@fedify/fedify 2.4.0-dev.2193 → 2.4.0-dev.2212

package/dist/audience-CHQ-FlLD.mjs

@@ -0,0 +1,95 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
+import { PUBLIC_COLLECTION } from "@fedify/vocab";
+//#region src/federation/audience.ts
+const AS_NAMESPACE = "https://www.w3.org/ns/activitystreams#";
+/**
+* The addressing properties that determine the audience of an object.
+*/
+const ADDRESSING_PROPERTIES = [
+	"to",
+	"cc",
+	"bto",
+	"bcc",
+	"audience"
+];
+/**
+* The IDs that Fedify treats as the public collection.  Besides the full IRI,
+* the compact forms `as:Public` and `Public` are reserved as public for
+* compatibility with documents whose compact forms survive JSON-LD expansion,
+* e.g., bare `Public`, which expands to a relative IRI.
+*/
+const PUBLIC_IDS = /* @__PURE__ */ new Set([
+	PUBLIC_COLLECTION.href,
+	"as:Public",
+	"Public"
+]);
+/**
+* Checks whether an expanded JSON-LD node is addressed to the public
+* collection, i.e., any of its `to`, `cc`, `bto`, `bcc`, and `audience` has
+* the public collection.  Only the node itself is checked, not the nodes
+* embedded in it.
+* @param node The expanded JSON-LD node.
+* @returns `true` if the node is publicly addressed.
+* @internal
+*/
+function isPubliclyAddressedNode(node) {
+	for (const property of ADDRESSING_PROPERTIES) {
+		const values = node[AS_NAMESPACE + property];
+		if (!Array.isArray(values)) continue;
+		for (const value of values) if (typeof value === "object" && value != null && "@id" in value && typeof value["@id"] === "string" && PUBLIC_IDS.has(value["@id"])) return true;
+	}
+	return false;
+}
+function getAudienceIds(object) {
+	return [
+		...object.toIds,
+		...object.ccIds,
+		...object.btoIds,
+		...object.bccIds,
+		...object.audienceIds
+	];
+}
+/**
+* Checks whether two actor IDs refer to the same actor.  [FEP-ef61] portable
+* IDs are compared by their canonical forms, so an `ap:` URI, an `ap+ef61:`
+* URI, and a compatible identifier on any gateway are the same actor if they
+* have the same canonical portable ID.  Other IDs are compared as they are.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+function isSameActorId(a, b) {
+	const canonicalA = getCanonicalPortableId(a);
+	const canonicalB = getCanonicalPortableId(b);
+	if (canonicalA != null || canonicalB != null) return canonicalA === canonicalB;
+	return a.href === b.href;
+}
+/**
+* Checks whether an actor belongs to the audience of an object: the object is
+* publicly addressed, the actor is one of its addressees, or the actor is
+* a member of one of them according to `isMember()`.
+* @param object The object whose audience is checked.
+* @param actor The actor to check, or `null` if there is no actor.  No actor
+*              belongs to the audience of an object that is not public.
+* @param options Options for checking the audience.
+* @returns `true` if the actor belongs to the audience of the object.
+* @internal
+*/
+async function isInAudience(object, actor, options = {}) {
+	const addressees = getAudienceIds(object);
+	if (addressees.some((id) => PUBLIC_IDS.has(id.href))) return true;
+	const actorId = actor?.id;
+	if (actor == null || actorId == null) return false;
+	const others = [];
+	for (const addressee of addressees) {
+		if (isSameActorId(addressee, actorId)) return true;
+		others.push(addressee);
+	}
+	if (options.isMember == null) return false;
+	for (const addressee of others) if (await options.isMember(addressee, actor)) return true;
+	return false;
+}
+//#endregion
+export { isPubliclyAddressedNode as n, isInAudience as t };

package/dist/{builder-0onlMY4u.mjs → builder-CKAVFvcH.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DB_Sh0LK.mjs";
 import { i as getPortableDid, l as isPortableId, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
+import { n as version, t as name } from "./deno-BKp9fYB3.mjs";
 import { t as ActivityListenerSet } from "./activity-listener-C-BSbKI7.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
@@ -89,7 +89,7 @@ var FederationBuilderImpl = class {
 	* specified.
 	*/
 	async build(options) {
-		const { FederationImpl } = await import("./middleware-BZQnf0nI.mjs");
+		const { FederationImpl } = await import("./middleware-G9zpxUsD.mjs");
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();

package/dist/compat/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $t as ActivityTransformer, n as Context } from "../context-CDcAgm4l.cjs";
+import { en as ActivityTransformer, n as Context } from "../context-Bl_Y7T_3.cjs";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { $t as ActivityTransformer, n as Context } from "../context-9T--NSo4.js";
+import { en as ActivityTransformer, n as Context } from "../context-DMd11IAu.js";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/public-audience.test.mjs

@@ -5,8 +5,8 @@ import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
 import { t as normalizePublicAudience } from "../public-audience--klBIOk1.mjs";
 import { Create, Follow, Note, PUBLIC_COLLECTION } from "@fedify/vocab";
-import { test } from "@fedify/fixture";
 import { getDocumentLoader, preloadedContexts } from "@fedify/vocab-runtime";
+import { test } from "@fedify/fixture";
 //#region src/compat/public-audience.test.ts
 const PUBLIC_URI = PUBLIC_COLLECTION.href;
 const AS_CONTEXT = "https://www.w3.org/ns/activitystreams";

package/dist/compat/transformers.test.mjs

@@ -5,7 +5,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { E as autoIdAssigner, T as actorDehydrator, n as FederationImpl } from "../middleware-BqqycC0P.mjs";
+import { E as autoIdAssigner, T as actorDehydrator, n as FederationImpl } from "../middleware-BW7-tHAG.mjs";
 import { Follow, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 //#region src/compat/transformers.test.ts

package/dist/{compound-proof-B-Fk6Slo.mjs → compound-proof-BP5SOdXv.mjs}

@@ -3,8 +3,8 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { a as getRawCanonicalPortableId, l as isPortableId, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
-import { c as getNormalizationContextLoader } from "./ld-C15yzuY6.mjs";
-import { l as verifyPortableObjectProofPolicy, n as classifyFep2277CoreType, o as verifyMapLocalProof } from "./proof-DrJWKeOl.mjs";
+import { c as getNormalizationContextLoader } from "./ld-DBBVabBC.mjs";
+import { l as verifyPortableObjectProofPolicy, n as classifyFep2277CoreType, o as verifyMapLocalProof } from "./proof-MFz2960e.mjs";
 import { parseIri, preloadedContexts } from "@fedify/vocab-runtime";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/sig/compound-proof.ts

package/dist/{context-B2rlkkyJ.mjs → context-8Tu9kea0.mjs}

@@ -2,6 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as mockDocumentLoader } from "./dist-DJQM4u7i.mjs";
+import { t as isInAudience } from "./audience-CHQ-FlLD.mjs";
 import { RouterError } from "@fedify/uri-template";
 import { lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
@@ -105,6 +106,7 @@ function createRequestContext(args) {
 		getObject: args.getObject ?? (() => Promise.resolve(null)),
 		getSignedKey: args.getSignedKey ?? (() => Promise.resolve(null)),
 		getSignedKeyOwner: args.getSignedKeyOwner ?? (() => Promise.resolve(null)),
+		isSignedByAudience: args.isSignedByAudience ?? (async (object, options) => await isInAudience(object, null) || await isInAudience(object, args.getSignedKeyOwner == null ? null : await args.getSignedKeyOwner(options ?? {}), options)),
 		sendActivity: args.sendActivity ?? ((_params) => {
 			throw new Error("Not implemented");
 		})

package/dist/{context-CDcAgm4l.d.cts → context-Bl_Y7T_3.d.cts}

@@ -1257,6 +1257,18 @@ interface FanoutMessage {
   readonly inboxes: Readonly<Record<string, {
     readonly actorIds: readonly string[];
     readonly sharedInbox: boolean;
+    /**
+    * The canonical form of the FEP-ef61 portable inbox that the inbox
+    * stands for.
+    * @internal
+    */
+    readonly portableInbox?: string;
+    /**
+    * The compatible identifiers of the portable inbox on each gateway to
+    * deliver through, in order.
+    * @internal
+    */
+    readonly gatewayInboxes?: readonly string[];
   }>>;
   readonly activity: unknown;
   readonly activityId?: string;
@@ -1300,6 +1312,27 @@ interface OutboxMessage {
   * @internal
   */
   readonly circuitHeldSince?: string;
+  /**
+  * The canonical form of the FEP-ef61 portable inbox that {@link inbox}, its
+  * compatible identifier on a gateway, stands for.
+  * @internal
+  */
+  readonly portableInbox?: string;
+  /**
+  * The compatible identifiers of the FEP-ef61 portable inbox on each gateway
+  * that is still to be tried, in order.  {@link inbox} is the first one.
+  * If there is more than one, the activity is delivered through the first
+  * gateway that accepts it.
+  * @internal
+  */
+  readonly gatewayInboxes?: readonly string[];
+  /**
+  * The times before which each of {@link gatewayInboxes} must not be tried
+  * again, as their responses' `Retry-After` headers requested, keyed by
+  * the inbox URL, in ISO 8601.
+  * @internal
+  */
+  readonly gatewayNotBefore?: Readonly<Record<string, string>>;
   readonly traceContext: Readonly<Record<string, string>>;
 }
 /**
@@ -4203,6 +4236,52 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * [instance actor]: https://swicg.github.io/activitypub-http-signature/#instance-actor
   */
   getSignedKeyOwner(options: GetKeyOwnerOptions): Promise<Actor | null>;
+  /**
+  * Checks whether the request is signed by an actor who belongs to
+  * the intended audience of an object, i.e., the owner of the signed key
+  * (see {@link RequestContext.getSignedKeyOwner}) is one of the object's
+  * `to`, `cc`, `bto`, `bcc`, and `audience`, or a member of one of them
+  * according to the `isMember` option.
+  *
+  * Everyone belongs to the audience of a publicly addressed object, so it
+  * returns `true` for such an object even if the request is not signed.
+  *
+  * This can be used in authorization predicates for serving non-public
+  * objects, which [FEP-ef61] requires of gateways serving portable objects.
+  * [FEP-ef61] portable IDs are compared by their canonical forms, so
+  * an `ap:` URI, an `ap+ef61:` URI, and a compatible identifier on any
+  * gateway refer to the same actor.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  *
+  * @param object The object whose audience is checked.
+  * @param options Options for checking the audience.
+  * @returns `true` if the object is publicly addressed, or the request is
+  *          signed by an actor who belongs to its audience.
+  * @since 2.4.0
+  */
+  isSignedByAudience(object: Object$1, options?: IsSignedByAudienceOptions): Promise<boolean>;
+}
+/**
+* Options for {@link RequestContext.isSignedByAudience} method.
+* @since 2.4.0
+*/
+interface IsSignedByAudienceOptions extends GetKeyOwnerOptions {
+  /**
+  * Checks whether the actor who signed the request is a member of
+  * an addressee of the object that is not the actor itself, e.g.,
+  * a followers collection.  Fedify does not resolve collections by itself,
+  * as only the application can tell their members reliably.
+  *
+  * It is called for each such addressee in order until it returns `true`.
+  * If it is omitted, only the actors that the object addresses directly
+  * belong to its audience.
+  * @param addressee The ID of the addressee, e.g., the ID of a followers
+  *                  collection.
+  * @param actor The actor who signed the request.
+  * @returns `true` if the actor is a member of the addressee.
+  */
+  isMember?: (addressee: URL, actor: Actor) => boolean | Promise<boolean>;
 }
 /**
 * A context for inbox listeners.
@@ -4635,4 +4714,4 @@ interface ActorKeyPair extends CryptoKeyPair {
   readonly multikey: Multikey;
 }
 //#endregion
-export { respondWithObjectIfAcceptable as $, ActivityTransformer as $t, InboxListenerSetters as A, HashlinkMediaDispatcher as At, Message as B, OutboxListenerErrorHandler as Bt, FederationBuilder as C, AuthorizePredicate as Ct, IdempotencyKeyCallback as D, CustomCollectionCounter as Dt, FederationStartQueueOptions as E, CollectionDispatcher as Et, Rfc6570Expression as F, NodeInfoDispatcher as Ft, TaskHandler as G, UnverifiedActivityHandler as Gt, TaskDefinition as H, PortableActorIdMapper as Ht, FederationKvPrefixes as I, ObjectAuthorizePredicate as It, RetryContext as J, SendActivityError as Jt, TaskRegistry as K, UnverifiedActivityReason as Kt, FederationOrigin as L, ObjectDispatcher as Lt, ObjectCallbackSetters as M, InboxErrorHandler as Mt, OutboxListenerSetters as N, InboxListener as Nt, IdempotencyStrategy as O, CustomCollectionCursor as Ot, PortableInboxForwardingOptions as P, MediaUploaderCallback as Pt, respondWithObject as Q, digest as Qt, FederationQueueOptions as R, OutboxErrorHandler as Rt, FederationBenchmarkOptions as S, ActorKeyPairsDispatcher as St, FederationOptions as T, CollectionCursor as Tt, TaskDefinitionOptions as U, PortableCollectionOwnerMapper as Ut, createFederationBuilder as V, OutboxPermanentFailureHandler as Vt, TaskEnqueueOptions as W, SharedInboxKeyDispatcher as Wt, createExponentialBackoffPolicy as X, PageItems as Xt, RetryPolicy as Y, SenderKeyPair as Yt, RespondWithObjectOptions as Z, buildCollectionSynchronizationHeader as Zt, CollectionCallbackSetters as _, normalizeCircuitBreakerOptions as _t, GetObjectOptions as a, MessageQueueListenOptions as at, Federatable as b, ActorDispatcher as bt, OutboxContext as c, CircuitBreakerActivityDrop as ct, PortableRequest as d, CircuitBreakerFailurePolicy as dt, InProcessMessageQueue as et, RequestContext as f, CircuitBreakerKvState as ft, ActorCallbackSetters as g, NormalizedCircuitBreakerOptions as gt, SendActivityOptionsForCollection as h, CircuitBreakerStateChange as ht, GetActorOptions as i, MessageQueueEnqueueOptions as it, MediaUploaderSetters as j, HashlinkMediaRequest as jt, InboxChallengePolicy as k, CustomCollectionDispatcher as kt, ParseUriOptions as l, CircuitBreakerBeforeSendDecision as lt, SendActivityOptions as m, CircuitBreakerState as mt, Context as n, MessageQueue as nt, GetSignedKeyOptions as o, ParallelMessageQueue as ot, RouteActivityOptions as p, CircuitBreakerOptions as pt, CreateExponentialBackoffPolicyOptions as q, WebFingerLinksDispatcher as qt, ForwardActivityOptions as r, MessageQueueDepth as rt, InboxContext as s, CircuitBreaker as st, ActorKeyPair as t, InProcessMessageQueueOptions as tt, ParseUriResult as u, CircuitBreakerCreateOptions as ut, ConstructorWithTypeId as v, parseCircuitBreakerKvState as vt, FederationFetchOptions as w, CollectionCounter as wt, Federation as x, ActorHandleMapper as xt, CustomCollectionCallbackSetters as y, ActorAliasMapper as yt, createFederation as z, OutboxListener as zt };
+export { respondWithObject as $, digest as $t, InboxChallengePolicy as A, CustomCollectionDispatcher as At, createFederation as B, OutboxListener as Bt, FederationBenchmarkOptions as C, ActorKeyPairsDispatcher as Ct, FederationStartQueueOptions as D, CollectionDispatcher as Dt, FederationOptions as E, CollectionCursor as Et, PortableInboxForwardingOptions as F, MediaUploaderCallback as Ft, TaskEnqueueOptions as G, SharedInboxKeyDispatcher as Gt, createFederationBuilder as H, OutboxPermanentFailureHandler as Ht, Rfc6570Expression as I, NodeInfoDispatcher as It, CreateExponentialBackoffPolicyOptions as J, WebFingerLinksDispatcher as Jt, TaskHandler as K, UnverifiedActivityHandler as Kt, FederationKvPrefixes as L, ObjectAuthorizePredicate as Lt, MediaUploaderSetters as M, HashlinkMediaRequest as Mt, ObjectCallbackSetters as N, InboxErrorHandler as Nt, IdempotencyKeyCallback as O, CustomCollectionCounter as Ot, OutboxListenerSetters as P, InboxListener as Pt, RespondWithObjectOptions as Q, buildCollectionSynchronizationHeader as Qt, FederationOrigin as R, ObjectDispatcher as Rt, Federation as S, ActorHandleMapper as St, FederationFetchOptions as T, CollectionCounter as Tt, TaskDefinition as U, PortableActorIdMapper as Ut, Message as V, OutboxListenerErrorHandler as Vt, TaskDefinitionOptions as W, PortableCollectionOwnerMapper as Wt, RetryPolicy as X, SenderKeyPair as Xt, RetryContext as Y, SendActivityError as Yt, createExponentialBackoffPolicy as Z, PageItems as Zt, ActorCallbackSetters as _, NormalizedCircuitBreakerOptions as _t, GetObjectOptions as a, MessageQueueEnqueueOptions as at, CustomCollectionCallbackSetters as b, ActorAliasMapper as bt, IsSignedByAudienceOptions as c, CircuitBreaker as ct, ParseUriResult as d, CircuitBreakerCreateOptions as dt, ActivityTransformer as en, respondWithObjectIfAcceptable as et, PortableRequest as f, CircuitBreakerFailurePolicy as ft, SendActivityOptionsForCollection as g, CircuitBreakerStateChange as gt, SendActivityOptions as h, CircuitBreakerState as ht, GetActorOptions as i, MessageQueueDepth as it, InboxListenerSetters as j, HashlinkMediaDispatcher as jt, IdempotencyStrategy as k, CustomCollectionCursor as kt, OutboxContext as l, CircuitBreakerActivityDrop as lt, RouteActivityOptions as m, CircuitBreakerOptions as mt, Context as n, InProcessMessageQueueOptions as nt, GetSignedKeyOptions as o, MessageQueueListenOptions as ot, RequestContext as p, CircuitBreakerKvState as pt, TaskRegistry as q, UnverifiedActivityReason as qt, ForwardActivityOptions as r, MessageQueue as rt, InboxContext as s, ParallelMessageQueue as st, ActorKeyPair as t, InProcessMessageQueue as tt, ParseUriOptions as u, CircuitBreakerBeforeSendDecision as ut, CollectionCallbackSetters as v, normalizeCircuitBreakerOptions as vt, FederationBuilder as w, AuthorizePredicate as wt, Federatable as x, ActorDispatcher as xt, ConstructorWithTypeId as y, parseCircuitBreakerKvState as yt, FederationQueueOptions as z, OutboxErrorHandler as zt };

package/dist/{context-9T--NSo4.d.ts → context-DMd11IAu.d.ts}

@@ -1259,6 +1259,18 @@ interface FanoutMessage {
   readonly inboxes: Readonly<Record<string, {
     readonly actorIds: readonly string[];
     readonly sharedInbox: boolean;
+    /**
+    * The canonical form of the FEP-ef61 portable inbox that the inbox
+    * stands for.
+    * @internal
+    */
+    readonly portableInbox?: string;
+    /**
+    * The compatible identifiers of the portable inbox on each gateway to
+    * deliver through, in order.
+    * @internal
+    */
+    readonly gatewayInboxes?: readonly string[];
   }>>;
   readonly activity: unknown;
   readonly activityId?: string;
@@ -1302,6 +1314,27 @@ interface OutboxMessage {
   * @internal
   */
   readonly circuitHeldSince?: string;
+  /**
+  * The canonical form of the FEP-ef61 portable inbox that {@link inbox}, its
+  * compatible identifier on a gateway, stands for.
+  * @internal
+  */
+  readonly portableInbox?: string;
+  /**
+  * The compatible identifiers of the FEP-ef61 portable inbox on each gateway
+  * that is still to be tried, in order.  {@link inbox} is the first one.
+  * If there is more than one, the activity is delivered through the first
+  * gateway that accepts it.
+  * @internal
+  */
+  readonly gatewayInboxes?: readonly string[];
+  /**
+  * The times before which each of {@link gatewayInboxes} must not be tried
+  * again, as their responses' `Retry-After` headers requested, keyed by
+  * the inbox URL, in ISO 8601.
+  * @internal
+  */
+  readonly gatewayNotBefore?: Readonly<Record<string, string>>;
   readonly traceContext: Readonly<Record<string, string>>;
 }
 /**
@@ -4205,6 +4238,52 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * [instance actor]: https://swicg.github.io/activitypub-http-signature/#instance-actor
   */
   getSignedKeyOwner(options: GetKeyOwnerOptions): Promise<Actor | null>;
+  /**
+  * Checks whether the request is signed by an actor who belongs to
+  * the intended audience of an object, i.e., the owner of the signed key
+  * (see {@link RequestContext.getSignedKeyOwner}) is one of the object's
+  * `to`, `cc`, `bto`, `bcc`, and `audience`, or a member of one of them
+  * according to the `isMember` option.
+  *
+  * Everyone belongs to the audience of a publicly addressed object, so it
+  * returns `true` for such an object even if the request is not signed.
+  *
+  * This can be used in authorization predicates for serving non-public
+  * objects, which [FEP-ef61] requires of gateways serving portable objects.
+  * [FEP-ef61] portable IDs are compared by their canonical forms, so
+  * an `ap:` URI, an `ap+ef61:` URI, and a compatible identifier on any
+  * gateway refer to the same actor.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  *
+  * @param object The object whose audience is checked.
+  * @param options Options for checking the audience.
+  * @returns `true` if the object is publicly addressed, or the request is
+  *          signed by an actor who belongs to its audience.
+  * @since 2.4.0
+  */
+  isSignedByAudience(object: Object$1, options?: IsSignedByAudienceOptions): Promise<boolean>;
+}
+/**
+* Options for {@link RequestContext.isSignedByAudience} method.
+* @since 2.4.0
+*/
+interface IsSignedByAudienceOptions extends GetKeyOwnerOptions {
+  /**
+  * Checks whether the actor who signed the request is a member of
+  * an addressee of the object that is not the actor itself, e.g.,
+  * a followers collection.  Fedify does not resolve collections by itself,
+  * as only the application can tell their members reliably.
+  *
+  * It is called for each such addressee in order until it returns `true`.
+  * If it is omitted, only the actors that the object addresses directly
+  * belong to its audience.
+  * @param addressee The ID of the addressee, e.g., the ID of a followers
+  *                  collection.
+  * @param actor The actor who signed the request.
+  * @returns `true` if the actor is a member of the addressee.
+  */
+  isMember?: (addressee: URL, actor: Actor) => boolean | Promise<boolean>;
 }
 /**
 * A context for inbox listeners.
@@ -4637,4 +4716,4 @@ interface ActorKeyPair extends CryptoKeyPair {
   readonly multikey: Multikey;
 }
 //#endregion
-export { respondWithObjectIfAcceptable as $, ActivityTransformer as $t, InboxListenerSetters as A, HashlinkMediaDispatcher as At, Message as B, OutboxListenerErrorHandler as Bt, FederationBuilder as C, AuthorizePredicate as Ct, IdempotencyKeyCallback as D, CustomCollectionCounter as Dt, FederationStartQueueOptions as E, CollectionDispatcher as Et, Rfc6570Expression as F, NodeInfoDispatcher as Ft, TaskHandler as G, UnverifiedActivityHandler as Gt, TaskDefinition as H, PortableActorIdMapper as Ht, FederationKvPrefixes as I, ObjectAuthorizePredicate as It, RetryContext as J, SendActivityError as Jt, TaskRegistry as K, UnverifiedActivityReason as Kt, FederationOrigin as L, ObjectDispatcher as Lt, ObjectCallbackSetters as M, InboxErrorHandler as Mt, OutboxListenerSetters as N, InboxListener as Nt, IdempotencyStrategy as O, CustomCollectionCursor as Ot, PortableInboxForwardingOptions as P, MediaUploaderCallback as Pt, respondWithObject as Q, digest as Qt, FederationQueueOptions as R, OutboxErrorHandler as Rt, FederationBenchmarkOptions as S, ActorKeyPairsDispatcher as St, FederationOptions as T, CollectionCursor as Tt, TaskDefinitionOptions as U, PortableCollectionOwnerMapper as Ut, createFederationBuilder as V, OutboxPermanentFailureHandler as Vt, TaskEnqueueOptions as W, SharedInboxKeyDispatcher as Wt, createExponentialBackoffPolicy as X, PageItems as Xt, RetryPolicy as Y, SenderKeyPair as Yt, RespondWithObjectOptions as Z, buildCollectionSynchronizationHeader as Zt, CollectionCallbackSetters as _, normalizeCircuitBreakerOptions as _t, GetObjectOptions as a, MessageQueueListenOptions as at, Federatable as b, ActorDispatcher as bt, OutboxContext as c, CircuitBreakerActivityDrop as ct, PortableRequest as d, CircuitBreakerFailurePolicy as dt, InProcessMessageQueue as et, RequestContext as f, CircuitBreakerKvState as ft, ActorCallbackSetters as g, NormalizedCircuitBreakerOptions as gt, SendActivityOptionsForCollection as h, CircuitBreakerStateChange as ht, GetActorOptions as i, MessageQueueEnqueueOptions as it, MediaUploaderSetters as j, HashlinkMediaRequest as jt, InboxChallengePolicy as k, CustomCollectionDispatcher as kt, ParseUriOptions as l, CircuitBreakerBeforeSendDecision as lt, SendActivityOptions as m, CircuitBreakerState as mt, Context as n, MessageQueue as nt, GetSignedKeyOptions as o, ParallelMessageQueue as ot, RouteActivityOptions as p, CircuitBreakerOptions as pt, CreateExponentialBackoffPolicyOptions as q, WebFingerLinksDispatcher as qt, ForwardActivityOptions as r, MessageQueueDepth as rt, InboxContext as s, CircuitBreaker as st, ActorKeyPair as t, InProcessMessageQueueOptions as tt, ParseUriResult as u, CircuitBreakerCreateOptions as ut, ConstructorWithTypeId as v, parseCircuitBreakerKvState as vt, FederationFetchOptions as w, CollectionCounter as wt, Federation as x, ActorHandleMapper as xt, CustomCollectionCallbackSetters as y, ActorAliasMapper as yt, createFederation as z, OutboxListener as zt };
+export { respondWithObject as $, digest as $t, InboxChallengePolicy as A, CustomCollectionDispatcher as At, createFederation as B, OutboxListener as Bt, FederationBenchmarkOptions as C, ActorKeyPairsDispatcher as Ct, FederationStartQueueOptions as D, CollectionDispatcher as Dt, FederationOptions as E, CollectionCursor as Et, PortableInboxForwardingOptions as F, MediaUploaderCallback as Ft, TaskEnqueueOptions as G, SharedInboxKeyDispatcher as Gt, createFederationBuilder as H, OutboxPermanentFailureHandler as Ht, Rfc6570Expression as I, NodeInfoDispatcher as It, CreateExponentialBackoffPolicyOptions as J, WebFingerLinksDispatcher as Jt, TaskHandler as K, UnverifiedActivityHandler as Kt, FederationKvPrefixes as L, ObjectAuthorizePredicate as Lt, MediaUploaderSetters as M, HashlinkMediaRequest as Mt, ObjectCallbackSetters as N, InboxErrorHandler as Nt, IdempotencyKeyCallback as O, CustomCollectionCounter as Ot, OutboxListenerSetters as P, InboxListener as Pt, RespondWithObjectOptions as Q, buildCollectionSynchronizationHeader as Qt, FederationOrigin as R, ObjectDispatcher as Rt, Federation as S, ActorHandleMapper as St, FederationFetchOptions as T, CollectionCounter as Tt, TaskDefinition as U, PortableActorIdMapper as Ut, Message as V, OutboxListenerErrorHandler as Vt, TaskDefinitionOptions as W, PortableCollectionOwnerMapper as Wt, RetryPolicy as X, SenderKeyPair as Xt, RetryContext as Y, SendActivityError as Yt, createExponentialBackoffPolicy as Z, PageItems as Zt, ActorCallbackSetters as _, NormalizedCircuitBreakerOptions as _t, GetObjectOptions as a, MessageQueueEnqueueOptions as at, CustomCollectionCallbackSetters as b, ActorAliasMapper as bt, IsSignedByAudienceOptions as c, CircuitBreaker as ct, ParseUriResult as d, CircuitBreakerCreateOptions as dt, ActivityTransformer as en, respondWithObjectIfAcceptable as et, PortableRequest as f, CircuitBreakerFailurePolicy as ft, SendActivityOptionsForCollection as g, CircuitBreakerStateChange as gt, SendActivityOptions as h, CircuitBreakerState as ht, GetActorOptions as i, MessageQueueDepth as it, InboxListenerSetters as j, HashlinkMediaDispatcher as jt, IdempotencyStrategy as k, CustomCollectionCursor as kt, OutboxContext as l, CircuitBreakerActivityDrop as lt, RouteActivityOptions as m, CircuitBreakerOptions as mt, Context as n, InProcessMessageQueueOptions as nt, GetSignedKeyOptions as o, MessageQueueListenOptions as ot, RequestContext as p, CircuitBreakerKvState as pt, TaskRegistry as q, UnverifiedActivityReason as qt, ForwardActivityOptions as r, MessageQueue as rt, InboxContext as s, ParallelMessageQueue as st, ActorKeyPair as t, InProcessMessageQueue as tt, ParseUriOptions as u, CircuitBreakerBeforeSendDecision as ut, CollectionCallbackSetters as v, normalizeCircuitBreakerOptions as vt, FederationBuilder as w, AuthorizePredicate as wt, Federatable as x, ActorDispatcher as xt, ConstructorWithTypeId as y, parseCircuitBreakerKvState as yt, FederationQueueOptions as z, OutboxErrorHandler as zt };

package/dist/{deno-DB_Sh0LK.mjs → deno-BKp9fYB3.mjs}

@@ -3,6 +3,6 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2193+402149b5";
+var version = "2.4.0-dev.2212+26ce9858";
 //#endregion
 export { version as n, name as t };

package/dist/{docloader-DpWYYY6a.mjs → docloader-BjJreYQU.mjs}

@@ -1,11 +1,11 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as validateCryptoKey } from "./key-DA3Yx8p2.mjs";
-import { n as doubleKnock } from "./http-DQf9Mw4V.mjs";
+import { c as validateCryptoKey } from "./key-ChfV9C3v.mjs";
+import { n as doubleKnock } from "./http--IGUT1mg.mjs";
 import { getLogger } from "@logtape/logtape";
-import { curry } from "es-toolkit";
 import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, resolveDocumentLoaderTimeout, validatePublicUrl, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
+import { curry } from "es-toolkit";
 //#region src/utils/docloader.ts
 const logger = getLogger([
 	"fedify",

package/dist/federation/audience.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/federation/audience.test.mjs

@@ -0,0 +1,130 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { n as isPubliclyAddressedNode, t as isInAudience } from "../audience-CHQ-FlLD.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { Note, PUBLIC_COLLECTION, Person } from "@fedify/vocab";
+import { parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+import jsonld from "@fedify/vocab-runtime/jsonld";
+//#region src/federation/audience.test.ts
+const did = "did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2";
+async function expand(document) {
+	const [node] = await jsonld.expand({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/notes/1",
+		type: "Note",
+		...document
+	}, { documentLoader: mockDocumentLoader });
+	return node;
+}
+test("isPubliclyAddressedNode()", async (t) => {
+	for (const property of [
+		"to",
+		"cc",
+		"bto",
+		"bcc",
+		"audience"
+	]) for (const value of [
+		PUBLIC_COLLECTION.href,
+		"as:Public",
+		"Public",
+		["https://example.com/person", "as:Public"]
+	]) await t.step(`${JSON.stringify(value)} in ${property}`, async () => {
+		assertEquals(isPubliclyAddressedNode(await expand({ [property]: value })), true);
+	});
+	await t.step("not addressed", async () => {
+		assertEquals(isPubliclyAddressedNode(await expand({})), false);
+	});
+	await t.step("addressed to other recipients", async () => {
+		assertEquals(isPubliclyAddressedNode(await expand({
+			to: "https://example.com/person",
+			cc: "https://example.com/person/followers"
+		})), false);
+	});
+	await t.step("Public in other properties", async () => {
+		assertEquals(isPubliclyAddressedNode(await expand({ tag: PUBLIC_COLLECTION.href })), false);
+	});
+	await t.step("a Public literal rather than an ID", async () => {
+		assertEquals(isPubliclyAddressedNode(await expand({ to: { "@value": PUBLIC_COLLECTION.href } })), false);
+	});
+	await t.step("Public that the context maps elsewhere", async () => {
+		for (const [context, to] of [[{ as: "https://example.com/ns#" }, "as:Public"], [{ "@base": "https://example.com/" }, "Public"]]) {
+			const [node] = await jsonld.expand({
+				"@context": ["https://www.w3.org/ns/activitystreams", context],
+				id: "https://example.com/notes/1",
+				type: "Note",
+				to
+			}, { documentLoader: mockDocumentLoader });
+			assertEquals(isPubliclyAddressedNode(node), false, JSON.stringify(context));
+		}
+	});
+	await t.step("only the node itself is checked", async () => {
+		assertEquals(isPubliclyAddressedNode(await expand({
+			type: "Create",
+			actor: "https://example.com/person",
+			object: {
+				type: "Note",
+				id: "https://example.com/notes/2",
+				to: PUBLIC_COLLECTION.href
+			}
+		})), false);
+	});
+});
+test("isInAudience()", async (t) => {
+	const person = new Person({ id: new URL("https://example.com/person") });
+	const portableId = parseIri(`ap+ef61://${did}/actor`);
+	const portable = new Person({ id: toCompatibleEf61Id(portableId, "https://other.example") });
+	const followers = new URL("https://example.com/person2/followers");
+	await t.step("publicly addressed", async () => {
+		for (const actor of [null, person]) assertEquals(await isInAudience(new Note({ cc: PUBLIC_COLLECTION }), actor), true);
+	});
+	await t.step("no actor", async () => {
+		assertEquals(await isInAudience(new Note({ to: person.id }), null), false);
+		assertEquals(await isInAudience(new Note({}), null), false);
+	});
+	await t.step("directly addressed", async () => {
+		for (const property of [
+			"to",
+			"cc",
+			"bto",
+			"bcc",
+			"audience"
+		]) assertEquals(await isInAudience(new Note({ [property]: person.id }), person), true, property);
+	});
+	await t.step("not addressed", async () => {
+		assertEquals(await isInAudience(new Note({ to: new URL("https://example.com/other") }), person), false);
+		assertEquals(await isInAudience(new Note({ to: person.id }), new Person({})), false);
+	});
+	await t.step("portable IDs are compared canonically", async () => {
+		for (const addressee of [
+			portableId,
+			parseIri(`ap://${did}/actor`),
+			parseIri(`ap+ef61://${did.replaceAll(":", "%3A")}/actor`),
+			toCompatibleEf61Id(portableId, "https://example.com")
+		]) assertEquals(await isInAudience(new Note({ to: addressee }), portable), true, addressee.href);
+		assertEquals(await isInAudience(new Note({ to: parseIri(`ap+ef61://${did}/other`) }), portable), false);
+		assertEquals(await isInAudience(new Note({ to: new URL(`https://other.example/${did}/actor`) }), portable), false);
+	});
+	await t.step("isMember()", async () => {
+		const calls = [];
+		const isMember = (addressee, actor) => {
+			calls.push(`${addressee.href} ${actor.id?.href}`);
+			return addressee.href === followers.href;
+		};
+		const note = new Note({
+			to: new URL("https://example.com/other"),
+			cc: followers
+		});
+		assertEquals(await isInAudience(note, person, { isMember }), true);
+		assertEquals(calls, [`https://example.com/other ${person.id?.href}`, `${followers.href} ${person.id?.href}`]);
+		calls.length = 0;
+		assertEquals(await isInAudience(new Note({ to: person.id }), person, { isMember }), true);
+		assertEquals(await isInAudience(note, null, { isMember }), false);
+		assertEquals(calls, []);
+		assertEquals(await isInAudience(note, person, { isMember: () => false }), false);
+	});
+});
+//#endregion
+export {};

package/dist/federation/builder.test.mjs

@@ -6,7 +6,7 @@ import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertExists } from "../assert_exists-cffSpJ7X.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { r as createFederationBuilder } from "../builder-0onlMY4u.mjs";
+import { r as createFederationBuilder } from "../builder-CKAVFvcH.mjs";
 import { DisallowedOperatorError, DisallowedVarSpecModifierError, DuplicateRouteVariableError, RouteTemplateOptionsNotMatchedError, RouterError } from "@fedify/uri-template";
 import { Activity, Note, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";

package/dist/federation/compound-fanout.test.mjs

@@ -6,14 +6,14 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { n as exportJwk } from "../key-DA3Yx8p2.mjs";
+import { n as exportJwk } from "../key-ChfV9C3v.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as signObject, d as verifyProof } from "../proof-DrJWKeOl.mjs";
+import { a as signObject, d as verifyProof } from "../proof-MFz2960e.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as FederationImpl } from "../middleware-BqqycC0P.mjs";
+import { n as FederationImpl } from "../middleware-BW7-tHAG.mjs";
 import { Create, DataIntegrityProof, Note } from "@fedify/vocab";
-import { mockDocumentLoader, test } from "@fedify/fixture";
 import { exportDidKey, parseIri } from "@fedify/vocab-runtime";
+import { mockDocumentLoader, test } from "@fedify/fixture";
 import serialize from "json-canon";
 //#region src/federation/compound-fanout.test.ts
 const options = {

package/dist/federation/handler-compound-proof.test.mjs

@@ -1,19 +1,19 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { r as createRequestContext, t as createInboxContext } from "../context-B2rlkkyJ.mjs";
+import { r as createRequestContext, t as createInboxContext } from "../context-8Tu9kea0.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { a as compactJsonLd, m as verifyCompactJsonLd, p as signJsonLd } from "../ld-C15yzuY6.mjs";
-import { l as signRequest } from "../http-DQf9Mw4V.mjs";
+import { a as compactJsonLd, m as verifyCompactJsonLd, p as signJsonLd } from "../ld-DBBVabBC.mjs";
+import { l as signRequest } from "../http--IGUT1mg.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { f as handleInbox, o as createFederation } from "../middleware-BqqycC0P.mjs";
+import { f as handleInbox, o as createFederation } from "../middleware-BW7-tHAG.mjs";
 import { t as ActivityListenerSet } from "../activity-listener-C-BSbKI7.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { Create, CryptographicKey, Multikey, Person, Update } from "@fedify/vocab";
-import { mockDocumentLoader, test } from "@fedify/fixture";
 import { encodeMultibase, exportDidKey, parseIri } from "@fedify/vocab-runtime";
+import { mockDocumentLoader, test } from "@fedify/fixture";
 import serialize from "json-canon";
 //#region src/federation/handler-compound-proof.test.ts
 async function sha256(value) {