@fedify/fedify 2.5.0-dev.2446 → 2.5.0-dev.2492

package/dist/{context-CQ9H8vNW.d.cts → context-DSuL3YWx.d.cts}

@@ -1,14 +1,43 @@
 /// <reference lib="esnext.temporal" />
-import { o as JsonValue, s as NodeInfo, t as GetNodeInfoOptions } from "./client-D-XP_Ccb.cjs";
-import { _ as InboxVerificationKey, d as InboxProofPolicyFailureReason, h as InboxVerificationAttempt, w as VerifyRequestFailureReason, y as HttpMessageSignaturesSpec } from "./key-nYGY4QB9.cjs";
-import { n as GetKeyOwnerOptions } from "./owner-BF0L9cMt.cjs";
+import { o as JsonValue, s as NodeInfo, t as GetNodeInfoOptions } from "./client-3InDZbba.cjs";
+import { _ as InboxVerificationKey, d as InboxProofPolicyFailureReason, h as InboxVerificationAttempt, w as VerifyRequestFailureReason, y as HttpMessageSignaturesSpec } from "./key-DlHT4R6k.cjs";
+import { m as GetKeyOwnerOptions, n as EffectiveContextLoaderPolicy } from "./ld-CWVpo_NM.cjs";
 import { n as KvStore, t as KvKey } from "./kv-B2mzK5tl.cjs";
 import { Activity, Actor, Collection, CryptographicKey, Hashtag, Link, LookupObjectOptions, Multikey, Object as Object$1, Recipient, Tombstone, TraverseCollectionOptions } from "@fedify/vocab";
-import { AuthenticatedDocumentLoaderFactory, DocumentLoader, DocumentLoaderFactory, GetUserAgentOptions, PortableObjectVerifier } from "@fedify/vocab-runtime";
+import { AuthenticatedDocumentLoaderFactory, DocumentLoader, DocumentLoaderFactory, GetUserAgentOptions, PortableObjectVerifier, RemoteDocument } from "@fedify/vocab-runtime";
 import { Link as Link$1, LookupWebFingerOptions, ResourceDescriptor } from "@fedify/webfinger";
 import { MeterProvider, Span, Tracer, TracerProvider } from "@opentelemetry/api";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 
+//#region src/federation/activity-listener.d.ts
+/**
+* Options for an inbox listener.
+* @since 2.5.0
+*/
+interface InboxListenerOptions {
+  /**
+  * Whether activities that declare no `actor` at all may reach the listener.
+  *
+  * Some protocols identify the requester without an `actor`; for example,
+  * Mastodon sends [FEP-7aa9] `FeatureRequest` activities without one.  When
+  * this is `true`, such an activity is dispatched to the listener if Fedify
+  * authenticated at least one principal for it, i.e., the signer of its
+  * Object Integrity Proofs or Linked Data Signature, or otherwise the signer
+  * of the HTTP request, and its `id`, if any, has the same origin as that
+  * principal.  The listener is then responsible for authorizing the request
+  * with {@link InboxContext.authentication}, e.g., with
+  * `featureInteraction.verifyRequest()` from
+  * `@fedify/interaction-controls`.
+  *
+  * An activity that declares an `actor` is never affected by this option;
+  * its actor must be authenticated as usual.
+  *
+  * [FEP-7aa9]: https://w3id.org/fep/7aa9
+  * @default `false`
+  */
+  readonly allowActorless?: boolean;
+}
+//#endregion
 //#region src/federation/inbox-report.d.ts
 /**
 * A JSON value retained from the incoming request.
@@ -51,6 +80,13 @@ type InboxAuthentication = {
     readonly type: "activityOriginMismatch";
     readonly activityId: URL;
     readonly actorIds: readonly URL[];
+  } | {
+    /**
+    * The activity declares no actor, and no principal was authenticated
+    * for it, although its listener allows activities without an actor.
+    * @since 2.5.0
+    */
+    readonly type: "noAuthenticatedPrincipal";
   };
 } | {
   readonly status: "skipped";
@@ -949,6 +985,18 @@ interface MessageQueue {
   */
   readonly atomicEnqueueMany?: boolean;
   /**
+  * The largest message, in bytes, that the backend can hold.  Fedify compares
+  * it with a conservative estimate of a message's serialized size: the
+  * length of its JSON serialization encoded in UTF-8, plus 8 bytes for each
+  * JSON value in it, plus what encoding strings beyond Latin-1 as UTF-16
+  * adds, which also bounds binary serialization formats.  When an
+  * incoming activity would make a larger inbox message, Fedify processes the
+  * activity right away instead of enqueueing it, as if there were no inbox
+  * queue.  When omitted, messages are enqueued regardless of their size.
+  * @since 2.5.0
+  */
+  readonly maxMessageSize?: number;
+  /**
   * Enqueues a message in the queue.
   * @param message The message to enqueue.
   * @param options Additional options for enqueuing the message.
@@ -1074,6 +1122,11 @@ declare class ParallelMessageQueue implements MessageQueue {
   * @since 2.4.0
   */
   readonly atomicEnqueueMany?: boolean;
+  /**
+  * Inherits the message size limit from the wrapped queue.
+  * @since 2.5.0
+  */
+  readonly maxMessageSize?: number;
   readonly getDepth?: () => Promise<MessageQueueDepth>;
   /**
   * Constructs a new {@link ParallelMessageQueue} with the given queue and
@@ -1090,6 +1143,211 @@ declare class ParallelMessageQueue implements MessageQueue {
   listen(handler: (message: any) => Promise<void> | void, options?: MessageQueueListenOptions): Promise<void>;
 }
 //#endregion
+//#region src/federation/inbox-authentication.d.ts
+/**
+* A party that Fedify authenticated for an incoming activity, independently
+* of the activity's declared `actor`.
+* @since 2.5.0
+*/
+interface InboxPrincipal {
+  /**
+  * What {@link InboxPrincipal.id} is:
+  *
+  *  -  `"actor"`: an actor whose ownership of the verifying key Fedify
+  *     confirmed with the actor's own document.
+  *  -  `"portableAuthority"`: a DID whose verification method made a valid
+  *     Object Integrity Proof.  It authenticates the [FEP-ef61] portable
+  *     actors of that DID, and nothing else.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  */
+  readonly kind: "actor" | "portableAuthority";
+  /** The actor ID, or the DID if {@link kind} is `"portableAuthority"`. */
+  readonly id: URL;
+  /**
+  * How the principal was authenticated:
+  *
+  *  -  `"httpSignatures"`: it signed the HTTP request.
+  *  -  `"linkedDataSignatures"`: it made the Linked Data Signature of the
+  *     activity.
+  *  -  `"objectIntegrityProofs"`: it made an Object Integrity Proof of the
+  *     activity.
+  *  -  `"origin"`: the activity was fetched again from the actor's own web
+  *     origin, which happens only for `Context.routeActivity()`.
+  */
+  readonly mechanism: "httpSignatures" | "linkedDataSignatures" | "objectIntegrityProofs" | "origin";
+  /** The key or verification method that authenticated the principal. */
+  readonly keyId: URL | null;
+}
+/**
+* Who Fedify authenticated for an incoming activity, and the interpretation of
+* the activity it authenticated.  Inbox listeners receive it as
+* {@link InboxContext.authentication}.
+*
+* Authenticated principals are independent of the activity's declared
+* `actor`: an activity forwarded by a relay is signed by the relay in its
+* HTTP request, but its document may be signed by its author, and some
+* activities, such as [FEP-7aa9] `FeatureRequest`s sent by Mastodon, declare
+* no `actor` at all.  A valid signature alone does not authorize anything;
+* use {@link isActorAuthenticated} to check whether a specific actor was
+* authenticated.
+*
+* [FEP-7aa9]: https://w3id.org/fep/7aa9
+* @since 2.5.0
+*/
+interface InboxAuthenticationEvidence {
+  /**
+  * Whether signatures were verified at all.  It is `false` only when
+  * signature verification is skipped, or when there is no evidence, e.g.,
+  * for an activity queued by an older version of Fedify.  In that case all
+  * the principal lists are empty.
+  */
+  readonly verified: boolean;
+  /**
+  * The principals that signed the HTTP request, i.e., the server that
+  * delivered the activity, which may have forwarded it.  It is empty when
+  * the activity document was authenticated by its own signatures, so that
+  * HTTP Signatures did not need to be verified.
+  */
+  readonly requestSigners: readonly InboxPrincipal[];
+  /**
+  * The principals that made the verified Linked Data Signature or Object
+  * Integrity Proofs of the activity document.  All of them are listed when
+  * there are several proofs.
+  */
+  readonly documentSigners: readonly InboxPrincipal[];
+  /**
+  * The actors authenticated because `Context.routeActivity()` fetched the
+  * activity again from their own web origin.  It is always empty for
+  * activities delivered to an inbox.
+  */
+  readonly originAuthenticated: readonly InboxPrincipal[];
+  /**
+  * The activity as Fedify interpreted it while authenticating it, in
+  * expanded JSON-LD.  Typed vocabulary objects omit some values, such as
+  * blank node references and values they cannot decode, so authorization
+  * that has to count every value of a property, e.g., that a property has
+  * exactly one value, should inspect this instead.  It is deeply frozen.
+  * It is empty when there is no evidence.
+  */
+  readonly expandedActivity: readonly Record<string, unknown>[];
+  /**
+  * The base URL the activity was decoded with, e.g., the URL an activity
+  * fetched by `Context.routeActivity()` was finally retrieved from, or
+  * `null` if none was given.  Relative IRIs left in
+  * {@link expandedActivity} resolve against it, or against the activity's
+  * own `@id` if it is `null`, as the decoder resolves them.
+  */
+  readonly baseUrl: URL | null;
+}
+/**
+* Options for {@link isActorAuthenticated}.
+* @since 2.5.0
+*/
+interface IsActorAuthenticatedOptions {
+  /**
+  * Which principals to consider:
+  *
+  *  -  `"effective"` (default): the document signers if there are any,
+  *     otherwise the request signers if there are any, otherwise the actors
+  *     authenticated by their origin.
+  *  -  `"document"`: the document signers only.
+  */
+  readonly scope?: "effective" | "document";
+}
+/**
+* Checks whether the given evidence authenticates the given actor.
+*
+* Actor IDs are compared exactly, except that [FEP-ef61] portable IDs and
+* compatible identifiers are compared by their canonical portable IDs, and
+* a portable authority (a DID) authenticates the portable actors of that DID.
+*
+* @example
+* ``` typescript
+* federation
+*   .setInboxListeners("/users/{identifier}/inbox", "/inbox")
+*   .on(Follow, async (ctx, follow) => {
+*     if (follow.actorId == null) return;
+*     // The actor is always authenticated for activities that declare one,
+*     // but the same check works for any actor an activity names:
+*     isActorAuthenticated(ctx.authentication, follow.actorId);
+*   });
+* ```
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* @param evidence The authentication evidence, usually
+*                 {@link InboxContext.authentication}.
+* @param actorId The actor ID to check.
+* @param options Options.
+* @returns `true` if the actor is authenticated.
+* @since 2.5.0
+*/
+declare function isActorAuthenticated(evidence: InboxAuthenticationEvidence, actorId: URL, options?: IsActorAuthenticatedOptions): boolean;
+/**
+* A {@link InboxPrincipal} as stored in a queued message.
+* @internal
+*/
+interface SerializedInboxPrincipal {
+  readonly kind: InboxPrincipal["kind"];
+  readonly id: string;
+  readonly mechanism: InboxPrincipal["mechanism"];
+  readonly keyId: string | null;
+}
+/**
+* The principals of an {@link InboxAuthenticationEvidence} as stored in
+* a queued message.  The expanded activity and the base URL are restored
+* from the queued verified view instead.
+* @internal
+*/
+interface SerializedInboxAuthentication {
+  readonly verified: boolean;
+  readonly requestSigners: readonly SerializedInboxPrincipal[];
+  readonly documentSigners: readonly SerializedInboxPrincipal[];
+  readonly originAuthenticated: readonly SerializedInboxPrincipal[];
+}
+//#endregion
+//#region src/federation/inbox-view.d.ts
+/**
+* A {@link ContextSnapshotEntry} as stored in a queued message.  A response
+* that equals the one Fedify bundles for the URL is stored as a reference to
+* the bundled context, along with its hash for diagnostics.
+* @internal
+*/
+type SerializedContextSnapshotEntry = {
+  readonly policy: EffectiveContextLoaderPolicy;
+  readonly url: string; /** The SHA-256 of the canonical JSON of the whole response. */
+  readonly sha256: string;
+} & ({
+  readonly bundled: true;
+} | {
+  readonly response: RemoteDocument;
+});
+/**
+* The interpretation of an incoming activity that Fedify authenticated, as
+* stored in a queued message.  The document itself is not copied; it is
+* a field of the message.
+* @internal
+*/
+interface SerializedVerifiedActivityView {
+  /** The format version. */
+  readonly version: 1;
+  /** The context loader policy the activity was parsed with. */
+  readonly policy: EffectiveContextLoaderPolicy;
+  /**
+  * Which document the activity was parsed from, with its Linked Data
+  * Signature detached: the `activity` of the message, i.e., the payload as
+  * received, or its `normalizedActivity`, i.e., the payload compacted for
+  * Linked Data Signatures.
+  */
+  readonly source: "activity" | "normalizedActivity";
+  /** The `baseUrl` option the activity was parsed with. */
+  readonly baseUrl: string | null;
+  /** The context responses the interpretation used. */
+  readonly contexts: readonly SerializedContextSnapshotEntry[];
+  /** The digest of the expanded activity. */
+  readonly expandedDigest: string;
+}
+//#endregion
 //#region src/federation/handler.d.ts
 /**
 * Options for the {@link respondWithObject} and
@@ -1504,6 +1762,21 @@ interface InboxMessage {
   * @internal
   */
   readonly ldSignatureVerified?: boolean;
+  /**
+  * The interpretation of the activity that Fedify authenticated, i.e., which
+  * document it was parsed from and every JSON-LD context response the parse
+  * used, so that the worker and its retries dispatch the very same
+  * interpretation without loading contexts again.  Absent in messages queued
+  * by older Fedify versions.
+  * @internal
+  */
+  readonly verifiedView?: SerializedVerifiedActivityView;
+  /**
+  * Who Fedify authenticated for the activity.  Absent in messages queued by
+  * older Fedify versions.
+  * @internal
+  */
+  readonly authentication?: SerializedInboxAuthentication;
   readonly started: string;
   readonly attempt: number;
   readonly identifier: string | null;
@@ -2884,11 +3157,27 @@ interface InboxListenerSetters<TContextData> {
   /**
   * Registers a listener for a specific incoming activity type.
   *
+  * @example
+  * ``` typescript
+  * federation
+  *   .setInboxListeners("/users/{identifier}/inbox", "/inbox")
+  *   // Mastodon sends FeatureRequest activities without an actor:
+  *   .on(FeatureRequest, async (ctx, request) => {
+  *     const verification = await featureInteraction.verifyRequest(ctx, {
+  *       request,
+  *       authentication: ctx.authentication,
+  *     });
+  *     // ...
+  *   }, { allowActorless: true });
+  * ```
+  *
   * @param type A subclass of {@link Activity} to listen to.
   * @param listener A callback to handle an incoming activity.
+  * @param options Options for the listener.  See
+  *                {@link InboxListenerOptions}.  (Since 2.5.0.)
   * @returns The setters object so that settings can be chained.
   */
-  on<TActivity extends Activity>(type: new (...args: any[]) => TActivity, listener: InboxListener<TContextData, TActivity>): InboxListenerSetters<TContextData>;
+  on<TActivity extends Activity>(type: new (...args: any[]) => TActivity, listener: InboxListener<TContextData, TActivity>, options?: InboxListenerOptions): InboxListenerSetters<TContextData>;
   /**
   * Registers an error handler for inbox listeners.  Any exceptions thrown
   * from the listeners are caught and passed to this handler.
@@ -4296,6 +4585,11 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * Gets the public key of the sender, if any exists and it is verified.
   * Otherwise, `null` is returned.
   *
+  * Successful results are reused for this request regardless of the options.
+  * Pending checks and `null` results are reused for the same effective
+  * document and context loaders, including failed lookups.  Rejected checks
+  * can be retried.  Shared work uses the first caller's tracer provider.
+  *
   * This can be used for implementing [authorized fetch] (also known as
   * secure mode) in ActivityPub.
   *
@@ -4309,6 +4603,11 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * Gets the public key of the sender, if any exists and it is verified.
   * Otherwise, `null` is returned.
   *
+  * Successful results are reused for this request regardless of the options.
+  * Pending checks and `null` results are reused for the same effective
+  * document and context loaders, including failed lookups.  Rejected checks
+  * can be retried.  Shared work uses the first caller's tracer provider.
+  *
   * This can be used for implementing [authorized fetch] (also known as
   * secure mode) in ActivityPub.
   *
@@ -4328,6 +4627,14 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * Gets the owner of the signed key, if any exists and it is verified.
   * Otherwise, `null` is returned.
   *
+  * Verified keys and owners are reused for this request regardless of the
+  * options.  Pending checks are shared for the same effective document and
+  * context loaders.  A `null` result from an owner lookup after key
+  * verification is retained for those loaders.  A `null` result caused by
+  * an unverified key is not retained, allowing an owner lookup after another
+  * loader verifies the key.  Rejected checks can be retried.  Shared work
+  * uses the first caller's tracer provider.
+  *
   * This can be used for implementing [authorized fetch] (also known as
   * secure mode) in ActivityPub.
   *
@@ -4342,6 +4649,14 @@ interface RequestContext<TContextData> extends Context<TContextData> {
   * Gets the owner of the signed key, if any exists and it is verified.
   * Otherwise, `null` is returned.
   *
+  * Verified keys and owners are reused for this request regardless of the
+  * options.  Pending checks are shared for the same effective document and
+  * context loaders.  A `null` result from an owner lookup after key
+  * verification is retained for those loaders.  A `null` result caused by
+  * an unverified key is not retained, allowing an owner lookup after another
+  * loader verifies the key.  Rejected checks can be retried.  Shared work
+  * uses the first caller's tracer provider.
+  *
   * This can be used for implementing [authorized fetch] (also known as
   * secure mode) in ActivityPub.
   *
@@ -4417,6 +4732,17 @@ interface InboxContext<TContextData> extends Context<TContextData> {
   */
   readonly recipient: string | null;
   /**
+  * Who Fedify authenticated for the incoming activity, independently of its
+  * declared `actor`, and the interpretation of the activity that was
+  * authenticated.  It is preserved through the inbox queue and its retries.
+  *
+  * Use it with {@link isActorAuthenticated} to authorize requests that do
+  * not declare an `actor`, which reach a listener only if it is registered
+  * with the `allowActorless` option.
+  * @since 2.5.0
+  */
+  readonly authentication: InboxAuthenticationEvidence;
+  /**
   * Creates a new context with the same properties as this one,
   * but with the given data.
   * @param data The new data to associate with the context.
@@ -4836,4 +5162,4 @@ interface ActorKeyPair extends CryptoKeyPair {
   readonly multikey: Multikey;
 }
 //#endregion
-export { respondWithObject as $, digest as $t, InboxChallengePolicy as A, CustomCollectionDispatcher as At, createFederation as B, OutboxListener as Bt, FederationBenchmarkOptions as C, ActorKeyPairsDispatcher as Ct, FederationStartQueueOptions as D, CollectionDispatcher as Dt, FederationOptions as E, CollectionCursor as Et, PortableInboxForwardingOptions as F, MediaUploaderCallback as Ft, TaskEnqueueOptions as G, SharedInboxKeyDispatcher as Gt, createFederationBuilder as H, OutboxPermanentFailureHandler as Ht, Rfc6570Expression as I, NodeInfoDispatcher as It, CreateExponentialBackoffPolicyOptions as J, WebFingerLinksDispatcher as Jt, TaskHandler as K, UnverifiedActivityHandler as Kt, FederationKvPrefixes as L, ObjectAuthorizePredicate as Lt, MediaUploaderSetters as M, HashlinkMediaRequest as Mt, ObjectCallbackSetters as N, InboxErrorHandler as Nt, IdempotencyKeyCallback as O, CustomCollectionCounter as Ot, OutboxListenerSetters as P, InboxListener as Pt, RespondWithObjectOptions as Q, buildCollectionSynchronizationHeader as Qt, FederationOrigin as R, ObjectDispatcher as Rt, Federation as S, ActorHandleMapper as St, FederationFetchOptions as T, CollectionCounter as Tt, TaskDefinition as U, PortableActorIdMapper as Ut, Message as V, OutboxListenerErrorHandler as Vt, TaskDefinitionOptions as W, PortableCollectionOwnerMapper as Wt, RetryPolicy as X, SenderKeyPair as Xt, RetryContext as Y, SendActivityError as Yt, createExponentialBackoffPolicy as Z, PageItems as Zt, ActorCallbackSetters as _, NormalizedCircuitBreakerOptions as _t, GetObjectOptions as a, InboxRequestReport as an, MessageQueueEnqueueOptions as at, CustomCollectionCallbackSetters as b, ActorAliasMapper as bt, IsSignedByAudienceOptions as c, CircuitBreaker as ct, ParseUriResult as d, CircuitBreakerCreateOptions as dt, ActivityTransformer as en, respondWithObjectIfAcceptable as et, PortableRequest as f, CircuitBreakerFailurePolicy as ft, SendActivityOptionsForCollection as g, CircuitBreakerStateChange as gt, SendActivityOptions as h, CircuitBreakerState as ht, GetActorOptions as i, InboxRequestOutcome as in, MessageQueueDepth as it, InboxListenerSetters as j, HashlinkMediaDispatcher as jt, IdempotencyStrategy as k, CustomCollectionCursor as kt, OutboxContext as l, CircuitBreakerActivityDrop as lt, RouteActivityOptions as m, CircuitBreakerOptions as mt, Context as n, InboxJsonValue as nn, InProcessMessageQueueOptions as nt, GetSignedKeyOptions as o, MessageQueueListenOptions as ot, RequestContext as p, CircuitBreakerKvState as pt, TaskRegistry as q, UnverifiedActivityReason as qt, ForwardActivityOptions as r, InboxRequestFinishedHandler as rn, MessageQueue as rt, InboxContext as s, ParallelMessageQueue as st, ActorKeyPair as t, InboxAuthentication as tn, InProcessMessageQueue as tt, ParseUriOptions as u, CircuitBreakerBeforeSendDecision as ut, CollectionCallbackSetters as v, normalizeCircuitBreakerOptions as vt, FederationBuilder as w, AuthorizePredicate as wt, Federatable as x, ActorDispatcher as xt, ConstructorWithTypeId as y, parseCircuitBreakerKvState as yt, FederationQueueOptions as z, OutboxErrorHandler as zt };
+export { respondWithObject as $, SendActivityError as $t, InboxChallengePolicy as A, CollectionCursor as At, createFederation as B, NodeInfoDispatcher as Bt, FederationBenchmarkOptions as C, parseCircuitBreakerKvState as Ct, FederationStartQueueOptions as D, ActorKeyPairsDispatcher as Dt, FederationOptions as E, ActorHandleMapper as Et, PortableInboxForwardingOptions as F, HashlinkMediaDispatcher as Ft, TaskEnqueueOptions as G, OutboxListenerErrorHandler as Gt, createFederationBuilder as H, ObjectDispatcher as Ht, Rfc6570Expression as I, HashlinkMediaRequest as It, CreateExponentialBackoffPolicyOptions as J, PortableCollectionOwnerMapper as Jt, TaskHandler as K, OutboxPermanentFailureHandler as Kt, FederationKvPrefixes as L, InboxErrorHandler as Lt, MediaUploaderSetters as M, CustomCollectionCounter as Mt, ObjectCallbackSetters as N, CustomCollectionCursor as Nt, IdempotencyKeyCallback as O, AuthorizePredicate as Ot, OutboxListenerSetters as P, CustomCollectionDispatcher as Pt, RespondWithObjectOptions as Q, WebFingerLinksDispatcher as Qt, FederationOrigin as R, InboxListener as Rt, Federation as S, normalizeCircuitBreakerOptions as St, FederationFetchOptions as T, ActorDispatcher as Tt, TaskDefinition as U, OutboxErrorHandler as Ut, Message as V, ObjectAuthorizePredicate as Vt, TaskDefinitionOptions as W, OutboxListener as Wt, RetryPolicy as X, UnverifiedActivityHandler as Xt, RetryContext as Y, SharedInboxKeyDispatcher as Yt, createExponentialBackoffPolicy as Z, UnverifiedActivityReason as Zt, ActorCallbackSetters as _, CircuitBreakerKvState as _t, GetObjectOptions as a, InboxAuthentication as an, InProcessMessageQueue as at, CustomCollectionCallbackSetters as b, CircuitBreakerStateChange as bt, IsSignedByAudienceOptions as c, InboxRequestOutcome as cn, MessageQueueDepth as ct, ParseUriResult as d, ParallelMessageQueue as dt, SenderKeyPair as en, respondWithObjectIfAcceptable as et, PortableRequest as f, CircuitBreaker as ft, SendActivityOptionsForCollection as g, CircuitBreakerFailurePolicy as gt, SendActivityOptions as h, CircuitBreakerCreateOptions as ht, GetActorOptions as i, ActivityTransformer as in, isActorAuthenticated as it, InboxListenerSetters as j, CollectionDispatcher as jt, IdempotencyStrategy as k, CollectionCounter as kt, OutboxContext as l, InboxRequestReport as ln, MessageQueueEnqueueOptions as lt, RouteActivityOptions as m, CircuitBreakerBeforeSendDecision as mt, Context as n, buildCollectionSynchronizationHeader as nn, InboxPrincipal as nt, GetSignedKeyOptions as o, InboxJsonValue as on, InProcessMessageQueueOptions as ot, RequestContext as p, CircuitBreakerActivityDrop as pt, TaskRegistry as q, PortableActorIdMapper as qt, ForwardActivityOptions as r, digest as rn, IsActorAuthenticatedOptions as rt, InboxContext as s, InboxRequestFinishedHandler as sn, MessageQueue as st, ActorKeyPair as t, PageItems as tn, InboxAuthenticationEvidence as tt, ParseUriOptions as u, InboxListenerOptions as un, MessageQueueListenOptions as ut, CollectionCallbackSetters as v, CircuitBreakerOptions as vt, FederationBuilder as w, ActorAliasMapper as wt, Federatable as x, NormalizedCircuitBreakerOptions as xt, ConstructorWithTypeId as y, CircuitBreakerState as yt, FederationQueueOptions as z, MediaUploaderCallback as zt };

package/dist/{deno-eNpfj4oR.mjs → deno-iOAA7iRN.mjs}

@@ -3,6 +3,6 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.5.0-dev.2446+2014cb03";
+var version = "2.5.0-dev.2492+4648c04e";
 //#endregion
 export { version as n, name as t };

package/dist/docloader-DCZkiTeF.mjs

@@ -0,0 +1,136 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { D as validateCryptoKey } from "./ld-CdvcOEXQ.mjs";
+import { r as doubleKnockScoped } from "./http-BoJCMnjY.mjs";
+import { getLogger } from "@logtape/logtape";
+import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, resolveDocumentLoaderTimeout, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
+import { curry } from "es-toolkit";
+import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";
+//#region src/utils/docloader.ts
+const logger = getLogger([
+	"fedify",
+	"utils",
+	"docloader"
+]);
+const DEFAULT_MAX_REDIRECTION = 20;
+/**
+* Gets an authenticated {@link DocumentLoader} for the given identity.
+* Note that an authenticated document loader intentionally does not cache
+* the fetched documents.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
+* Each call, including its double-knocking retries, times out after
+* 10 seconds by default; see {@link DocumentLoaderFactoryOptions.timeout}.
+* @param identity The identity to get the document loader for.
+*                 The actor's key pair.
+* @param options The options for the document loader.
+* @returns The authenticated document loader.
+* @throws {TypeError} If the key is invalid or unsupported.
+* @throws {RangeError} If the `timeout` option is invalid.
+* @since 0.4.0
+*/
+function getAuthenticatedDocumentLoader(identity, options = {}) {
+	return createAuthenticatedDocumentLoader(identity, options);
+}
+/**
+* The placeholder that the alternate document callback of
+* `getRemoteDocument()` returns, so that the alternate document is loaded
+* after the current hop is closed.
+*/
+const ALTERNATE_PLACEHOLDER = Object.freeze({
+	contextUrl: null,
+	document: null,
+	documentUrl: "about:blank"
+});
+/**
+* The implementation of {@link getAuthenticatedDocumentLoader}.  This is not
+* exported from any entry point.
+* @param identity The identity to get the document loader for.
+* @param options The options for the document loader.
+* @param deps The dependencies, for tests.
+* @returns The authenticated document loader.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+function createAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, timeout, tracerProvider } = {}, deps = {}) {
+	validateCryptoKey(identity.privateKey);
+	const resolvedTimeout = resolveDocumentLoaderTimeout(timeout);
+	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
+		options?.signal?.throwIfAborted();
+		let currentUrl = new URL(url).href;
+		validateUrl(currentUrl);
+		visited.add(currentUrl);
+		const originalRequest = createActivityPubRequest(currentUrl, { userAgent });
+		function follow(nextUrl) {
+			options?.signal?.throwIfAborted();
+			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+			if (visited.has(nextUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
+			redirected++;
+		}
+		const result = await doubleKnockScoped(originalRequest, identity, {
+			maxRedirection,
+			specDeterminer,
+			log: curry(logRequest)(logger),
+			tracerProvider,
+			signal: options?.signal,
+			validateRedirect: (nextUrl) => {
+				follow(nextUrl);
+				validateUrl(nextUrl);
+				visited.add(nextUrl);
+				currentUrl = nextUrl;
+			}
+		}, (hopUrl) => openHop(hopUrl, options), async (response) => {
+			options?.signal?.throwIfAborted();
+			let alternateUrl;
+			const document = await getRemoteDocument(currentUrl, response, (url) => {
+				alternateUrl = url;
+				return Promise.resolve(ALTERNATE_PLACEHOLDER);
+			}, options);
+			if (alternateUrl == null) return { document };
+			if (!response.bodyUsed && response.body?.locked !== true) response.body?.cancel().catch((error) => {
+				logger.debug("Failed to cancel the response body from {url}: {error}", {
+					url: currentUrl,
+					error
+				});
+			});
+			return { alternateUrl };
+		});
+		options?.signal?.throwIfAborted();
+		if ("document" in result) return result.document;
+		follow(result.alternateUrl);
+		return load(result.alternateUrl, options, redirected, visited);
+	}
+	function openUnvalidatedHop(url, signal) {
+		if (deps.openHop != null) return deps.openHop(url);
+		return allowPrivateAddress ? openDirectFetch(url) : openPublicFetch(url, { signal });
+	}
+	async function openHop(url, options) {
+		try {
+			const session = await openUnvalidatedHop(url, options?.signal);
+			if (options?.signal?.aborted) {
+				await session.close();
+				options.signal.throwIfAborted();
+			}
+			return session;
+		} catch (error) {
+			if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	function validateUrl(url) {
+		const parsedUrl = new URL(url);
+		const protocol = parsedUrl.protocol;
+		if (protocol !== "http:" && protocol !== "https:") throw new UrlError(`Unsupported protocol: ${protocol}`);
+		if (parsedUrl.username !== "" || parsedUrl.password !== "") throw new UrlError("URLs with credentials are not allowed");
+	}
+	return withDocumentLoaderTimeout((url, options) => load(url, options), resolvedTimeout);
+}
+//#endregion
+export { getAuthenticatedDocumentLoader as n, createAuthenticatedDocumentLoader as t };

package/dist/{exporter-DThFfe7P.mjs → exporter-DVG68ozH.mjs}

@@ -189,33 +189,6 @@ var FedifySpanExporter = class {
 			record.spanId
 		];
 		await this.#kv.set(key, record, options);
-		await this.#updateTraceSummary(record, options);
-	}
-	async #setWithCasRetry(key, transform, options) {
-		if (this.#kv.cas != null) for (let attempt = 0; attempt < 3; attempt++) {
-			const existing = await this.#kv.get(key);
-			const newValue = transform(existing);
-			if (await this.#kv.cas(key, existing, newValue, options)) return;
-		}
-		const newValue = transform(await this.#kv.get(key));
-		await this.#kv.set(key, newValue, options);
-	}
-	async #updateTraceSummary(record, options) {
-		const summaryKey = [
-			...this.#keyPrefix,
-			"_summaries",
-			record.traceId
-		];
-		await this.#setWithCasRetry(summaryKey, (existing) => {
-			const activityCount = existing != null ? existing.activityCount + 1 : 1;
-			const activityTypes = existing != null ? existing.activityTypes.includes(record.activityType) ? existing.activityTypes : [...existing.activityTypes, record.activityType] : [record.activityType];
-			return {
-				traceId: existing?.traceId ?? record.traceId,
-				timestamp: existing?.timestamp ?? record.timestamp,
-				activityCount,
-				activityTypes
-			};
-		}, options);
 	}
 	/**
 	* Gets all activity records for a specific trace ID.
@@ -232,13 +205,46 @@ var FedifySpanExporter = class {
 	/**
 	* Gets recent traces with summary information.
 	*
+	* Each summary is computed directly from the activity records currently
+	* stored for each trace, rather than from a separately maintained
+	* counter.  This guarantees that a trace is discoverable, and its
+	* `activityCount` accurate, as soon as its records are stored, even if
+	* an earlier attempt at summarizing it (in a previous version of this
+	* exporter) never completed, and that the count always reflects
+	* records that have not expired.  It costs a full scan of every stored
+	* record on every call, including full inbound activity JSON.  The
+	* `limit` option only truncates the returned summaries and does not
+	* reduce the scan.  Callers that poll this method frequently should
+	* account for the total retained data when choosing a TTL and polling
+	* interval.
+	*
 	* @param options Options for the query.
 	* @returns An array of trace summaries.
 	*/
 	async getRecentTraces(options) {
-		const summaryPrefix = [...this.#keyPrefix, "_summaries"];
-		const summaries = [];
-		for await (const entry of this.#kv.list(summaryPrefix)) summaries.push(entry.value);
+		const aggregates = /* @__PURE__ */ new Map();
+		const traceIdIndex = this.#keyPrefix.length;
+		for await (const entry of this.#kv.list(this.#keyPrefix)) {
+			const traceId = entry.key[traceIdIndex];
+			if (traceId == null || traceId === "_summaries") continue;
+			const record = entry.value;
+			if (record == null || typeof record.timestamp !== "string") continue;
+			const aggregate = aggregates.get(traceId);
+			if (aggregate == null) aggregates.set(traceId, {
+				timestamp: record.timestamp,
+				activityCount: 1,
+				activityTypes: [record.activityType]
+			});
+			else {
+				aggregate.activityCount++;
+				if (record.timestamp < aggregate.timestamp) aggregate.timestamp = record.timestamp;
+				if (!aggregate.activityTypes.includes(record.activityType)) aggregate.activityTypes.push(record.activityType);
+			}
+		}
+		const summaries = [...aggregates].map(([traceId, aggregate]) => ({
+			traceId,
+			...aggregate
+		}));
 		summaries.sort((a, b) => b.timestamp.localeCompare(a.timestamp));
 		if (options?.limit != null) return summaries.slice(0, options.limit);
 		return summaries;