Split identifier path validation into loose and strict asserts

`validateSingleIdentifierVariablePath` was applied to every setter
that takes a single-identifier path, which tightened upstream's
inline `variables.size!==1 || !variables.has("identifier")` check
into a stricter one that also rejected the named operators
(`{+identifier}`, `{?identifier}`, etc.) and any explode/prefix
modifier.  That restriction only matched the runtime behaviour the
outbox setters historically required; the other eight setters
preserved the looser upstream rule and the TS signatures already
allowed `Rfc6570Expression<"identifier">`.

Split the helper:

  -  `assertIdentifierPath` keeps the upstream rule (one variable
     named `identifier`, any operator).
  -  `assertStrictIdentifierPath` layers the operator/explode/prefix
     guard on top by calling `assertIdentifierPath` first.

Both helpers carry an `asserts path is Path` predicate so callers
get the `Path` narrowing automatically.  Apply
`assertStrictIdentifierPath` to setOutboxDispatcher and
setOutboxListeners (the two setters upstream already routed through
the strict centralized validator) and `assertIdentifierPath`
everywhere else.  All existing "wrong variables in path" tests pass.

Addresses the type-vs-runtime mismatch flagged by CodeRabbit in
#758 (2026-05-11).

Assisted-by: Claude Opus 4.7 (1M context)

Author: 2chanhaeng

packages/fedify/src/federation/builder.ts

@@ -71,15 +71,23 @@ import type {
 
 export const ACTOR_ALIAS_PREFIX = "actorAlias:";
 
-function validateSingleIdentifierVariablePath(
+function assertIdentifierPath(
   path: string,
   errorMessage: string,
-): void {
+): asserts path is Path {
   assertPath(path);
-  const pattern = Router.compile(path);
-  if (pattern.variables.size !== 1 || !pattern.variables.has("identifier")) {
+  const variables = Router.variables(path);
+  if (variables.size !== 1 || !variables.has("identifier")) {
     throw new RouterError(errorMessage);
   }
+}
+
+function assertStrictIdentifierPath(
+  path: string,
+  errorMessage: string,
+): asserts path is Path {
+  assertIdentifierPath(path, errorMessage);
+  const pattern = Router.compile(path);
   const expressions = pattern.template.tokens
     .filter(isExpression)
     .filter((token) => token.vars.some(({ name }) => name === "identifier"));
@@ -258,7 +266,7 @@ export class FederationBuilderImpl<TContextData>
     if (this.router.has("actor")) {
       throw new RouterError("Actor dispatcher already set.");
     }
-    validateSingleIdentifierVariablePath(
+    assertIdentifierPath(
       path,
       "Path for actor dispatcher must have one variable: {identifier}",
     );
@@ -716,7 +724,7 @@ export class FederationBuilderImpl<TContextData>
         );
       }
     } else {
-      validateSingleIdentifierVariablePath(
+      assertIdentifierPath(
         path,
         "Path for inbox dispatcher must have one variable: {identifier}",
       );
@@ -790,7 +798,7 @@ export class FederationBuilderImpl<TContextData>
         );
       }
     } else {
-      validateSingleIdentifierVariablePath(
+      assertStrictIdentifierPath(
         path,
         "Path for outbox dispatcher must have one variable: {identifier}",
       );
@@ -854,7 +862,7 @@ export class FederationBuilderImpl<TContextData>
         );
       }
     } else {
-      validateSingleIdentifierVariablePath(
+      assertStrictIdentifierPath(
         outboxPath,
         "Path for outbox must have one variable: {identifier}",
       );
@@ -905,7 +913,7 @@ export class FederationBuilderImpl<TContextData>
     if (this.router.has("following")) {
       throw new RouterError("Following collection dispatcher already set.");
     }
-    validateSingleIdentifierVariablePath(
+    assertIdentifierPath(
       path,
       "Path for following collection dispatcher must have one variable: " +
         "{identifier}",
@@ -967,7 +975,7 @@ export class FederationBuilderImpl<TContextData>
     if (this.router.has("followers")) {
       throw new RouterError("Followers collection dispatcher already set.");
     }
-    validateSingleIdentifierVariablePath(
+    assertIdentifierPath(
       path,
       "Path for followers collection dispatcher must have one variable: " +
         "{identifier}",
@@ -1025,7 +1033,7 @@ export class FederationBuilderImpl<TContextData>
     if (this.router.has("liked")) {
       throw new RouterError("Liked collection dispatcher already set.");
     }
-    validateSingleIdentifierVariablePath(
+    assertIdentifierPath(
       path,
       "Path for liked collection dispatcher must have one variable: " +
         "{identifier}",
@@ -1091,7 +1099,7 @@ export class FederationBuilderImpl<TContextData>
     if (this.router.has("featured")) {
       throw new RouterError("Featured collection dispatcher already set.");
     }
-    validateSingleIdentifierVariablePath(
+    assertIdentifierPath(
       path,
       "Path for featured collection dispatcher must have one variable: " +
         "{identifier}",
@@ -1157,7 +1165,7 @@ export class FederationBuilderImpl<TContextData>
     if (this.router.has("featuredTags")) {
       throw new RouterError("Featured tags collection dispatcher already set.");
     }
-    validateSingleIdentifierVariablePath(
+    assertIdentifierPath(
       path,
       "Path for featured tags collection dispatcher must have one " +
         "variable: {identifier}",
@@ -1221,7 +1229,7 @@ export class FederationBuilderImpl<TContextData>
         );
       }
     } else {
-      validateSingleIdentifierVariablePath(
+      assertIdentifierPath(
         inboxPath,
         "Path for inbox must have one variable: {identifier}",
       );