@fedify/fedify 2.1.29 → 2.1.31

package/dist/{http-B3rSb2GQ.js → http-Crml3gei.js}

@@ -10,7 +10,7 @@ import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } fro
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.1.29";
+var version = "2.1.31";
 //#endregion
 //#region src/sig/accept.ts
 /**
@@ -291,16 +291,23 @@ async function importJwk(jwk, type) {
 /**
 * Fetches the document that the given actor URI dereferences to, and returns
 * the actor only if the host that served the document is authoritative for
-* the id the document claims.
+* the id the document claims, and that id is the actor that was asked for.
 *
 * Only the origin that serves an actor id can speak for it.  Without that
 * rule any host could serve a document describing somebody else's actor—and
 * listing its own keys as that actor's.
 *
+* The returned actor always has exactly the requested `actorId` as its `id`.
+* A document loader follows redirects and alternate document links, so the
+* document an actor id leads to may describe a different actor altogether,
+* on the same origin or on another; accepting it would attribute that other
+* actor's keys to the requested one.  See GHSA-8863-8468-7hq7.
+*
 * @param actorId The URI of the actor to fetch.
 * @param options Options for fetching the document.
 * @returns The actor, or `null` if the document cannot be fetched, is not an
-*          actor, or belongs to another origin.
+*          actor, belongs to another origin, or describes an actor other
+*          than the requested one.
 * @internal
 */
 async function fetchActorDocument(actorId, options = {}) {
@@ -355,6 +362,13 @@ async function fetchActorDocumentInternal(actorId, options, propagateContextFetc
 		});
 		return null;
 	}
+	if (object.id.href !== actorId.href) {
+		logger.debug("The document fetched for the actor {actorId} is the actor {documentActorId} instead; refusing to treat it as the requested actor's document.", {
+			actorId: actorId.href,
+			documentActorId: object.id.href
+		});
+		return null;
+	}
 	return object;
 }
 /**
@@ -1583,10 +1597,10 @@ async function createRedirectRequest(request, location, body, validateRedirect)
 		cache: request.cache
 	});
 }
-async function fetchDoubleKnockRequest(request, signedRequest, signal) {
+async function fetchDoubleKnockRequest(session, request, signedRequest, signal) {
 	const maxAttempts = request.method === "GET" || request.method === "HEAD" ? 2 : 1;
 	for (let attempt = 1;; attempt++) try {
-		return await fetch(signedRequest, {
+		return await session.fetch(signedRequest, {
 			redirect: "manual",
 			signal
 		});
@@ -1637,117 +1651,186 @@ function getAbortReason(signal) {
 	return signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
 }
 /**
-* Performs a double-knock request to the given URL.  For the details of
-* double-knocking, see
-* <https://swicg.github.io/activitypub-http-signature/#how-to-upgrade-supported-versions>.
+* Performs a double-knock request like {@link doubleKnock}, opening a session
+* for every hop with the given function, and passes the final response to
+* the given function.  The final session is closed after `consume` settles,
+* so `consume` must read or cancel the response body before it returns.
+* This is not exported from any entry point.
 * @param request The request to send.
 * @param identity The identity to use for signing the request.
 * @param options The options for double-knock requests.
-* @returns The response to the request.
-* @since 1.6.0
+* @param openHop The function to open a session for each hop.  The session of
+*                a hop is closed before the next hop is opened.
+* @param consume The function to consume the final response.
+* @returns The value returned by `consume`.
 */
-async function doubleKnock(request, identity, options = {}) {
-	return await doubleKnockInternal(request, identity, options);
+async function doubleKnockScoped(request, identity, options, openHop, consume) {
+	const { response, session } = await doubleKnockCore(request, identity, options, openHop);
+	try {
+		return await consume(response);
+	} catch (error) {
+		getLogger([
+			"fedify",
+			"sig",
+			"http"
+		]).debug("Failed to consume the response from {url}; closing the session: {error}", {
+			url: request.url,
+			error
+		});
+		throw error;
+	} finally {
+		await session.close();
+	}
 }
-async function doubleKnockInternal(request, identity, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
-	const { specDeterminer, log, tracerProvider, signal } = options;
-	visited.add(request.url);
-	const origin = new URL(request.url).origin;
-	const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
-	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
-	let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
-		spec: firstTrySpec,
-		tracerProvider,
-		body
-	});
-	log?.(signedRequest);
-	let response = await fetchDoubleKnockRequest(request, signedRequest, signal);
-	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-		if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(request.url, `Too many redirections (${redirected + 1})`);
-		const redirectRequest = await createRedirectRequest(request, response.headers.get("Location"), body, options.validateRedirect);
-		if (visited.has(redirectRequest.url)) throw new FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
-		return doubleKnockInternal(redirectRequest, identity, {
-			...options,
-			body
-		}, redirected + 1, visited);
-	} else if (response.status === 400 || response.status === 401 || response.status > 401) {
-		const logger = getLogger([
+function isRedirectResponse(response) {
+	return response.status >= 300 && response.status < 400 && response.headers.has("Location");
+}
+/**
+* Starts cancelling the body of a response that is not passed to the caller,
+* without waiting for it to settle.  The cancellation of a branch of a tee
+* (e.g., a body cloned by a fetch mock) settles only after the other branch
+* is cancelled too, per the Streams standard, so awaiting it could block
+* forever.  Failures are only logged.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		getLogger([
 			"fedify",
 			"sig",
 			"http"
-		]);
-		const acceptSigHeader = response.headers.get("Accept-Signature");
-		if (acceptSigHeader != null) {
-			const entries = validateAcceptSignature(parseAcceptSignature(acceptSigHeader));
-			const localKeyId = identity.keyId.href;
-			const localAlg = "rsa-v1_5-sha256";
-			let fulfilled = false;
-			let challengeRequest;
-			for (const entry of entries) {
-				const rfc9421 = fulfillAcceptSignature(entry, localKeyId, localAlg);
-				if (rfc9421 == null) continue;
-				logger.debug("Received Accept-Signature challenge; accumulating label {label} and components {components}.", {
-					label: rfc9421.label,
-					components: rfc9421.components
-				});
-				try {
-					challengeRequest = await signRequest(challengeRequest ?? request, identity.privateKey, identity.keyId, {
-						spec: "rfc9421",
-						tracerProvider,
-						body,
-						rfc9421
+		]).debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
+		});
+	});
+}
+async function doubleKnockCore(request, identity, options, openHop) {
+	const { specDeterminer, log, tracerProvider, signal } = options;
+	const visited = /* @__PURE__ */ new Set();
+	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
+	let session = await openHop(request.url);
+	try {
+		for (let redirected = 0;; redirected++) {
+			visited.add(request.url);
+			const origin = new URL(request.url).origin;
+			const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
+			let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+				spec: firstTrySpec,
+				tracerProvider,
+				body
+			});
+			log?.(signedRequest);
+			let response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+			const firstRedirected = isRedirectResponse(response);
+			if (!firstRedirected && (response.status === 400 || response.status === 401 || response.status > 401)) {
+				const logger = getLogger([
+					"fedify",
+					"sig",
+					"http"
+				]);
+				const acceptSigHeader = response.headers.get("Accept-Signature");
+				if (acceptSigHeader != null) {
+					const entries = validateAcceptSignature(parseAcceptSignature(acceptSigHeader));
+					const localKeyId = identity.keyId.href;
+					const localAlg = "rsa-v1_5-sha256";
+					let fulfilled = false;
+					let challengeRequest;
+					for (const entry of entries) {
+						const rfc9421 = fulfillAcceptSignature(entry, localKeyId, localAlg);
+						if (rfc9421 == null) continue;
+						logger.debug("Received Accept-Signature challenge; accumulating label {label} and components {components}.", {
+							label: rfc9421.label,
+							components: rfc9421.components
+						});
+						try {
+							challengeRequest = await signRequest(challengeRequest ?? request, identity.privateKey, identity.keyId, {
+								spec: "rfc9421",
+								tracerProvider,
+								body,
+								rfc9421
+							});
+							fulfilled = true;
+						} catch (error) {
+							logger.debug("Failed to fulfill Accept-Signature challenge entry {label}: {error}", {
+								label: entry.label,
+								error
+							});
+						}
+					}
+					if (fulfilled && challengeRequest != null) {
+						cancelResponseBody(response, request.url);
+						signedRequest = challengeRequest;
+						log?.(signedRequest);
+						response = await session.fetch(signedRequest, {
+							redirect: "manual",
+							signal
+						});
+					}
+					if (fulfilled && !isRedirectResponse(response)) {
+						if (response.status < 300) {
+							await specDeterminer?.rememberSpec(origin, "rfc9421");
+							return {
+								response,
+								session
+							};
+						}
+						if (response.status !== 400 && response.status !== 401) return {
+							response,
+							session
+						};
+					}
+				}
+				if (!isRedirectResponse(response)) {
+					const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
+					getLogger([
+						"fedify",
+						"sig",
+						"http"
+					]).debug("Failed to verify with the spec {spec} ({status} {statusText}); retrying with spec {secondSpec}... (double-knocking)", {
+						spec: firstTrySpec,
+						secondSpec: spec,
+						status: response.status,
+						statusText: response.statusText
 					});
-					fulfilled = true;
-				} catch (error) {
-					logger.debug("Failed to fulfill Accept-Signature challenge entry {label}: {error}", {
-						label: entry.label,
-						error
+					cancelResponseBody(response, request.url);
+					signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+						spec,
+						tracerProvider,
+						body
 					});
+					log?.(signedRequest);
+					response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+					if (!isRedirectResponse(response) && response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
 				}
-			}
-			if (fulfilled && challengeRequest != null) {
-				signedRequest = challengeRequest;
-				log?.(signedRequest);
-				response = await fetch(signedRequest, {
-					redirect: "manual",
-					signal
-				});
-				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) return doubleKnock(await createRedirectRequest(request, response.headers.get("Location"), body, options.validateRedirect), identity, {
-					...options,
-					body
-				});
-			}
-			if (fulfilled && response.status < 300) {
-				await specDeterminer?.rememberSpec(origin, "rfc9421");
-				return response;
-			}
-			if (fulfilled && response.status !== 400 && response.status !== 401) return response;
-		}
-		const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
-		logger.debug("Failed to verify with the spec {spec} ({status} {statusText}); retrying with spec {secondSpec}... (double-knocking)", {
-			spec: firstTrySpec,
-			secondSpec: spec,
-			status: response.status,
-			statusText: response.statusText
-		});
-		signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
-			spec,
-			tracerProvider,
-			body
-		});
-		log?.(signedRequest);
-		response = await fetchDoubleKnockRequest(request, signedRequest, signal);
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+			} else if (!firstRedirected) await specDeterminer?.rememberSpec(origin, firstTrySpec);
+			if (!isRedirectResponse(response)) return {
+				response,
+				session
+			};
+			cancelResponseBody(response, request.url);
+			await session.close();
 			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(request.url, `Too many redirections (${redirected + 1})`);
-			const redirectRequest = await createRedirectRequest(request, response.headers.get("Location"), body, options.validateRedirect);
+			const location = response.headers.get("Location");
+			const redirectRequest = await createRedirectRequest(request, location, body, options.validateRedirect);
 			if (visited.has(redirectRequest.url)) throw new FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
-			return doubleKnockInternal(redirectRequest, identity, {
-				...options,
-				body
-			}, redirected + 1, visited);
-		} else if (response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
-	} else await specDeterminer?.rememberSpec(origin, firstTrySpec);
-	return response;
+			request = redirectRequest;
+			session = await openHop(request.url);
+		}
+	} catch (error) {
+		try {
+			await session.close();
+		} catch (closeError) {
+			getLogger([
+				"fedify",
+				"sig",
+				"http"
+			]).debug("Failed to close the session for {url}: {error}", {
+				url: request.url,
+				error: closeError
+			});
+		}
+		throw error;
+	}
 }
 /**
 * Performs a timing-safe equality comparison between two `Uint8Array` values.
@@ -1777,4 +1860,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { validateAcceptSignature as _, verifyRequestDetailed as a, fetchKey as c, importJwk as d, validateCryptoKey as f, parseAcceptSignature as g, fulfillAcceptSignature as h, verifyRequest as i, fetchKeyDetailed as l, formatAcceptSignature as m, parseRfc9421SignatureInput as n, exportJwk as o, verifyKeyOwnership as p, signRequest as r, fetchActorDocument as s, doubleKnock as t, generateCryptoKeyPair as u, name as v, version as y };
+export { validateAcceptSignature as _, verifyRequestDetailed as a, fetchKey as c, importJwk as d, validateCryptoKey as f, parseAcceptSignature as g, fulfillAcceptSignature as h, verifyRequest as i, fetchKeyDetailed as l, formatAcceptSignature as m, parseRfc9421SignatureInput as n, exportJwk as o, verifyKeyOwnership as p, signRequest as r, fetchActorDocument as s, doubleKnockScoped as t, generateCryptoKeyPair as u, name as v, version as y };

package/dist/{http-DqZhyEso.d.cts → http-SbfezERn.d.ts}

@@ -1,8 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { Actor, CryptographicKey, Multikey } from "@fedify/vocab";
-import { DocumentLoader } from "@fedify/vocab-runtime";
 import { TracerProvider } from "@opentelemetry/api";
-
+import { DocumentLoader } from "@fedify/vocab-runtime";
 //#region src/sig/key.d.ts
 /**
 * Generates a key pair which is appropriate for Fedify.

package/dist/{inbox-BWzL0xMU.mjs → inbox-KESLudq4.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BiYv5RT5.mjs";
+import { n as version, t as name } from "./deno-CiaJqTcu.mjs";
 import { Activity, getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";

package/dist/{key-O-ATwIGS.mjs → key-Dg6-DV_O.mjs}

@@ -1,7 +1,7 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BiYv5RT5.mjs";
+import { n as version, t as name } from "./deno-CiaJqTcu.mjs";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";
@@ -146,16 +146,23 @@ async function importJwk(jwk, type) {
 /**
 * Fetches the document that the given actor URI dereferences to, and returns
 * the actor only if the host that served the document is authoritative for
-* the id the document claims.
+* the id the document claims, and that id is the actor that was asked for.
 *
 * Only the origin that serves an actor id can speak for it.  Without that
 * rule any host could serve a document describing somebody else's actor—and
 * listing its own keys as that actor's.
 *
+* The returned actor always has exactly the requested `actorId` as its `id`.
+* A document loader follows redirects and alternate document links, so the
+* document an actor id leads to may describe a different actor altogether,
+* on the same origin or on another; accepting it would attribute that other
+* actor's keys to the requested one.  See GHSA-8863-8468-7hq7.
+*
 * @param actorId The URI of the actor to fetch.
 * @param options Options for fetching the document.
 * @returns The actor, or `null` if the document cannot be fetched, is not an
-*          actor, or belongs to another origin.
+*          actor, belongs to another origin, or describes an actor other
+*          than the requested one.
 * @internal
 */
 async function fetchActorDocument(actorId, options = {}) {
@@ -210,6 +217,13 @@ async function fetchActorDocumentInternal(actorId, options, propagateContextFetc
 		});
 		return null;
 	}
+	if (object.id.href !== actorId.href) {
+		logger.debug("The document fetched for the actor {actorId} is the actor {documentActorId} instead; refusing to treat it as the requested actor's document.", {
+			actorId: actorId.href,
+			documentActorId: object.id.href
+		});
+		return null;
+	}
 	return object;
 }
 /**

package/dist/{keycache-RFlZObU3.mjs → keycache-DahCaG_m.mjs}

@@ -4,7 +4,7 @@ globalThis.addEventListener = () => {};
 import { CryptographicKey, Multikey } from "@fedify/vocab";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";
 //#region src/federation/keycache.ts
-const KEY_CACHE_GENERATION = "2";
+const KEY_CACHE_GENERATION = "3";
 var KvKeyCache = class {
 	kv;
 	prefix;

package/dist/{kv-cache-BdylAE9w.cjs → kv-cache-Cqmm-yQa.cjs}

@@ -1,10 +1,11 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 require("./chunk-DDcVe30Y.cjs");
-const require_http = require("./http-Cginz7L0.cjs");
+const require_http = require("./http-CRiVlZd5.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let _fedify_vocab_runtime_internal = require("@fedify/vocab-runtime/internal");
 //#region src/utils/docloader.ts
 const logger$1 = (0, _logtape_logtape.getLogger)([
 	"fedify",
@@ -25,12 +26,34 @@ const DEFAULT_MAX_REDIRECTION = 20;
 * @throws {TypeError} If the key is invalid or unsupported.
 * @since 0.4.0
 */
-function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, userAgent, specDeterminer, tracerProvider } = {}) {
+function getAuthenticatedDocumentLoader(identity, options = {}) {
+	return createAuthenticatedDocumentLoader(identity, options);
+}
+/**
+* The placeholder that the alternate document callback of
+* `getRemoteDocument()` returns, so that the alternate document is loaded
+* after the current hop is closed.
+*/
+const ALTERNATE_PLACEHOLDER = Object.freeze({
+	contextUrl: null,
+	document: null,
+	documentUrl: "about:blank"
+});
+/**
+* The implementation of {@link getAuthenticatedDocumentLoader}.  This is not
+* exported from any entry point.
+* @param identity The identity to get the document loader for.
+* @param options The options for the document loader.
+* @param deps The dependencies, for tests.
+* @returns The authenticated document loader.
+* @throws {TypeError} If the key is invalid or unsupported.
+*/
+function createAuthenticatedDocumentLoader(identity, { allowPrivateAddress, userAgent, specDeterminer, tracerProvider } = {}, deps = {}) {
 	require_http.validateCryptoKey(identity.privateKey);
 	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
 		let currentUrl = new URL(url).href;
-		await validateUrl(currentUrl);
+		validateUrl(currentUrl);
 		visited.add(currentUrl);
 		const originalRequest = (0, _fedify_vocab_runtime.createActivityPubRequest)(currentUrl, { userAgent });
 		function follow(nextUrl) {
@@ -39,28 +62,43 @@ function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, userAge
 			if (visited.has(nextUrl)) throw new _fedify_vocab_runtime.FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
 			redirected++;
 		}
-		const response = await require_http.doubleKnock(originalRequest, identity, {
+		const result = await require_http.doubleKnockScoped(originalRequest, identity, {
 			specDeterminer,
 			log: (0, es_toolkit.curry)(_fedify_vocab_runtime.logRequest)(logger$1),
 			tracerProvider,
 			signal: options?.signal,
-			validateRedirect: async (nextUrl) => {
+			validateRedirect: (nextUrl) => {
 				follow(nextUrl);
-				await validateUrl(nextUrl);
+				validateUrl(nextUrl);
 				visited.add(nextUrl);
 				currentUrl = nextUrl;
 			}
+		}, (hopUrl) => openHop(hopUrl, options?.signal), async (response) => {
+			let alternateUrl;
+			const document = await (0, _fedify_vocab_runtime.getRemoteDocument)(currentUrl, response, (url) => {
+				alternateUrl = url;
+				return Promise.resolve(ALTERNATE_PLACEHOLDER);
+			});
+			if (alternateUrl == null) return { document };
+			if (!response.bodyUsed && response.body?.locked !== true) response.body?.cancel().catch((error) => {
+				logger$1.debug("Failed to cancel the response body from {url}: {error}", {
+					url: currentUrl,
+					error
+				});
+			});
+			return { alternateUrl };
 		});
-		return (0, _fedify_vocab_runtime.getRemoteDocument)(currentUrl, response, (alternateUrl) => {
-			follow(alternateUrl);
-			return load(alternateUrl, options, redirected, visited);
-		});
+		if ("document" in result) return result.document;
+		follow(result.alternateUrl);
+		return load(result.alternateUrl, options, redirected, visited);
 	}
-	async function validateUrl(url) {
-		const protocol = new URL(url).protocol;
-		if (protocol !== "http:" && protocol !== "https:") throw new _fedify_vocab_runtime.UrlError(`Unsupported protocol: ${protocol}`);
-		if (!allowPrivateAddress) try {
-			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
+	function openUnvalidatedHop(url, signal) {
+		if (deps.openHop != null) return deps.openHop(url);
+		return allowPrivateAddress ? (0, _fedify_vocab_runtime_internal.openDirectFetch)(url) : (0, _fedify_vocab_runtime_internal.openPublicFetch)(url, { signal });
+	}
+	async function openHop(url, signal) {
+		try {
+			return await openUnvalidatedHop(url, signal);
 		} catch (error) {
 			if (error instanceof _fedify_vocab_runtime.UrlError) if (error.reason === "dns") logger$1.debug("DNS lookup failed for {url}", {
 				url,
@@ -73,6 +111,12 @@ function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, userAge
 			throw error;
 		}
 	}
+	function validateUrl(url) {
+		const parsedUrl = new URL(url);
+		const protocol = parsedUrl.protocol;
+		if (protocol !== "http:" && protocol !== "https:") throw new _fedify_vocab_runtime.UrlError(`Unsupported protocol: ${protocol}`);
+		if (parsedUrl.username !== "" || parsedUrl.password !== "") throw new _fedify_vocab_runtime.UrlError("URLs with credentials are not allowed");
+	}
 	return (url, options) => load(url, options);
 }
 //#endregion