@fedify/fedify 1.9.0-dev.1668 → 1.9.0-dev.1704

package/dist/{vocab-WpDLcZH7.js → vocab-DxoBe7PI.js}

@@ -2,9 +2,9 @@
           import { Temporal } from "@js-temporal/polyfill";
           import { URLPattern } from "urlpattern-polyfill";
         
-import { deno_default, getDocumentLoader } from "./docloader-Bqh-eFNP.js";
-import { Object as Object$1, getTypeId } from "./actor-ChSW_rBk.js";
-import { lookupWebFinger } from "./lookup-B61sZAOY.js";
+import { deno_default, getDocumentLoader } from "./docloader-isD0ntZv.js";
+import { Object as Object$1, getTypeId } from "./actor-B0LpLKRw.js";
+import { lookupWebFinger } from "./lookup-BBTRFcU5.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { delay } from "es-toolkit";
@@ -152,14 +152,13 @@ async function lookupObject(identifier, options = {}) {
 async function lookupObjectInternal(identifier, options = {}) {
 	const documentLoader = options.documentLoader ?? getDocumentLoader({ userAgent: options.userAgent });
 	if (typeof identifier === "string") identifier = toAcctUrl(identifier) ?? new URL(identifier);
-	let document = null;
+	let remoteDoc = null;
 	if (identifier.protocol === "http:" || identifier.protocol === "https:") try {
-		const remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
-		document = remoteDoc.document;
+		remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
 	} catch (error) {
 		logger.debug("Failed to fetch remote document:\n{error}", { error });
 	}
-	if (document == null) {
+	if (remoteDoc == null) {
 		const jrd = await lookupWebFinger(identifier, {
 			userAgent: options.userAgent,
 			tracerProvider: options.tracerProvider,
@@ -170,8 +169,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 		for (const l of jrd.links) {
 			if (l.type !== "application/activity+json" && !l.type?.match(/application\/ld\+json;\s*profile="https:\/\/www.w3.org\/ns\/activitystreams"/) || l.rel !== "self" || l.href == null) continue;
 			try {
-				const remoteDoc = await documentLoader(l.href, { signal: options.signal });
-				document = remoteDoc.document;
+				remoteDoc = await documentLoader(l.href, { signal: options.signal });
 				break;
 			} catch (error) {
 				logger.debug("Failed to fetch remote document:\n{error}", { error });
@@ -179,23 +177,34 @@ async function lookupObjectInternal(identifier, options = {}) {
 			}
 		}
 	}
-	if (document == null) return null;
+	if (remoteDoc == null) return null;
+	let object;
 	try {
-		return await Object$1.fromJsonLd(document, {
+		object = await Object$1.fromJsonLd(remoteDoc.document, {
 			documentLoader,
 			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider
+			tracerProvider: options.tracerProvider,
+			baseUrl: new URL(remoteDoc.documentUrl)
 		});
 	} catch (error) {
 		if (error instanceof TypeError) {
 			logger.debug("Failed to parse JSON-LD document: {error}\n{document}", {
-				error,
-				document
+				...remoteDoc,
+				error
 			});
 			return null;
 		}
 		throw error;
 	}
+	if (options.crossOrigin !== "trust" && object.id != null && object.id.origin !== new URL(remoteDoc.documentUrl).origin) {
+		if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
+		logger.warn("The object's @id ({objectId}) has a different origin than the document URL ({documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to \"trust\".", {
+			...remoteDoc,
+			objectId: object.id.href
+		});
+		return null;
+	}
+	return object;
 }
 /**
 * Traverses a collection, yielding each item in the collection.

package/dist/webfinger/handler.test.js

@@ -3,30 +3,30 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { Image, Link, Person } from "../type-BRNRL3aj.js";
+import { Image, Link, Person } from "../type-C5udJemk.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
 import { MemoryKvStore } from "../kv-CRZrzyXm.js";
-import { createFederation, handleWebFinger } from "../middleware-CyUVZG3t.js";
+import { createFederation, handleWebFinger } from "../middleware-Bcv0xCjs.js";
 import "../semver-dArNLkR9.js";
-import "../client-B8gJ1cw8.js";
-import "../lookup-CZBG-vCx.js";
+import "../client-BWusKCWF.js";
+import "../lookup-RINL4MOa.js";
 import "../types-BIgY6c-l.js";
-import "../actor-BHAPrCDB.js";
-import "../key-B27QtSbc.js";
-import "../http-BpAVdmaR.js";
-import "../authdocloader-CgrKtaQg.js";
-import "../ld-upnKn3yw.js";
-import "../owner-zvsMGYzc.js";
-import "../proof-BgKYSJ00.js";
-import "../inbox-BA9sYsBf.js";
-import "../builder-DI4-Kpdg.js";
+import "../actor-CQzdjHs3.js";
+import "../key-C5cRHj8g.js";
+import "../http-BiKoa3o_.js";
+import "../authdocloader-CzmsYrAn.js";
+import "../ld-BWADNtQr.js";
+import "../owner-QEQV9vx-.js";
+import "../proof-g2_9VhUQ.js";
+import "../inbox-CzGsgKH-.js";
+import "../builder-D2Oyy8AY.js";
 import "../collection-CSzG2j1P.js";
-import "../keycache-CiW2SvJu.js";
+import "../keycache-rO8ea311.js";
 import "../retry-D4GJ670a.js";
-import "../send-DlqdAGHP.js";
-import { createRequestContext, test } from "../testing-CAAJTPCt.js";
+import "../send-cTLNXtTp.js";
+import { createRequestContext, test } from "../testing-CNtyBr2m.js";
 import "../std__assert-X-_kMxKM.js";
 import "../assert_rejects-DiIiJbZn.js";
 import "../assert_is_error-BPGph1Jx.js";

package/dist/webfinger/lookup.test.js

@@ -3,18 +3,18 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { lookupWebFinger } from "../type-BRNRL3aj.js";
+import { lookupWebFinger } from "../type-C5udJemk.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-CZBG-vCx.js";
-import { test } from "../testing-CAAJTPCt.js";
+import "../lookup-RINL4MOa.js";
+import { test } from "../testing-CNtyBr2m.js";
 import "../std__assert-X-_kMxKM.js";
 import "../assert_rejects-DiIiJbZn.js";
 import "../assert_is_error-BPGph1Jx.js";
 import "../assert_not_equals-f3m3epl3.js";
 import "../assert_throws-BOO88avQ.js";
-import { esm_default } from "../esm-DTi75ew2.js";
+import { esm_default } from "../esm-BBVcrjH8.js";
 import { withTimeout } from "es-toolkit";
 
 //#region src/webfinger/lookup.test.ts

package/dist/webfinger/mod.cjs

@@ -2,8 +2,8 @@
           const { Temporal } = require("@js-temporal/polyfill");
           const { URLPattern } = require("urlpattern-polyfill");
         
-require('../docloader-CSB8cAnw.cjs');
-const require_lookup = require('../lookup-BrrOs_g1.cjs');
+require('../docloader-NcFUThCx.cjs');
+const require_lookup = require('../lookup-CILOZed9.cjs');
 require('../webfinger-BjOEdFPs.cjs');
 
 exports.lookupWebFinger = require_lookup.lookupWebFinger;

package/dist/webfinger/mod.js

@@ -2,8 +2,8 @@
           import { Temporal } from "@js-temporal/polyfill";
           import { URLPattern } from "urlpattern-polyfill";
         
-import "../docloader-Bqh-eFNP.js";
-import { lookupWebFinger } from "../lookup-B61sZAOY.js";
+import "../docloader-isD0ntZv.js";
+import { lookupWebFinger } from "../lookup-BBTRFcU5.js";
 import "../webfinger-De_bU0iE.js";
 
 export { lookupWebFinger };

package/dist/x/cfworkers.test.js

@@ -3,12 +3,12 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import "../type-BRNRL3aj.js";
+import "../type-C5udJemk.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-CZBG-vCx.js";
-import { test } from "../testing-CAAJTPCt.js";
+import "../lookup-RINL4MOa.js";
+import { test } from "../testing-CNtyBr2m.js";
 import "../std__assert-X-_kMxKM.js";
 import "../assert_rejects-DiIiJbZn.js";
 import "../assert_is_error-BPGph1Jx.js";

package/dist/x/hono.d.cts

@@ -1,13 +1,13 @@
 import "../kv-63Cil1MD.cjs";
 import "../docloader-D-MrRyHl.cjs";
 import "../client-DjT_tegg.cjs";
-import "../vocab-BzGg7ltX.cjs";
-import "../actor-CHOM_AN3.cjs";
-import "../http-B_zBcsai.cjs";
-import "../owner-C9Ry0TOI.cjs";
-import "../mod-NKH_G-IY.cjs";
+import "../vocab-Cfs0937i.cjs";
+import "../actor-Ydzhc8dj.cjs";
+import "../http-B1_DzfAU.cjs";
+import "../owner-6KSEp9eV.cjs";
+import "../mod-BUbqxBev.cjs";
 import "../mod-jQ4OODsl.cjs";
-import { Federation } from "../context-KXVF2AhH.cjs";
+import { Federation } from "../context-Qnv814-p.cjs";
 import "../mq-B7R1Q-M5.cjs";
 
 //#region src/x/hono.d.ts

package/dist/x/hono.d.ts

@@ -3,13 +3,13 @@ import { URLPattern } from "urlpattern-polyfill";
 import "../kv-C7sopW2E.js";
 import "../docloader-CxWcuWqQ.js";
 import "../client-DF8anIB5.js";
-import "../vocab-BEEm2I6u.js";
-import "../actor-Ch5yFYFG.js";
-import "../http-D8Q4xH0d.js";
-import "../owner-D38zBIMc.js";
-import "../mod-Cy6pkZSn.js";
+import "../vocab-CDHNj5zp.js";
+import "../actor-C1Euqngb.js";
+import "../http-wsGR6KkT.js";
+import "../owner-BbeUDvOu.js";
+import "../mod-CDObsV1d.js";
 import "../mod-DBzN0aCM.js";
-import { Federation } from "../context-DFruNLny.js";
+import { Federation } from "../context-C51zGhGC.js";
 import "../mq-CRGm1e_F.js";
 
 //#region src/x/hono.d.ts

package/dist/x/sveltekit.d.cts

@@ -1,13 +1,13 @@
 import "../kv-63Cil1MD.cjs";
 import "../docloader-D-MrRyHl.cjs";
 import "../client-DjT_tegg.cjs";
-import "../vocab-BzGg7ltX.cjs";
-import "../actor-CHOM_AN3.cjs";
-import "../http-B_zBcsai.cjs";
-import "../owner-C9Ry0TOI.cjs";
-import "../mod-NKH_G-IY.cjs";
+import "../vocab-Cfs0937i.cjs";
+import "../actor-Ydzhc8dj.cjs";
+import "../http-B1_DzfAU.cjs";
+import "../owner-6KSEp9eV.cjs";
+import "../mod-BUbqxBev.cjs";
 import "../mod-jQ4OODsl.cjs";
-import { Federation } from "../context-KXVF2AhH.cjs";
+import { Federation } from "../context-Qnv814-p.cjs";
 import "../mq-B7R1Q-M5.cjs";
 
 //#region src/x/sveltekit.d.ts

package/dist/x/sveltekit.d.ts

@@ -3,13 +3,13 @@ import { URLPattern } from "urlpattern-polyfill";
 import "../kv-C7sopW2E.js";
 import "../docloader-CxWcuWqQ.js";
 import "../client-DF8anIB5.js";
-import "../vocab-BEEm2I6u.js";
-import "../actor-Ch5yFYFG.js";
-import "../http-D8Q4xH0d.js";
-import "../owner-D38zBIMc.js";
-import "../mod-Cy6pkZSn.js";
+import "../vocab-CDHNj5zp.js";
+import "../actor-C1Euqngb.js";
+import "../http-wsGR6KkT.js";
+import "../owner-BbeUDvOu.js";
+import "../mod-CDObsV1d.js";
 import "../mod-DBzN0aCM.js";
-import { Federation } from "../context-DFruNLny.js";
+import { Federation } from "../context-C51zGhGC.js";
 import "../mq-CRGm1e_F.js";
 
 //#region src/x/sveltekit.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "1.9.0-dev.1668+09a99df1",
+  "version": "1.9.0-dev.1704+7d65b9a9",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",

package/dist/key-Ck4-GNm0.cjs

@@ -1,10 +0,0 @@
-
-          const { Temporal } = require("@js-temporal/polyfill");
-          const { URLPattern } = require("urlpattern-polyfill");
-        
-require('./docloader-CSB8cAnw.cjs');
-require('./actor-fGD4yb1K.cjs');
-require('./lookup-BrrOs_g1.cjs');
-const require_key = require('./key-CYpTUnwf.cjs');
-
-exports.validateCryptoKey = require_key.validateCryptoKey;

package/dist/middleware-D8O6iKhr.js

@@ -1,26 +0,0 @@
-
-      import { Temporal } from "@js-temporal/polyfill";
-      import { URLPattern } from "urlpattern-polyfill";
-      globalThis.addEventListener = () => {};
-    
-import "./type-BRNRL3aj.js";
-import { ContextImpl, FederationImpl, InboxContextImpl, KvSpecDeterminer, createFederation } from "./middleware-CyUVZG3t.js";
-import "./semver-dArNLkR9.js";
-import "./client-B8gJ1cw8.js";
-import "./lookup-CZBG-vCx.js";
-import "./types-BIgY6c-l.js";
-import "./actor-BHAPrCDB.js";
-import "./key-B27QtSbc.js";
-import "./http-BpAVdmaR.js";
-import "./authdocloader-CgrKtaQg.js";
-import "./ld-upnKn3yw.js";
-import "./owner-zvsMGYzc.js";
-import "./proof-BgKYSJ00.js";
-import "./inbox-BA9sYsBf.js";
-import "./builder-DI4-Kpdg.js";
-import "./collection-CSzG2j1P.js";
-import "./keycache-CiW2SvJu.js";
-import "./retry-D4GJ670a.js";
-import "./send-DlqdAGHP.js";
-
-export { FederationImpl };

package/dist/middleware-DI4sIaI4.js

@@ -1,17 +0,0 @@
-
-          import { Temporal } from "@js-temporal/polyfill";
-          import { URLPattern } from "urlpattern-polyfill";
-        
-import "./transformers-BFT6d7J5.js";
-import "./docloader-Bqh-eFNP.js";
-import "./actor-ChSW_rBk.js";
-import { ContextImpl, FederationImpl, InboxContextImpl, KvSpecDeterminer, createFederation } from "./middleware-CfP7UhQy.js";
-import "./lookup-B61sZAOY.js";
-import "./key-sCE-TgxY.js";
-import "./http-DBHpjcjo.js";
-import "./proof-Bt6yHsMN.js";
-import "./types-C8yjtF5A.js";
-import "./authdocloader-ChsJ9FJN.js";
-import "./vocab-WpDLcZH7.js";
-
-export { FederationImpl };

package/dist/middleware-lw0MLhVG.cjs

@@ -1,17 +0,0 @@
-
-          const { Temporal } = require("@js-temporal/polyfill");
-          const { URLPattern } = require("urlpattern-polyfill");
-        
-require('./transformers-CoBS-oFG.cjs');
-require('./docloader-CSB8cAnw.cjs');
-require('./actor-fGD4yb1K.cjs');
-const require_middleware = require('./middleware-P3jCWk4K.cjs');
-require('./lookup-BrrOs_g1.cjs');
-require('./key-CYpTUnwf.cjs');
-require('./http-BDErrXSN.cjs');
-require('./proof-CC_7UV_j.cjs');
-require('./types-Dz0NMslg.cjs');
-require('./authdocloader-eSrbn3wM.cjs');
-require('./vocab-BDMmyzZA.cjs');
-
-exports.FederationImpl = require_middleware.FederationImpl;