@fedify/fedify 2.0.0-pr.435.1673 → 2.0.0-pr.449.1725

package/dist/{vocab-DWZQ7gVQ.cjs → vocab-NZXL5Pr-.cjs}

@@ -3,9 +3,9 @@
           const { URLPattern } = require("urlpattern-polyfill");
         
 const require_chunk = require('./chunk-DqRYRqnO.cjs');
-const require_docloader = require('./docloader-SZjTrl6Z.cjs');
-const require_actor = require('./actor-CNUje03O.cjs');
-const require_lookup = require('./lookup-C-Y0Ep1a.cjs');
+const require_docloader = require('./docloader-BdF5STdg.cjs');
+const require_actor = require('./actor-CsRJa7wV.cjs');
+const require_lookup = require('./lookup-B2Bsau2g.cjs');
 const __logtape_logtape = require_chunk.__toESM(require("@logtape/logtape"));
 const __opentelemetry_api = require_chunk.__toESM(require("@opentelemetry/api"));
 const es_toolkit = require_chunk.__toESM(require("es-toolkit"));
@@ -153,14 +153,13 @@ async function lookupObject(identifier, options = {}) {
 async function lookupObjectInternal(identifier, options = {}) {
 	const documentLoader = options.documentLoader ?? require_docloader.getDocumentLoader({ userAgent: options.userAgent });
 	if (typeof identifier === "string") identifier = toAcctUrl(identifier) ?? new URL(identifier);
-	let document = null;
+	let remoteDoc = null;
 	if (identifier.protocol === "http:" || identifier.protocol === "https:") try {
-		const remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
-		document = remoteDoc.document;
+		remoteDoc = await documentLoader(identifier.href, { signal: options.signal });
 	} catch (error) {
 		logger.debug("Failed to fetch remote document:\n{error}", { error });
 	}
-	if (document == null) {
+	if (remoteDoc == null) {
 		const jrd = await require_lookup.lookupWebFinger(identifier, {
 			userAgent: options.userAgent,
 			tracerProvider: options.tracerProvider,
@@ -171,8 +170,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 		for (const l of jrd.links) {
 			if (l.type !== "application/activity+json" && !l.type?.match(/application\/ld\+json;\s*profile="https:\/\/www.w3.org\/ns\/activitystreams"/) || l.rel !== "self" || l.href == null) continue;
 			try {
-				const remoteDoc = await documentLoader(l.href, { signal: options.signal });
-				document = remoteDoc.document;
+				remoteDoc = await documentLoader(l.href, { signal: options.signal });
 				break;
 			} catch (error) {
 				logger.debug("Failed to fetch remote document:\n{error}", { error });
@@ -180,23 +178,34 @@ async function lookupObjectInternal(identifier, options = {}) {
 			}
 		}
 	}
-	if (document == null) return null;
+	if (remoteDoc == null) return null;
+	let object;
 	try {
-		return await require_actor.Object.fromJsonLd(document, {
+		object = await require_actor.Object.fromJsonLd(remoteDoc.document, {
 			documentLoader,
 			contextLoader: options.contextLoader,
-			tracerProvider: options.tracerProvider
+			tracerProvider: options.tracerProvider,
+			baseUrl: new URL(remoteDoc.documentUrl)
 		});
 	} catch (error) {
 		if (error instanceof TypeError) {
 			logger.debug("Failed to parse JSON-LD document: {error}\n{document}", {
-				error,
-				document
+				...remoteDoc,
+				error
 			});
 			return null;
 		}
 		throw error;
 	}
+	if (options.crossOrigin !== "trust" && object.id != null && object.id.origin !== new URL(remoteDoc.documentUrl).origin) {
+		if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
+		logger.warn("The object's @id ({objectId}) has a different origin than the document URL ({documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to \"trust\".", {
+			...remoteDoc,
+			objectId: object.id.href
+		});
+		return null;
+	}
+	return object;
 }
 /**
 * Traverses a collection, yielding each item in the collection.

package/dist/webfinger/handler.test.js

@@ -3,30 +3,30 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { Image, Link, Person } from "../type-BYN6Ax2M.js";
+import { Image, Link, Person } from "../type-COb6KNlm.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
 import { MemoryKvStore } from "../kv-CRZrzyXm.js";
-import { createFederation, handleWebFinger } from "../middleware-CMiUxZ6O.js";
-import "../client-yGBH5stP.js";
-import "../lookup-DuqY2_In.js";
+import { createFederation, handleWebFinger } from "../middleware-BDqkoMAQ.js";
+import "../client-BS-GE3XI.js";
+import "../lookup-C3pnuyiD.js";
 import "../types-BSuWJsOm.js";
-import "../actor-BxAu0qet.js";
-import "../key-Cps8Sv3N.js";
-import "../http-BEo67UOx.js";
-import "../authdocloader-Chl2nuOI.js";
-import "../ld-CXygHn_m.js";
-import "../owner-D2fTlp_x.js";
-import "../proof-kEUjWRNJ.js";
-import "../inbox-D-B5xFtJ.js";
-import "../builder-C8Of4dPy.js";
+import "../actor-VrXd7EdX.js";
+import "../key-BSJX6n9o.js";
+import "../http-DbyMqL2X.js";
+import "../authdocloader-C8LXxsmU.js";
+import "../ld-CAJ6Q2od.js";
+import "../owner-CaIfLBwg.js";
+import "../proof-BQwXHakc.js";
+import "../inbox-DQlf_-Dz.js";
+import "../builder-JjsppXTK.js";
 import "../collection-CcnIw1qY.js";
-import "../keycache-D_Q1fPV0.js";
+import "../keycache-CcIfdj0m.js";
 import "../negotiation-5NPJL6zp.js";
 import "../retry-D4GJ670a.js";
-import "../send-Utq2Jm0I.js";
-import { createRequestContext, test } from "../testing-DUpTIvNE.js";
+import "../send-DQd3R1Oc.js";
+import { createRequestContext, test } from "../testing-BljKU-GG.js";
 import "../std__assert-X-_kMxKM.js";
 import "../assert_rejects-DiIiJbZn.js";
 import "../assert_is_error-BPGph1Jx.js";

package/dist/webfinger/lookup.test.js

@@ -3,18 +3,18 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import { lookupWebFinger } from "../type-BYN6Ax2M.js";
+import { lookupWebFinger } from "../type-COb6KNlm.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-DuqY2_In.js";
-import { test } from "../testing-DUpTIvNE.js";
+import "../lookup-C3pnuyiD.js";
+import { test } from "../testing-BljKU-GG.js";
 import "../std__assert-X-_kMxKM.js";
 import "../assert_rejects-DiIiJbZn.js";
 import "../assert_is_error-BPGph1Jx.js";
 import "../assert_not_equals-f3m3epl3.js";
 import "../assert_throws-BOO88avQ.js";
-import { esm_default } from "../esm-e_G_xo95.js";
+import { esm_default } from "../esm-CvUgdJZ_.js";
 import { withTimeout } from "es-toolkit";
 
 //#region src/webfinger/lookup.test.ts

package/dist/webfinger/mod.cjs

@@ -2,8 +2,8 @@
           const { Temporal } = require("@js-temporal/polyfill");
           const { URLPattern } = require("urlpattern-polyfill");
         
-require('../docloader-SZjTrl6Z.cjs');
-const require_lookup = require('../lookup-C-Y0Ep1a.cjs');
+require('../docloader-BdF5STdg.cjs');
+const require_lookup = require('../lookup-B2Bsau2g.cjs');
 require('../webfinger-BjOEdFPs.cjs');
 
 exports.lookupWebFinger = require_lookup.lookupWebFinger;

package/dist/webfinger/mod.js

@@ -2,8 +2,8 @@
           import { Temporal } from "@js-temporal/polyfill";
           import { URLPattern } from "urlpattern-polyfill";
         
-import "../docloader-_WdHTWQR.js";
-import { lookupWebFinger } from "../lookup-C6WSLjPE.js";
+import "../docloader-AMdJU291.js";
+import { lookupWebFinger } from "../lookup-BGCuyJRy.js";
 import "../webfinger-De_bU0iE.js";
 
 export { lookupWebFinger };

package/dist/x/cfworkers.test.js

@@ -3,12 +3,12 @@
       import { URLPattern } from "urlpattern-polyfill";
       globalThis.addEventListener = () => {};
     
-import "../type-BYN6Ax2M.js";
+import "../type-COb6KNlm.js";
 import { assertEquals } from "../assert_equals-DSbWqCm3.js";
 import "../assert-MZs1qjMx.js";
 import "../assert_instance_of-DHz7EHNU.js";
-import "../lookup-DuqY2_In.js";
-import { test } from "../testing-DUpTIvNE.js";
+import "../lookup-C3pnuyiD.js";
+import { test } from "../testing-BljKU-GG.js";
 import "../std__assert-X-_kMxKM.js";
 import "../assert_rejects-DiIiJbZn.js";
 import "../assert_is_error-BPGph1Jx.js";

package/dist/x/hono.d.cts

@@ -1,13 +1,13 @@
 import "../kv-63Cil1MD.cjs";
 import "../docloader-D-MrRyHl.cjs";
 import "../client-CegPX0Rn.cjs";
-import "../vocab-DJTYMqyU.cjs";
-import "../actor-DMgu-ZjT.cjs";
-import "../http-BS6766zs.cjs";
-import "../owner-B-7Ptt_m.cjs";
-import "../mod-evzlRVZq.cjs";
+import "../vocab-Dw1-yVGg.cjs";
+import "../actor-D6K058Tb.cjs";
+import "../http-D-e6AFwR.cjs";
+import "../owner-BN_tO3cY.cjs";
+import "../mod-CxkWO3Mg.cjs";
 import "../mod-jQ4OODsl.cjs";
-import { Federation } from "../context-tVOQ76fi.cjs";
+import { Federation } from "../context-DYCJXr7J.cjs";
 import "../mq-B7R1Q-M5.cjs";
 
 //#region src/x/hono.d.ts

package/dist/x/hono.d.ts

@@ -3,13 +3,13 @@ import { URLPattern } from "urlpattern-polyfill";
 import "../kv-C7sopW2E.js";
 import "../docloader-CxWcuWqQ.js";
 import "../client-bgSdkFa2.js";
-import "../vocab-SOE1ifCr.js";
-import "../actor-C22bXuuC.js";
-import "../http-DqSNLFNY.js";
-import "../owner-CQPnQVtf.js";
-import "../mod-Cxt4Kpf6.js";
+import "../vocab-BI0Ak5lL.js";
+import "../actor-T6RyhRgk.js";
+import "../http-D6Uj2x2y.js";
+import "../owner-hd9lvQcP.js";
+import "../mod-DlU8ISoa.js";
 import "../mod-DBzN0aCM.js";
-import { Federation } from "../context-CQsAT7xk.js";
+import { Federation } from "../context-B1X8-X33.js";
 import "../mq-CRGm1e_F.js";
 
 //#region src/x/hono.d.ts

package/dist/x/sveltekit.d.cts

@@ -1,13 +1,13 @@
 import "../kv-63Cil1MD.cjs";
 import "../docloader-D-MrRyHl.cjs";
 import "../client-CegPX0Rn.cjs";
-import "../vocab-DJTYMqyU.cjs";
-import "../actor-DMgu-ZjT.cjs";
-import "../http-BS6766zs.cjs";
-import "../owner-B-7Ptt_m.cjs";
-import "../mod-evzlRVZq.cjs";
+import "../vocab-Dw1-yVGg.cjs";
+import "../actor-D6K058Tb.cjs";
+import "../http-D-e6AFwR.cjs";
+import "../owner-BN_tO3cY.cjs";
+import "../mod-CxkWO3Mg.cjs";
 import "../mod-jQ4OODsl.cjs";
-import { Federation } from "../context-tVOQ76fi.cjs";
+import { Federation } from "../context-DYCJXr7J.cjs";
 import "../mq-B7R1Q-M5.cjs";
 
 //#region src/x/sveltekit.d.ts

package/dist/x/sveltekit.d.ts

@@ -3,13 +3,13 @@ import { URLPattern } from "urlpattern-polyfill";
 import "../kv-C7sopW2E.js";
 import "../docloader-CxWcuWqQ.js";
 import "../client-bgSdkFa2.js";
-import "../vocab-SOE1ifCr.js";
-import "../actor-C22bXuuC.js";
-import "../http-DqSNLFNY.js";
-import "../owner-CQPnQVtf.js";
-import "../mod-Cxt4Kpf6.js";
+import "../vocab-BI0Ak5lL.js";
+import "../actor-T6RyhRgk.js";
+import "../http-D6Uj2x2y.js";
+import "../owner-hd9lvQcP.js";
+import "../mod-DlU8ISoa.js";
 import "../mod-DBzN0aCM.js";
-import { Federation } from "../context-CQsAT7xk.js";
+import { Federation } from "../context-B1X8-X33.js";
 import "../mq-CRGm1e_F.js";
 
 //#region src/x/sveltekit.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "2.0.0-pr.435.1673+515e9f9e",
+  "version": "2.0.0-pr.449.1725+70c3284b",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",

package/dist/key-BvvbahfP.cjs

@@ -1,10 +0,0 @@
-
-          const { Temporal } = require("@js-temporal/polyfill");
-          const { URLPattern } = require("urlpattern-polyfill");
-        
-require('./docloader-SZjTrl6Z.cjs');
-require('./actor-CNUje03O.cjs');
-require('./lookup-C-Y0Ep1a.cjs');
-const require_key = require('./key-JqiQvcq1.cjs');
-
-exports.validateCryptoKey = require_key.validateCryptoKey;

package/dist/middleware-BD1IE5O5.js

@@ -1,26 +0,0 @@
-
-      import { Temporal } from "@js-temporal/polyfill";
-      import { URLPattern } from "urlpattern-polyfill";
-      globalThis.addEventListener = () => {};
-    
-import "./type-BYN6Ax2M.js";
-import { ContextImpl, FederationImpl, InboxContextImpl, KvSpecDeterminer, createFederation } from "./middleware-CMiUxZ6O.js";
-import "./client-yGBH5stP.js";
-import "./lookup-DuqY2_In.js";
-import "./types-BSuWJsOm.js";
-import "./actor-BxAu0qet.js";
-import "./key-Cps8Sv3N.js";
-import "./http-BEo67UOx.js";
-import "./authdocloader-Chl2nuOI.js";
-import "./ld-CXygHn_m.js";
-import "./owner-D2fTlp_x.js";
-import "./proof-kEUjWRNJ.js";
-import "./inbox-D-B5xFtJ.js";
-import "./builder-C8Of4dPy.js";
-import "./collection-CcnIw1qY.js";
-import "./keycache-D_Q1fPV0.js";
-import "./negotiation-5NPJL6zp.js";
-import "./retry-D4GJ670a.js";
-import "./send-Utq2Jm0I.js";
-
-export { FederationImpl };

package/dist/middleware-BuZrvrDv.js

@@ -1,17 +0,0 @@
-
-          import { Temporal } from "@js-temporal/polyfill";
-          import { URLPattern } from "urlpattern-polyfill";
-        
-import "./transformers-BFT6d7J5.js";
-import "./docloader-_WdHTWQR.js";
-import "./actor-m_ko-86v.js";
-import { ContextImpl, FederationImpl, InboxContextImpl, KvSpecDeterminer, createFederation } from "./middleware-2qNNXYEE.js";
-import "./lookup-C6WSLjPE.js";
-import "./key-Cf8KTg-A.js";
-import "./http-BpoEurUR.js";
-import "./proof-CHM9su4L.js";
-import "./types-BXkh8ctL.js";
-import "./authdocloader-nRFL9luh.js";
-import "./vocab-PKJB4DyY.js";
-
-export { FederationImpl };

package/dist/middleware-h_3nRr8m.cjs

@@ -1,17 +0,0 @@
-
-          const { Temporal } = require("@js-temporal/polyfill");
-          const { URLPattern } = require("urlpattern-polyfill");
-        
-require('./transformers-CoBS-oFG.cjs');
-require('./docloader-SZjTrl6Z.cjs');
-require('./actor-CNUje03O.cjs');
-const require_middleware = require('./middleware-BsFAFlnZ.cjs');
-require('./lookup-C-Y0Ep1a.cjs');
-require('./key-JqiQvcq1.cjs');
-require('./http-DREvFalF.cjs');
-require('./proof-C4Y4gJcm.cjs');
-require('./types-BBpQe860.cjs');
-require('./authdocloader-D_3mtAjX.cjs');
-require('./vocab-DWZQ7gVQ.cjs');
-
-exports.FederationImpl = require_middleware.FederationImpl;