@fedify/fedify 1.9.0-dev.1613 → 1.9.0-dev.1689

package/dist/{vocab-BVOFD7iz.js → vocab-DdTdRfBW.js}

@@ -2,9 +2,9 @@
           import { Temporal } from "@js-temporal/polyfill";
           import { URLPattern } from "urlpattern-polyfill";
         
-import { deno_default, getDocumentLoader } from "./docloader-CB-b64F8.js";
-import { Object as Object$1, getTypeId } from "./actor-BrhPUG_N.js";
-import { lookupWebFinger } from "./lookup-DADsKd8V.js";
+import { deno_default, getDocumentLoader } from "./docloader-DyvW1gbN.js";
+import { Object as Object$1, getTypeId } from "./actor-Dpkqj5Dv.js";
+import { lookupWebFinger } from "./lookup-WoJkw8wY.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { delay } from "es-toolkit";
@@ -152,14 +152,13 @@ async function lookupObject(identifier, options = {}) {
 async function lookupObjectInternal(identifier, options = {}) {
 	const documentLoader = options.documentLoader ?? getDocumentLoader({ userAgent: options.userAgent });
 	if (typeof identifier === "string") identifier = toAcctUrl(identifier) ?? new URL(identifier);
-	let document = null;
+	let remoteDoc = null;
 	if (identifier.protocol === "http:" || identifier.protocol === "https:") try {
-		const remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
-		document = remoteDoc.document;
+		remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
 	} catch (error) {
 		logger.debug("Failed to fetch remote document:\n{error}", { error });
 	}
-	if (document == null) {
+	if (remoteDoc == null) {
 		const jrd = await lookupWebFinger(identifier, {
 			userAgent: options.userAgent,
 			tracerProvider: options.tracerProvider,
@@ -170,8 +169,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 		for (const l of jrd.links) {
 			if (l.type !== "application/activity+json" && !l.type?.match(/application\/ld\+json;\s*profile="https:\/\/www.w3.org\/ns\/activitystreams"/) || l.rel !== "self" || l.href == null) continue;
 			try {
-				const remoteDoc = await documentLoader(l.href, { signal: options.signal });
-				document = remoteDoc.document;
+				remoteDoc = await documentLoader(l.href, { signal: options.signal });
 				break;
 			} catch (error) {
 				logger.debug("Failed to fetch remote document:\n{error}", { error });
@@ -179,23 +177,34 @@ async function lookupObjectInternal(identifier, options = {}) {
 			}
 		}
 	}
-	if (document == null) return null;
+	if (remoteDoc == null) return null;
+	let object;
 	try {
-		return await Object$1.fromJsonLd(document, {
+		object = await Object$1.fromJsonLd(remoteDoc.document, {
 			documentLoader,
 			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider
+			tracerProvider: options.tracerProvider,
+			baseUrl: new URL(remoteDoc.documentUrl)
 		});
 	} catch (error) {
 		if (error instanceof TypeError) {
 			logger.debug("Failed to parse JSON-LD document: {error}\n{document}", {
-				error,
-				document
+				...remoteDoc,
+				error
 			});
 			return null;
 		}
 		throw error;
 	}
+	if (options.crossOrigin !== "trust" && object.id != null && object.id.origin !== new URL(remoteDoc.documentUrl).origin) {
+		if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
+		logger.warn("The object's @id ({objectId}) has a different origin than the document URL ({documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to \"trust\".", {
+			...remoteDoc,
+			objectId: object.id.href
+		});
+		return null;
+	}
+	return object;
 }
 /**
 * Traverses a collection, yielding each item in the collection.

package/dist/webfinger/handler.test.js

@@ -3,30 +3,30 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { Image, Link, Person } from "../type-Bm9mdHQS.js";
+import { Image, Link, Person } from "../type-BCazg_Pu.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
 import { MemoryKvStore } from "../kv-CRZrzyXm.js";
-import { createFederation, handleWebFinger } from "../middleware-B1iLu-jg.js";
+import { createFederation, handleWebFinger } from "../middleware-CjgR6ayA.js";
 import "../semver-dArNLkR9.js";
-import "../client-CkjMau5E.js";
-import "../lookup-BkaLctZw.js";
+import "../client-BoUqciR8.js";
+import "../lookup-y6-PEpxS.js";
 import "../types-BIgY6c-l.js";
-import "../actor-Do9KG1O2.js";
-import "../key-CN1jS3_Y.js";
-import "../http-zgzZkO8A.js";
-import "../authdocloader-D_pDyzSu.js";
-import "../ld-o8aGatC0.js";
-import "../owner-qeK3HiL9.js";
-import "../proof-0MIJ70kC.js";
-import "../inbox-CirfyLns.js";
-import "../builder-CwFGbC7w.js";
+import "../actor-DzdLVqkJ.js";
+import "../key-C25gGlmV.js";
+import "../http-C7nvEG1N.js";
+import "../authdocloader-DdSBpn11.js";
+import "../ld-WZpO-MzE.js";
+import "../owner-CPBOVM7l.js";
+import "../proof-h0JvKPRP.js";
+import "../inbox-DZNE3Jtq.js";
+import "../builder-BR--hcb8.js";
 import "../collection-CSzG2j1P.js";
-import "../keycache-COrk8-eB.js";
+import "../keycache-CoMI1L_W.js";
 import "../retry-D4GJ670a.js";
-import "../send-CuL-kYv7.js";
-import { createRequestContext, test } from "../testing-Did3bCyV.js";
+import "../send-CD-m2vwX.js";
+import { createRequestContext, test } from "../testing-DvTABhvG.js";
 import "../std__assert-X-_kMxKM.js";
 import "../assert_rejects-DiIiJbZn.js";
 import "../assert_is_error-BPGph1Jx.js";

package/dist/webfinger/lookup.test.js

@@ -3,18 +3,18 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { lookupWebFinger } from "../type-Bm9mdHQS.js";
+import { lookupWebFinger } from "../type-BCazg_Pu.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-BkaLctZw.js";
-import { test } from "../testing-Did3bCyV.js";
+import "../lookup-y6-PEpxS.js";
+import { test } from "../testing-DvTABhvG.js";
 import "../std__assert-X-_kMxKM.js";
 import "../assert_rejects-DiIiJbZn.js";
 import "../assert_is_error-BPGph1Jx.js";
 import "../assert_not_equals-f3m3epl3.js";
 import "../assert_throws-BOO88avQ.js";
-import { esm_default } from "../esm-BeBLf_np.js";
+import { esm_default } from "../esm-DMb2eQXG.js";
 import { withTimeout } from "es-toolkit";
 
 //#region src/webfinger/lookup.test.ts

package/dist/webfinger/mod.cjs

@@ -2,8 +2,8 @@
           const { Temporal } = require("@js-temporal/polyfill");
           const { URLPattern } = require("urlpattern-polyfill");
         
-require('../docloader-CCo7N8E2.cjs');
-const require_lookup = require('../lookup-CwHCSBI8.cjs');
+require('../docloader-Bui9z8Lb.cjs');
+const require_lookup = require('../lookup-D_w567L8.cjs');
 require('../webfinger-BjOEdFPs.cjs');
 
 exports.lookupWebFinger = require_lookup.lookupWebFinger;

package/dist/webfinger/mod.js

@@ -2,8 +2,8 @@
           import { Temporal } from "@js-temporal/polyfill";
           import { URLPattern } from "urlpattern-polyfill";
         
-import "../docloader-CB-b64F8.js";
-import { lookupWebFinger } from "../lookup-DADsKd8V.js";
+import "../docloader-DyvW1gbN.js";
+import { lookupWebFinger } from "../lookup-WoJkw8wY.js";
 import "../webfinger-De_bU0iE.js";
 
 export { lookupWebFinger };

package/dist/x/cfworkers.test.js

@@ -3,12 +3,12 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import "../type-Bm9mdHQS.js";
+import "../type-BCazg_Pu.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-BkaLctZw.js";
-import { test } from "../testing-Did3bCyV.js";
+import "../lookup-y6-PEpxS.js";
+import { test } from "../testing-DvTABhvG.js";
 import "../std__assert-X-_kMxKM.js";
 import "../assert_rejects-DiIiJbZn.js";
 import "../assert_is_error-BPGph1Jx.js";

package/dist/x/hono.d.cts

@@ -1,13 +1,13 @@
 import "../kv-63Cil1MD.cjs";
 import "../docloader-D-MrRyHl.cjs";
 import "../client-DjT_tegg.cjs";
-import "../vocab-BzGg7ltX.cjs";
-import "../actor-CHOM_AN3.cjs";
-import "../http-B_zBcsai.cjs";
-import "../owner-C9Ry0TOI.cjs";
-import "../mod-NKH_G-IY.cjs";
+import "../vocab-Cfs0937i.cjs";
+import "../actor-Ydzhc8dj.cjs";
+import "../http-B1_DzfAU.cjs";
+import "../owner-6KSEp9eV.cjs";
+import "../mod-BUbqxBev.cjs";
 import "../mod-jQ4OODsl.cjs";
-import { Federation } from "../context-KXVF2AhH.cjs";
+import { Federation } from "../context-DCh96LcF.cjs";
 import "../mq-B7R1Q-M5.cjs";
 
 //#region src/x/hono.d.ts

package/dist/x/hono.d.ts

@@ -3,13 +3,13 @@ import { URLPattern } from "urlpattern-polyfill";
 import "../kv-C7sopW2E.js";
 import "../docloader-CxWcuWqQ.js";
 import "../client-DF8anIB5.js";
-import "../vocab-BEEm2I6u.js";
-import "../actor-Ch5yFYFG.js";
-import "../http-D8Q4xH0d.js";
-import "../owner-D38zBIMc.js";
-import "../mod-Cy6pkZSn.js";
+import "../vocab-CDHNj5zp.js";
+import "../actor-C1Euqngb.js";
+import "../http-wsGR6KkT.js";
+import "../owner-BbeUDvOu.js";
+import "../mod-CDObsV1d.js";
 import "../mod-DBzN0aCM.js";
-import { Federation } from "../context-DFruNLny.js";
+import { Federation } from "../context-CZorAkt8.js";
 import "../mq-CRGm1e_F.js";
 
 //#region src/x/hono.d.ts

package/dist/x/sveltekit.d.cts

@@ -1,13 +1,13 @@
 import "../kv-63Cil1MD.cjs";
 import "../docloader-D-MrRyHl.cjs";
 import "../client-DjT_tegg.cjs";
-import "../vocab-BzGg7ltX.cjs";
-import "../actor-CHOM_AN3.cjs";
-import "../http-B_zBcsai.cjs";
-import "../owner-C9Ry0TOI.cjs";
-import "../mod-NKH_G-IY.cjs";
+import "../vocab-Cfs0937i.cjs";
+import "../actor-Ydzhc8dj.cjs";
+import "../http-B1_DzfAU.cjs";
+import "../owner-6KSEp9eV.cjs";
+import "../mod-BUbqxBev.cjs";
 import "../mod-jQ4OODsl.cjs";
-import { Federation } from "../context-KXVF2AhH.cjs";
+import { Federation } from "../context-DCh96LcF.cjs";
 import "../mq-B7R1Q-M5.cjs";
 
 //#region src/x/sveltekit.d.ts

package/dist/x/sveltekit.d.ts

@@ -3,13 +3,13 @@ import { URLPattern } from "urlpattern-polyfill";
 import "../kv-C7sopW2E.js";
 import "../docloader-CxWcuWqQ.js";
 import "../client-DF8anIB5.js";
-import "../vocab-BEEm2I6u.js";
-import "../actor-Ch5yFYFG.js";
-import "../http-D8Q4xH0d.js";
-import "../owner-D38zBIMc.js";
-import "../mod-Cy6pkZSn.js";
+import "../vocab-CDHNj5zp.js";
+import "../actor-C1Euqngb.js";
+import "../http-wsGR6KkT.js";
+import "../owner-BbeUDvOu.js";
+import "../mod-CDObsV1d.js";
 import "../mod-DBzN0aCM.js";
-import { Federation } from "../context-DFruNLny.js";
+import { Federation } from "../context-CZorAkt8.js";
 import "../mq-CRGm1e_F.js";
 
 //#region src/x/sveltekit.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "1.9.0-dev.1613+a3d15523",
+  "version": "1.9.0-dev.1689+cbc8aca7",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",

package/dist/key-BSapRu6X.cjs

@@ -1,10 +0,0 @@
-
-          const { Temporal } = require("@js-temporal/polyfill");
-          const { URLPattern } = require("urlpattern-polyfill");
-        
-require('./docloader-CCo7N8E2.cjs');
-require('./actor-BkOvltE1.cjs');
-require('./lookup-CwHCSBI8.cjs');
-const require_key = require('./key-4EZXrjJw.cjs');
-
-exports.validateCryptoKey = require_key.validateCryptoKey;

package/dist/middleware-3K0jP9Du.js

@@ -1,26 +0,0 @@
-
-      import { Temporal } from "@js-temporal/polyfill";
-      import { URLPattern } from "urlpattern-polyfill";
-      globalThis.addEventListener = () => {};
-    
-import "./type-Bm9mdHQS.js";
-import { ContextImpl, FederationImpl, InboxContextImpl, KvSpecDeterminer, createFederation } from "./middleware-B1iLu-jg.js";
-import "./semver-dArNLkR9.js";
-import "./client-CkjMau5E.js";
-import "./lookup-BkaLctZw.js";
-import "./types-BIgY6c-l.js";
-import "./actor-Do9KG1O2.js";
-import "./key-CN1jS3_Y.js";
-import "./http-zgzZkO8A.js";
-import "./authdocloader-D_pDyzSu.js";
-import "./ld-o8aGatC0.js";
-import "./owner-qeK3HiL9.js";
-import "./proof-0MIJ70kC.js";
-import "./inbox-CirfyLns.js";
-import "./builder-CwFGbC7w.js";
-import "./collection-CSzG2j1P.js";
-import "./keycache-COrk8-eB.js";
-import "./retry-D4GJ670a.js";
-import "./send-CuL-kYv7.js";
-
-export { FederationImpl };

package/dist/middleware-CZyWbiwd.js

@@ -1,17 +0,0 @@
-
-          import { Temporal } from "@js-temporal/polyfill";
-          import { URLPattern } from "urlpattern-polyfill";
-        
-import "./transformers-BFT6d7J5.js";
-import "./docloader-CB-b64F8.js";
-import "./actor-BrhPUG_N.js";
-import { ContextImpl, FederationImpl, InboxContextImpl, KvSpecDeterminer, createFederation } from "./middleware-CuCsnDA9.js";
-import "./lookup-DADsKd8V.js";
-import "./key-Dq2ZV4ZW.js";
-import "./http-CmDy8xoP.js";
-import "./proof-BSqN3lwx.js";
-import "./types-B9ZmKzEm.js";
-import "./authdocloader-CF0X5NR7.js";
-import "./vocab-BVOFD7iz.js";
-
-export { FederationImpl };

package/dist/middleware-T8MY-txY.cjs

@@ -1,17 +0,0 @@
-
-          const { Temporal } = require("@js-temporal/polyfill");
-          const { URLPattern } = require("urlpattern-polyfill");
-        
-require('./transformers-CoBS-oFG.cjs');
-require('./docloader-CCo7N8E2.cjs');
-require('./actor-BkOvltE1.cjs');
-const require_middleware = require('./middleware-BcqldfgB.cjs');
-require('./lookup-CwHCSBI8.cjs');
-require('./key-4EZXrjJw.cjs');
-require('./http-DpcYXIiB.cjs');
-require('./proof-DasSZLsd.cjs');
-require('./types-DF88bXyE.cjs');
-require('./authdocloader-lcfCE1vG.cjs');
-require('./vocab-DFyEBhSA.cjs');
-
-exports.FederationImpl = require_middleware.FederationImpl;