@fedify/fedify 2.0.0-dev.1485 → 2.0.0-dev.149

package/dist/{types-BIgY6c-l.js → types-D2jhK2VG.js}

@@ -3,8 +3,6 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { formatSemVer } from "./semver-dArNLkR9.js";
-
 //#region src/nodeinfo/types.ts
 /**
 * Converts a {@link NodeInfo} object to a JSON value.
@@ -25,7 +23,7 @@ function nodeInfoToJson(nodeInfo) {
 		version: "2.1",
 		software: {
 			name: nodeInfo.software.name,
-			version: formatSemVer(nodeInfo.software.version),
+			version: nodeInfo.software.version,
 			repository: nodeInfo.software.repository?.href,
 			homepage: nodeInfo.software.homepage?.href
 		},

package/dist/{runtime/authdocloader.test.js → utils/docloader.test.js}

@@ -3,25 +3,27 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { UrlError } from "../type-I68qwqmo.js";
-import { assertEquals } from "../assert_equals-DSbWqCm3.js";
-import "../assert-MZs1qjMx.js";
-import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-DNQyH8UQ.js";
-import "../actor-7ivEf1H3.js";
-import "../key-CYOcZ9G5.js";
-import { verifyRequest } from "../http-C7rxW7Kh.js";
-import { getAuthenticatedDocumentLoader } from "../authdocloader-D_IvQE4z.js";
-import { mockDocumentLoader, test } from "../testing-BG_8Fyas.js";
-import "../std__assert-X-_kMxKM.js";
-import { assertRejects } from "../assert_rejects-DiIiJbZn.js";
-import "../assert_is_error-BPGph1Jx.js";
-import "../assert_not_equals-f3m3epl3.js";
-import "../assert_throws-BOO88avQ.js";
-import { rsaPrivateKey2 } from "../keys-BIwlbtMN.js";
-import { esm_default } from "../esm-CPZhxxGc.js";
+import { mockDocumentLoader, test } from "../dist-lStjlyET.js";
+import { assertEquals } from "../assert_equals-Gbplq4lg.js";
+import "../assert-Dp5_aoAs.js";
+import "../assert_instance_of-D1m8F7x0.js";
+import "../deno-BTeveqhY.js";
+import "../vocab-C3nSleOZ.js";
+import "../lookup-yv_aH7K7.js";
+import "../type-BSNcIxTd.js";
+import "../actor-DYdPViDz.js";
+import "../key-dws2_YsP.js";
+import { verifyRequest } from "../http-BIDOYI9f.js";
+import { getAuthenticatedDocumentLoader } from "../docloader-BSGGKhrl.js";
+import "../std__assert-Cm-MfI66.js";
+import { assertRejects } from "../assert_rejects-BoKYY0g1.js";
+import "../assert_throws-DjkXin1a.js";
+import "../assert_not_equals-B2R_8p36.js";
+import { rsaPrivateKey2 } from "../keys-C6QyjjIN.js";
+import { esm_default } from "../esm-B52TuumP.js";
+import { UrlError } from "@fedify/vocab-runtime";
 
-//#region src/runtime/authdocloader.test.ts
+//#region src/utils/docloader.test.ts
 test("getAuthenticatedDocumentLoader()", async (t) => {
 	esm_default.spyGlobal();
 	esm_default.get("begin:https://example.com/object", async (cl) => {

package/dist/utils/kv-cache.test.js

@@ -0,0 +1,211 @@
+
+      import { Temporal } from "@js-temporal/polyfill";
+      import { URLPattern } from "urlpattern-polyfill";
+      globalThis.addEventListener = () => {};
+    
+import { mockDocumentLoader, test } from "../dist-lStjlyET.js";
+import { MockKvStore, kvCache } from "../kv-cache-C6NrTtII.js";
+import { preloadedContexts } from "@fedify/vocab-runtime";
+import { deepStrictEqual, throws } from "node:assert";
+
+//#region src/utils/kv-cache.test.ts
+test("kvCache()", async (t) => {
+	const kv = new MockKvStore();
+	await t.step("cached", async () => {
+		const loader = kvCache({
+			kv,
+			loader: mockDocumentLoader,
+			rules: [
+				["https://example.org/", Temporal.Duration.from({ days: 1 })],
+				[new URL("https://example.net/"), Temporal.Duration.from({ days: 1 })],
+				[new URLPattern("https://example.com/*"), Temporal.Duration.from({ days: 30 })]
+			],
+			prefix: ["_test", "cached"]
+		});
+		const result = await loader("https://example.com/object");
+		deepStrictEqual(result, {
+			contextUrl: null,
+			documentUrl: "https://example.com/object",
+			document: {
+				"@context": "https://www.w3.org/ns/activitystreams",
+				id: "https://example.com/object",
+				name: "Fetched object",
+				type: "Object"
+			}
+		});
+		const cache = await kv.get([
+			"_test",
+			"cached",
+			"https://example.com/object"
+		]);
+		deepStrictEqual(cache, result);
+		await kv.set([
+			"_test",
+			"cached",
+			"https://example.org/"
+		], {
+			contextUrl: null,
+			documentUrl: "https://example.org/",
+			document: { "id": "https://example.org/" }
+		});
+		const result2 = await loader("https://example.org/");
+		deepStrictEqual(result2, {
+			contextUrl: null,
+			documentUrl: "https://example.org/",
+			document: { "id": "https://example.org/" }
+		});
+		await kv.set([
+			"_test",
+			"cached",
+			"https://example.net/"
+		], {
+			contextUrl: null,
+			documentUrl: "https://example.net/",
+			document: { "id": "https://example.net/" }
+		});
+		const result3 = await loader("https://example.net/");
+		deepStrictEqual(result3, {
+			contextUrl: null,
+			documentUrl: "https://example.net/",
+			document: { "id": "https://example.net/" }
+		});
+	});
+	await t.step("not cached", async () => {
+		const loader = kvCache({
+			kv,
+			loader: mockDocumentLoader,
+			rules: [],
+			prefix: ["_test", "not cached"]
+		});
+		const result = await loader("https://example.com/object");
+		deepStrictEqual(result, {
+			contextUrl: null,
+			documentUrl: "https://example.com/object",
+			document: {
+				"@context": "https://www.w3.org/ns/activitystreams",
+				id: "https://example.com/object",
+				name: "Fetched object",
+				type: "Object"
+			}
+		});
+		const cache = await kv.get([
+			"test2",
+			"not cached",
+			"https://example.com/object"
+		]);
+		deepStrictEqual(cache, void 0);
+	});
+	await t.step("maximum cache duration", () => {
+		throws(() => kvCache({
+			kv,
+			loader: mockDocumentLoader,
+			rules: [["https://example.com/", Temporal.Duration.from({
+				days: 30,
+				seconds: 1
+			})]]
+		}), TypeError, "The maximum cache duration is 30 days");
+		throws(() => kvCache({
+			kv,
+			loader: mockDocumentLoader,
+			rules: [[new URLPattern("https://example.com/*"), Temporal.Duration.from({
+				days: 30,
+				seconds: 1
+			})]]
+		}), TypeError, "The maximum cache duration is 30 days");
+	});
+	await t.step("on kv store exception", async () => {
+		class KvStoreThrowsException {
+			get(_key) {
+				throw new Error("Failed to get key");
+			}
+			set(_key, _value, _options) {
+				throw new Error("Failed to set key");
+			}
+			delete(_key) {
+				throw new Error("Failed to delete key");
+			}
+			async *list(_prefix) {
+				throw new Error("Failed to list keys");
+			}
+		}
+		const loader = kvCache({
+			kv: new KvStoreThrowsException(),
+			loader: mockDocumentLoader,
+			rules: [
+				["https://example.org/", Temporal.Duration.from({ days: 1 })],
+				[new URL("https://example.net/"), Temporal.Duration.from({ days: 1 })],
+				[new URLPattern("https://example.com/*"), Temporal.Duration.from({ days: 30 })]
+			],
+			prefix: ["_test", "not cached"]
+		});
+		const result = await loader("https://example.com/object");
+		deepStrictEqual(result, {
+			contextUrl: null,
+			documentUrl: "https://example.com/object",
+			document: {
+				"@context": "https://www.w3.org/ns/activitystreams",
+				id: "https://example.com/object",
+				name: "Fetched object",
+				type: "Object"
+			}
+		});
+	});
+	await t.step("preloaded contexts bypass cache", async () => {
+		const kv$1 = new MockKvStore();
+		let loaderCalled = false;
+		const mockLoader = (url) => {
+			loaderCalled = true;
+			return Promise.resolve({
+				contextUrl: null,
+				documentUrl: url,
+				document: { "mock": "document" }
+			});
+		};
+		const loader = kvCache({
+			kv: kv$1,
+			loader: mockLoader,
+			prefix: ["_test", "preloaded"]
+		});
+		const activityStreamsUrl = "https://www.w3.org/ns/activitystreams";
+		loaderCalled = false;
+		const result = await loader(activityStreamsUrl);
+		deepStrictEqual(result, {
+			contextUrl: null,
+			documentUrl: activityStreamsUrl,
+			document: preloadedContexts[activityStreamsUrl]
+		});
+		deepStrictEqual(loaderCalled, false, "Loader should not be called for preloaded contexts");
+		const cachedValue = await kv$1.get([
+			"_test",
+			"preloaded",
+			activityStreamsUrl
+		]);
+		deepStrictEqual(cachedValue, void 0, "Preloaded contexts should not be cached in KV store");
+		const securityUrl = "https://w3id.org/security/v1";
+		loaderCalled = false;
+		const result2 = await loader(securityUrl);
+		deepStrictEqual(result2, {
+			contextUrl: null,
+			documentUrl: securityUrl,
+			document: preloadedContexts[securityUrl]
+		});
+		deepStrictEqual(loaderCalled, false, "Loader should not be called for preloaded contexts");
+		const nonPreloadedUrl = "https://example.com/not-preloaded";
+		loaderCalled = false;
+		const result3 = await loader(nonPreloadedUrl);
+		deepStrictEqual(result3, {
+			contextUrl: null,
+			documentUrl: nonPreloadedUrl,
+			document: { "mock": "document" }
+		});
+		deepStrictEqual(loaderCalled, true, "Loader should be called for non-preloaded URLs");
+		const cachedValue2 = await kv$1.get([
+			"_test",
+			"preloaded",
+			nonPreloadedUrl
+		]);
+		deepStrictEqual(cachedValue2, result3, "Non-preloaded URLs should be cached");
+	});
+});
+
+//#endregion

package/dist/utils/mod.cjs

@@ -0,0 +1,12 @@
+
+          const { Temporal } = require("@js-temporal/polyfill");
+          const { URLPattern } = require("urlpattern-polyfill");
+        
+require('../lookup-BORWbouU.cjs');
+require('../actor-CCAL5-E_.cjs');
+require('../http-DtYHWbwa.cjs');
+const require_kv_cache = require('../kv-cache-1_lcnUMp.cjs');
+require('../utils-DyRU1gdZ.cjs');
+
+exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
+exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.d.cts

@@ -0,0 +1,5 @@
+import "../vocab-CeDBzu-f.cjs";
+import "../http-M8k5mKc0.cjs";
+import "../kv-cD_d4hg-.cjs";
+import { getAuthenticatedDocumentLoader, kvCache } from "../mod-fxr25Gv7.cjs";
+export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.d.ts

@@ -0,0 +1,7 @@
+import { Temporal } from "@js-temporal/polyfill";
+import { URLPattern } from "urlpattern-polyfill";
+import "../vocab-BCWe1Ih5.js";
+import "../http-BbO0ejuk.js";
+import "../kv-BpJND1Hr.js";
+import { getAuthenticatedDocumentLoader, kvCache } from "../mod-CAdoBu0x.js";
+export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.js

@@ -0,0 +1,11 @@
+
+          import { Temporal } from "@js-temporal/polyfill";
+          import { URLPattern } from "urlpattern-polyfill";
+        
+import "../lookup-BV72lfsA.js";
+import "../actor-U_BZZ2ps.js";
+import "../http-BQRnmfXP.js";
+import { getAuthenticatedDocumentLoader, kvCache } from "../kv-cache-BEP4OyiZ.js";
+import "../utils-D-Va7aXC.js";
+
+export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils-D-Va7aXC.js

@@ -0,0 +1,4 @@
+
+          import { Temporal } from "@js-temporal/polyfill";
+          import { URLPattern } from "urlpattern-polyfill";
+        

package/dist/utils-DyRU1gdZ.cjs

@@ -0,0 +1,4 @@
+
+          const { Temporal } = require("@js-temporal/polyfill");
+          const { URLPattern } = require("urlpattern-polyfill");
+        

package/dist/vocab/actor.test.js

@@ -3,19 +3,21 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { Application, Group, Organization, Person, Service, __export } from "../type-I68qwqmo.js";
-import { assertEquals } from "../assert_equals-DSbWqCm3.js";
-import { assert } from "../assert-MZs1qjMx.js";
-import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-DNQyH8UQ.js";
-import { getActorClassByTypeName, getActorHandle, getActorTypeName, isActor, normalizeActorHandle } from "../actor-7ivEf1H3.js";
-import { test } from "../testing-BG_8Fyas.js";
-import { assertStrictEquals } from "../std__assert-X-_kMxKM.js";
-import { assertFalse, assertRejects } from "../assert_rejects-DiIiJbZn.js";
-import "../assert_is_error-BPGph1Jx.js";
-import "../assert_not_equals-f3m3epl3.js";
-import { assertThrows } from "../assert_throws-BOO88avQ.js";
-import { esm_default } from "../esm-CPZhxxGc.js";
+import { __export } from "../chunk-HsBuZ-b2.js";
+import { test } from "../dist-lStjlyET.js";
+import { assertEquals } from "../assert_equals-Gbplq4lg.js";
+import { assert } from "../assert-Dp5_aoAs.js";
+import "../assert_instance_of-D1m8F7x0.js";
+import "../deno-BTeveqhY.js";
+import { Application, Group, Organization, Person, Service } from "../vocab-C3nSleOZ.js";
+import "../lookup-yv_aH7K7.js";
+import "../type-BSNcIxTd.js";
+import { getActorClassByTypeName, getActorHandle, getActorTypeName, isActor, normalizeActorHandle } from "../actor-DYdPViDz.js";
+import { assertStrictEquals } from "../std__assert-Cm-MfI66.js";
+import { assertFalse, assertRejects } from "../assert_rejects-BoKYY0g1.js";
+import { assertThrows } from "../assert_throws-DjkXin1a.js";
+import "../assert_not_equals-B2R_8p36.js";
+import { esm_default } from "../esm-B52TuumP.js";
 
 //#region ../../node_modules/.pnpm/fast-check@3.23.2/node_modules/fast-check/lib/esm/check/precondition/PreconditionFailure.js
 var PreconditionFailure = class PreconditionFailure extends Error {

package/dist/vocab/lookup.test.js

@@ -3,18 +3,20 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { Collection, Note, Object as Object$1, Person } from "../type-I68qwqmo.js";
-import { assertEquals } from "../assert_equals-DSbWqCm3.js";
-import "../assert-MZs1qjMx.js";
-import { assertInstanceOf } from "../assert_instance_of-DHz7EHNU.js";
-import { lookupObject, traverseCollection } from "../lookup-DNQyH8UQ.js";
-import { mockDocumentLoader, test } from "../testing-BG_8Fyas.js";
-import "../std__assert-X-_kMxKM.js";
-import "../assert_rejects-DiIiJbZn.js";
-import "../assert_is_error-BPGph1Jx.js";
-import "../assert_not_equals-f3m3epl3.js";
-import "../assert_throws-BOO88avQ.js";
-import { esm_default } from "../esm-CPZhxxGc.js";
+import { createTestTracerProvider, mockDocumentLoader, test } from "../dist-lStjlyET.js";
+import { assertEquals } from "../assert_equals-Gbplq4lg.js";
+import { assert } from "../assert-Dp5_aoAs.js";
+import { assertInstanceOf } from "../assert_instance_of-D1m8F7x0.js";
+import "../deno-BTeveqhY.js";
+import { Collection, Note, Object as Object$1, Person } from "../vocab-C3nSleOZ.js";
+import "../lookup-yv_aH7K7.js";
+import "../type-BSNcIxTd.js";
+import { lookupObject, traverseCollection } from "../lookup-BoiLMtAx.js";
+import "../std__assert-Cm-MfI66.js";
+import { assertRejects } from "../assert_rejects-BoKYY0g1.js";
+import "../assert_throws-DjkXin1a.js";
+import "../assert_not_equals-B2R_8p36.js";
+import { esm_default } from "../esm-B52TuumP.js";
 
 //#region src/vocab/lookup.test.ts
 test("lookupObject()", {
@@ -202,5 +204,276 @@ test("traverseCollection()", {
 		new Note({ content: "This is a third simple note" })
 	]);
 });
+test("FEP-fe34: lookupObject() cross-origin security", {
+	sanitizeResources: false,
+	sanitizeOps: false
+}, async (t) => {
+	await t.step("crossOrigin: ignore (default) - returns null for cross-origin objects", async () => {
+		const crossOriginDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "https://malicious.com/fake-note",
+					content: "This is a spoofed note from a different origin"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://example.com/note", {
+			documentLoader: crossOriginDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertEquals(result, null);
+	});
+	await t.step("crossOrigin: throw - throws error for cross-origin objects", async () => {
+		const crossOriginDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "https://malicious.com/fake-note",
+					content: "This is a spoofed note from a different origin"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		await assertRejects(() => lookupObject("https://example.com/note", {
+			documentLoader: crossOriginDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "throw"
+		}), Error, "The object's @id (https://malicious.com/fake-note) has a different origin than the document URL (https://example.com/note)");
+	});
+	await t.step("crossOrigin: trust - allows cross-origin objects", async () => {
+		const crossOriginDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "https://malicious.com/fake-note",
+					content: "This is a spoofed note from a different origin"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://example.com/note", {
+			documentLoader: crossOriginDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "trust"
+		});
+		assertInstanceOf(result, Note);
+		assertEquals(result.id, new URL("https://malicious.com/fake-note"));
+		assertEquals(result.content, "This is a spoofed note from a different origin");
+	});
+	await t.step("same-origin objects are always trusted", async () => {
+		const sameOriginDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "https://example.com/note",
+					content: "This is a legitimate note from the same origin"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://example.com/note", {
+			documentLoader: sameOriginDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertInstanceOf(result, Note);
+		assertEquals(result.id, new URL("https://example.com/note"));
+		assertEquals(result.content, "This is a legitimate note from the same origin");
+	});
+	await t.step("objects without @id are trusted", async () => {
+		const noIdDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					content: "This is a note without an ID"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://example.com/note", {
+			documentLoader: noIdDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertInstanceOf(result, Note);
+		assertEquals(result.id, null);
+		assertEquals(result.content, "This is a note without an ID");
+	});
+	await t.step("WebFinger lookup with cross-origin actor URL", async () => {
+		esm_default.spyGlobal();
+		esm_default.get("begin:https://example.com/.well-known/webfinger", {
+			subject: "acct:user@example.com",
+			links: [{
+				rel: "self",
+				href: "https://different-origin.com/actor",
+				type: "application/activity+json"
+			}]
+		});
+		const webfingerDocumentLoader = async (url) => {
+			if (url === "https://different-origin.com/actor") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Person",
+					id: "https://malicious.com/fake-actor",
+					name: "Fake Actor"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result1 = await lookupObject("@user@example.com", {
+			documentLoader: webfingerDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertEquals(result1, null);
+		await assertRejects(() => lookupObject("@user@example.com", {
+			documentLoader: webfingerDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "throw"
+		}), Error, "The object's @id (https://malicious.com/fake-actor) has a different origin than the document URL (https://different-origin.com/actor)");
+		const result2 = await lookupObject("@user@example.com", {
+			documentLoader: webfingerDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "trust"
+		});
+		assertInstanceOf(result2, Person);
+		assertEquals(result2.id, new URL("https://malicious.com/fake-actor"));
+		esm_default.removeRoutes();
+		esm_default.hardReset();
+	});
+	await t.step("subdomain same-origin check", async () => {
+		const subdomainDocumentLoader = async (url) => {
+			if (url === "https://api.example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "https://www.example.com/note",
+					content: "Cross-subdomain note"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://api.example.com/note", {
+			documentLoader: subdomainDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertEquals(result, null);
+	});
+	await t.step("different port same-origin check", async () => {
+		const differentPortDocumentLoader = async (url) => {
+			if (url === "https://example.com:8080/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "https://example.com:9090/note",
+					content: "Cross-port note"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://example.com:8080/note", {
+			documentLoader: differentPortDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertEquals(result, null);
+	});
+	await t.step("protocol difference same-origin check", async () => {
+		const differentProtocolDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: {
+					"@context": "https://www.w3.org/ns/activitystreams",
+					type: "Note",
+					id: "http://example.com/note",
+					content: "Cross-protocol note"
+				}
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		const result = await lookupObject("https://example.com/note", {
+			documentLoader: differentProtocolDocumentLoader,
+			contextLoader: mockDocumentLoader
+		});
+		assertEquals(result, null);
+	});
+	await t.step("error handling with crossOrigin throw option", async () => {
+		const errorDocumentLoader = async (_url) => {
+			throw new Error("Network error");
+		};
+		const result = await lookupObject("https://example.com/note", {
+			documentLoader: errorDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "throw"
+		});
+		assertEquals(result, null);
+	});
+	await t.step("malformed JSON handling with cross-origin policy", async () => {
+		const malformedJsonDocumentLoader = async (url) => {
+			if (url === "https://example.com/note") return {
+				documentUrl: url,
+				contextUrl: null,
+				document: "invalid json"
+			};
+			throw new Error(`Unexpected URL: ${url}`);
+		};
+		assertEquals(await lookupObject("https://example.com/note", {
+			documentLoader: malformedJsonDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "ignore"
+		}), null);
+		assertEquals(await lookupObject("https://example.com/note", {
+			documentLoader: malformedJsonDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "throw"
+		}), null);
+		assertEquals(await lookupObject("https://example.com/note", {
+			documentLoader: malformedJsonDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			crossOrigin: "trust"
+		}), null);
+	});
+});
+test("lookupObject() records OpenTelemetry span events", async () => {
+	const [tracerProvider, exporter] = createTestTracerProvider();
+	const object = await lookupObject("https://example.com/object", {
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader,
+		tracerProvider
+	});
+	assertInstanceOf(object, Object$1);
+	const spans = exporter.getSpans("activitypub.lookup_object");
+	assertEquals(spans.length, 1);
+	const span = spans[0];
+	assertEquals(span.attributes["activitypub.object.id"], "https://example.com/object");
+	const events = exporter.getEvents("activitypub.lookup_object", "activitypub.object.fetched");
+	assertEquals(events.length, 1);
+	const event = events[0];
+	assert(event.attributes != null);
+	assert(typeof event.attributes["activitypub.object.type"] === "string");
+	assert(typeof event.attributes["activitypub.object.json"] === "string");
+	const recordedObject = JSON.parse(event.attributes["activitypub.object.json"]);
+	assertEquals(recordedObject.id, "https://example.com/object");
+});
 
 //#endregion