@fedify/fedify 2.4.5-dev.2462 → 2.4.5

package/README.md

@@ -15,6 +15,9 @@ It aims to eliminate the complexity and boilerplate code when
 building a federated server app, so that you can focus on your business logic
 and user experience.
 
+Fedify supports Node.js, Bun, and Deno.  We recommend using the latest
+version of Node.js for the best experience.
+
 Currently, Fedify provides the following features out of the box:
 
  -  Type-safe objects for [Activity Vocabulary] (including some vendor-specific

package/dist/{builder-BBUGd9wr.mjs → builder-CUAVOHg6.mjs}

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { i as getPortableDid, l as isPortableId, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
-import { n as version, t as name } from "./deno-BO7-a3hz.mjs";
+import { n as version, t as name } from "./deno-DcJISdwu.mjs";
 import { t as ActivityListenerSet } from "./activity-listener-C-BSbKI7.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
@@ -91,7 +91,7 @@ var FederationBuilderImpl = class {
 	* specified.
 	*/
 	async build(options) {
-		const { FederationImpl } = await import("./middleware-DPI-Jp9w.mjs");
+		const { FederationImpl } = await import("./middleware-CdP-lz8Q.mjs");
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();

package/dist/{client-D-XP_Ccb.d.cts → client-3InDZbba.d.cts}

@@ -1,6 +1,5 @@
 /// <reference lib="esnext.temporal" />
 import { GetUserAgentOptions } from "@fedify/vocab-runtime";
-
 //#region src/nodeinfo/types.d.ts
 /**
 * The type of the result of parsing JSON.

package/dist/{client-D-XP_Ccb.d.ts → client-3InDZbba.d.ts}

@@ -1,6 +1,5 @@
 /// <reference lib="esnext.temporal" />
 import { GetUserAgentOptions } from "@fedify/vocab-runtime";
-
 //#region src/nodeinfo/types.d.ts
 /**
 * The type of the result of parsing JSON.

package/dist/{client-CEnNz8O7.mjs → client-5SIFzW3q.mjs}

@@ -2,7 +2,8 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { getLogger } from "@logtape/logtape";
-import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getUserAgent } from "@fedify/vocab-runtime";
+import { openPublicFetch } from "@fedify/vocab-runtime/internal";
 //#region src/utils/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */
 const MAX_BODY_SIZE = 16 * 1024 * 1024;
@@ -85,23 +86,34 @@ const logger = getLogger([
 ]);
 const DEFAULT_MAX_REDIRECTION = 5;
 /**
-* Fetches a URL while guarding against SSRF.  Before every request—including
-* each redirect hop—the destination is validated with
-* {@link validatePublicUrl}, so that loopback, link-local, and private
-* addresses, as well as non-HTTP(S) schemes such as `data:`, are rejected.
-* Redirects are followed manually with a cap, so that a public URL cannot
-* bounce the request to an internal address.
+* Fetches a URL while guarding against SSRF.  Every request—including each
+* redirect hop—is made in its own session opened with `openPublicFetch()`,
+* which rejects loopback, link-local, and private addresses, as well as
+* non-HTTP(S) schemes such as `data:`, and connects only to the validated
+* addresses where the runtime supports it.  Redirects are followed manually
+* with a cap, so that a public URL cannot bounce the request to an internal
+* address.
+*
+* The final response is passed to `consume`, which must consume or cancel its
+* body; the session is closed after `consume` settles.  The cancellation of
+* redirect response bodies is started before their sessions are closed.
 * @param url The URL to fetch.
 * @param headers The request headers.
-* @returns The final response, or `null` if the URL is disallowed, its
-*          hostname cannot be resolved, or there are too many redirects.
+* @param consume The function to consume the final response with.
+* @param deps The dependencies.
+* @returns The value returned by `consume`, or `null` if the URL is
+*          disallowed, its hostname cannot be resolved, or there are too many
+*          redirects.
+* @internal
 */
-async function fetchPublicUrl(url, headers) {
+async function fetchPublicUrl(url, headers, consume, deps = {}) {
+	const openHop = deps.openHop ?? ((hopUrl) => openPublicFetch(hopUrl));
 	let current = url instanceof URL ? url : new URL(url);
 	let redirected = 0;
 	while (true) {
+		let session;
 		try {
-			await validatePublicUrl(current.href);
+			session = await openHop(current.href);
 		} catch (e) {
 			if (e instanceof UrlError) {
 				if (e.reason === "dns") logger.error("DNS lookup failed for {url}: {error}", {
@@ -116,52 +128,89 @@ async function fetchPublicUrl(url, headers) {
 			}
 			throw e;
 		}
-		const response = await fetch(current, {
-			headers,
-			redirect: "manual"
-		});
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-			redirected++;
-			if (redirected >= DEFAULT_MAX_REDIRECTION) {
-				logger.error("Too many redirections ({redirections}) while fetching {url}.", {
-					redirections: redirected,
-					url: current.href
-				});
-				return null;
-			}
-			const next = new URL(response.headers.get("Location"), response.url == null || response.url === "" ? current : response.url);
-			if (next.protocol !== current.protocol) {
-				logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
-					protocol: current.protocol,
-					redirectedProtocol: next.protocol
-				});
-				return null;
-			}
-			current = next;
-			continue;
+		let location;
+		try {
+			const response = await session.fetch(current, {
+				headers,
+				redirect: "manual"
+			});
+			if (response.status < 300 || response.status >= 400 || !response.headers.has("Location")) return await consume(response);
+			location = response.headers.get("Location");
+			cancelBody(response, current);
+		} finally {
+			await session.close();
+		}
+		redirected++;
+		if (redirected >= DEFAULT_MAX_REDIRECTION) {
+			logger.error("Too many redirections ({redirections}) while fetching {url}.", {
+				redirections: redirected,
+				url: current.href
+			});
+			return null;
+		}
+		const next = new URL(location, current);
+		if (next.protocol !== current.protocol) {
+			logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
+				protocol: current.protocol,
+				redirectedProtocol: next.protocol
+			});
+			return null;
 		}
-		return response;
+		current = next;
 	}
 }
+/**
+* Starts cancelling a response body that is not read, without waiting for it
+* to settle.  The cancellation of a branch of a tee (e.g., a body cloned by
+* a fetch mock) settles only after the other branch is cancelled too, per
+* the Streams standard, so awaiting it could block forever.  A failure is
+* only logged.
+*/
+function cancelBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url: url.toString(),
+			error
+		});
+	});
+}
 async function getNodeInfo(url, options = {}) {
+	return await getNodeInfoInternal(url, options);
+}
+/**
+* The implementation of {@link getNodeInfo}, which is not exported from any
+* entry point.
+* @param url The base URL of the server, or the URL of the NodeInfo document
+*            if `options.direct` is turned on.
+* @param options Options for fetching the NodeInfo document.
+* @param deps The dependencies.
+* @returns The NodeInfo document if it could be fetched successfully.
+*          Otherwise, `undefined` is returned.
+* @internal
+*/
+async function getNodeInfoInternal(url, options = {}, deps = {}) {
 	try {
+		const headers = {
+			Accept: "application/json",
+			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
+		};
 		let nodeInfoUrl = url;
 		if (!options.direct) {
 			const wellKnownUrl = new URL("/.well-known/nodeinfo", url);
-			const wellKnownResponse = await fetchPublicUrl(wellKnownUrl, {
-				Accept: "application/json",
-				"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-			});
-			if (wellKnownResponse == null) return void 0;
-			if (!wellKnownResponse.ok) {
-				logger.error("Failed to fetch {url}: {status} {statusText}", {
-					url: wellKnownUrl.href,
-					status: wellKnownResponse.status,
-					statusText: wellKnownResponse.statusText
-				});
-				return;
-			}
-			const wellKnownRd = JSON.parse(await readBoundedText(wellKnownResponse, MAX_BODY_SIZE, wellKnownUrl));
+			const wellKnown = await fetchPublicUrl(wellKnownUrl, headers, async (response) => {
+				if (!response.ok) {
+					logger.error("Failed to fetch {url}: {status} {statusText}", {
+						url: wellKnownUrl.href,
+						status: response.status,
+						statusText: response.statusText
+					});
+					cancelBody(response, wellKnownUrl);
+					return;
+				}
+				return { rd: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, wellKnownUrl)) };
+			}, deps);
+			if (wellKnown == null) return void 0;
+			const wellKnownRd = wellKnown.rd;
 			const link = wellKnownRd?.links?.find((link) => link != null && "rel" in link && (link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.0" || link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.1") && "href" in link && link.href != null);
 			if (link == null || link.href == null) {
 				logger.error("Failed to find a NodeInfo document link from {url}: {resourceDescriptor}", {
@@ -172,20 +221,20 @@ async function getNodeInfo(url, options = {}) {
 			}
 			nodeInfoUrl = link.href;
 		}
-		const response = await fetchPublicUrl(nodeInfoUrl, {
-			Accept: "application/json",
-			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-		});
-		if (response == null) return void 0;
-		if (!response.ok) {
-			logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
-				url: nodeInfoUrl.toString(),
-				status: response.status,
-				statusText: response.statusText
-			});
-			return;
-		}
-		const data = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl));
+		const document = await fetchPublicUrl(nodeInfoUrl, headers, async (response) => {
+			if (!response.ok) {
+				logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
+					url: nodeInfoUrl.toString(),
+					status: response.status,
+					statusText: response.statusText
+				});
+				cancelBody(response, nodeInfoUrl);
+				return;
+			}
+			return { data: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl)) };
+		}, deps);
+		if (document == null) return void 0;
+		const { data } = document;
 		if (options.parse === "none") return data;
 		return parseNodeInfo(data, { tryBestEffort: options.parse === "best-effort" }) ?? void 0;
 	} catch (error) {
@@ -389,4 +438,4 @@ function parseUsage(data, options = {}) {
 	};
 }
 //#endregion
-export { parseProtocol as a, parseUsage as c, readBoundedText as d, parseOutboundService as i, BodyTooLargeError as l, parseInboundService as n, parseServices as o, parseNodeInfo as r, parseSoftware as s, getNodeInfo as t, MAX_BODY_SIZE as u };
+export { parseOutboundService as a, parseSoftware as c, MAX_BODY_SIZE as d, readBoundedText as f, parseNodeInfo as i, parseUsage as l, getNodeInfoInternal as n, parseProtocol as o, parseInboundService as r, parseServices as s, getNodeInfo as t, BodyTooLargeError as u };

package/dist/compat/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { en as ActivityTransformer, n as Context } from "../context-tsYPJ2Ew.cjs";
+import { en as ActivityTransformer, n as Context } from "../context-D0gFIgev.cjs";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { en as ActivityTransformer, n as Context } from "../context-7NyiqIcg.js";
+import { en as ActivityTransformer, n as Context } from "../context-CVOOd9pD.js";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/transformers.test.mjs

@@ -5,7 +5,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { O as actorDehydrator, k as autoIdAssigner, n as FederationImpl } from "../middleware-ByanhTvb.mjs";
+import { O as actorDehydrator, k as autoIdAssigner, n as FederationImpl } from "../middleware-D2fk45uN.mjs";
 import { Follow, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 //#region src/compat/transformers.test.ts

package/dist/{compound-proof-CariICma.mjs → compound-proof-BNjXclzO.mjs}

@@ -3,9 +3,9 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { a as getRawCanonicalPortableId, l as isPortableId, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as verificationObservation, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { c as getNormalizationContextLoader } from "./ld-PJLGA2MJ.mjs";
+import { c as getNormalizationContextLoader } from "./ld-Cy5GqbvS.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
-import { l as verifyPortableObjectProofPolicy, n as classifyFep2277CoreType, o as verifyMapLocalProof } from "./proof-DNu-qP0i.mjs";
+import { l as verifyPortableObjectProofPolicy, n as classifyFep2277CoreType, o as verifyMapLocalProof } from "./proof-UN4CW55z.mjs";
 import { parseIri, preloadedContexts } from "@fedify/vocab-runtime";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/sig/compound-proof.ts

package/dist/{context-7NyiqIcg.d.ts → context-CVOOd9pD.d.ts}

@@ -1,6 +1,6 @@
 /// <reference lib="esnext.temporal" />
-import { o as JsonValue, s as NodeInfo, t as GetNodeInfoOptions } from "./client-D-XP_Ccb.js";
-import { _ as InboxVerificationKey, d as InboxProofPolicyFailureReason, h as InboxVerificationAttempt, w as VerifyRequestFailureReason, y as HttpMessageSignaturesSpec } from "./key-C1nv7_jD.js";
+import { o as JsonValue, s as NodeInfo, t as GetNodeInfoOptions } from "./client-3InDZbba.js";
+import { _ as InboxVerificationKey, d as InboxProofPolicyFailureReason, h as InboxVerificationAttempt, w as VerifyRequestFailureReason, y as HttpMessageSignaturesSpec } from "./key-CyCcut3h.js";
 import { n as GetKeyOwnerOptions } from "./owner-BSzr5-I8.js";
 import { n as KvStore, t as KvKey } from "./kv-B2mzK5tl.js";
 import { Router } from "@fedify/uri-template";
@@ -4285,6 +4285,11 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * Gets the public key of the sender, if any exists and it is verified.
   * Otherwise, `null` is returned.
   *
+  * Successful results are reused for this request regardless of the options.
+  * Pending checks and `null` results are reused for the same effective
+  * document and context loaders, including failed lookups.  Rejected checks
+  * can be retried.  Shared work uses the first caller's tracer provider.
+  *
   * This can be used for implementing [authorized fetch] (also known as
   * secure mode) in ActivityPub.
   *
@@ -4298,6 +4303,11 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * Gets the public key of the sender, if any exists and it is verified.
   * Otherwise, `null` is returned.
   *
+  * Successful results are reused for this request regardless of the options.
+  * Pending checks and `null` results are reused for the same effective
+  * document and context loaders, including failed lookups.  Rejected checks
+  * can be retried.  Shared work uses the first caller's tracer provider.
+  *
   * This can be used for implementing [authorized fetch] (also known as
   * secure mode) in ActivityPub.
   *
@@ -4317,6 +4327,14 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * Gets the owner of the signed key, if any exists and it is verified.
   * Otherwise, `null` is returned.
   *
+  * Verified keys and owners are reused for this request regardless of the
+  * options.  Pending checks are shared for the same effective document and
+  * context loaders.  A `null` result from an owner lookup after key
+  * verification is retained for those loaders.  A `null` result caused by
+  * an unverified key is not retained, allowing an owner lookup after another
+  * loader verifies the key.  Rejected checks can be retried.  Shared work
+  * uses the first caller's tracer provider.
+  *
   * This can be used for implementing [authorized fetch] (also known as
   * secure mode) in ActivityPub.
   *
@@ -4331,6 +4349,14 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * Gets the owner of the signed key, if any exists and it is verified.
   * Otherwise, `null` is returned.
   *
+  * Verified keys and owners are reused for this request regardless of the
+  * options.  Pending checks are shared for the same effective document and
+  * context loaders.  A `null` result from an owner lookup after key
+  * verification is retained for those loaders.  A `null` result caused by
+  * an unverified key is not retained, allowing an owner lookup after another
+  * loader verifies the key.  Rejected checks can be retried.  Shared work
+  * uses the first caller's tracer provider.
+  *
   * This can be used for implementing [authorized fetch] (also known as
   * secure mode) in ActivityPub.
   *

package/dist/{context-tsYPJ2Ew.d.cts → context-D0gFIgev.d.cts}

@@ -1,6 +1,6 @@
 /// <reference lib="esnext.temporal" />
-import { o as JsonValue, s as NodeInfo, t as GetNodeInfoOptions } from "./client-D-XP_Ccb.cjs";
-import { _ as InboxVerificationKey, d as InboxProofPolicyFailureReason, h as InboxVerificationAttempt, w as VerifyRequestFailureReason, y as HttpMessageSignaturesSpec } from "./key-DYxuyd-s.cjs";
+import { o as JsonValue, s as NodeInfo, t as GetNodeInfoOptions } from "./client-3InDZbba.cjs";
+import { _ as InboxVerificationKey, d as InboxProofPolicyFailureReason, h as InboxVerificationAttempt, w as VerifyRequestFailureReason, y as HttpMessageSignaturesSpec } from "./key-VEL1QqHF.cjs";
 import { n as GetKeyOwnerOptions } from "./owner-BF0L9cMt.cjs";
 import { n as KvStore, t as KvKey } from "./kv-B2mzK5tl.cjs";
 import { Activity, Actor, Collection, CryptographicKey, Hashtag, Link, LookupObjectOptions, Multikey, Object as Object$1, Recipient, Tombstone, TraverseCollectionOptions } from "@fedify/vocab";
@@ -4283,6 +4283,11 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * Gets the public key of the sender, if any exists and it is verified.
   * Otherwise, `null` is returned.
   *
+  * Successful results are reused for this request regardless of the options.
+  * Pending checks and `null` results are reused for the same effective
+  * document and context loaders, including failed lookups.  Rejected checks
+  * can be retried.  Shared work uses the first caller's tracer provider.
+  *
   * This can be used for implementing [authorized fetch] (also known as
   * secure mode) in ActivityPub.
   *
@@ -4296,6 +4301,11 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * Gets the public key of the sender, if any exists and it is verified.
   * Otherwise, `null` is returned.
   *
+  * Successful results are reused for this request regardless of the options.
+  * Pending checks and `null` results are reused for the same effective
+  * document and context loaders, including failed lookups.  Rejected checks
+  * can be retried.  Shared work uses the first caller's tracer provider.
+  *
   * This can be used for implementing [authorized fetch] (also known as
   * secure mode) in ActivityPub.
   *
@@ -4315,6 +4325,14 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * Gets the owner of the signed key, if any exists and it is verified.
   * Otherwise, `null` is returned.
   *
+  * Verified keys and owners are reused for this request regardless of the
+  * options.  Pending checks are shared for the same effective document and
+  * context loaders.  A `null` result from an owner lookup after key
+  * verification is retained for those loaders.  A `null` result caused by
+  * an unverified key is not retained, allowing an owner lookup after another
+  * loader verifies the key.  Rejected checks can be retried.  Shared work
+  * uses the first caller's tracer provider.
+  *
   * This can be used for implementing [authorized fetch] (also known as
   * secure mode) in ActivityPub.
   *
@@ -4329,6 +4347,14 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * Gets the owner of the signed key, if any exists and it is verified.
   * Otherwise, `null` is returned.
   *
+  * Verified keys and owners are reused for this request regardless of the
+  * options.  Pending checks are shared for the same effective document and
+  * context loaders.  A `null` result from an owner lookup after key
+  * verification is retained for those loaders.  A `null` result caused by
+  * an unverified key is not retained, allowing an owner lookup after another
+  * loader verifies the key.  Rejected checks can be retried.  Shared work
+  * uses the first caller's tracer provider.
+  *
   * This can be used for implementing [authorized fetch] (also known as
   * secure mode) in ActivityPub.
   *

package/dist/{deno-BO7-a3hz.mjs → deno-DcJISdwu.mjs}

@@ -3,6 +3,6 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.5-dev.2462+46a3f2c5";
+var version = "2.4.5";
 //#endregion
 export { version as n, name as t };

package/dist/docloader-CP1UxMLL.mjs

@@ -0,0 +1,136 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { T as validateCryptoKey } from "./ld-Cy5GqbvS.mjs";
+import { r as doubleKnockScoped } from "./http-DuGmr8J8.mjs";
+import { getLogger } from "@logtape/logtape";
+import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, resolveDocumentLoaderTimeout, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
+import { curry } from "es-toolkit";
+import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";
+//#region src/utils/docloader.ts
+const logger = getLogger([
+	"fedify",
+	"utils",
+	"docloader"
+]);
+const DEFAULT_MAX_REDIRECTION = 20;
+/**
+* Gets an authenticated {@link DocumentLoader} for the given identity.
+* Note that an authenticated document loader intentionally does not cache
+* the fetched documents.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
+* Each call, including its double-knocking retries, times out after
+* 10 seconds by default; see {@link DocumentLoaderFactoryOptions.timeout}.
+* @param identity The identity to get the document loader for.
+*                 The actor's key pair.
+* @param options The options for the document loader.
+* @returns The authenticated document loader.
+* @throws {TypeError} If the key is invalid or unsupported.
+* @throws {RangeError} If the `timeout` option is invalid.
+* @since 0.4.0
+*/
+function getAuthenticatedDocumentLoader(identity, options = {}) {
+	return createAuthenticatedDocumentLoader(identity, options);
+}
+/**
+* The placeholder that the alternate document callback of
+* `getRemoteDocument()` returns, so that the alternate document is loaded
+* after the current hop is closed.
+*/
+const ALTERNATE_PLACEHOLDER = Object.freeze({
+	contextUrl: null,
+	document: null,
+	documentUrl: "about:blank"
+});
+/**
+* The implementation of {@link getAuthenticatedDocumentLoader}.  This is not
+* exported from any entry point.
+* @param identity The identity to get the document loader for.
+* @param options The options for the document loader.
+* @param deps The dependencies, for tests.
+* @returns The authenticated document loader.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+function createAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, timeout, tracerProvider } = {}, deps = {}) {
+	validateCryptoKey(identity.privateKey);
+	const resolvedTimeout = resolveDocumentLoaderTimeout(timeout);
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
+		options?.signal?.throwIfAborted();
+		let currentUrl = new URL(url).href;
+		validateUrl(currentUrl);
+		visited.add(currentUrl);
+		const originalRequest = createActivityPubRequest(currentUrl, { userAgent });
+		function follow(nextUrl) {
+			options?.signal?.throwIfAborted();
+			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+			if (visited.has(nextUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
+			redirected++;
+		}
+		const result = await doubleKnockScoped(originalRequest, identity, {
+			maxRedirection,
+			specDeterminer,
+			log: curry(logRequest)(logger),
+			tracerProvider,
+			signal: options?.signal,
+			validateRedirect: (nextUrl) => {
+				follow(nextUrl);
+				validateUrl(nextUrl);
+				visited.add(nextUrl);
+				currentUrl = nextUrl;
+			}
+		}, (hopUrl) => openHop(hopUrl, options), async (response) => {
+			options?.signal?.throwIfAborted();
+			let alternateUrl;
+			const document = await getRemoteDocument(currentUrl, response, (url) => {
+				alternateUrl = url;
+				return Promise.resolve(ALTERNATE_PLACEHOLDER);
+			}, options);
+			if (alternateUrl == null) return { document };
+			if (!response.bodyUsed && response.body?.locked !== true) response.body?.cancel().catch((error) => {
+				logger.debug("Failed to cancel the response body from {url}: {error}", {
+					url: currentUrl,
+					error
+				});
+			});
+			return { alternateUrl };
+		});
+		options?.signal?.throwIfAborted();
+		if ("document" in result) return result.document;
+		follow(result.alternateUrl);
+		return load(result.alternateUrl, options, redirected, visited);
+	}
+	function openUnvalidatedHop(url, signal) {
+		if (deps.openHop != null) return deps.openHop(url);
+		return allowPrivateAddress ? openDirectFetch(url) : openPublicFetch(url, { signal });
+	}
+	async function openHop(url, options) {
+		try {
+			const session = await openUnvalidatedHop(url, options?.signal);
+			if (options?.signal?.aborted) {
+				await session.close();
+				options.signal.throwIfAborted();
+			}
+			return session;
+		} catch (error) {
+			if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	function validateUrl(url) {
+		const parsedUrl = new URL(url);
+		const protocol = parsedUrl.protocol;
+		if (protocol !== "http:" && protocol !== "https:") throw new UrlError(`Unsupported protocol: ${protocol}`);
+		if (parsedUrl.username !== "" || parsedUrl.password !== "") throw new UrlError("URLs with credentials are not allowed");
+	}
+	return withDocumentLoaderTimeout((url, options) => load(url, options), resolvedTimeout);
+}
+//#endregion
+export { getAuthenticatedDocumentLoader as n, createAuthenticatedDocumentLoader as t };

package/dist/federation/builder.test.mjs

@@ -7,7 +7,7 @@ import { t as assertExists } from "../assert_exists-cffSpJ7X.mjs";
 import { t as assertThrows } from "../assert_throws-BYITOvPO.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertStrictEquals } from "../assert_strict_equals-CYvBmkpC.mjs";
-import { r as createFederationBuilder } from "../builder-BBUGd9wr.mjs";
+import { r as createFederationBuilder } from "../builder-CUAVOHg6.mjs";
 import { DisallowedOperatorError, DisallowedVarSpecModifierError, DuplicateRouteVariableError, RouteTemplateOptionsNotMatchedError, RouterError } from "@fedify/uri-template";
 import { Activity, Note, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";

package/dist/federation/compound-fanout.test.mjs

@@ -6,11 +6,11 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { y as exportJwk } from "../ld-PJLGA2MJ.mjs";
+import { y as exportJwk } from "../ld-Cy5GqbvS.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as signObject, d as verifyProof } from "../proof-DNu-qP0i.mjs";
+import { a as signObject, d as verifyProof } from "../proof-UN4CW55z.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as FederationImpl } from "../middleware-ByanhTvb.mjs";
+import { n as FederationImpl } from "../middleware-D2fk45uN.mjs";
 import { Create, DataIntegrityProof, Note } from "@fedify/vocab";
 import { exportDidKey, parseIri } from "@fedify/vocab-runtime";
 import { mockDocumentLoader, test } from "@fedify/fixture";
@@ -68,6 +68,7 @@ test("fanout delivery keeps an embedded signed child intact", async () => {
 			kv: new MemoryKvStore(),
 			contextLoaderFactory: () => mockDocumentLoader
 		});
+		federation.allowPrivateAddress = true;
 		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox");
 		const message = {
 			type: "fanout",
@@ -139,6 +140,7 @@ test("forced fanout signs before serializing so the child survives", async () =>
 			manuallyStartQueue: true,
 			contextLoaderFactory: () => mockDocumentLoader
 		});
+		federation.allowPrivateAddress = true;
 		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox");
 		await federation.createContext(new URL("https://example.com/")).sendActivity({
 			keyId: childKeyId,
@@ -203,6 +205,7 @@ test("an already signed activity keeps its single proof through fanout", async (
 			manuallyStartQueue: true,
 			contextLoaderFactory: () => mockDocumentLoader
 		});
+		federation.allowPrivateAddress = true;
 		federation.setInboxListeners("/users/{identifier}/inbox", "/inbox");
 		await federation.createContext(new URL("https://example.com/")).sendActivity({
 			keyId: childKeyId,

package/dist/federation/handler-compound-proof.test.mjs

@@ -5,10 +5,10 @@ import { r as createRequestContext, t as createInboxContext } from "../context-8
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { a as compactJsonLd, m as verifyCompactJsonLd, p as signJsonLd } from "../ld-PJLGA2MJ.mjs";
-import { l as signRequest } from "../http-D7L2pqLT.mjs";
+import { a as compactJsonLd, m as verifyCompactJsonLd, p as signJsonLd } from "../ld-Cy5GqbvS.mjs";
+import { u as signRequest } from "../http-DuGmr8J8.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { f as handleInbox, o as createFederation } from "../middleware-ByanhTvb.mjs";
+import { f as handleInbox, o as createFederation } from "../middleware-D2fk45uN.mjs";
 import { t as ActivityListenerSet } from "../activity-listener-C-BSbKI7.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { Create, CryptographicKey, Multikey, Person, Update } from "@fedify/vocab";