@fedify/fedify 1.9.0-pr.443.1682 → 1.9.0-pr.455.1742

package/dist/{vocab-95nbu41B.cjs → vocab-DY3aCxLN.cjs}

@@ -3,9 +3,9 @@
           const { URLPattern } = require("urlpattern-polyfill");
         
 const require_chunk = require('./chunk-DqRYRqnO.cjs');
-const require_docloader = require('./docloader-C8VNT_Xq.cjs');
-const require_actor = require('./actor-C84MVjvg.cjs');
-const require_lookup = require('./lookup-BQHLqqvB.cjs');
+const require_docloader = require('./docloader-CLtA3Ji8.cjs');
+const require_actor = require('./actor-D_0j9hMV.cjs');
+const require_lookup = require('./lookup-BsOmKssB.cjs');
 const __logtape_logtape = require_chunk.__toESM(require("@logtape/logtape"));
 const __opentelemetry_api = require_chunk.__toESM(require("@opentelemetry/api"));
 const es_toolkit = require_chunk.__toESM(require("es-toolkit"));
@@ -153,14 +153,13 @@ async function lookupObject(identifier, options = {}) {
 async function lookupObjectInternal(identifier, options = {}) {
 	const documentLoader = options.documentLoader ?? require_docloader.getDocumentLoader({ userAgent: options.userAgent });
 	if (typeof identifier === "string") identifier = toAcctUrl(identifier) ?? new URL(identifier);
-	let document = null;
+	let remoteDoc = null;
 	if (identifier.protocol === "http:" || identifier.protocol === "https:") try {
-		const remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
-		document = remoteDoc.document;
+		remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
 	} catch (error) {
 		logger.debug("Failed to fetch remote document:\n{error}", { error });
 	}
-	if (document == null) {
+	if (remoteDoc == null) {
 		const jrd = await require_lookup.lookupWebFinger(identifier, {
 			userAgent: options.userAgent,
 			tracerProvider: options.tracerProvider,
@@ -171,8 +170,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 		for (const l of jrd.links) {
 			if (l.type !== "application/activity+json" && !l.type?.match(/application\/ld\+json;\s*profile="https:\/\/www.w3.org\/ns\/activitystreams"/) || l.rel !== "self" || l.href == null) continue;
 			try {
-				const remoteDoc = await documentLoader(l.href, { signal: options.signal });
-				document = remoteDoc.document;
+				remoteDoc = await documentLoader(l.href, { signal: options.signal });
 				break;
 			} catch (error) {
 				logger.debug("Failed to fetch remote document:\n{error}", { error });
@@ -180,23 +178,34 @@ async function lookupObjectInternal(identifier, options = {}) {
 			}
 		}
 	}
-	if (document == null) return null;
+	if (remoteDoc == null) return null;
+	let object;
 	try {
-		return await require_actor.Object.fromJsonLd(document, {
+		object = await require_actor.Object.fromJsonLd(remoteDoc.document, {
 			documentLoader,
 			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider
+			tracerProvider: options.tracerProvider,
+			baseUrl: new URL(remoteDoc.documentUrl)
 		});
 	} catch (error) {
 		if (error instanceof TypeError) {
 			logger.debug("Failed to parse JSON-LD document: {error}\n{document}", {
-				error,
-				document
+				...remoteDoc,
+				error
 			});
 			return null;
 		}
 		throw error;
 	}
+	if (options.crossOrigin !== "trust" && object.id != null && object.id.origin !== new URL(remoteDoc.documentUrl).origin) {
+		if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
+		logger.warn("The object's @id ({objectId}) has a different origin than the document URL ({documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to \"trust\".", {
+			...remoteDoc,
+			objectId: object.id.href
+		});
+		return null;
+	}
+	return object;
 }
 /**
 * Traverses a collection, yielding each item in the collection.

package/dist/{vocab-DUIA4PK3.js → vocab-Q8XBm9oV.js}

@@ -2,9 +2,9 @@
           import { Temporal } from "@js-temporal/polyfill";
           import { URLPattern } from "urlpattern-polyfill";
         
-import { deno_default, getDocumentLoader } from "./docloader-vwID5KeD.js";
-import { Object as Object$1, getTypeId } from "./actor-BfM4acO7.js";
-import { lookupWebFinger } from "./lookup-tJvVI01W.js";
+import { deno_default, getDocumentLoader } from "./docloader-BggS4E4F.js";
+import { Object as Object$1, getTypeId } from "./actor-CYnaKz6k.js";
+import { lookupWebFinger } from "./lookup-C-jJgyrW.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { delay } from "es-toolkit";
@@ -152,14 +152,13 @@ async function lookupObject(identifier, options = {}) {
 async function lookupObjectInternal(identifier, options = {}) {
 	const documentLoader = options.documentLoader ?? getDocumentLoader({ userAgent: options.userAgent });
 	if (typeof identifier === "string") identifier = toAcctUrl(identifier) ?? new URL(identifier);
-	let document = null;
+	let remoteDoc = null;
 	if (identifier.protocol === "http:" || identifier.protocol === "https:") try {
-		const remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
-		document = remoteDoc.document;
+		remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
 	} catch (error) {
 		logger.debug("Failed to fetch remote document:\n{error}", { error });
 	}
-	if (document == null) {
+	if (remoteDoc == null) {
 		const jrd = await lookupWebFinger(identifier, {
 			userAgent: options.userAgent,
 			tracerProvider: options.tracerProvider,
@@ -170,8 +169,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 		for (const l of jrd.links) {
 			if (l.type !== "application/activity+json" && !l.type?.match(/application\/ld\+json;\s*profile="https:\/\/www.w3.org\/ns\/activitystreams"/) || l.rel !== "self" || l.href == null) continue;
 			try {
-				const remoteDoc = await documentLoader(l.href, { signal: options.signal });
-				document = remoteDoc.document;
+				remoteDoc = await documentLoader(l.href, { signal: options.signal });
 				break;
 			} catch (error) {
 				logger.debug("Failed to fetch remote document:\n{error}", { error });
@@ -179,23 +177,34 @@ async function lookupObjectInternal(identifier, options = {}) {
 			}
 		}
 	}
-	if (document == null) return null;
+	if (remoteDoc == null) return null;
+	let object;
 	try {
-		return await Object$1.fromJsonLd(document, {
+		object = await Object$1.fromJsonLd(remoteDoc.document, {
 			documentLoader,
 			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider
+			tracerProvider: options.tracerProvider,
+			baseUrl: new URL(remoteDoc.documentUrl)
 		});
 	} catch (error) {
 		if (error instanceof TypeError) {
 			logger.debug("Failed to parse JSON-LD document: {error}\n{document}", {
-				error,
-				document
+				...remoteDoc,
+				error
 			});
 			return null;
 		}
 		throw error;
 	}
+	if (options.crossOrigin !== "trust" && object.id != null && object.id.origin !== new URL(remoteDoc.documentUrl).origin) {
+		if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
+		logger.warn("The object's @id ({objectId}) has a different origin than the document URL ({documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to \"trust\".", {
+			...remoteDoc,
+			objectId: object.id.href
+		});
+		return null;
+	}
+	return object;
 }
 /**
 * Traverses a collection, yielding each item in the collection.

package/dist/webfinger/handler.test.js

@@ -3,30 +3,30 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { Image, Link, Person } from "../type-C9v8GMO6.js";
+import { Image, Link, Person } from "../type-Du-WE8NC.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
 import { MemoryKvStore } from "../kv-CRZrzyXm.js";
-import { createFederation, handleWebFinger } from "../middleware-CPgUeSYU.js";
+import { createFederation, handleWebFinger } from "../middleware-lg47b3mK.js";
 import "../semver-dArNLkR9.js";
-import "../client-BXo-ifnJ.js";
-import "../lookup-B8X3pPjF.js";
+import "../client-BM12q1DJ.js";
+import "../lookup-B5jlZrQb.js";
 import "../types-BIgY6c-l.js";
-import "../actor-DNoKtm0e.js";
-import "../key-CH7qaiOX.js";
-import "../http-PJ3EklL0.js";
-import "../authdocloader-BMUj-LDP.js";
-import "../ld-BLx5h_2L.js";
-import "../owner-DeXz0uXj.js";
-import "../proof-DEbHE-Rp.js";
-import "../inbox-4wLOWRkP.js";
-import "../builder-DbzYJjYW.js";
+import "../actor-CL8lYYUx.js";
+import "../key-B42BY6RL.js";
+import "../http-DNkYeLxx.js";
+import "../authdocloader-BlVoSqyh.js";
+import "../ld-CMWQXDty.js";
+import "../owner-Ch2ApIpq.js";
+import "../proof-DaD7vIAi.js";
+import "../inbox-FbqGLKha.js";
+import "../builder-CqMKWEN0.js";
 import "../collection-CSzG2j1P.js";
-import "../keycache-OXZYOWra.js";
+import "../keycache-BLtGOP6f.js";
 import "../retry-D4GJ670a.js";
-import "../send-ZLr2Fq_j.js";
-import { createRequestContext, test } from "../testing-CyBcyXDK.js";
+import "../send-DE79ptpc.js";
+import { createRequestContext, test } from "../testing-Bh2wmeXp.js";
 import "../std__assert-X-_kMxKM.js";
 import "../assert_rejects-DiIiJbZn.js";
 import "../assert_is_error-BPGph1Jx.js";

package/dist/webfinger/lookup.test.js

@@ -3,18 +3,18 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { lookupWebFinger } from "../type-C9v8GMO6.js";
+import { lookupWebFinger } from "../type-Du-WE8NC.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-B8X3pPjF.js";
-import { test } from "../testing-CyBcyXDK.js";
+import "../lookup-B5jlZrQb.js";
+import { test } from "../testing-Bh2wmeXp.js";
 import "../std__assert-X-_kMxKM.js";
 import "../assert_rejects-DiIiJbZn.js";
 import "../assert_is_error-BPGph1Jx.js";
 import "../assert_not_equals-f3m3epl3.js";
 import "../assert_throws-BOO88avQ.js";
-import { esm_default } from "../esm-BrKG8Ydq.js";
+import { esm_default } from "../esm-B3jpomik.js";
 import { withTimeout } from "es-toolkit";
 
 //#region src/webfinger/lookup.test.ts

package/dist/webfinger/mod.cjs

@@ -2,8 +2,8 @@
           const { Temporal } = require("@js-temporal/polyfill");
           const { URLPattern } = require("urlpattern-polyfill");
         
-require('../docloader-C8VNT_Xq.cjs');
-const require_lookup = require('../lookup-BQHLqqvB.cjs');
+require('../docloader-CLtA3Ji8.cjs');
+const require_lookup = require('../lookup-BsOmKssB.cjs');
 require('../webfinger-BjOEdFPs.cjs');
 
 exports.lookupWebFinger = require_lookup.lookupWebFinger;

package/dist/webfinger/mod.js

@@ -2,8 +2,8 @@
           import { Temporal } from "@js-temporal/polyfill";
           import { URLPattern } from "urlpattern-polyfill";
         
-import "../docloader-vwID5KeD.js";
-import { lookupWebFinger } from "../lookup-tJvVI01W.js";
+import "../docloader-BggS4E4F.js";
+import { lookupWebFinger } from "../lookup-C-jJgyrW.js";
 import "../webfinger-De_bU0iE.js";
 
 export { lookupWebFinger };

package/dist/x/cfworkers.test.js

@@ -3,12 +3,12 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import "../type-C9v8GMO6.js";
+import "../type-Du-WE8NC.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-B8X3pPjF.js";
-import { test } from "../testing-CyBcyXDK.js";
+import "../lookup-B5jlZrQb.js";
+import { test } from "../testing-Bh2wmeXp.js";
 import "../std__assert-X-_kMxKM.js";
 import "../assert_rejects-DiIiJbZn.js";
 import "../assert_is_error-BPGph1Jx.js";

package/dist/x/hono.d.cts

@@ -1,13 +1,13 @@
 import "../kv-63Cil1MD.cjs";
 import "../docloader-D-MrRyHl.cjs";
 import "../client-DjT_tegg.cjs";
-import "../vocab-qpRpljdS.cjs";
-import "../actor-D8GmZX63.cjs";
-import "../http-B9UPBFJz.cjs";
-import "../owner-BYxDl2qi.cjs";
-import "../mod-DxjZ8kbs.cjs";
+import "../vocab-Cfs0937i.cjs";
+import "../actor-Ydzhc8dj.cjs";
+import "../http-B1_DzfAU.cjs";
+import "../owner-6KSEp9eV.cjs";
+import "../mod-BUbqxBev.cjs";
 import "../mod-jQ4OODsl.cjs";
-import { Federation } from "../context-BkqGJwLI.cjs";
+import { Federation } from "../context-CwUAkopp.cjs";
 import "../mq-B7R1Q-M5.cjs";
 
 //#region src/x/hono.d.ts

package/dist/x/hono.d.ts

@@ -3,13 +3,13 @@ import { URLPattern } from "urlpattern-polyfill";
 import "../kv-C7sopW2E.js";
 import "../docloader-CxWcuWqQ.js";
 import "../client-DF8anIB5.js";
-import "../vocab-BW6SWH9P.js";
-import "../actor-sT_gcgkl.js";
-import "../http-BGqh2jzk.js";
-import "../owner-DOUl7e-t.js";
-import "../mod-CnEwcmyF.js";
+import "../vocab-CDHNj5zp.js";
+import "../actor-C1Euqngb.js";
+import "../http-wsGR6KkT.js";
+import "../owner-BbeUDvOu.js";
+import "../mod-CDObsV1d.js";
 import "../mod-DBzN0aCM.js";
-import { Federation } from "../context-Cp-kboln.js";
+import { Federation } from "../context-CXUibY4L.js";
 import "../mq-CRGm1e_F.js";
 
 //#region src/x/hono.d.ts

package/dist/x/sveltekit.d.cts

@@ -1,13 +1,13 @@
 import "../kv-63Cil1MD.cjs";
 import "../docloader-D-MrRyHl.cjs";
 import "../client-DjT_tegg.cjs";
-import "../vocab-qpRpljdS.cjs";
-import "../actor-D8GmZX63.cjs";
-import "../http-B9UPBFJz.cjs";
-import "../owner-BYxDl2qi.cjs";
-import "../mod-DxjZ8kbs.cjs";
+import "../vocab-Cfs0937i.cjs";
+import "../actor-Ydzhc8dj.cjs";
+import "../http-B1_DzfAU.cjs";
+import "../owner-6KSEp9eV.cjs";
+import "../mod-BUbqxBev.cjs";
 import "../mod-jQ4OODsl.cjs";
-import { Federation } from "../context-BkqGJwLI.cjs";
+import { Federation } from "../context-CwUAkopp.cjs";
 import "../mq-B7R1Q-M5.cjs";
 
 //#region src/x/sveltekit.d.ts

package/dist/x/sveltekit.d.ts

@@ -3,13 +3,13 @@ import { URLPattern } from "urlpattern-polyfill";
 import "../kv-C7sopW2E.js";
 import "../docloader-CxWcuWqQ.js";
 import "../client-DF8anIB5.js";
-import "../vocab-BW6SWH9P.js";
-import "../actor-sT_gcgkl.js";
-import "../http-BGqh2jzk.js";
-import "../owner-DOUl7e-t.js";
-import "../mod-CnEwcmyF.js";
+import "../vocab-CDHNj5zp.js";
+import "../actor-C1Euqngb.js";
+import "../http-wsGR6KkT.js";
+import "../owner-BbeUDvOu.js";
+import "../mod-CDObsV1d.js";
 import "../mod-DBzN0aCM.js";
-import { Federation } from "../context-Cp-kboln.js";
+import { Federation } from "../context-CXUibY4L.js";
 import "../mq-CRGm1e_F.js";
 
 //#region src/x/sveltekit.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "1.9.0-pr.443.1682+0f07cf27",
+  "version": "1.9.0-pr.455.1742+fb29545a",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",

package/dist/key-C-eEPc5P.cjs

@@ -1,10 +0,0 @@
-
-          const { Temporal } = require("@js-temporal/polyfill");
-          const { URLPattern } = require("urlpattern-polyfill");
-        
-require('./docloader-C8VNT_Xq.cjs');
-require('./actor-C84MVjvg.cjs');
-require('./lookup-BQHLqqvB.cjs');
-const require_key = require('./key-Bt6aeupK.cjs');
-
-exports.validateCryptoKey = require_key.validateCryptoKey;

package/dist/middleware-BKKzirBh.cjs

@@ -1,17 +0,0 @@
-
-          const { Temporal } = require("@js-temporal/polyfill");
-          const { URLPattern } = require("urlpattern-polyfill");
-        
-require('./transformers-CoBS-oFG.cjs');
-require('./docloader-C8VNT_Xq.cjs');
-require('./actor-C84MVjvg.cjs');
-const require_middleware = require('./middleware-BN1ZyxrJ.cjs');
-require('./lookup-BQHLqqvB.cjs');
-require('./key-Bt6aeupK.cjs');
-require('./http-D21OQwhJ.cjs');
-require('./proof-1YMXAyHu.cjs');
-require('./types-B2Gwh9uw.cjs');
-require('./authdocloader-BZ3wxRbU.cjs');
-require('./vocab-95nbu41B.cjs');
-
-exports.FederationImpl = require_middleware.FederationImpl;

package/dist/middleware-D9dqPUdF.js

@@ -1,17 +0,0 @@
-
-          import { Temporal } from "@js-temporal/polyfill";
-          import { URLPattern } from "urlpattern-polyfill";
-        
-import "./transformers-BFT6d7J5.js";
-import "./docloader-vwID5KeD.js";
-import "./actor-BfM4acO7.js";
-import { ContextImpl, FederationImpl, InboxContextImpl, KvSpecDeterminer, createFederation } from "./middleware-DpNXnRa6.js";
-import "./lookup-tJvVI01W.js";
-import "./key-7YeppNTi.js";
-import "./http-1S7OolRE.js";
-import "./proof-C5AaUlDb.js";
-import "./types-KhFFD-xZ.js";
-import "./authdocloader-CSF0HpUd.js";
-import "./vocab-DUIA4PK3.js";
-
-export { FederationImpl };

package/dist/middleware-ofHkiPKA.js

@@ -1,26 +0,0 @@
-
-      import { Temporal } from "@js-temporal/polyfill";
-      import { URLPattern } from "urlpattern-polyfill";
-      globalThis.addEventListener = () => {};
-    
-import "./type-C9v8GMO6.js";
-import { ContextImpl, FederationImpl, InboxContextImpl, KvSpecDeterminer, createFederation } from "./middleware-CPgUeSYU.js";
-import "./semver-dArNLkR9.js";
-import "./client-BXo-ifnJ.js";
-import "./lookup-B8X3pPjF.js";
-import "./types-BIgY6c-l.js";
-import "./actor-DNoKtm0e.js";
-import "./key-CH7qaiOX.js";
-import "./http-PJ3EklL0.js";
-import "./authdocloader-BMUj-LDP.js";
-import "./ld-BLx5h_2L.js";
-import "./owner-DeXz0uXj.js";
-import "./proof-DEbHE-Rp.js";
-import "./inbox-4wLOWRkP.js";
-import "./builder-DbzYJjYW.js";
-import "./collection-CSzG2j1P.js";
-import "./keycache-OXZYOWra.js";
-import "./retry-D4GJ670a.js";
-import "./send-ZLr2Fq_j.js";
-
-export { FederationImpl };