@fedify/fedify 2.0.35-dev.2470 → 2.0.35-dev.2485

package/dist/sig/ld.test.mjs

@@ -5,9 +5,9 @@ import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { n as assertInstanceOf, t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { i as generateCryptoKeyPair } from "../key-CDAqlyxF.mjs";
+import { i as generateCryptoKeyPair } from "../key-CgcWGw6W.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { a as compactJsonLd, d as isInvalidUrlTypeError, f as signJsonLd, h as verifySignature, i as attachSignature, m as verifyJsonLd, n as UnsafeJsonLdError, o as createSignature, s as detachSignature } from "../ld-Ceiqwon2.mjs";
+import { a as compactJsonLd, d as isInvalidUrlTypeError, f as signJsonLd, h as verifySignature, i as attachSignature, m as verifyJsonLd, n as UnsafeJsonLdError, o as createSignature, s as detachSignature } from "../ld-CfOIwHup.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { CryptographicKey } from "@fedify/vocab";
 import { encodeBase64 } from "byte-encodings/base64";

package/dist/sig/mod.cjs

@@ -1,8 +1,8 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_http = require("../http-C7d5tddX.cjs");
-const require_proof = require("../proof-DllVQdfR.cjs");
+const require_http = require("../http-CjkqnlR2.cjs");
+const require_proof = require("../proof-BssSZpMi.cjs");
 exports.attachSignature = require_proof.attachSignature;
 exports.createProof = require_proof.createProof;
 exports.createSignature = require_proof.createSignature;

package/dist/sig/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { a as signRequest, c as FetchKeyResult, d as fetchKey, f as generateCryptoKeyPair, i as VerifyRequestOptions, l as KeyCache, n as HttpMessageSignaturesSpecDeterminer, o as verifyRequest, p as importJwk, r as SignRequestOptions, s as FetchKeyOptions, t as HttpMessageSignaturesSpec, u as exportJwk } from "../http-Bs6thuCC.cjs";
+import { a as signRequest, c as FetchKeyResult, d as fetchKey, f as generateCryptoKeyPair, i as VerifyRequestOptions, l as KeyCache, n as HttpMessageSignaturesSpecDeterminer, o as verifyRequest, p as importJwk, r as SignRequestOptions, s as FetchKeyOptions, t as HttpMessageSignaturesSpec, u as exportJwk } from "../http-DFqAb11b.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-B3hNQCG8.cjs";
-import { _ as verifyJsonLd, a as createProof, c as verifyProof, d as VerifyJsonLdOptions, f as VerifySignatureOptions, g as signJsonLd, h as detachSignature, i as VerifyProofOptions, l as CreateSignatureOptions, m as createSignature, n as SignObjectOptions, o as signObject, p as attachSignature, r as VerifyObjectOptions, s as verifyObject, t as CreateProofOptions, u as SignJsonLdOptions, v as verifySignature } from "../mod-IOWUF5Yr.cjs";
+import { _ as verifyJsonLd, a as createProof, c as verifyProof, d as VerifyJsonLdOptions, f as VerifySignatureOptions, g as signJsonLd, h as detachSignature, i as VerifyProofOptions, l as CreateSignatureOptions, m as createSignature, n as SignObjectOptions, o as signObject, p as attachSignature, r as VerifyObjectOptions, s as verifyObject, t as CreateProofOptions, u as SignJsonLdOptions, v as verifySignature } from "../mod-DVPS4yam.cjs";
 export { CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyOptions, FetchKeyResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyProofOptions, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, generateCryptoKeyPair, getKeyOwner, importJwk, signJsonLd, signObject, signRequest, verifyJsonLd, verifyObject, verifyProof, verifyRequest, verifySignature };

package/dist/sig/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { a as signRequest, c as FetchKeyResult, d as fetchKey, f as generateCryptoKeyPair, i as VerifyRequestOptions, l as KeyCache, n as HttpMessageSignaturesSpecDeterminer, o as verifyRequest, p as importJwk, r as SignRequestOptions, s as FetchKeyOptions, t as HttpMessageSignaturesSpec, u as exportJwk } from "../http-CDupyfOc.js";
+import { a as signRequest, c as FetchKeyResult, d as fetchKey, f as generateCryptoKeyPair, i as VerifyRequestOptions, l as KeyCache, n as HttpMessageSignaturesSpecDeterminer, o as verifyRequest, p as importJwk, r as SignRequestOptions, s as FetchKeyOptions, t as HttpMessageSignaturesSpec, u as exportJwk } from "../http-Cd8UD1ym.js";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "../owner-CiBPcC6F.js";
-import { _ as verifyJsonLd, a as createProof, c as verifyProof, d as VerifyJsonLdOptions, f as VerifySignatureOptions, g as signJsonLd, h as detachSignature, i as VerifyProofOptions, l as CreateSignatureOptions, m as createSignature, n as SignObjectOptions, o as signObject, p as attachSignature, r as VerifyObjectOptions, s as verifyObject, t as CreateProofOptions, u as SignJsonLdOptions, v as verifySignature } from "../mod-E7YM72JZ.js";
+import { _ as verifyJsonLd, a as createProof, c as verifyProof, d as VerifyJsonLdOptions, f as VerifySignatureOptions, g as signJsonLd, h as detachSignature, i as VerifyProofOptions, l as CreateSignatureOptions, m as createSignature, n as SignObjectOptions, o as signObject, p as attachSignature, r as VerifyObjectOptions, s as verifyObject, t as CreateProofOptions, u as SignJsonLdOptions, v as verifySignature } from "../mod-BS-jg3Wx.js";
 export { CreateProofOptions, CreateSignatureOptions, DoesActorOwnKeyOptions, FetchKeyOptions, FetchKeyResult, GetKeyOwnerOptions, HttpMessageSignaturesSpec, HttpMessageSignaturesSpecDeterminer, KeyCache, SignJsonLdOptions, SignObjectOptions, SignRequestOptions, VerifyJsonLdOptions, VerifyObjectOptions, VerifyProofOptions, VerifyRequestOptions, VerifySignatureOptions, attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, generateCryptoKeyPair, getKeyOwner, importJwk, signJsonLd, signObject, signRequest, verifyJsonLd, verifyObject, verifyProof, verifyRequest, verifySignature };

package/dist/sig/mod.js

@@ -1,5 +1,5 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { c as importJwk, i as exportJwk, n as signRequest, o as fetchKey, r as verifyRequest, s as generateCryptoKeyPair } from "../http-BTQ5wllw.js";
-import { _ as signJsonLd, a as doesActorOwnKey, b as verifySignature, d as createSignature, f as detachSignature, i as verifyProof, l as attachSignature, n as signObject, o as getKeyOwner, r as verifyObject, t as createProof, y as verifyJsonLd } from "../proof-ClDA_fq4.js";
+import { c as importJwk, i as exportJwk, n as signRequest, o as fetchKey, r as verifyRequest, s as generateCryptoKeyPair } from "../http-DVEBwq6e.js";
+import { _ as signJsonLd, a as doesActorOwnKey, b as verifySignature, d as createSignature, f as detachSignature, i as verifyProof, l as attachSignature, n as signObject, o as getKeyOwner, r as verifyObject, t as createProof, y as verifyJsonLd } from "../proof-Cp62GFJ3.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, generateCryptoKeyPair, getKeyOwner, importJwk, signJsonLd, signObject, signRequest, verifyJsonLd, verifyObject, verifyProof, verifyRequest, verifySignature };

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import "../std__assert-DflMZha5.mjs";
 import { r as assertFalse } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-CCxRJhWa.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-Cmn2WKBi.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-BvVwCoj2.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 //#region src/sig/owner.test.ts

package/dist/sig/proof.test.mjs

@@ -6,7 +6,7 @@ import "../std__assert-DflMZha5.mjs";
 import { n as assertInstanceOf } from "../assert-BhQd8QHP.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { i as verifyProof, n as signObject, r as verifyObject, t as createProof } from "../proof-VZ9Ryp3F.mjs";
+import { i as verifyProof, n as signObject, r as verifyObject, t as createProof } from "../proof-C9TBSmUR.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { Create, DataIntegrityProof, Multikey, Note, Place } from "@fedify/vocab";
 import { decodeMultibase, importMultibaseKey } from "@fedify/vocab-runtime";

package/dist/{temporal-DXm8zGR8.mjs → temporal-BNtFi_ut.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-Ceiqwon2.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CfOIwHup.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/mod.d.mts

@@ -5,7 +5,6 @@ import { Activity, Actor, Collection, CryptographicKey, Hashtag, Link, LookupObj
 import { Link as Link$1, LookupWebFingerOptions, ResourceDescriptor } from "@fedify/webfinger";
 import { TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader, GetUserAgentOptions } from "@fedify/vocab-runtime";
-
 //#region src/nodeinfo/types.d.ts
 /**
  * The type of the result of parsing JSON.

package/dist/{types-miAYfiGO.js → types-B1_pRFE_.js}

@@ -1,7 +1,8 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { getLogger } from "@logtape/logtape";
-import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getUserAgent } from "@fedify/vocab-runtime";
+import { openPublicFetch } from "@fedify/vocab-runtime/internal";
 //#region src/utils/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */
 const MAX_BODY_SIZE = 16 * 1024 * 1024;
@@ -84,23 +85,34 @@ const logger = getLogger([
 ]);
 const DEFAULT_MAX_REDIRECTION = 5;
 /**
-* Fetches a URL while guarding against SSRF.  Before every request—including
-* each redirect hop—the destination is validated with
-* {@link validatePublicUrl}, so that loopback, link-local, and private
-* addresses, as well as non-HTTP(S) schemes such as `data:`, are rejected.
-* Redirects are followed manually with a cap, so that a public URL cannot
-* bounce the request to an internal address.
+* Fetches a URL while guarding against SSRF.  Every request—including each
+* redirect hop—is made in its own session opened with `openPublicFetch()`,
+* which rejects loopback, link-local, and private addresses, as well as
+* non-HTTP(S) schemes such as `data:`, and connects only to the validated
+* addresses where the runtime supports it.  Redirects are followed manually
+* with a cap, so that a public URL cannot bounce the request to an internal
+* address.
+*
+* The final response is passed to `consume`, which must consume or cancel its
+* body; the session is closed after `consume` settles.  The cancellation of
+* redirect response bodies is started before their sessions are closed.
 * @param url The URL to fetch.
 * @param headers The request headers.
-* @returns The final response, or `null` if the URL is disallowed, its
-*          hostname cannot be resolved, or there are too many redirects.
+* @param consume The function to consume the final response with.
+* @param deps The dependencies.
+* @returns The value returned by `consume`, or `null` if the URL is
+*          disallowed, its hostname cannot be resolved, or there are too many
+*          redirects.
+* @internal
 */
-async function fetchPublicUrl(url, headers) {
+async function fetchPublicUrl(url, headers, consume, deps = {}) {
+	const openHop = deps.openHop ?? ((hopUrl) => openPublicFetch(hopUrl));
 	let current = url instanceof URL ? url : new URL(url);
 	let redirected = 0;
 	while (true) {
+		let session;
 		try {
-			await validatePublicUrl(current.href);
+			session = await openHop(current.href);
 		} catch (e) {
 			if (e instanceof UrlError) {
 				if (e.reason === "dns") logger.error("DNS lookup failed for {url}: {error}", {
@@ -115,52 +127,89 @@ async function fetchPublicUrl(url, headers) {
 			}
 			throw e;
 		}
-		const response = await fetch(current, {
-			headers,
-			redirect: "manual"
-		});
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-			redirected++;
-			if (redirected >= DEFAULT_MAX_REDIRECTION) {
-				logger.error("Too many redirections ({redirections}) while fetching {url}.", {
-					redirections: redirected,
-					url: current.href
-				});
-				return null;
-			}
-			const next = new URL(response.headers.get("Location"), response.url == null || response.url === "" ? current : response.url);
-			if (next.protocol !== current.protocol) {
-				logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
-					protocol: current.protocol,
-					redirectedProtocol: next.protocol
-				});
-				return null;
-			}
-			current = next;
-			continue;
+		let location;
+		try {
+			const response = await session.fetch(current, {
+				headers,
+				redirect: "manual"
+			});
+			if (response.status < 300 || response.status >= 400 || !response.headers.has("Location")) return await consume(response);
+			location = response.headers.get("Location");
+			cancelBody(response, current);
+		} finally {
+			await session.close();
+		}
+		redirected++;
+		if (redirected >= DEFAULT_MAX_REDIRECTION) {
+			logger.error("Too many redirections ({redirections}) while fetching {url}.", {
+				redirections: redirected,
+				url: current.href
+			});
+			return null;
+		}
+		const next = new URL(location, current);
+		if (next.protocol !== current.protocol) {
+			logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
+				protocol: current.protocol,
+				redirectedProtocol: next.protocol
+			});
+			return null;
 		}
-		return response;
+		current = next;
 	}
 }
+/**
+* Starts cancelling a response body that is not read, without waiting for it
+* to settle.  The cancellation of a branch of a tee (e.g., a body cloned by
+* a fetch mock) settles only after the other branch is cancelled too, per
+* the Streams standard, so awaiting it could block forever.  A failure is
+* only logged.
+*/
+function cancelBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url: url.toString(),
+			error
+		});
+	});
+}
 async function getNodeInfo(url, options = {}) {
+	return await getNodeInfoInternal(url, options);
+}
+/**
+* The implementation of {@link getNodeInfo}, which is not exported from any
+* entry point.
+* @param url The base URL of the server, or the URL of the NodeInfo document
+*            if `options.direct` is turned on.
+* @param options Options for fetching the NodeInfo document.
+* @param deps The dependencies.
+* @returns The NodeInfo document if it could be fetched successfully.
+*          Otherwise, `undefined` is returned.
+* @internal
+*/
+async function getNodeInfoInternal(url, options = {}, deps = {}) {
 	try {
+		const headers = {
+			Accept: "application/json",
+			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
+		};
 		let nodeInfoUrl = url;
 		if (!options.direct) {
 			const wellKnownUrl = new URL("/.well-known/nodeinfo", url);
-			const wellKnownResponse = await fetchPublicUrl(wellKnownUrl, {
-				Accept: "application/json",
-				"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-			});
-			if (wellKnownResponse == null) return void 0;
-			if (!wellKnownResponse.ok) {
-				logger.error("Failed to fetch {url}: {status} {statusText}", {
-					url: wellKnownUrl.href,
-					status: wellKnownResponse.status,
-					statusText: wellKnownResponse.statusText
-				});
-				return;
-			}
-			const wellKnownRd = JSON.parse(await readBoundedText(wellKnownResponse, MAX_BODY_SIZE, wellKnownUrl));
+			const wellKnown = await fetchPublicUrl(wellKnownUrl, headers, async (response) => {
+				if (!response.ok) {
+					logger.error("Failed to fetch {url}: {status} {statusText}", {
+						url: wellKnownUrl.href,
+						status: response.status,
+						statusText: response.statusText
+					});
+					cancelBody(response, wellKnownUrl);
+					return;
+				}
+				return { rd: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, wellKnownUrl)) };
+			}, deps);
+			if (wellKnown == null) return void 0;
+			const wellKnownRd = wellKnown.rd;
 			const link = wellKnownRd?.links?.find((link) => link != null && "rel" in link && (link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.0" || link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.1") && "href" in link && link.href != null);
 			if (link == null || link.href == null) {
 				logger.error("Failed to find a NodeInfo document link from {url}: {resourceDescriptor}", {
@@ -171,20 +220,20 @@ async function getNodeInfo(url, options = {}) {
 			}
 			nodeInfoUrl = link.href;
 		}
-		const response = await fetchPublicUrl(nodeInfoUrl, {
-			Accept: "application/json",
-			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-		});
-		if (response == null) return void 0;
-		if (!response.ok) {
-			logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
-				url: nodeInfoUrl.toString(),
-				status: response.status,
-				statusText: response.statusText
-			});
-			return;
-		}
-		const data = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl));
+		const document = await fetchPublicUrl(nodeInfoUrl, headers, async (response) => {
+			if (!response.ok) {
+				logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
+					url: nodeInfoUrl.toString(),
+					status: response.status,
+					statusText: response.statusText
+				});
+				cancelBody(response, nodeInfoUrl);
+				return;
+			}
+			return { data: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl)) };
+		}, deps);
+		if (document == null) return void 0;
+		const { data } = document;
 		if (options.parse === "none") return data;
 		return parseNodeInfo(data, { tryBestEffort: options.parse === "best-effort" }) ?? void 0;
 	} catch (error) {

package/dist/{types-DRPjmHVV.cjs → types-DOvyymM4.cjs}

@@ -3,6 +3,7 @@ const { URLPattern } = require("urlpattern-polyfill");
 require("./chunk-DDcVe30Y.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let _fedify_vocab_runtime_internal = require("@fedify/vocab-runtime/internal");
 //#region src/utils/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */
 const MAX_BODY_SIZE = 16 * 1024 * 1024;
@@ -85,23 +86,34 @@ const logger = (0, _logtape_logtape.getLogger)([
 ]);
 const DEFAULT_MAX_REDIRECTION = 5;
 /**
-* Fetches a URL while guarding against SSRF.  Before every request—including
-* each redirect hop—the destination is validated with
-* {@link validatePublicUrl}, so that loopback, link-local, and private
-* addresses, as well as non-HTTP(S) schemes such as `data:`, are rejected.
-* Redirects are followed manually with a cap, so that a public URL cannot
-* bounce the request to an internal address.
+* Fetches a URL while guarding against SSRF.  Every request—including each
+* redirect hop—is made in its own session opened with `openPublicFetch()`,
+* which rejects loopback, link-local, and private addresses, as well as
+* non-HTTP(S) schemes such as `data:`, and connects only to the validated
+* addresses where the runtime supports it.  Redirects are followed manually
+* with a cap, so that a public URL cannot bounce the request to an internal
+* address.
+*
+* The final response is passed to `consume`, which must consume or cancel its
+* body; the session is closed after `consume` settles.  The cancellation of
+* redirect response bodies is started before their sessions are closed.
 * @param url The URL to fetch.
 * @param headers The request headers.
-* @returns The final response, or `null` if the URL is disallowed, its
-*          hostname cannot be resolved, or there are too many redirects.
+* @param consume The function to consume the final response with.
+* @param deps The dependencies.
+* @returns The value returned by `consume`, or `null` if the URL is
+*          disallowed, its hostname cannot be resolved, or there are too many
+*          redirects.
+* @internal
 */
-async function fetchPublicUrl(url, headers) {
+async function fetchPublicUrl(url, headers, consume, deps = {}) {
+	const openHop = deps.openHop ?? ((hopUrl) => (0, _fedify_vocab_runtime_internal.openPublicFetch)(hopUrl));
 	let current = url instanceof URL ? url : new URL(url);
 	let redirected = 0;
 	while (true) {
+		let session;
 		try {
-			await (0, _fedify_vocab_runtime.validatePublicUrl)(current.href);
+			session = await openHop(current.href);
 		} catch (e) {
 			if (e instanceof _fedify_vocab_runtime.UrlError) {
 				if (e.reason === "dns") logger.error("DNS lookup failed for {url}: {error}", {
@@ -116,52 +128,89 @@ async function fetchPublicUrl(url, headers) {
 			}
 			throw e;
 		}
-		const response = await fetch(current, {
-			headers,
-			redirect: "manual"
-		});
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-			redirected++;
-			if (redirected >= DEFAULT_MAX_REDIRECTION) {
-				logger.error("Too many redirections ({redirections}) while fetching {url}.", {
-					redirections: redirected,
-					url: current.href
-				});
-				return null;
-			}
-			const next = new URL(response.headers.get("Location"), response.url == null || response.url === "" ? current : response.url);
-			if (next.protocol !== current.protocol) {
-				logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
-					protocol: current.protocol,
-					redirectedProtocol: next.protocol
-				});
-				return null;
-			}
-			current = next;
-			continue;
+		let location;
+		try {
+			const response = await session.fetch(current, {
+				headers,
+				redirect: "manual"
+			});
+			if (response.status < 300 || response.status >= 400 || !response.headers.has("Location")) return await consume(response);
+			location = response.headers.get("Location");
+			cancelBody(response, current);
+		} finally {
+			await session.close();
+		}
+		redirected++;
+		if (redirected >= DEFAULT_MAX_REDIRECTION) {
+			logger.error("Too many redirections ({redirections}) while fetching {url}.", {
+				redirections: redirected,
+				url: current.href
+			});
+			return null;
+		}
+		const next = new URL(location, current);
+		if (next.protocol !== current.protocol) {
+			logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
+				protocol: current.protocol,
+				redirectedProtocol: next.protocol
+			});
+			return null;
 		}
-		return response;
+		current = next;
 	}
 }
+/**
+* Starts cancelling a response body that is not read, without waiting for it
+* to settle.  The cancellation of a branch of a tee (e.g., a body cloned by
+* a fetch mock) settles only after the other branch is cancelled too, per
+* the Streams standard, so awaiting it could block forever.  A failure is
+* only logged.
+*/
+function cancelBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url: url.toString(),
+			error
+		});
+	});
+}
 async function getNodeInfo(url, options = {}) {
+	return await getNodeInfoInternal(url, options);
+}
+/**
+* The implementation of {@link getNodeInfo}, which is not exported from any
+* entry point.
+* @param url The base URL of the server, or the URL of the NodeInfo document
+*            if `options.direct` is turned on.
+* @param options Options for fetching the NodeInfo document.
+* @param deps The dependencies.
+* @returns The NodeInfo document if it could be fetched successfully.
+*          Otherwise, `undefined` is returned.
+* @internal
+*/
+async function getNodeInfoInternal(url, options = {}, deps = {}) {
 	try {
+		const headers = {
+			Accept: "application/json",
+			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : (0, _fedify_vocab_runtime.getUserAgent)(options.userAgent)
+		};
 		let nodeInfoUrl = url;
 		if (!options.direct) {
 			const wellKnownUrl = new URL("/.well-known/nodeinfo", url);
-			const wellKnownResponse = await fetchPublicUrl(wellKnownUrl, {
-				Accept: "application/json",
-				"User-Agent": typeof options.userAgent === "string" ? options.userAgent : (0, _fedify_vocab_runtime.getUserAgent)(options.userAgent)
-			});
-			if (wellKnownResponse == null) return void 0;
-			if (!wellKnownResponse.ok) {
-				logger.error("Failed to fetch {url}: {status} {statusText}", {
-					url: wellKnownUrl.href,
-					status: wellKnownResponse.status,
-					statusText: wellKnownResponse.statusText
-				});
-				return;
-			}
-			const wellKnownRd = JSON.parse(await readBoundedText(wellKnownResponse, MAX_BODY_SIZE, wellKnownUrl));
+			const wellKnown = await fetchPublicUrl(wellKnownUrl, headers, async (response) => {
+				if (!response.ok) {
+					logger.error("Failed to fetch {url}: {status} {statusText}", {
+						url: wellKnownUrl.href,
+						status: response.status,
+						statusText: response.statusText
+					});
+					cancelBody(response, wellKnownUrl);
+					return;
+				}
+				return { rd: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, wellKnownUrl)) };
+			}, deps);
+			if (wellKnown == null) return void 0;
+			const wellKnownRd = wellKnown.rd;
 			const link = wellKnownRd?.links?.find((link) => link != null && "rel" in link && (link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.0" || link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.1") && "href" in link && link.href != null);
 			if (link == null || link.href == null) {
 				logger.error("Failed to find a NodeInfo document link from {url}: {resourceDescriptor}", {
@@ -172,20 +221,20 @@ async function getNodeInfo(url, options = {}) {
 			}
 			nodeInfoUrl = link.href;
 		}
-		const response = await fetchPublicUrl(nodeInfoUrl, {
-			Accept: "application/json",
-			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : (0, _fedify_vocab_runtime.getUserAgent)(options.userAgent)
-		});
-		if (response == null) return void 0;
-		if (!response.ok) {
-			logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
-				url: nodeInfoUrl.toString(),
-				status: response.status,
-				statusText: response.statusText
-			});
-			return;
-		}
-		const data = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl));
+		const document = await fetchPublicUrl(nodeInfoUrl, headers, async (response) => {
+			if (!response.ok) {
+				logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
+					url: nodeInfoUrl.toString(),
+					status: response.status,
+					statusText: response.statusText
+				});
+				cancelBody(response, nodeInfoUrl);
+				return;
+			}
+			return { data: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl)) };
+		}, deps);
+		if (document == null) return void 0;
+		const { data } = document;
 		if (options.parse === "none") return data;
 		return parseNodeInfo(data, { tryBestEffort: options.parse === "best-effort" }) ?? void 0;
 	} catch (error) {