@fedify/vocab 2.5.0-dev.2446 → 2.5.0-dev.2492

package/dist-tests/{lookup-BehNGq4X.mjs → lookup-BQqIkZ5j.mjs}

@@ -1,13 +1,13 @@
 import { Temporal } from "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { A as Object$1 } from "./vocab-jHKm_LJ6.mjs";
-import { i as isActor, o as name, s as version } from "./actor-C89Bex4F.mjs";
+import { i as isActor, o as name, s as version } from "./actor-BjUFWXfi.mjs";
 import { t as getTypeId } from "./type-BMdjm4Eg.mjs";
+import { A as Object$1 } from "./vocab-BMEyHiOV.mjs";
 import { canonicalizePortableUri, formatIri, getDocumentLoader, haveSameFe34Origin, haveSameIriOrigin, parseIri } from "@fedify/vocab-runtime";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";
-import { PortableObjectRejectedError, createSnapshotContextLoader, dereferencePortableIri, getPortableGatewayCandidates, getPortableResponseClaim, isPortableIri, parseCompatibleEf61Reference } from "@fedify/vocab-runtime/internal/portable-dereference";
+import { PortableObjectRejectedError, acceptCandidate, createSnapshotContextLoader, dereferencePortableIri, getPortableGatewayCandidates, getPortableResponseClaim, isPortableIri, parseCompatibleEf61Reference } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { delay } from "es-toolkit";
 //#region src/handle.ts
 /**
@@ -107,6 +107,20 @@ const logger = getLogger([
 	"lookup"
 ]);
 /**
+* Options for the {@link lookupObject} function.
+*
+* @since 0.2.0
+*/
+/**
+* The key of the {@link LookupObjectOptions} property that observes how
+* {@link lookupObject} selects the object it returns.
+*
+* @internal Technically exported for other Fedify packages, but not part of
+* the public API contract.  This is not considered public API for Semantic
+* Versioning decisions.
+*/
+const lookupObserver = Symbol.for("@fedify/vocab/lookupObserver");
+/**
 * The maximum number of requests to FEP-ef61 gateways that a single
 * {@link lookupObject} call makes for portable objects.  Gateways come from
 * possibly untrusted WebFinger responses and location hints, so they are
@@ -226,8 +240,13 @@ async function lookupObjectInternal(identifier, options = {}) {
 			remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
 		} catch (error) {
 			logger.debug("Failed to fetch remote document:\n{error}", { error });
+			options[lookupObserver]?.failed?.({
+				operation: "fetch",
+				error
+			});
 		}
 	}
+	if (remoteDoc == null && options[lookupObserver]?.webFinger === false) return null;
 	if (remoteDoc == null) {
 		const jrd = await lookupWebFinger(identifier, {
 			userAgent: options.userAgent,
@@ -272,7 +291,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 		}
 	}
 	if (remoteDoc == null) return null;
-	const snapshot = options.verifyPortableObject == null ? null : createSnapshotContextLoader(options.contextLoader ?? getDocumentLoader({ userAgent: options.userAgent }));
+	const snapshot = options.verifyPortableObject == null && options[lookupObserver] == null ? null : createSnapshotContextLoader(options.contextLoader ?? getDocumentLoader({ userAgent: options.userAgent }));
 	try {
 		let object;
 		let documentUrl;
@@ -286,6 +305,10 @@ async function lookupObjectInternal(identifier, options = {}) {
 				baseUrl: documentUrl
 			});
 		} catch (error) {
+			options[lookupObserver]?.failed?.({
+				operation: "parse",
+				error
+			});
 			if (error instanceof TypeError) {
 				logger.debug("Failed to parse JSON-LD document: {error}\n{document}", {
 					...remoteDoc,
@@ -295,7 +318,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 			}
 			throw error;
 		}
-		if (snapshot != null) {
+		if (options.verifyPortableObject != null && snapshot != null) {
 			const claim = getPortableResponseClaim(remoteDoc.documentUrl, object.id);
 			if (claim === null) {
 				logger.debug("Refusing the document {documentUrl}, as it claims to be a portable object with a malformed compatible identifier.", { documentUrl: remoteDoc.documentUrl });
@@ -314,8 +337,16 @@ async function lookupObjectInternal(identifier, options = {}) {
 				...remoteDoc,
 				objectId: object.id.href
 			});
+			options[lookupObserver]?.failed?.({ operation: "origin" });
 			return null;
 		}
+		if (!await acceptCandidate(options[lookupObserver], {
+			document: remoteDoc.document,
+			documentUrl: remoteDoc.documentUrl,
+			baseUrl: documentUrl,
+			contextLoader: snapshot?.loader ?? options.contextLoader ?? getDocumentLoader({ userAgent: options.userAgent }),
+			object
+		})) return null;
 		return object;
 	} finally {
 		snapshot?.release();
@@ -429,6 +460,7 @@ async function dereference({ options, documentLoader }, id, inferredGateways, ga
 			verifyPortableObject: options.verifyPortableObject,
 			crossOrigin: options.crossOrigin === "throw" ? "throw" : "ignore",
 			signal: options.signal,
+			observer: options[lookupObserver],
 			parse: (document, { contextLoader, baseUrl }) => Object$1.fromJsonLd(document, {
 				documentLoader,
 				contextLoader,
@@ -477,4 +509,4 @@ async function* traverseCollection(collection, options = {}) {
 	}
 }
 //#endregion
-export { traverseCollection as n, lookupObject as t };
+export { lookupObserver as n, traverseCollection as r, lookupObject as t };

package/dist-tests/lookup.test.mjs

@@ -1,16 +1,18 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { A as Object$1, F as Person, k as Note, s as Collection } from "./vocab-jHKm_LJ6.mjs";
-import { t as esm_default } from "./esm-DtAfYdqR.mjs";
-import { n as traverseCollection, t as lookupObject } from "./lookup-BehNGq4X.mjs";
+import { t as esm_default } from "./esm-BIqRhjGA.mjs";
+import { A as Object$1, F as Person, k as Note, s as Collection } from "./vocab-BMEyHiOV.mjs";
+import { n as lookupObserver, r as traverseCollection, t as lookupObject } from "./lookup-BQqIkZ5j.mjs";
 import { t as assertInstanceOf } from "./utils-Df2odC27.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, equal, ok, rejects } from "node:assert/strict";
 //#region src/lookup.test.ts
+const allowPrivateAddress = { allowPrivateAddress: true };
 test("lookupObject()", {
 	sanitizeResources: false,
 	sanitizeOps: false
 }, async (t) => {
+	const responseTimers = [];
 	esm_default.spyGlobal();
 	esm_default.get("begin:https://example.com/.well-known/webfinger", {
 		subject: "acct:johndoe@example.com",
@@ -34,7 +36,8 @@ test("lookupObject()", {
 	});
 	const options = {
 		documentLoader: mockDocumentLoader,
-		contextLoader: mockDocumentLoader
+		contextLoader: mockDocumentLoader,
+		...allowPrivateAddress
 	};
 	await t.step("actor", async () => {
 		const person = await lookupObject("@johndoe@example.com", options);
@@ -73,7 +76,7 @@ test("lookupObject()", {
 	});
 	esm_default.removeRoutes({ includeFallback: false });
 	esm_default.get("begin:https://example.com/.well-known/webfinger", () => new Promise((resolve) => {
-		setTimeout(() => {
+		responseTimers.push(setTimeout(() => {
 			resolve({
 				subject: "acct:johndoe@example.com",
 				links: [{
@@ -82,7 +85,7 @@ test("lookupObject()", {
 					type: "application/activity+json"
 				}]
 			});
-		}, 1e3);
+		}, 1e3));
 	}));
 	await t.step("request cancellation", async () => {
 		const controller = new AbortController();
@@ -113,7 +116,7 @@ test("lookupObject()", {
 	});
 	esm_default.removeRoutes({ includeFallback: false });
 	esm_default.get("begin:https://example.com/.well-known/webfinger", () => new Promise((resolve) => {
-		setTimeout(() => {
+		responseTimers.push(setTimeout(() => {
 			resolve({
 				subject: "acct:johndoe@example.com",
 				links: [{
@@ -122,7 +125,7 @@ test("lookupObject()", {
 					type: "application/activity+json"
 				}]
 			});
-		}, 500);
+		}, 500));
 	}));
 	await t.step("cancellation with immediate abort", async () => {
 		const controller = new AbortController();
@@ -134,7 +137,7 @@ test("lookupObject()", {
 	});
 	esm_default.removeRoutes({ includeFallback: false });
 	esm_default.get("https://example.com/slow-object", () => new Promise((resolve) => {
-		setTimeout(() => {
+		responseTimers.push(setTimeout(() => {
 			resolve({
 				status: 200,
 				headers: { "Content-Type": "application/activity+json" },
@@ -144,7 +147,7 @@ test("lookupObject()", {
 					content: "Slow response"
 				}
 			});
-		}, 1e3);
+		}, 1e3));
 	}));
 	await t.step("direct object fetch cancellation", async () => {
 		const controller = new AbortController();
@@ -155,6 +158,7 @@ test("lookupObject()", {
 		controller.abort();
 		deepStrictEqual(await promise, null);
 	});
+	for (const timer of responseTimers) clearTimeout(timer);
 	esm_default.hardReset();
 	esm_default.removeRoutes();
 });
@@ -392,15 +396,18 @@ test("FEP-fe34: lookupObject() cross-origin security", {
 			throw new Error(`Unexpected URL: ${url}`);
 		};
 		deepStrictEqual(await lookupObject("@user@example.com", {
+			...allowPrivateAddress,
 			documentLoader: webfingerDocumentLoader,
 			contextLoader: mockDocumentLoader
 		}), null);
 		await rejects(() => lookupObject("@user@example.com", {
+			...allowPrivateAddress,
 			documentLoader: webfingerDocumentLoader,
 			contextLoader: mockDocumentLoader,
 			crossOrigin: "throw"
 		}), Error, "The object's @id (https://malicious.com/fake-actor) has a different origin than the document URL (https://different-origin.com/actor)");
 		const result2 = await lookupObject("@user@example.com", {
+			...allowPrivateAddress,
 			documentLoader: webfingerDocumentLoader,
 			contextLoader: mockDocumentLoader,
 			crossOrigin: "trust"
@@ -471,11 +478,20 @@ test("FEP-fe34: lookupObject() cross-origin security", {
 		const errorDocumentLoader = async (_url) => {
 			throw new Error("Network error");
 		};
-		deepStrictEqual(await lookupObject("https://example.com/note", {
-			documentLoader: errorDocumentLoader,
-			contextLoader: mockDocumentLoader,
-			crossOrigin: "throw"
-		}), null);
+		esm_default.spyGlobal();
+		esm_default.get("begin:https://example.com/.well-known/webfinger", 404);
+		let result;
+		try {
+			result = await lookupObject("https://example.com/note", {
+				...allowPrivateAddress,
+				documentLoader: errorDocumentLoader,
+				contextLoader: mockDocumentLoader,
+				crossOrigin: "throw"
+			});
+		} finally {
+			esm_default.hardReset();
+		}
+		deepStrictEqual(result, null);
 	});
 	await t.step("malformed JSON handling with cross-origin policy", async () => {
 		const malformedJsonDocumentLoader = async (url) => {
@@ -540,6 +556,7 @@ test("lookupObject() records activitypub.object.lookup counter", {
 		await t.step("records kind=actor for an actor result", async () => {
 			const [meterProvider, recorder] = createTestMeterProvider();
 			assertInstanceOf(await lookupObject("@johndoe@example.com", {
+				...allowPrivateAddress,
 				documentLoader: mockDocumentLoader,
 				contextLoader: mockDocumentLoader,
 				meterProvider
@@ -593,6 +610,7 @@ test("lookupObject() records activitypub.object.lookup counter", {
 			});
 			const [meterProvider, recorder] = createTestMeterProvider();
 			deepStrictEqual(await lookupObject("janedoe@example.com", {
+				...allowPrivateAddress,
 				documentLoader: mockDocumentLoader,
 				contextLoader: mockDocumentLoader,
 				meterProvider
@@ -622,6 +640,7 @@ test("lookupObject() records activitypub.object.lookup counter", {
 			});
 			const [meterProvider, recorder] = createTestMeterProvider();
 			await lookupObject("@johndoe@example.com", {
+				...allowPrivateAddress,
 				documentLoader: mockDocumentLoader,
 				contextLoader: mockDocumentLoader,
 				meterProvider
@@ -643,6 +662,7 @@ test("lookupObject() records activitypub.object.lookup counter", {
 			});
 			const [meterProvider, recorder] = createTestMeterProvider();
 			await lookupObject(new URL("acct:johndoe@example.com"), {
+				...allowPrivateAddress,
 				documentLoader: mockDocumentLoader,
 				contextLoader: mockDocumentLoader,
 				meterProvider
@@ -665,5 +685,104 @@ test("lookupObject() records activitypub.object.lookup counter", {
 		esm_default.hardReset();
 	}
 });
+const OBSERVER_DID = "did:key:z6MkhVPuyvgG1RkMv67azDqDCDERPXVrUg1i3qchXY5EACE3";
+test("lookupObject() offers each candidate to the observer", async () => {
+	const note = {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/notes/1",
+		type: "Note",
+		content: "Hello"
+	};
+	const fetched = [];
+	const documentLoader = (url) => {
+		fetched.push(url);
+		if (url === "https://example.com/notes/1") return Promise.resolve({
+			contextUrl: null,
+			document: note,
+			documentUrl: "https://example.com/notes/1?redirected"
+		});
+		return Promise.reject(/* @__PURE__ */ new Error(`Not found: ${url}`));
+	};
+	const candidates = [];
+	const failures = [];
+	const accepted = await lookupObject("https://example.com/notes/1", {
+		documentLoader,
+		contextLoader: mockDocumentLoader,
+		[lookupObserver]: {
+			accept: (candidate) => {
+				candidates.push(candidate);
+				return Promise.resolve(true);
+			},
+			failed: (failure) => failures.push(failure)
+		}
+	});
+	ok(accepted instanceof Note);
+	equal(candidates.length, 1);
+	deepStrictEqual(candidates[0].document, note);
+	equal(candidates[0].documentUrl, "https://example.com/notes/1?redirected");
+	equal(candidates[0].baseUrl.href, "https://example.com/notes/1?redirected");
+	equal(candidates[0].object, accepted);
+	deepStrictEqual(failures, []);
+	for (const accept of [() => Promise.resolve(false), () => Promise.reject(/* @__PURE__ */ new Error("Oops"))]) {
+		const refusals = [];
+		equal(await lookupObject("https://example.com/notes/1", {
+			documentLoader,
+			contextLoader: mockDocumentLoader,
+			[lookupObserver]: {
+				accept,
+				failed: (f) => refusals.push(f)
+			}
+		}), null);
+		deepStrictEqual(refusals.map((f) => f.operation), ["accept"]);
+	}
+	fetched.length = 0;
+	const missing = [];
+	equal(await lookupObject("https://example.com/notes/2", {
+		documentLoader,
+		contextLoader: mockDocumentLoader,
+		[lookupObserver]: {
+			webFinger: false,
+			failed: (f) => missing.push(f)
+		}
+	}), null);
+	deepStrictEqual(fetched, ["https://example.com/notes/2"]);
+	deepStrictEqual(missing.map((f) => f.operation), ["fetch"]);
+});
+test("lookupObject() keeps looking after the observer refuses a portable candidate", async () => {
+	const id = `ap://${OBSERVER_DID}/notes/1`;
+	const gateways = ["https://gw1.example", "https://gw2.example"];
+	const documentLoader = (url) => Promise.resolve({
+		contextUrl: null,
+		document: {
+			"@context": "https://www.w3.org/ns/activitystreams",
+			id,
+			type: "Note",
+			content: url.startsWith("https://gw1.example/") ? "first" : "second"
+		},
+		documentUrl: url
+	});
+	const verifier = () => Promise.resolve({ verified: true });
+	const offered = [];
+	const failures = [];
+	const object = await lookupObject(id, {
+		documentLoader,
+		contextLoader: mockDocumentLoader,
+		gateways,
+		verifyPortableObject: verifier,
+		[lookupObserver]: {
+			accept: (candidate) => {
+				offered.push(candidate.documentUrl);
+				return Promise.resolve(offered.length > 1);
+			},
+			failed: (failure) => failures.push(failure)
+		}
+	});
+	ok(object instanceof Note);
+	equal(object.content, "second");
+	equal(offered.length, 2);
+	ok(offered[0].startsWith("https://gw1.example/"));
+	ok(offered[1].startsWith("https://gw2.example/"));
+	deepStrictEqual(failures.map((f) => f.operation), ["accept"]);
+});
 //#endregion
 export {};

package/dist-tests/portable-lookup.test.mjs

@@ -1,14 +1,15 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { F as Person } from "./vocab-jHKm_LJ6.mjs";
-import { t as esm_default } from "./esm-DtAfYdqR.mjs";
-import { n as getActorHandle } from "./actor-C89Bex4F.mjs";
-import { t as lookupObject } from "./lookup-BehNGq4X.mjs";
+import { t as esm_default } from "./esm-BIqRhjGA.mjs";
+import { n as getActorHandle } from "./actor-BjUFWXfi.mjs";
+import { F as Person } from "./vocab-BMEyHiOV.mjs";
+import { t as lookupObject } from "./lookup-BQqIkZ5j.mjs";
 import { t as assertInstanceOf } from "./utils-Df2odC27.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, equal, rejects } from "node:assert/strict";
 import { FetchError, parseIri } from "@fedify/vocab-runtime";
 //#region src/portable-lookup.test.ts
+const allowPrivateAddress = { allowPrivateAddress: true };
 const did = "did:key:z6Mkabc";
 const actorId = `ap+ef61://${did}/actor`;
 const gatewayPath = `/.well-known/apgateway/${did}/actor`;
@@ -72,6 +73,7 @@ test("lookupObject() with FEP-ef61 portable actors", {
 			const actor = await lookupObject("@alice@example.com", {
 				documentLoader,
 				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress,
 				verifyPortableObject
 			});
 			assertInstanceOf(actor, Person);
@@ -94,6 +96,7 @@ test("lookupObject() with FEP-ef61 portable actors", {
 			assertInstanceOf(await lookupObject("@alice@example.com", {
 				documentLoader,
 				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress,
 				verifyPortableObject: createVerifier()
 			}), Person);
 			deepStrictEqual(documentLoader.fetched, [compatibleId, hinted]);
@@ -106,6 +109,7 @@ test("lookupObject() with FEP-ef61 portable actors", {
 			assertInstanceOf(await lookupObject("@alice@example.com", {
 				documentLoader,
 				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress,
 				verifyPortableObject: createVerifier(),
 				gateways: ["https://second.example"]
 			}), Person);
@@ -118,6 +122,7 @@ test("lookupObject() with FEP-ef61 portable actors", {
 			equal(await lookupObject("@alice@example.com", {
 				documentLoader,
 				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress,
 				verifyPortableObject: createVerifier(),
 				gateways: Array.from({ length: 6 }, (_, i) => `https://g${i}.example`)
 			}), null);
@@ -136,6 +141,7 @@ test("lookupObject() with FEP-ef61 portable actors", {
 			assertInstanceOf(await lookupObject("@alice@example.com", {
 				documentLoader,
 				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress,
 				verifyPortableObject: createVerifier()
 			}), Person);
 			deepStrictEqual(documentLoader.fetched, [compatibleId, other]);
@@ -149,6 +155,7 @@ test("lookupObject() with FEP-ef61 portable actors", {
 			const actor = await lookupObject("@alice@example.com", {
 				documentLoader,
 				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress,
 				verifyPortableObject
 			});
 			assertInstanceOf(actor, Person);
@@ -169,18 +176,21 @@ test("lookupObject() with FEP-ef61 portable actors", {
 				equal(await lookupObject("@alice@example.com", {
 					documentLoader,
 					contextLoader: mockDocumentLoader,
+					...allowPrivateAddress,
 					verifyPortableObject
 				}), null);
 				deepStrictEqual(documentLoader.fetched, [compatibleId]);
 				await rejects(() => lookupObject("@alice@example.com", {
 					documentLoader,
 					contextLoader: mockDocumentLoader,
+					...allowPrivateAddress,
 					verifyPortableObject,
 					crossOrigin: "throw"
 				}), { name: "PortableObjectRejectedError" });
 				equal(await lookupObject("@alice@example.com", {
 					documentLoader,
 					contextLoader: mockDocumentLoader,
+					...allowPrivateAddress,
 					verifyPortableObject,
 					crossOrigin: "trust"
 				}), null);
@@ -193,17 +203,20 @@ test("lookupObject() with FEP-ef61 portable actors", {
 			for (const crossOrigin of ["ignore", "trust"]) equal(await lookupObject("@alice@example.com", {
 				documentLoader,
 				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress,
 				crossOrigin
 			}), null);
 			deepStrictEqual(documentLoader.fetched, [compatibleId, compatibleId]);
 			await rejects(() => lookupObject("@alice@example.com", {
 				documentLoader,
 				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress,
 				crossOrigin: "throw"
 			}), /has a different origin than the document URL/);
 			const actor = await lookupObject("@alice@example.com", {
 				documentLoader: createLoader({ [compatibleId]: person(compatibleId) }),
-				contextLoader: mockDocumentLoader
+				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress
 			});
 			assertInstanceOf(actor, Person);
 			deepStrictEqual(actor.id, new URL(compatibleId));
@@ -211,7 +224,8 @@ test("lookupObject() with FEP-ef61 portable actors", {
 			const ordinaryLoader = createLoader({ [malformed]: person(malformed) });
 			assertInstanceOf(await lookupObject(malformed, {
 				documentLoader: ordinaryLoader,
-				contextLoader: mockDocumentLoader
+				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress
 			}), Person);
 			deepStrictEqual(ordinaryLoader.fetched, [malformed]);
 		});
@@ -222,6 +236,7 @@ test("lookupObject() with FEP-ef61 portable actors", {
 			const options = {
 				documentLoader,
 				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress,
 				verifyPortableObject: createVerifier()
 			};
 			equal(await lookupObject("@alice@example.com", options), null);
@@ -235,6 +250,7 @@ test("lookupObject() with FEP-ef61 portable actors", {
 			const options = {
 				documentLoader,
 				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress,
 				verifyPortableObject: createVerifier()
 			};
 			equal(await lookupObject(dotted, options), null);
@@ -250,6 +266,7 @@ test("lookupObject() with FEP-ef61 portable actors", {
 			equal(await lookupObject("@alice@example.com", {
 				documentLoader,
 				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress,
 				verifyPortableObject: createVerifier()
 			}), null);
 			deepStrictEqual(documentLoader.fetched, [compatibleId, ...[
@@ -271,6 +288,7 @@ test("lookupObject() with FEP-ef61 portable actors", {
 			equal(await lookupObject("@alice@example.com", {
 				documentLoader,
 				contextLoader: mockDocumentLoader,
+				...allowPrivateAddress,
 				verifyPortableObject,
 				signal: controller.signal
 			}), null);
@@ -405,12 +423,18 @@ test("getActorHandle() with FEP-ef61 portable actors", {
 		await t.step("verified through the first gateway", async () => {
 			esm_default.removeRoutes();
 			esm_default.get("https://example.com/.well-known/webfinger?resource=acct%3Aalice%40example.com", selfLinks(compatibleId));
-			deepStrictEqual(await getActorHandle(actor), "@alice@example.com");
+			deepStrictEqual(await getActorHandle(actor, {
+				...allowPrivateAddress,
+				userAgent: void 0
+			}), "@alice@example.com");
 		});
 		await t.step("canonical self link", async () => {
 			esm_default.removeRoutes();
 			esm_default.get(webFingerPrefix, selfLinks(`ap://${did}/actor`));
-			deepStrictEqual(await getActorHandle(actor), "@alice@example.com");
+			deepStrictEqual(await getActorHandle(actor, {
+				...allowPrivateAddress,
+				userAgent: void 0
+			}), "@alice@example.com");
 		});
 		await t.step("follows a verified subject", async () => {
 			esm_default.removeRoutes();
@@ -422,14 +446,20 @@ test("getActorHandle() with FEP-ef61 portable actors", {
 				...selfLinks(compatibleId),
 				subject: "acct:alice@example.org"
 			});
-			deepStrictEqual(await getActorHandle(actor), "@alice@example.org");
+			deepStrictEqual(await getActorHandle(actor, {
+				...allowPrivateAddress,
+				userAgent: void 0
+			}), "@alice@example.org");
 			esm_default.removeRoutes();
 			esm_default.get(webFingerPrefix, {
 				...selfLinks(compatibleId),
 				subject: "acct:alice@example.org"
 			});
 			esm_default.get("begin:https://example.org/.well-known/webfinger", selfLinks(`ap://${did}/other`));
-			deepStrictEqual(await getActorHandle(actor), "@alice@example.com");
+			deepStrictEqual(await getActorHandle(actor, {
+				...allowPrivateAddress,
+				userAgent: void 0
+			}), "@alice@example.com");
 		});
 		await t.step("rejects a WebFinger response for another actor", async () => {
 			for (const jrd of [
@@ -442,13 +472,19 @@ test("getActorHandle() with FEP-ef61 portable actors", {
 			]) {
 				esm_default.removeRoutes();
 				esm_default.get(webFingerPrefix, jrd);
-				await rejects(() => getActorHandle(actor), TypeError);
+				await rejects(() => getActorHandle(actor, {
+					...allowPrivateAddress,
+					userAgent: void 0
+				}), TypeError);
 			}
 		});
 		await t.step("does not fall back when WebFinger fails", async () => {
 			esm_default.removeRoutes();
 			esm_default.get(webFingerPrefix, 404);
-			await rejects(() => getActorHandle(actor), TypeError);
+			await rejects(() => getActorHandle(actor, {
+				...allowPrivateAddress,
+				userAgent: void 0
+			}), TypeError);
 		});
 		await t.step("not enough information", async () => {
 			esm_default.removeRoutes();
@@ -463,7 +499,10 @@ test("getActorHandle() with FEP-ef61 portable actors", {
 					id: parseIri(actorId),
 					gateways: [new URL("https://example.com")]
 				})
-			]) await rejects(() => getActorHandle(target), TypeError);
+			]) await rejects(() => getActorHandle(target, {
+				...allowPrivateAddress,
+				userAgent: void 0
+			}), TypeError);
 			deepStrictEqual(esm_default.callHistory.calls().length, 0);
 		});
 	} finally {

package/dist-tests/rolldown-runtime-BWJg4WE8.mjs

@@ -0,0 +1,37 @@
+import "temporal-polyfill";
+globalThis.addEventListener = () => {};
+import { createRequire } from "node:module";
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
+//#endregion
+export { __toESM as i, __exportAll as n, __require as r, __commonJSMin as t };

package/dist-tests/signed-representation.test.mjs

@@ -1,6 +1,6 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { M as OrderedCollection, Z as vocab_exports, i as Announce, k as Note, u as Create, z as Question } from "./vocab-jHKm_LJ6.mjs";
+import { M as OrderedCollection, Z as vocab_exports, i as Announce, k as Note, u as Create, z as Question } from "./vocab-BMEyHiOV.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, ok } from "node:assert/strict";
 import { isMarkerSafeContext, retainSignedRepresentation } from "@fedify/vocab-runtime/internal/signed-representation";

package/dist-tests/{src-fpZm9WyF.mjs → src-DQiQQv6h.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import "./vocab-jHKm_LJ6.mjs";
-import "./actor-C89Bex4F.mjs";
-import "./lookup-BehNGq4X.mjs";
+import "./actor-BjUFWXfi.mjs";
+import "./vocab-BMEyHiOV.mjs";
+import "./lookup-BQqIkZ5j.mjs";
 import { LanguageString as LanguageString$1 } from "@fedify/vocab-runtime";
 new URL("https://www.w3.org/ns/activitystreams#Public");
 //#endregion

package/dist-tests/translation.test.mjs

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { A as Object$1, E as Link, F as Person, K as Translation, L as PropertyValue, P as Organization, U as Service, a as Application, b as Group, k as Note, o as Article, q as Update, s as Collection, u as Create } from "./vocab-jHKm_LJ6.mjs";
-import { t as LanguageString$1 } from "./src-fpZm9WyF.mjs";
+import { A as Object$1, E as Link, F as Person, K as Translation, L as PropertyValue, P as Organization, U as Service, a as Application, b as Group, k as Note, o as Article, q as Update, s as Collection, u as Create } from "./vocab-BMEyHiOV.mjs";
+import { t as LanguageString$1 } from "./src-DQiQQv6h.mjs";
 import { test } from "@fedify/fixture";
 import { deepStrictEqual, ok, rejects } from "node:assert/strict";
 import { getDocumentLoader, preloadedContexts } from "@fedify/vocab-runtime";