@fedify/fedify 2.0.0-pr.435.1667 → 2.0.0-pr.445.1694

package/dist/{vocab-gpwUU9fc.js → vocab-w--qk7HF.js}

@@ -2,9 +2,9 @@
           import { Temporal } from "@js-temporal/polyfill";
           import { URLPattern } from "urlpattern-polyfill";
         
-import { deno_default, getDocumentLoader } from "./docloader-xJVzq9O0.js";
-import { Object as Object$1, getTypeId } from "./actor-CnVfp1Hp.js";
-import { lookupWebFinger } from "./lookup-CfU0DgLr.js";
+import { deno_default, getDocumentLoader } from "./docloader-Czl3xV10.js";
+import { Object as Object$1, getTypeId } from "./actor-DoMcqXsW.js";
+import { lookupWebFinger } from "./lookup-Dhm78GlK.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { delay } from "es-toolkit";
@@ -152,14 +152,13 @@ async function lookupObject(identifier, options = {}) {
 async function lookupObjectInternal(identifier, options = {}) {
 	const documentLoader = options.documentLoader ?? getDocumentLoader({ userAgent: options.userAgent });
 	if (typeof identifier === "string") identifier = toAcctUrl(identifier) ?? new URL(identifier);
-	let document = null;
+	let remoteDoc = null;
 	if (identifier.protocol === "http:" || identifier.protocol === "https:") try {
-		const remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
-		document = remoteDoc.document;
+		remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
 	} catch (error) {
 		logger.debug("Failed to fetch remote document:\n{error}", { error });
 	}
-	if (document == null) {
+	if (remoteDoc == null) {
 		const jrd = await lookupWebFinger(identifier, {
 			userAgent: options.userAgent,
 			tracerProvider: options.tracerProvider,
@@ -170,8 +169,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 		for (const l of jrd.links) {
 			if (l.type !== "application/activity+json" && !l.type?.match(/application\/ld\+json;\s*profile="https:\/\/www.w3.org\/ns\/activitystreams"/) || l.rel !== "self" || l.href == null) continue;
 			try {
-				const remoteDoc = await documentLoader(l.href, { signal: options.signal });
-				document = remoteDoc.document;
+				remoteDoc = await documentLoader(l.href, { signal: options.signal });
 				break;
 			} catch (error) {
 				logger.debug("Failed to fetch remote document:\n{error}", { error });
@@ -179,23 +177,34 @@ async function lookupObjectInternal(identifier, options = {}) {
 			}
 		}
 	}
-	if (document == null) return null;
+	if (remoteDoc == null) return null;
+	let object;
 	try {
-		return await Object$1.fromJsonLd(document, {
+		object = await Object$1.fromJsonLd(remoteDoc.document, {
 			documentLoader,
 			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider
+			tracerProvider: options.tracerProvider,
+			baseUrl: new URL(remoteDoc.documentUrl)
 		});
 	} catch (error) {
 		if (error instanceof TypeError) {
 			logger.debug("Failed to parse JSON-LD document: {error}\n{document}", {
-				error,
-				document
+				...remoteDoc,
+				error
 			});
 			return null;
 		}
 		throw error;
 	}
+	if (options.crossOrigin !== "trust" && object.id != null && object.id.origin !== new URL(remoteDoc.documentUrl).origin) {
+		if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
+		logger.warn("The object's @id ({objectId}) has a different origin than the document URL ({documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to \"trust\".", {
+			...remoteDoc,
+			objectId: object.id.href
+		});
+		return null;
+	}
+	return object;
 }
 /**
 * Traverses a collection, yielding each item in the collection.

package/dist/webfinger/handler.test.js

@@ -3,34 +3,35 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { Image, Link, Person } from "../type-FCer_9yh.js";
+import { Image, Link, Person } from "../type-DaUr3Il7.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
 import { MemoryKvStore } from "../kv-CRZrzyXm.js";
-import { createFederation, handleWebFinger } from "../middleware-BDN7YoYJ.js";
-import "../client-BqyuOGiQ.js";
-import "../lookup-BrhURkmj.js";
+import { createFederation, handleWebFinger } from "../middleware-DQYscW90.js";
+import "../client-D5CBsPrc.js";
+import "../lookup-CbtuFbtg.js";
 import "../types-BSuWJsOm.js";
-import "../actor-Cpal85xW.js";
-import "../key-DORX19Bl.js";
-import "../http-y7khnX5Q.js";
-import "../authdocloader-Df2BFefL.js";
-import "../ld-D3cq9xO1.js";
-import "../owner-NFlQJyvM.js";
-import "../proof-ar9xgPWi.js";
-import "../inbox-DpcYOzs8.js";
-import "../builder-CMxichO9.js";
+import "../actor-D8gCwLzv.js";
+import "../key-DnqhSgAv.js";
+import "../http-CuS-d4U0.js";
+import "../authdocloader-DYTNpaMA.js";
+import "../ld-Isot0tiW.js";
+import "../owner-ChSL4aJ7.js";
+import "../proof-x3IBewan.js";
+import "../inbox-IETv_Qez.js";
+import "../builder-1_skw-d2.js";
 import "../collection-CcnIw1qY.js";
-import "../keycache-AH1uj1j-.js";
-import "../retry-CfF8Gn4d.js";
-import "../send-DkwkMFjJ.js";
-import { createRequestContext, test } from "../testing-BMBhkcz9.js";
-import "../std__assert-DWivtrGR.js";
-import "../assert_rejects-7UF4R_Qs.js";
-import "../assert_is_error-B035L3om.js";
-import "../assert_not_equals-C80BG-_5.js";
-import "../assert_throws-53_pKeP3.js";
+import "../keycache-CSBkusP8.js";
+import "../negotiation-5NPJL6zp.js";
+import "../retry-D4GJ670a.js";
+import "../send-D5fjmUEj.js";
+import { createRequestContext, test } from "../testing-tWr1VQxx.js";
+import "../std__assert-X-_kMxKM.js";
+import "../assert_rejects-DiIiJbZn.js";
+import "../assert_is_error-BPGph1Jx.js";
+import "../assert_not_equals-f3m3epl3.js";
+import "../assert_throws-BOO88avQ.js";
 
 //#region src/webfinger/handler.test.ts
 test("handleWebFinger()", async (t) => {

package/dist/webfinger/lookup.test.js

@@ -3,18 +3,18 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { lookupWebFinger } from "../type-FCer_9yh.js";
+import { lookupWebFinger } from "../type-DaUr3Il7.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-BrhURkmj.js";
-import { test } from "../testing-BMBhkcz9.js";
-import "../std__assert-DWivtrGR.js";
-import "../assert_rejects-7UF4R_Qs.js";
-import "../assert_is_error-B035L3om.js";
-import "../assert_not_equals-C80BG-_5.js";
-import "../assert_throws-53_pKeP3.js";
-import { esm_default } from "../esm-BBznxjVc.js";
+import "../lookup-CbtuFbtg.js";
+import { test } from "../testing-tWr1VQxx.js";
+import "../std__assert-X-_kMxKM.js";
+import "../assert_rejects-DiIiJbZn.js";
+import "../assert_is_error-BPGph1Jx.js";
+import "../assert_not_equals-f3m3epl3.js";
+import "../assert_throws-BOO88avQ.js";
+import { esm_default } from "../esm-Dl5T1RNE.js";
 import { withTimeout } from "es-toolkit";
 
 //#region src/webfinger/lookup.test.ts

package/dist/webfinger/mod.cjs

@@ -2,8 +2,8 @@
           const { Temporal } = require("@js-temporal/polyfill");
           const { URLPattern } = require("urlpattern-polyfill");
         
-require('../docloader-B1O1Z5OK.cjs');
-const require_lookup = require('../lookup-7u217Q3H.cjs');
+require('../docloader-CYnQRIXv.cjs');
+const require_lookup = require('../lookup-D6dro5Au.cjs');
 require('../webfinger-BjOEdFPs.cjs');
 
 exports.lookupWebFinger = require_lookup.lookupWebFinger;

package/dist/webfinger/mod.js

@@ -2,8 +2,8 @@
           import { Temporal } from "@js-temporal/polyfill";
           import { URLPattern } from "urlpattern-polyfill";
         
-import "../docloader-xJVzq9O0.js";
-import { lookupWebFinger } from "../lookup-CfU0DgLr.js";
+import "../docloader-Czl3xV10.js";
+import { lookupWebFinger } from "../lookup-Dhm78GlK.js";
 import "../webfinger-De_bU0iE.js";
 
 export { lookupWebFinger };

package/dist/x/cfworkers.test.js

@@ -3,17 +3,17 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import "../type-FCer_9yh.js";
+import "../type-DaUr3Il7.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-BrhURkmj.js";
-import { test } from "../testing-BMBhkcz9.js";
-import "../std__assert-DWivtrGR.js";
-import "../assert_rejects-7UF4R_Qs.js";
-import "../assert_is_error-B035L3om.js";
-import "../assert_not_equals-C80BG-_5.js";
-import "../assert_throws-53_pKeP3.js";
+import "../lookup-CbtuFbtg.js";
+import { test } from "../testing-tWr1VQxx.js";
+import "../std__assert-X-_kMxKM.js";
+import "../assert_rejects-DiIiJbZn.js";
+import "../assert_is_error-BPGph1Jx.js";
+import "../assert_not_equals-f3m3epl3.js";
+import "../assert_throws-BOO88avQ.js";
 import { delay } from "es-toolkit";
 import { getLogger } from "@logtape/logtape";
 

package/dist/x/hono.d.cts

@@ -1,13 +1,13 @@
 import "../kv-63Cil1MD.cjs";
 import "../docloader-D-MrRyHl.cjs";
 import "../client-CegPX0Rn.cjs";
-import "../vocab-DJTYMqyU.cjs";
-import "../actor-DMgu-ZjT.cjs";
-import "../http-BS6766zs.cjs";
-import "../owner-B-7Ptt_m.cjs";
-import "../mod-evzlRVZq.cjs";
+import "../vocab-Dw1-yVGg.cjs";
+import "../actor-D6K058Tb.cjs";
+import "../http-D-e6AFwR.cjs";
+import "../owner-BN_tO3cY.cjs";
+import "../mod-CxkWO3Mg.cjs";
 import "../mod-jQ4OODsl.cjs";
-import { Federation } from "../context-Dq8aCtMH.cjs";
+import { Federation } from "../context-DiqjMRef.cjs";
 import "../mq-B7R1Q-M5.cjs";
 
 //#region src/x/hono.d.ts

package/dist/x/hono.d.ts

@@ -3,13 +3,13 @@ import { URLPattern } from "urlpattern-polyfill";
 import "../kv-C7sopW2E.js";
 import "../docloader-CxWcuWqQ.js";
 import "../client-bgSdkFa2.js";
-import "../vocab-SOE1ifCr.js";
-import "../actor-C22bXuuC.js";
-import "../http-DqSNLFNY.js";
-import "../owner-CQPnQVtf.js";
-import "../mod-Cxt4Kpf6.js";
+import "../vocab-BI0Ak5lL.js";
+import "../actor-T6RyhRgk.js";
+import "../http-D6Uj2x2y.js";
+import "../owner-hd9lvQcP.js";
+import "../mod-DlU8ISoa.js";
 import "../mod-DBzN0aCM.js";
-import { Federation } from "../context-CDSZdQHD.js";
+import { Federation } from "../context-DBKpNBnc.js";
 import "../mq-CRGm1e_F.js";
 
 //#region src/x/hono.d.ts

package/dist/x/sveltekit.d.cts

@@ -1,13 +1,13 @@
 import "../kv-63Cil1MD.cjs";
 import "../docloader-D-MrRyHl.cjs";
 import "../client-CegPX0Rn.cjs";
-import "../vocab-DJTYMqyU.cjs";
-import "../actor-DMgu-ZjT.cjs";
-import "../http-BS6766zs.cjs";
-import "../owner-B-7Ptt_m.cjs";
-import "../mod-evzlRVZq.cjs";
+import "../vocab-Dw1-yVGg.cjs";
+import "../actor-D6K058Tb.cjs";
+import "../http-D-e6AFwR.cjs";
+import "../owner-BN_tO3cY.cjs";
+import "../mod-CxkWO3Mg.cjs";
 import "../mod-jQ4OODsl.cjs";
-import { Federation } from "../context-Dq8aCtMH.cjs";
+import { Federation } from "../context-DiqjMRef.cjs";
 import "../mq-B7R1Q-M5.cjs";
 
 //#region src/x/sveltekit.d.ts

package/dist/x/sveltekit.d.ts

@@ -3,13 +3,13 @@ import { URLPattern } from "urlpattern-polyfill";
 import "../kv-C7sopW2E.js";
 import "../docloader-CxWcuWqQ.js";
 import "../client-bgSdkFa2.js";
-import "../vocab-SOE1ifCr.js";
-import "../actor-C22bXuuC.js";
-import "../http-DqSNLFNY.js";
-import "../owner-CQPnQVtf.js";
-import "../mod-Cxt4Kpf6.js";
+import "../vocab-BI0Ak5lL.js";
+import "../actor-T6RyhRgk.js";
+import "../http-D6Uj2x2y.js";
+import "../owner-hd9lvQcP.js";
+import "../mod-DlU8ISoa.js";
 import "../mod-DBzN0aCM.js";
-import { Federation } from "../context-CDSZdQHD.js";
+import { Federation } from "../context-DBKpNBnc.js";
 import "../mq-CRGm1e_F.js";
 
 //#region src/x/sveltekit.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "2.0.0-pr.435.1667+3a249c3e",
+  "version": "2.0.0-pr.445.1694+d0c7cd75",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",

package/dist/key-CV3FT32G.cjs

@@ -1,10 +0,0 @@
-
-          const { Temporal } = require("@js-temporal/polyfill");
-          const { URLPattern } = require("urlpattern-polyfill");
-        
-require('./docloader-B1O1Z5OK.cjs');
-require('./actor-C3gJhZJj.cjs');
-require('./lookup-7u217Q3H.cjs');
-const require_key = require('./key-CzF9SAEI.cjs');
-
-exports.validateCryptoKey = require_key.validateCryptoKey;

package/dist/middleware-CV-OPMlZ.js

@@ -1,17 +0,0 @@
-
-          import { Temporal } from "@js-temporal/polyfill";
-          import { URLPattern } from "urlpattern-polyfill";
-        
-import "./transformers-BFT6d7J5.js";
-import "./docloader-xJVzq9O0.js";
-import "./actor-CnVfp1Hp.js";
-import { ContextImpl, FederationImpl, InboxContextImpl, KvSpecDeterminer, createFederation } from "./middleware-DXWUGrBQ.js";
-import "./lookup-CfU0DgLr.js";
-import "./key-BRmlopJL.js";
-import "./http-CovAm6we.js";
-import "./proof-Be1oOYEh.js";
-import "./types-CNWeAz8v.js";
-import "./authdocloader-DWnwkjvZ.js";
-import "./vocab-gpwUU9fc.js";
-
-export { FederationImpl };

package/dist/middleware-DGqnaAbp.cjs

@@ -1,17 +0,0 @@
-
-          const { Temporal } = require("@js-temporal/polyfill");
-          const { URLPattern } = require("urlpattern-polyfill");
-        
-require('./transformers-CoBS-oFG.cjs');
-require('./docloader-B1O1Z5OK.cjs');
-require('./actor-C3gJhZJj.cjs');
-const require_middleware = require('./middleware-Gsxukxs5.cjs');
-require('./lookup-7u217Q3H.cjs');
-require('./key-CzF9SAEI.cjs');
-require('./http-Hw9HJp9i.cjs');
-require('./proof-Gip91fK7.cjs');
-require('./types-CZ_qo9KW.cjs');
-require('./authdocloader-DPCGwidE.cjs');
-require('./vocab-9MjZjuZb.cjs');
-
-exports.FederationImpl = require_middleware.FederationImpl;

package/dist/middleware-cCdfTTMv.js

@@ -1,25 +0,0 @@
-
-      import { Temporal } from "@js-temporal/polyfill";
-      import { URLPattern } from "urlpattern-polyfill";
-      globalThis.addEventListener = () => {};
-    
-import "./type-FCer_9yh.js";
-import { ContextImpl, FederationImpl, InboxContextImpl, KvSpecDeterminer, createFederation } from "./middleware-BDN7YoYJ.js";
-import "./client-BqyuOGiQ.js";
-import "./lookup-BrhURkmj.js";
-import "./types-BSuWJsOm.js";
-import "./actor-Cpal85xW.js";
-import "./key-DORX19Bl.js";
-import "./http-y7khnX5Q.js";
-import "./authdocloader-Df2BFefL.js";
-import "./ld-D3cq9xO1.js";
-import "./owner-NFlQJyvM.js";
-import "./proof-ar9xgPWi.js";
-import "./inbox-DpcYOzs8.js";
-import "./builder-CMxichO9.js";
-import "./collection-CcnIw1qY.js";
-import "./keycache-AH1uj1j-.js";
-import "./retry-CfF8Gn4d.js";
-import "./send-DkwkMFjJ.js";
-
-export { FederationImpl };