@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/federation/middleware.test.mjs

@@ -1,43 +1,48 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { t as esm_default } from "../esm-yYQfPhIY.mjs";
-import { t as MemoryKvStore } from "../kv-CXBAok3k.mjs";
-import { a as numberSchema, r as envelopeSchema, t as MockQueue } from "../testing-CO7ftO8A.mjs";
-import { t as assertEquals } from "../assert_equals-BV7oLMxm.mjs";
-import { r as assertExists } from "../std__assert-B2NnY9bq.mjs";
-import { r as assertFalse, t as assertRejects } from "../assert_rejects-EgstcQy5.mjs";
-import { t as assertInstanceOf } from "../assert_instance_of-Q9KTBnrf.mjs";
-import { t as assertThrows } from "../assert_throws-NiFfqbnH.mjs";
-import { t as assertNotEquals } from "../assert_not_equals-EPJPoxuf.mjs";
-import { t as assertStrictEquals } from "../assert_strict_equals-Ec20AUwa.mjs";
-import { t as assert } from "../assert-CJ1KXcvv.mjs";
-import { g as recordInboxActivity } from "../metrics-DMk-nTxI.mjs";
-import { l as verifyRequest, s as signRequest } from "../http-CPVMUgsW.mjs";
-import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-Dbyd7bhl.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-e1khNUKy.mjs";
-import { a as compactJsonLd, h as verifyJsonLd, p as signJsonLd, s as detachSignature } from "../ld-Cj9F_5AP.mjs";
-import { t as doesActorOwnKey } from "../owner-Br9YYzn_.mjs";
-import { i as verifyObject, r as signObject } from "../proof-B4ngoaNQ.mjs";
-import { g as handleBenchmarkTrigger, i as KvSpecDeterminer, n as FederationImpl, o as createFederation, r as InboxContextImpl, t as ContextImpl } from "../middleware-CvwTUgnP.mjs";
-import { t as CircuitBreaker } from "../circuit-breaker-CBGyz5F7.mjs";
-import { t as TaskCodec } from "../codec-BBga-FWI.mjs";
+import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
+import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
+import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
+import { a as numberSchema, r as envelopeSchema, t as MockQueue } from "../tasks-IG3pHfvZ.mjs";
+import "../testing-t8xDeJZ5.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import { t as assertExists } from "../assert_exists-cffSpJ7X.mjs";
+import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
+import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
+import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
+import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
+import { t as assertStrictEquals } from "../assert_strict_equals-CYvBmkpC.mjs";
+import { t as assert } from "../assert-D1Eafmd_.mjs";
+import { g as recordInboxActivity } from "../metrics-CYg9yxBL.mjs";
+import { a as compactJsonLd, h as verifyJsonLd, p as signJsonLd, s as detachSignature } from "../ld-CzaP-hJl.mjs";
+import { a as signObject, s as verifyObject } from "../proof-Dxy6ByqI.mjs";
+import { f as verifyRequest, l as signRequest } from "../http-siciWkmx.mjs";
+import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-DBoYbvYW.mjs";
+import { T as handleBenchmarkTrigger, i as KvSpecDeterminer, n as FederationImpl, o as createFederation, r as InboxContextImpl, t as ContextImpl } from "../middleware-D7_LO-Vs.mjs";
+import { t as doesActorOwnKey } from "../owner-DYgfTFHy.mjs";
+import { t as CircuitBreaker } from "../circuit-breaker-XJ53md4S.mjs";
+import { t as TaskCodec } from "../codec-C6rTrpIp.mjs";
+import { t as markCircuitBreakerLegacySweepDone } from "../circuit-breaker-test-utils-DW6YC_Pe.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { RouterError } from "@fedify/uri-template";
 import * as vocab from "@fedify/vocab";
 import { Create, Note, Offer, Person, getTypeId, lookupObject } from "@fedify/vocab";
 import { SpanStatusCode, metrics } from "@opentelemetry/api";
+import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
-import { FetchError, getDocumentLoader } from "@fedify/vocab-runtime";
-import { deepStrictEqual, ok, rejects, strictEqual } from "node:assert/strict";
+import dns from "node:dns/promises";
+import { deepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert/strict";
 import serialize from "json-canon";
 import { DataPointType, MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 //#region ../fixture/src/fixtures/example.com/create.json
-var id$2 = "https://example.com/create";
 var create_default = {
 	"@context": "https://www.w3.org/ns/activitystreams",
 	type: "Create",
-	id: id$2,
+	id: "https://example.com/create",
 	actor: "https://example.com/person"
 };
 //#endregion
@@ -1171,6 +1176,90 @@ test({
 		esm_default.hardReset();
 	}
 });
+test("Federation.fetch() [rfc9421] multiple POST signatures", async (t) => {
+	for (const [name, validSecond, maxHttpSignatures] of [
+		[
+			"valid second signature",
+			true,
+			void 0
+		],
+		[
+			"both signatures invalid",
+			false,
+			void 0
+		],
+		[
+			"valid second signature beyond maxHttpSignatures",
+			true,
+			1
+		]
+	]) await t.step(name, async () => {
+		const inbox = [];
+		const federation = createFederation({
+			kv: new MemoryKvStore(),
+			documentLoaderFactory: () => mockDocumentLoader,
+			contextLoaderFactory: () => mockDocumentLoader,
+			maxHttpSignatures
+		});
+		federation.setActorDispatcher("/users/{identifier}", (ctx, identifier) => new vocab.Person({ id: ctx.getActorUri(identifier) }));
+		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(vocab.Create, (_ctx, activity) => {
+			inbox.push(activity.id.href);
+		});
+		const signed = await signRequest(new Request("https://example.com/inbox", {
+			method: "POST",
+			headers: { "Content-Type": "application/activity+json" },
+			body: JSON.stringify(create_default)
+		}), rsaPrivateKey2, rsaPublicKey2.id, { spec: "rfc9421" });
+		const input = signed.headers.get("Signature-Input");
+		const signature = signed.headers.get("Signature");
+		signed.headers.set("Signature-Input", `${input}, ${input.replace(/^sig1=/, "sig2=")}`);
+		signed.headers.set("Signature", `sig1=:AAAAAA==:, ${validSecond ? signature.replace(/^sig1=/, "sig2=") : "sig2=:AAAAAA==:"}`);
+		const response = await federation.fetch(signed, { contextData: void 0 });
+		const accepted = validSecond && maxHttpSignatures == null;
+		assertEquals(response.status, accepted ? 202 : 401);
+		assertEquals(inbox, accepted ? [create_default.id] : []);
+	});
+});
+test("FederationOptions.maxHttpSignatures", async (t) => {
+	const kv = new MemoryKvStore();
+	await t.step("defaults to three", () => {
+		const federation = createFederation({ kv });
+		assertInstanceOf(federation, FederationImpl);
+		assertEquals(federation.maxHttpSignatures, 3);
+	});
+	await t.step("rejects invalid values", () => {
+		for (const maxHttpSignatures of [
+			0,
+			-1,
+			1.5,
+			NaN,
+			2 ** 53,
+			null
+		]) assertThrows(() => createFederation({
+			kv,
+			maxHttpSignatures
+		}), RangeError);
+		const federation = createFederation({
+			kv,
+			maxHttpSignatures: Infinity
+		});
+		assertInstanceOf(federation, FederationImpl);
+		assertEquals(federation.maxHttpSignatures, Infinity);
+	});
+	await t.step("applies to RequestContext.getSignedKey()", async () => {
+		let request = new Request("https://example.com/", { headers: { "Accept": "application/ld+json" } });
+		for (const [label, keyId] of [["sig1", new URL("https://example.com/missing-key")], ["sig2", rsaPublicKey2.id]]) request = await signRequest(request, rsaPrivateKey2, keyId, {
+			spec: "rfc9421",
+			rfc9421: { label }
+		});
+		for (const maxHttpSignatures of [void 0, 1]) assertEquals(await createFederation({
+			kv,
+			documentLoaderFactory: () => mockDocumentLoader,
+			contextLoaderFactory: () => mockDocumentLoader,
+			maxHttpSignatures
+		}).createContext(request, void 0).getSignedKey(), maxHttpSignatures == null ? rsaPublicKey2 : null);
+	});
+});
 test("Federation.fetch()", async (t) => {
 	esm_default.spyGlobal();
 	esm_default.get("https://example.com/key2", {
@@ -1269,7 +1358,7 @@ test("Federation.fetch()", async (t) => {
 		}), rsaPrivateKey2, rsaPublicKey2.id);
 		assertEquals((await federation.fetch(request, { contextData: void 0 })).status, 202);
 		assertEquals(inbox.length, 1, "Expected one item in the inbox, json");
-		assertEquals(inbox[0], id$2);
+		assertEquals(inbox[0], create_default.id);
 	});
 	await t.step("GET with application/json", async () => {
 		const { federation, dispatches } = createTestContext();
@@ -1292,7 +1381,7 @@ test("Federation.fetch()", async (t) => {
 		}), rsaPrivateKey2, rsaPublicKey2.id);
 		assertEquals((await federation.fetch(request, { contextData: void 0 })).status, 202);
 		assertEquals(inbox.length, 1, "Expected one inbox activity, ld+json");
-		assertEquals(inbox[0], id$2);
+		assertEquals(inbox[0], create_default.id);
 	});
 	await t.step("GET with application/ld+json", async () => {
 		const { federation, dispatches } = createTestContext();
@@ -1316,7 +1405,7 @@ test("Federation.fetch()", async (t) => {
 		}), rsaPrivateKey2, rsaPublicKey2.id);
 		assertEquals((await federation.fetch(request, { contextData: void 0 })).status, 202);
 		assertEquals(inbox.length, 1);
-		assertEquals(inbox[0], id$2);
+		assertEquals(inbox[0], create_default.id);
 	});
 	await t.step("GET with application/activity+json", async () => {
 		const { federation, dispatches } = createTestContext();
@@ -2044,7 +2133,7 @@ test("Federation.setOutboxListeners()", async (t) => {
 			}
 		}), { contextData: void 0 });
 		assertEquals([response.status, await response.text()], [202, ""]);
-		assertEquals(received, [`john:${id$2}`]);
+		assertEquals(received, [`john:${create_default.id}`]);
 		response = await federation.fetch(new Request("https://example.com/users/no-one/outbox", {
 			method: "POST",
 			body: JSON.stringify(create_default),
@@ -2106,7 +2195,7 @@ test("Federation.setOutboxListeners()", async (t) => {
 			}
 		}), { contextData: void 0 });
 		assertEquals([response.status, await response.text()], [202, ""]);
-		assertEquals(received, [`john:${id$2}`]);
+		assertEquals(received, [`john:${create_default.id}`]);
 	});
 	await t.step("warns when listener omits delivery", async () => {
 		await withLogtapeLock(async () => {
@@ -2161,7 +2250,7 @@ test("Federation.setOutboxListeners()", async (t) => {
 			const records = [];
 			await reset();
 			esm_default.spyGlobal();
-			esm_default.post("https://remote.example/inbox", {
+			esm_default.post("https://example.com/inbox", {
 				status: 202,
 				body: "Accepted"
 			});
@@ -2187,7 +2276,7 @@ test("Federation.setOutboxListeners()", async (t) => {
 				federation.setOutboxListeners("/users/{identifier}/outbox").on(vocab.Activity, async (ctx, activity) => {
 					await ctx.sendActivity({ identifier: ctx.identifier }, new vocab.Person({
 						id: new URL("https://remote.example/users/alice"),
-						inbox: new URL("https://remote.example/inbox")
+						inbox: new URL("https://example.com/inbox")
 					}), activity);
 				}).authorize((ctx, identifier) => {
 					return identifier === "john" && ctx.request.headers.get("authorization") === "Bearer token";
@@ -2263,7 +2352,7 @@ test("Federation.setOutboxListeners()", async (t) => {
 			let ldsVerified = false;
 			await reset();
 			esm_default.spyGlobal();
-			esm_default.post("https://remote.example/inbox", async (cl) => {
+			esm_default.post("https://example.com/inbox", async (cl) => {
 				const verifyOptions = {
 					documentLoader: mockDocumentLoader,
 					contextLoader: mockDocumentLoader
@@ -2296,7 +2385,7 @@ test("Federation.setOutboxListeners()", async (t) => {
 						keyId: rsaPublicKey2.id
 					}], {
 						id: new URL("https://remote.example/users/alice"),
-						inboxId: new URL("https://remote.example/inbox")
+						inboxId: new URL("https://example.com/inbox")
 					}, { skipIfUnsigned: true });
 				}).authorize((ctx, identifier) => {
 					return identifier === "person2" && ctx.request.headers.get("authorization") === "Bearer token";
@@ -3106,6 +3195,7 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 		const kv = new MemoryKvStore();
 		const queuedMessages = [];
 		const federation = new FederationImpl({
+			allowPrivateAddress: true,
 			kv,
 			queue: {
 				nativeRetrial: true,
@@ -3168,6 +3258,7 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 		const kv = new MemoryKvStore();
 		let queuedMessages = [];
 		const federation = new FederationImpl({
+			allowPrivateAddress: true,
 			kv,
 			queue: {
 				enqueue(message, _options) {
@@ -3238,6 +3329,7 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 		const kv = new MemoryKvStore();
 		const [meterProvider, recorder] = createTestMeterProvider();
 		await new FederationImpl({
+			allowPrivateAddress: true,
 			kv,
 			meterProvider,
 			queue: {
@@ -3280,6 +3372,7 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 		const kv = new MemoryKvStore();
 		const [meterProvider, recorder] = createTestMeterProvider();
 		await new FederationImpl({
+			allowPrivateAddress: true,
 			kv,
 			meterProvider,
 			queue: {
@@ -4225,6 +4318,51 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 		assertEquals(errorCount, 1);
 		assertEquals(queuedMessages, []);
 	});
+	await t.step("malformed FEP-ef61 gateways are permanent queued inbox parse errors", async () => {
+		const queuedMessages = [];
+		const queue = {
+			enqueue(message, _options) {
+				queuedMessages.push(message);
+				return Promise.resolve();
+			},
+			listen(_handler, _options) {
+				return Promise.resolve();
+			}
+		};
+		const kv = new MemoryKvStore();
+		let errorCount = 0;
+		const federation = new FederationImpl({
+			kv,
+			queue
+		});
+		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Create, () => {
+			throw new Error("listener should not run");
+		}).onError(() => {
+			errorCount++;
+		});
+		await federation.processQueuedTask(void 0, {
+			type: "inbox",
+			id: crypto.randomUUID(),
+			baseUrl: "https://example.com",
+			activity: {
+				"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/fep/ef61"],
+				id: "https://remote.example/activities/invalid-gateway",
+				type: "Create",
+				actor: "https://remote.example/users/alice",
+				object: {
+					id: "https://remote.example/users/bob",
+					type: "Person",
+					gateways: ["https://gw.example/path"]
+				}
+			},
+			started: (/* @__PURE__ */ new Date()).toISOString(),
+			attempt: 0,
+			identifier: null,
+			traceContext: {}
+		});
+		assertEquals(errorCount, 1);
+		assertEquals(queuedMessages, []);
+	});
 	await t.step("legacy raw LDS inbox messages with network-path context ids retry", async () => {
 		const queue = {
 			enqueue(message, _options) {
@@ -4935,6 +5073,157 @@ test("FederationImpl.processQueuedTask()", async (t) => {
 		assertEquals(queuedMessages, []);
 	});
 });
+test({
+	name: "FederationImpl.processQueuedTask() accounts for destination validation failures",
+	ignore: "Deno" in globalThis && (await Deno.permissions.query({ name: "net" })).state !== "granted",
+	async fn(t) {
+		for (const result of [
+			"throws",
+			"empty",
+			"private"
+		]) for (const failureThreshold of [1, 5]) for (const redirected of [false, true]) await t.step(`${result}, threshold: ${failureThreshold}, redirected: ${redirected}`, async () => {
+			const destination = "https://delivery.invalid/inbox";
+			const publicInbox = "https://8.8.8.8/inbox";
+			const queuedMessages = [];
+			const delays = [];
+			const errors = [];
+			const activities = [];
+			const attempts = [];
+			const delay = Temporal.Duration.from({ seconds: 5 });
+			const kv = new MemoryKvStore();
+			await markCircuitBreakerLegacySweepDone(kv);
+			const [meterProvider, recorder] = createTestMeterProvider();
+			const recoveryDelay = Temporal.Duration.from({ minutes: 30 });
+			const federation = new FederationImpl({
+				kv,
+				meterProvider,
+				circuitBreaker: {
+					failureThreshold,
+					recoveryDelay
+				},
+				queue: {
+					enqueue(message, options) {
+						queuedMessages.push(message);
+						delays.push(options?.delay);
+						return Promise.resolve();
+					},
+					listen() {
+						return Promise.resolve();
+					}
+				},
+				documentLoaderFactory: () => mockDocumentLoader,
+				contextLoaderFactory: () => mockDocumentLoader,
+				onOutboxError(error, activity) {
+					errors.push(error);
+					activities.push(activity);
+				},
+				outboxRetryPolicy(options) {
+					attempts.push(options.attempts);
+					return delay;
+				}
+			});
+			const message = {
+				type: "outbox",
+				id: crypto.randomUUID(),
+				baseUrl: "https://example.com",
+				keys: [],
+				activity: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Create",
+					id: "https://example.com/activities/dns-failure",
+					actor: "https://example.com/users/alice",
+					object: {
+						type: "Note",
+						content: "test"
+					}
+				},
+				activityType: "https://www.w3.org/ns/activitystreams#Create",
+				inbox: redirected ? publicInbox : destination,
+				sharedInbox: false,
+				started: (/* @__PURE__ */ new Date()).toISOString(),
+				attempt: 0,
+				headers: {},
+				traceContext: {}
+			};
+			const originalLookup = dns.lookup;
+			const resolverError = /* @__PURE__ */ new Error("Resolver unavailable");
+			const lookups = [];
+			dns.lookup = ((hostname) => {
+				lookups.push(hostname);
+				assertEquals(hostname, "delivery.invalid");
+				if (result === "throws") return Promise.reject(resolverError);
+				return Promise.resolve(result === "empty" ? [] : [{
+					address: "127.0.0.1",
+					family: 4
+				}]);
+			});
+			try {
+				esm_default.mockGlobal().catch(202);
+				if (redirected) esm_default.route(publicInbox, {
+					status: 307,
+					headers: { Location: destination }
+				});
+				await federation.processQueuedTask(void 0, message);
+				assertEquals(errors.length, 1);
+				const error = errors[0];
+				if (result === "private") {
+					assertInstanceOf(error, UrlError);
+					assertEquals(error.reason, "disallowed");
+				} else {
+					assertInstanceOf(error, FetchError);
+					assertEquals(error.url.href, destination);
+					assertInstanceOf(error.cause, UrlError);
+					assertEquals(error.cause.reason, "dns");
+					assertStrictEquals(error.cause.cause, result === "throws" ? resolverError : void 0);
+				}
+				assertEquals(activities.length, 1);
+				assertInstanceOf(activities[0], Create);
+				assertEquals(activities[0].id?.href, "https://example.com/activities/dns-failure");
+				assertEquals(attempts, [0]);
+				const host = new URL(message.inbox).host;
+				const state = await kv.get([
+					"_fedify",
+					"circuit",
+					host
+				]);
+				if (result === "private") assertEquals(state, void 0);
+				else {
+					assertExists(state);
+					assertEquals(state.failures.length, 1);
+					assertEquals(state.state, failureThreshold === 1 ? "open" : "closed");
+				}
+				if (result !== "private" && failureThreshold === 1) {
+					assertEquals(queuedMessages.length, 1);
+					const held = queuedMessages[0];
+					assertEquals(held.attempt, 0);
+					assertEquals(held.circuitHeld, true);
+					assertExists(held.circuitHeldSince);
+					assertEquals(delays, [recoveryDelay]);
+				} else {
+					assertEquals(queuedMessages, [{
+						...message,
+						attempt: 1
+					}]);
+					assertEquals(delays, [delay]);
+				}
+				const expectedCount = result === "private" && !redirected ? 0 : 1;
+				const sent = recorder.getMeasurements("activitypub.delivery.sent");
+				assertEquals(sent.length, expectedCount);
+				if (expectedCount === 1) {
+					assertEquals(sent[0].value, 1);
+					assertEquals(sent[0].attributes["activitypub.delivery.success"], false);
+					assertEquals(sent[0].attributes["activitypub.remote.host"], host);
+				}
+				assertEquals(lookups, ["delivery.invalid"]);
+				assertEquals(esm_default.callHistory.calls(destination).length, 0);
+				assertEquals(esm_default.callHistory.calls().length, redirected ? 1 : 0);
+			} finally {
+				dns.lookup = originalLookup;
+				esm_default.hardReset();
+			}
+		});
+	}
+});
 test("FederationImpl.processQueuedTask() permanent failure", async (t) => {
 	esm_default.spyGlobal();
 	esm_default.post("https://gone.example/inbox", {
@@ -4968,6 +5257,7 @@ test("FederationImpl.processQueuedTask() permanent failure", async (t) => {
 					return Promise.resolve();
 				}
 			},
+			allowPrivateAddress: true,
 			...options.permanentFailureStatusCodes ? { permanentFailureStatusCodes: options.permanentFailureStatusCodes } : {},
 			...options.meterProvider ? { meterProvider: options.meterProvider } : {},
 			...options.tracerProvider ? { tracerProvider: options.tracerProvider } : {}
@@ -5166,6 +5456,7 @@ test("FederationImpl.processQueuedTask() circuit breaker", async (t) => {
 					return Promise.resolve();
 				}
 			},
+			allowPrivateAddress: true,
 			circuitBreaker: options,
 			...federationOptions
 		});
@@ -5316,6 +5607,7 @@ test("FederationImpl.processQueuedTask() circuit breaker", async (t) => {
 			body: ""
 		});
 		const { federation, queued, kv } = setup({ failureThreshold: 1 });
+		await markCircuitBreakerLegacySweepDone(kv);
 		await kv.set([
 			"_fedify",
 			"circuit",
@@ -5355,6 +5647,7 @@ test("FederationImpl.processQueuedTask() circuit breaker", async (t) => {
 		const { federation, queued, kv } = setup({ failureThreshold: 1 }, { outboxRetryPolicy: () => Temporal.Duration.from({ seconds: 3 }) });
 		kv.cas = () => Promise.resolve(false);
 		await federation.processQueuedTask(void 0, createOutboxMessage("https://failure-bookkeeping.example/inbox"));
+		await federation.circuitBreaker?.pendingSweep;
 		assertEquals(queued.length, 1);
 		const retry = queued[0].message;
 		assertEquals(retry.attempt, 1);
@@ -5449,6 +5742,7 @@ test("FederationImpl.processQueuedTask() circuit breaker", async (t) => {
 			body: "server error"
 		});
 		const { federation, queued, kv } = setup({ failureThreshold: 1 }, { permanentFailureStatusCodes: [500] });
+		await markCircuitBreakerLegacySweepDone(kv);
 		await kv.set([
 			"_fedify",
 			"circuit",
@@ -5681,6 +5975,7 @@ test("FederationImpl.processQueuedTask() circuit breaker", async (t) => {
 			failureThreshold: 1,
 			releaseInterval: { seconds: 1 }
 		}, { permanentFailureStatusCodes: [500] });
+		await markCircuitBreakerLegacySweepDone(kv);
 		await kv.set([
 			"_fedify",
 			"circuit",
@@ -5715,6 +6010,7 @@ test("FederationImpl.processQueuedTask() circuit breaker", async (t) => {
 			failureThreshold: 1,
 			releaseInterval: { seconds: 1 }
 		});
+		await markCircuitBreakerLegacySweepDone(kv);
 		await kv.set([
 			"_fedify",
 			"circuit",
@@ -5806,6 +6102,7 @@ test("FederationImpl.processQueuedTask() circuit breaker", async (t) => {
 				releaseInterval: { minutes: 1 }
 			}
 		});
+		await markCircuitBreakerLegacySweepDone(kv);
 		await kv.set([
 			"_fedify",
 			"circuit",
@@ -5848,6 +6145,7 @@ test("FederationImpl.processQueuedTask() circuit breaker", async (t) => {
 				recoveryDelay: { seconds: 1 }
 			}
 		});
+		await markCircuitBreakerLegacySweepDone(kv);
 		await kv.set([
 			"_fedify",
 			"circuit",
@@ -5936,6 +6234,7 @@ test("FederationImpl.processQueuedTask() circuit breaker", async (t) => {
 				}
 			}
 		});
+		await markCircuitBreakerLegacySweepDone(kv);
 		await kv.set([
 			"_fedify",
 			"circuit",
@@ -6171,7 +6470,8 @@ test("FederationImpl.processQueuedTask() queue task metrics", async (t) => {
 				listen(_handler, _options) {
 					return Promise.resolve();
 				}
-			}
+			},
+			allowPrivateAddress: true
 		});
 		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox");
 		esm_default.spyGlobal();
@@ -7096,6 +7396,81 @@ test({
 		assertEquals(rejected[1].attributes["activitypub.activity.type"], "https://www.w3.org/ns/activitystreams#Offer");
 	}
 });
+for (const queued of [false, true]) test(`ContextImpl.routeActivity() routes the fetched document (queued: ${queued})`, async () => {
+	const id = new URL("https://example.com/verified-create");
+	const genuine = new Create({
+		id,
+		actor: new URL("https://example.com/person"),
+		object: new vocab.Note({ content: "Genuine content" }),
+		to: new URL("https://example.com/recipient")
+	});
+	const genuineJson = await genuine.toJsonLd({ contextLoader: mockDocumentLoader });
+	const forged = new Create({
+		id,
+		actor: new URL("https://victim.example/actor"),
+		object: new vocab.Note({ content: "Forged content" }),
+		to: new URL("https://attacker.example/recipient")
+	});
+	const messages = [];
+	const queue = {
+		enqueue(message) {
+			messages.push(message);
+			return Promise.resolve();
+		},
+		async listen() {}
+	};
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderFactory: () => async (url, options) => url === id.href ? {
+			document: genuineJson,
+			documentUrl: id.href,
+			contextUrl: null
+		} : await mockDocumentLoader(url, options),
+		contextLoaderFactory: () => mockDocumentLoader,
+		queue: {
+			inbox: queued ? queue : void 0,
+			outbox: queue
+		},
+		manuallyStartQueue: true
+	});
+	const received = [];
+	const contextDocuments = [];
+	federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(Create, async (ctx, activity) => {
+		received.push(await activity.toJsonLd({ contextLoader: mockDocumentLoader }));
+		assertInstanceOf(ctx, InboxContextImpl);
+		contextDocuments.push(ctx.activity);
+		await ctx.forwardActivity({
+			privateKey: ed25519PrivateKey,
+			keyId: ed25519Multikey.id
+		}, {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		});
+	});
+	const ctx = federation.createContext(new URL("https://local.example/"));
+	async function processInbox() {
+		const inboxMessages = messages.filter((message) => message.type === "inbox");
+		for (const message of inboxMessages) await federation.processQueuedTask(void 0, message);
+	}
+	assert(await ctx.routeActivity(null, forged));
+	if (queued) {
+		assertEquals(received, []);
+		assertEquals(messages.length, 1);
+		assert(messages[0].type === "inbox");
+		assertEquals(messages[0].activity, genuineJson);
+		await processInbox();
+	}
+	assertEquals(received, [genuineJson]);
+	assertEquals(contextDocuments, [genuineJson]);
+	const forwarded = messages.filter((message) => message.type === "outbox");
+	assertEquals(forwarded.length, 1);
+	assertEquals(forwarded[0].activity, genuineJson);
+	assert(await ctx.routeActivity(null, genuine));
+	if (queued) await processInbox();
+	assertEquals(received, [genuineJson]);
+	assertEquals(contextDocuments, [genuineJson]);
+	assertEquals(messages.filter((message) => message.type === "outbox").length, 1);
+});
 test("ContextImpl.routeActivity() marks queued signed activities as non-LDS", async () => {
 	let queuedMessage = null;
 	const federation = new FederationImpl({
@@ -7155,6 +7530,47 @@ test("ContextImpl.getCollectionUri()", () => {
 	assertThrows(() => ctx.getCollectionUri(Symbol(notReg), values));
 	assertThrows(() => ctx.getCollectionUri(Symbol.for(notReg), values));
 });
+test("symbol-named custom collections are served and parsed", async () => {
+	const federation = createFederation({ kv: new MemoryKvStore() });
+	const names = [Symbol("bookmarks"), Symbol("bookmarks")];
+	const paths = ["bookmarks", "ordered-bookmarks"];
+	const calls = [];
+	federation.setCollectionDispatcher(names[0], vocab.Object, "/users/{identifier}/bookmarks", (_ctx, _values, cursor) => {
+		calls.push([0, cursor]);
+		return { items: [] };
+	});
+	federation.setOrderedCollectionDispatcher(names[1], vocab.Object, "/users/{identifier}/ordered-bookmarks", (_ctx, _values, cursor) => {
+		calls.push([1, cursor]);
+		return { items: [] };
+	});
+	const ctx = federation.createContext(new URL("https://example.com/"));
+	for (const [index, name] of names.entries()) {
+		const uri = ctx.getCollectionUri(name, { identifier: "alice" });
+		assertEquals(uri.pathname, `/users/alice/${paths[index]}`);
+		const parsed = ctx.parseUri(uri);
+		assertEquals(parsed?.type, index === 0 ? "collection" : "orderedCollection");
+		if (parsed?.type !== "collection" && parsed?.type !== "orderedCollection") throw new Error("Expected a custom collection URI");
+		assertStrictEquals(parsed.name, name);
+		assertStrictEquals(parsed.class, vocab.Object);
+		assertEquals(parsed.typeId, vocab.Object.typeId);
+		assertEquals(parsed.values, { identifier: "alice" });
+		for (const cursor of [null, "next"]) {
+			const pageUri = new URL(uri);
+			if (cursor != null) pageUri.searchParams.set("cursor", cursor);
+			const response = await federation.fetch(new Request(pageUri, { headers: { accept: "application/activity+json" } }), { contextData: void 0 });
+			assertEquals(response.status, 200);
+			const body = await response.json();
+			assert(body !== null && typeof body === "object" && "type" in body);
+			assertEquals(body.type, `${index === 0 ? "Collection" : "OrderedCollection"}${cursor == null ? "" : "Page"}`);
+		}
+	}
+	assertEquals(calls, [
+		[0, null],
+		[0, "next"],
+		[1, null],
+		[1, "next"]
+	]);
+});
 test("InboxContextImpl.forwardActivity()", async (t) => {
 	esm_default.spyGlobal();
 	let verified = null;
@@ -7348,6 +7764,193 @@ test("KvSpecDeterminer", async (t) => {
 		spec = await determiner.determineSpec("example.com");
 		assertEquals(spec, "rfc9421");
 	});
+	await t.step("should default specTtl to 90 days", () => {
+		assertEquals(new KvSpecDeterminer(new MemoryKvStore(), ["test", "spec"]).specTtl.total("day"), 90);
+	});
+	await t.step("should accept a configurable specTtl as a 4th positional argument", () => {
+		assertEquals(new KvSpecDeterminer(new MemoryKvStore(), ["test", "spec"], "rfc9421", { specTtl: Temporal.Duration.from({ days: 7 }) }).specTtl.total("day"), 7);
+	});
+	await t.step("should expire, relearn, and remember the spec again", async () => {
+		const kv = new ManualClockKvStore();
+		const determiner = new KvSpecDeterminer(kv, ["test", "spec"], "rfc9421", { specTtl: Temporal.Duration.from({ days: 90 }) });
+		await determiner.rememberSpec("example.com", "draft-cavage-http-signatures-12");
+		assertEquals(await determiner.determineSpec("example.com"), "draft-cavage-http-signatures-12");
+		kv.advance({ days: 91 });
+		assertEquals(await determiner.determineSpec("example.com"), "rfc9421");
+		await determiner.rememberSpec("example.com", "draft-cavage-http-signatures-12");
+		assertEquals(await determiner.determineSpec("example.com"), "draft-cavage-http-signatures-12");
+	});
+});
+/**
+* A `KvStore` that records the TTL every write was made with, so tests can
+* assert on TTLs even after the entries themselves have expired.
+*/
+var TtlRecordingKvStore = class {
+	inner = new ManualClockKvStore();
+	writes = [];
+	/** Moves the wrapped store's virtual clock forward. */
+	advance(duration) {
+		this.inner.advance(duration);
+	}
+	get(key) {
+		return this.inner.get(key);
+	}
+	set(key, value, options) {
+		this.writes.push({
+			key,
+			ttl: options?.ttl
+		});
+		return this.inner.set(key, value, options);
+	}
+	delete(key) {
+		return this.inner.delete(key);
+	}
+	list(prefix) {
+		return this.inner.list(prefix);
+	}
+	/** The TTL of the most recent write to `key`, or `undefined` if never set. */
+	lastTtl(key) {
+		const matches = this.writes.filter((w) => w.key.length === key.length && w.key.every((p, i) => p === key[i]));
+		return matches.length < 1 ? void 0 : matches[matches.length - 1].ttl;
+	}
+};
+test("createFederation() defaults the cache TTLs and lets them be overridden", () => {
+	const defaults = new FederationImpl({ kv: new MemoryKvStore() });
+	assertEquals(defaults.publicKeyTtl.total("day"), 30);
+	assertEquals(defaults.httpMessageSignaturesSpecTtl.total("day"), 90);
+	const overridden = new FederationImpl({
+		kv: new MemoryKvStore(),
+		publicKeyTtl: { days: 1 },
+		httpMessageSignaturesSpecTtl: { hours: 12 }
+	});
+	assertEquals(overridden.publicKeyTtl.total("day"), 1);
+	assertEquals(overridden.httpMessageSignaturesSpecTtl.total("hour"), 12);
+});
+test("createFederation() applies httpMessageSignaturesSpecTtl to remembered specs", async () => {
+	esm_default.spyGlobal();
+	try {
+		const attempts = [];
+		esm_default.post("https://example.com/inbox", async (cl) => {
+			const request = cl.request.clone();
+			const spec = request.headers.has("Signature-Input") ? "rfc9421" : "draft-cavage-http-signatures-12";
+			attempts.push(spec);
+			if (spec === "rfc9421") return new Response(null, { status: 401 });
+			const key = await verifyRequest(request, {
+				documentLoader: mockDocumentLoader,
+				contextLoader: mockDocumentLoader
+			});
+			return new Response(null, { status: key == null ? 401 : 202 });
+		});
+		const kv = new TtlRecordingKvStore();
+		const ctx = createFederation({
+			kv,
+			documentLoaderFactory: () => mockDocumentLoader,
+			contextLoaderFactory: () => mockDocumentLoader,
+			httpMessageSignaturesSpecTtl: { days: 14 }
+		}).createContext(new URL("https://example.com/"), void 0);
+		const specKey = [
+			"_fedify",
+			"httpMessageSignaturesSpec",
+			"https://example.com"
+		];
+		const send = () => ctx.sendActivity([{
+			privateKey: rsaPrivateKey2,
+			keyId: rsaPublicKey2.id
+		}], {
+			id: new URL("https://example.com/recipient"),
+			inboxId: new URL("https://example.com/inbox")
+		}, new vocab.Create({
+			id: new URL(`https://example.com/activities/${crypto.randomUUID()}`),
+			actor: new URL("https://example.com/person")
+		}));
+		await send();
+		assertEquals(attempts, ["rfc9421", "draft-cavage-http-signatures-12"]);
+		assertEquals(await kv.get(specKey), "draft-cavage-http-signatures-12");
+		assertEquals(kv.lastTtl(specKey)?.total("day"), 14);
+		attempts.length = 0;
+		await send();
+		assertEquals(attempts, ["draft-cavage-http-signatures-12"]);
+		kv.advance({ days: 15 });
+		assertEquals(await kv.get(specKey), void 0);
+		attempts.length = 0;
+		await send();
+		assertEquals(attempts, ["rfc9421", "draft-cavage-http-signatures-12"]);
+		assertEquals(await kv.get(specKey), "draft-cavage-http-signatures-12");
+		assertEquals(kv.lastTtl(specKey)?.total("day"), 14);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("createFederation() applies publicKeyTtl to cached public keys", async () => {
+	esm_default.spyGlobal();
+	try {
+		let keyFetches = 0;
+		esm_default.get("begin:https://example.com/person2", () => {
+			keyFetches++;
+			return {
+				headers: { "Content-Type": "application/activity+json" },
+				body: person2_default
+			};
+		});
+		const keyId = "https://example.com/person2#key3";
+		const kv = new TtlRecordingKvStore();
+		const federation = createFederation({
+			kv,
+			documentLoaderFactory: () => mockDocumentLoader,
+			contextLoaderFactory: () => mockDocumentLoader,
+			publicKeyTtl: { days: 7 }
+		});
+		const inbox = [];
+		federation.setActorDispatcher("/users/{identifier}", (_, identifier) => identifier === "john" ? new vocab.Person({}) : null).setKeyPairsDispatcher(() => [{
+			privateKey: rsaPrivateKey2,
+			publicKey: rsaPublicKey2.publicKey
+		}]);
+		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox").on(vocab.Create, (_ctx, create) => {
+			inbox.push(create);
+		});
+		const deliver = async () => {
+			const activity = new vocab.Create({
+				id: new URL(`https://example.com/activities/${crypto.randomUUID()}`),
+				actor: new URL("https://example.com/person2")
+			});
+			let request = new Request("https://example.com/users/john/inbox", {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/activity+json",
+					accept: "application/ld+json"
+				},
+				body: JSON.stringify(await activity.toJsonLd({ contextLoader: mockDocumentLoader }))
+			});
+			request = await signRequest(request, rsaPrivateKey3, new URL(keyId));
+			return await federation.fetch(request, { contextData: void 0 });
+		};
+		const publicKeyKey = [
+			"_fedify",
+			"publicKey",
+			"2",
+			keyId
+		];
+		assertEquals((await deliver()).status, 202);
+		assertEquals(inbox.length, 1);
+		assert(keyFetches > 0);
+		assert(await kv.get(publicKeyKey) != null);
+		assertEquals(kv.lastTtl(publicKeyKey)?.total("day"), 7);
+		const keyCacheWrites = () => kv.writes.filter((w) => w.key.length === publicKeyKey.length && w.key.every((part, i) => part === publicKeyKey[i])).length;
+		const warmWrites = keyCacheWrites();
+		assertEquals((await deliver()).status, 202);
+		assertEquals(inbox.length, 2);
+		assertEquals(keyCacheWrites(), warmWrites);
+		kv.advance({ days: 8 });
+		assertEquals(await kv.get(publicKeyKey), void 0);
+		keyFetches = 0;
+		assertEquals((await deliver()).status, 202);
+		assertEquals(inbox.length, 3);
+		assert(keyFetches > 0);
+		assert(await kv.get(publicKeyKey) != null);
+		assertEquals(kv.lastTtl(publicKeyKey)?.total("day"), 7);
+	} finally {
+		esm_default.hardReset();
+	}
 });
 test("createFederation() instruments documentLoader with activitypub.document.fetch", async () => {
 	const [meterProvider, recorder] = createTestMeterProvider();
@@ -7589,5 +8192,334 @@ test("ContextImpl.enqueueTaskMany()", async (t) => {
 		strictEqual(queue.enqueued.length, 0);
 	});
 });
+test("ContextImpl.sendActivity() honors the private-address policy", async (t) => {
+	for (const allowPrivateAddress of [false, true]) await t.step(`allowPrivateAddress: ${allowPrivateAddress}`, async () => {
+		const inbox = "http://127.0.0.1/inbox";
+		esm_default.mockGlobal().post(inbox, 202);
+		try {
+			const ctx = createFederation({
+				kv: new MemoryKvStore(),
+				allowPrivateAddress
+			}).createContext(new URL("https://example.com/"));
+			const send = () => ctx.sendActivity({
+				privateKey: ed25519PrivateKey,
+				keyId: ed25519Multikey.id
+			}, new Person({
+				id: new URL("https://example.com/recipient"),
+				inbox: new URL(inbox)
+			}), new Create({
+				id: new URL("https://example.com/activity"),
+				actor: new URL("https://example.com/person")
+			}), { immediate: true });
+			if (allowPrivateAddress) {
+				await send();
+				assertEquals(esm_default.callHistory.calls(inbox).length, 1);
+			} else {
+				await assertRejects(send, UrlError);
+				assertEquals(esm_default.callHistory.calls(inbox).length, 0);
+			}
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
+test("Federation.fetch() bounds inbox bodies before dispatch", async () => {
+	let dispatched = false;
+	const json = JSON.stringify({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/activities/bounded",
+		type: "Create",
+		actor: "https://example.com/actor"
+	});
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		skipSignatureVerification: true,
+		contextLoaderFactory: () => mockDocumentLoader
+	});
+	federation.setActorDispatcher("/actors/{identifier}", () => new Person({ id: new URL("https://example.com/actor") }));
+	federation.setInboxListeners("/actors/{identifier}/inbox", "/inbox").on(Create, () => {
+		dispatched = true;
+	});
+	for (const contentLength of [
+		void 0,
+		"1",
+		String(16777217)
+	]) {
+		assertEquals((await federation.fetch(new Request("https://example.com/inbox", {
+			method: "POST",
+			headers: contentLength == null ? {} : { "Content-Length": contentLength },
+			body: json.padEnd(16777217)
+		}), { contextData: void 0 })).status, 413);
+		assertFalse(dispatched);
+	}
+	let canceled = false;
+	let pulls = 0;
+	const body = new ReadableStream({
+		pull(controller) {
+			pulls++;
+			controller.enqueue(new Uint8Array(64 * 1024));
+		},
+		cancel() {
+			canceled = true;
+		}
+	}, { highWaterMark: 0 });
+	const request = new Request("https://example.com/inbox", {
+		method: "POST",
+		body,
+		duplex: "half"
+	});
+	assertEquals((await federation.fetch(request, { contextData: void 0 })).status, 413);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert(canceled);
+	assert(pulls <= 260);
+	assertFalse(dispatched);
+	assertEquals((await federation.fetch(new Request("https://example.com/inbox", {
+		method: "POST",
+		body: json
+	}), { contextData: void 0 })).status, 202);
+	assert(dispatched);
+});
+function getRawMessage(record) {
+	return typeof record.rawMessage === "string" ? record.rawMessage : record.rawMessage.join("");
+}
+test("Federation.fetch() serves tombstones of objects", async (t) => {
+	const deleted = Temporal.Instant.from("2024-01-15T00:00:00Z");
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderFactory: () => mockDocumentLoader,
+		contextLoaderFactory: () => mockDocumentLoader
+	});
+	federation.setObjectDispatcher(vocab.Note, "/users/{identifier}/notes/{id}", (ctx, values) => {
+		if (values.id === "missing") return null;
+		if (values.id === "deleted") return new vocab.Tombstone({
+			id: ctx.getObjectUri(vocab.Note, values),
+			formerType: vocab.Note,
+			deleted
+		});
+		return new vocab.Note({
+			id: ctx.getObjectUri(vocab.Note, values),
+			content: "Hello"
+		});
+	});
+	federation.setObjectDispatcher(vocab.Tombstone, "/tombstones/{id}", (ctx, values) => new vocab.Tombstone({ id: ctx.getObjectUri(vocab.Tombstone, values) }));
+	federation.setObjectDispatcher(vocab.Object, "/objects/{id}", (ctx, values) => values.id === "deleted" ? new vocab.Tombstone({ id: ctx.getObjectUri(vocab.Object, values) }) : new vocab.Note({ id: ctx.getObjectUri(vocab.Object, values) }));
+	function fetch(path, method = "GET") {
+		return federation.fetch(new Request(`https://example.com${path}`, {
+			method,
+			headers: { Accept: "application/activity+json" }
+		}), { contextData: void 0 });
+	}
+	await t.step("GET responds with 410 Gone and the tombstone", async () => {
+		const response = await fetch("/users/john/notes/deleted");
+		assertEquals(response.status, 410);
+		assertEquals(response.headers.get("Content-Type"), "application/activity+json");
+		const body = await response.json();
+		assertEquals(body.id, "https://example.com/users/john/notes/deleted");
+		assertEquals(body.type, "Tombstone");
+		assertEquals(body.formerType, "as:Note");
+		assertEquals(body.deleted, "2024-01-15T00:00:00Z");
+	});
+	await t.step("HEAD responds with 410 Gone without a body", async () => {
+		const response = await fetch("/users/john/notes/deleted", "HEAD");
+		assertEquals(response.status, 410);
+		assertEquals(response.body, null);
+	});
+	await t.step("objects and null are served as before", async () => {
+		const response = await fetch("/users/john/notes/123");
+		assertEquals(response.status, 200);
+		assertEquals((await response.json()).type, "Note");
+		assertEquals((await fetch("/users/john/notes/missing")).status, 404);
+	});
+	await t.step("Tombstone and Object dispatchers respond with 410", async () => {
+		assertEquals((await fetch("/tombstones/1")).status, 410);
+		assertEquals((await fetch("/objects/deleted")).status, 410);
+		assertEquals((await fetch("/objects/live")).status, 200);
+	});
+	await t.step("RequestContext.getObject()", async () => {
+		const ctx = federation.createContext(new Request("https://example.com/"), void 0);
+		const values = {
+			identifier: "john",
+			id: "deleted"
+		};
+		assertEquals(await ctx.getObject(vocab.Note, values), null);
+		assertEquals(await ctx.getObject(vocab.Note, values, { tombstone: "suppress" }), null);
+		assertEquals(await ctx.getObject(vocab.Note, values, {}), null);
+		const tombstone = await ctx.getObject(vocab.Note, values, { tombstone: "passthrough" });
+		assertInstanceOf(tombstone, vocab.Tombstone);
+		assertEquals(tombstone.id, new URL("https://example.com/users/john/notes/deleted"));
+		assertEquals(tombstone.deleted, deleted);
+		assertInstanceOf(await ctx.getObject(vocab.Note, values, { tombstone: "passthrough" }), vocab.Tombstone);
+		assertInstanceOf(await ctx.getObject(vocab.Note, {
+			identifier: "john",
+			id: "123"
+		}), vocab.Note);
+		assertEquals(await ctx.getObject(vocab.Note, {
+			identifier: "john",
+			id: "missing"
+		}, { tombstone: "passthrough" }), null);
+		assertInstanceOf(await ctx.getObject(vocab.Tombstone, { id: "1" }), vocab.Tombstone);
+		assertInstanceOf(await ctx.getObject(vocab.Object, { id: "deleted" }, { tombstone: "suppress" }), vocab.Tombstone);
+	});
+	await t.step("authorization predicates can get the tombstone", async () => {
+		await withLogtapeLock(async () => {
+			const records = [];
+			await reset();
+			try {
+				await configure({
+					sinks: { buffer(record) {
+						records.push(record);
+					} },
+					filters: {},
+					loggers: [{
+						category: ["fedify", "federation"],
+						sinks: ["buffer"]
+					}, {
+						category: ["logtape", "meta"],
+						sinks: []
+					}]
+				});
+				const federation = createFederation({
+					kv: new MemoryKvStore(),
+					documentLoaderFactory: () => mockDocumentLoader,
+					contextLoaderFactory: () => mockDocumentLoader
+				});
+				let dispatched = 0;
+				federation.setObjectDispatcher(vocab.Note, "/notes/{id}", (ctx, values) => {
+					dispatched++;
+					return new vocab.Tombstone({ id: ctx.getObjectUri(vocab.Note, values) });
+				}).authorize(async (ctx, values) => {
+					return await ctx.getObject(vocab.Note, values, { tombstone: "passthrough" }) instanceof vocab.Tombstone;
+				});
+				assertEquals((await federation.fetch(new Request("https://example.com/notes/1", { headers: { Accept: "application/activity+json" } }), { contextData: void 0 })).status, 410);
+				assertEquals(dispatched, 2);
+				assert(records.some((record) => getRawMessage(record).startsWith("RequestContext.getObject(") && getRawMessage(record).includes("may cause an infinite loop")));
+			} finally {
+				await reset();
+			}
+		});
+	});
+	await t.step("warns about the id of a tombstone", async () => {
+		await withLogtapeLock(async () => {
+			const records = [];
+			await reset();
+			try {
+				await configure({
+					sinks: { buffer(record) {
+						records.push(record);
+					} },
+					filters: {},
+					loggers: [{
+						category: [
+							"fedify",
+							"federation",
+							"object"
+						],
+						sinks: ["buffer"]
+					}, {
+						category: ["logtape", "meta"],
+						sinks: []
+					}]
+				});
+				const federation = createFederation({
+					kv: new MemoryKvStore(),
+					documentLoaderFactory: () => mockDocumentLoader,
+					contextLoaderFactory: () => mockDocumentLoader
+				});
+				const ids = {
+					"matching": new URL("https://example.com/notes/matching"),
+					"missing": null,
+					"mismatched": new URL("https://example.com/other/mismatched"),
+					"ap": new URL("ap://did%3Akey%3Az6MkTest/notes/ap"),
+					"ap-ef61": new URL("ap+ef61://did%3Akey%3Az6MkTest/notes/ap-ef61")
+				};
+				federation.setObjectDispatcher(vocab.Note, "/notes/{id}", (_ctx, { id }) => id === "live" ? new vocab.Note({ id: new URL("https://example.com/other/live") }) : new vocab.Tombstone({ id: ids[id] }));
+				const warnings = async (id) => {
+					records.length = 0;
+					assertEquals((await federation.fetch(new Request(`https://example.com/notes/${id}`, { headers: { Accept: "application/activity+json" } }), { contextData: void 0 })).status, id === "live" ? 200 : 410);
+					return records.filter((r) => r.level === "warning");
+				};
+				assertEquals(await warnings("matching"), []);
+				const missing = await warnings("missing");
+				assertEquals(missing.length, 1);
+				assert(getRawMessage(missing[0]).includes("without an id property"));
+				const mismatched = await warnings("mismatched");
+				assertEquals(mismatched.length, 1);
+				assert(getRawMessage(mismatched[0]).includes("does not match"));
+				assertEquals(mismatched[0].properties.tombstoneId, "https://example.com/other/mismatched");
+				assertEquals(mismatched[0].properties.objectUri, "https://example.com/notes/mismatched");
+				assertEquals(await warnings("ap"), []);
+				assertEquals(await warnings("ap-ef61"), []);
+				assertEquals(await warnings("live"), []);
+			} finally {
+				await reset();
+			}
+		});
+	});
+});
+test("createFederation() applies documentLoaderTimeout to built-in loaders", async (t) => {
+	esm_default.mockGlobal();
+	let requests = 0;
+	esm_default.get("begin:https://slow.example/", () => {
+		requests++;
+		return new Promise(() => {});
+	});
+	const isTimeout = (error) => {
+		ok(error instanceof FetchError, String(error));
+		strictEqual(error.response, void 0);
+		ok(error.cause instanceof DOMException);
+		strictEqual(error.cause.name, "TimeoutError");
+		ok(error.message.endsWith("Timed out after 100 ms"), error.message);
+		return true;
+	};
+	try {
+		await t.step("built-in loaders", async () => {
+			const ctx = createFederation({
+				kv: new MemoryKvStore(),
+				allowPrivateAddress: true,
+				documentLoaderTimeout: { milliseconds: 100 }
+			}).createContext(new URL("https://example.com/"), void 0);
+			await rejects(ctx.documentLoader("https://slow.example/object"), isTimeout);
+			await rejects(ctx.contextLoader("https://slow.example/context"), isTimeout);
+			await rejects(ctx.getDocumentLoader({
+				keyId: new URL("https://example.com/key2"),
+				privateKey: rsaPrivateKey2
+			})("https://slow.example/private"), isTimeout);
+			strictEqual(requests, 3);
+		});
+		await t.step("per-call override and null", async () => {
+			const federation = createFederation({
+				kv: new MemoryKvStore(),
+				allowPrivateAddress: true,
+				documentLoaderTimeout: null
+			});
+			await rejects(federation.documentLoaderFactory({ timeout: 100 })("https://slow.example/object"), isTimeout);
+			await rejects(federation.authenticatedDocumentLoaderFactory({
+				keyId: new URL("https://example.com/key2"),
+				privateKey: rsaPrivateKey2
+			}, { timeout: 100 })("https://slow.example/private"), isTimeout);
+			const controller = new AbortController();
+			const reason = /* @__PURE__ */ new Error("Canceled by the caller");
+			setTimeout(() => controller.abort(reason), 150);
+			await rejects(federation.documentLoaderFactory()("https://slow.example/object", { signal: controller.signal }), (error) => error === reason || error instanceof Error && error.name === "AbortError");
+		});
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("createFederation() validates documentLoaderTimeout", () => {
+	for (const documentLoaderTimeout of [
+		{ milliseconds: 0 },
+		{ seconds: -1 },
+		{ days: 25 },
+		{ months: 1 }
+	]) throws(() => createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderTimeout
+	}), RangeError);
+	createFederation({
+		kv: new MemoryKvStore(),
+		documentLoaderTimeout: Temporal.Duration.from({ seconds: 30 })
+	});
+});
 //#endregion
 export {};