrl(url);
+			} catch (error) {
+				if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+					url,
+					error
+				});
+				else logger[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+					url,
+					error
+				});
+				throw error;
+			}
+			options?.signal?.throwIfAborted();
 		}
 	}
-	return (url, options) => load(url, options);
+	return withDocumentLoaderTimeout((url, options) => load(url, options), resolvedTimeout);
 }
 //#endregion
 export { getAuthenticatedDocumentLoader as t };

package/dist/federation/builder.test.mjs

@@ -6,7 +6,7 @@ import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertExists } from "../assert_exists-cffSpJ7X.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { r as createFederationBuilder } from "../builder-B2d_Pt0j.mjs";
+import { r as createFederationBuilder } from "../builder-0onlMY4u.mjs";
 import { DisallowedOperatorError, DisallowedVarSpecModifierError, DuplicateRouteVariableError, RouteTemplateOptionsNotMatchedError, RouterError } from "@fedify/uri-template";
 import { Activity, Note, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";

package/dist/federation/circuit-breaker.test.mjs

@@ -5,7 +5,8 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { n as normalizeCircuitBreakerOptions, r as parseCircuitBreakerKvState, t as CircuitBreaker } from "../circuit-breaker-C5NqoLBJ.mjs";
+import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
+import { n as normalizeCircuitBreakerOptions, r as parseCircuitBreakerKvState, t as CircuitBreaker } from "../circuit-breaker-XJ53md4S.mjs";
 import { t as markCircuitBreakerLegacySweepDone } from "../circuit-breaker-test-utils-DW6YC_Pe.mjs";
 import { test } from "@fedify/fixture";
 //#region src/federation/circuit-breaker.test.ts
@@ -26,6 +27,54 @@ var CountingCasKvStore = class extends MemoryKvStore {
 		return super.cas(key, expectedValue, newValue, options);
 	}
 };
+var EncodedCasKvStore = class extends MemoryKvStore {
+	async cas(key, expectedValue, newValue, options) {
+		const current = await this.get(key);
+		if (JSON.stringify(current) !== JSON.stringify(expectedValue)) return false;
+		if (newValue === void 0) await this.delete(key);
+		else await this.set(key, newValue, options);
+		return true;
+	}
+};
+test("CircuitBreaker uses raw encoded CAS expectations", async () => {
+	const kv = new EncodedCasKvStore();
+	await markCircuitBreakerLegacySweepDone(kv);
+	let now = Temporal.Instant.from("2026-05-25T00:00:00Z");
+	const circuit = new CircuitBreaker({
+		kv,
+		prefix: ["_fedify", "circuit"],
+		now: () => now,
+		options: {
+			failureThreshold: 1,
+			recoveryDelay: { seconds: 30 }
+		}
+	});
+	const key = [
+		"_fedify",
+		"circuit",
+		"remote.example"
+	];
+	await circuit.recordFailure("remote.example");
+	now = now.add({ seconds: 30 });
+	assertEquals((await circuit.beforeSend("remote.example", {})).type, "send");
+	assertEquals((await circuit.recordSuccess("remote.example"))?.newState, "closed");
+	const oldOrder = {
+		state: "half-open",
+		failures: ["2026-05-25T00:00:00Z"],
+		opened: "2026-05-25T00:00:00Z",
+		__fedifyCircuitBreakerStateVersion: 1,
+		halfOpened: "2026-05-25T00:00:00Z"
+	};
+	await kv.set(key, oldOrder);
+	assertEquals((await circuit.recordFailure("remote.example"))?.newState, "open");
+	await kv.set(key, oldOrder);
+	assertEquals((await circuit.recordSuccess("remote.example"))?.newState, "closed");
+	await kv.set(key, oldOrder);
+	assertEquals((await circuit.beforeSend("remote.example", {})).type, "send");
+	await kv.set(key, { __fedifyDeletingCircuitBreakerLegacyState: true });
+	await assertRejects(() => circuit.recordFailure("remote.example"));
+	assertEquals(await kv.get(key), { __fedifyDeletingCircuitBreakerLegacyState: true });
+});
 var CountingSetKvStore = class {
 	#store = new MemoryKvStore();
 	keys = [];

package/dist/federation/compound-fanout.test.mjs

@@ -6,11 +6,11 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as exportJwk } from "../key-gIhVZO3p.mjs";
+import { n as exportJwk } from "../key-DA3Yx8p2.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as signObject, d as verifyProof } from "../proof-CQAYqWdj.mjs";
+import { a as signObject, d as verifyProof } from "../proof-DrJWKeOl.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as FederationImpl } from "../middleware-Coqgp-K0.mjs";
+import { n as FederationImpl } from "../middleware-BqqycC0P.mjs";
 import { Create, DataIntegrityProof, Note } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { exportDidKey, parseIri } from "@fedify/vocab-runtime";

package/dist/federation/handler-compound-proof.test.mjs

@@ -5,10 +5,10 @@ import { r as createRequestContext, t as createInboxContext } from "../context-B
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { a as compactJsonLd, m as verifyCompactJsonLd, p as signJsonLd } from "../ld-BsTkRrwF.mjs";
-import { l as signRequest } from "../http-Bd6rZlJX.mjs";
+import { a as compactJsonLd, m as verifyCompactJsonLd, p as signJsonLd } from "../ld-C15yzuY6.mjs";
+import { l as signRequest } from "../http-DQf9Mw4V.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { f as handleInbox, o as createFederation } from "../middleware-Coqgp-K0.mjs";
+import { f as handleInbox, o as createFederation } from "../middleware-BqqycC0P.mjs";
 import { t as ActivityListenerSet } from "../activity-listener-C-BSbKI7.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { Create, CryptographicKey, Multikey, Person, Update } from "@fedify/vocab";
@@ -331,5 +331,54 @@ test("handleInbox() accepts portable actors with keys at ap: URIs", async () =>
 	const dispatched = { count: 0 };
 	assertEquals([(await handle(await update("ap://did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK/actor"), dispatched)).status, dispatched.count], [401, 0]);
 });
+test("handleInbox() rejects embedded portable actors without valid gateways", async () => {
+	const did = await exportDidKey(ed25519PublicKey.publicKey);
+	const verificationMethod = `${did}#${did.slice(8)}`;
+	const privateJwk = await crypto.subtle.exportKey("jwk", ed25519PrivateKey);
+	const actorId = `ap://${did}/actor`;
+	const update = async (gateways) => await secureDocument({
+		"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+		id: `ap://${did}/activities/update`,
+		type: "Update",
+		actor: actorId,
+		object: await secureDocument({
+			"@context": [
+				"https://www.w3.org/ns/activitystreams",
+				"https://w3id.org/security/data-integrity/v1",
+				"https://w3id.org/fep/ef61"
+			],
+			id: actorId,
+			type: "Person",
+			inbox: `${actorId}/inbox`,
+			outbox: `${actorId}/outbox`,
+			...gateways
+		}, privateJwk, verificationMethod)
+	}, privateJwk, verificationMethod);
+	for (const [gateways, status, count] of [
+		[
+			{ gateways: ["https://gw.example"] },
+			202,
+			1
+		],
+		[
+			{},
+			401,
+			0
+		],
+		[
+			{ gateways: [] },
+			401,
+			0
+		],
+		[
+			{ gateways: ["https://gw.example/path"] },
+			400,
+			0
+		]
+	]) {
+		const dispatched = { count: 0 };
+		assertEquals([(await handle(await update(gateways), dispatched)).status, dispatched.count], [status, count], JSON.stringify(gateways));
+	}
+});
 //#endregion
 export {};

package/dist/federation/handler.test.mjs

@@ -10,12 +10,12 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as parseAcceptSignature } from "../accept-CPVqki78.mjs";
-import { o as generateCryptoKeyPair } from "../key-gIhVZO3p.mjs";
-import { a as compactJsonLd, p as signJsonLd } from "../ld-BsTkRrwF.mjs";
-import { a as signObject } from "../proof-CQAYqWdj.mjs";
-import { l as signRequest } from "../http-Bd6rZlJX.mjs";
+import { o as generateCryptoKeyPair } from "../key-DA3Yx8p2.mjs";
+import { a as compactJsonLd, p as signJsonLd } from "../ld-C15yzuY6.mjs";
+import { a as signObject } from "../proof-DrJWKeOl.mjs";
+import { l as signRequest } from "../http-DQf9Mw4V.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { d as handleCustomCollection, f as handleInbox, g as respondWithObjectIfAcceptable, h as respondWithObject, l as handleActor, m as handleOutbox, o as createFederation, p as handleObject, u as handleCollection } from "../middleware-Coqgp-K0.mjs";
+import { d as handleCustomCollection, f as handleInbox, g as respondWithObjectIfAcceptable, h as respondWithObject, l as handleActor, m as handleOutbox, o as createFederation, p as handleObject, u as handleCollection } from "../middleware-BqqycC0P.mjs";
 import { t as ActivityListenerSet } from "../activity-listener-C-BSbKI7.mjs";
 import { Activity, Create, CryptographicKey, Multikey, Note, Person, Tombstone } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/federation/hashlink-media.test.mjs

@@ -10,8 +10,8 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assertStrictEquals } from "../assert_strict_equals-CYvBmkpC.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { o as createFederation, x as parseHashlinkGatewayRequest } from "../middleware-Coqgp-K0.mjs";
-import { r as createFederationBuilder } from "../builder-B2d_Pt0j.mjs";
+import { o as createFederation, x as parseHashlinkGatewayRequest } from "../middleware-BqqycC0P.mjs";
+import { r as createFederationBuilder } from "../builder-0onlMY4u.mjs";
 import { n as RouterError } from "../router-u5O5KCQr.mjs";
 import { Note } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";