@fedify/fedify 2.5.0-dev.2446 → 2.5.0-dev.2492

package/README.md

@@ -15,6 +15,9 @@ It aims to eliminate the complexity and boilerplate code when
 building a federated server app, so that you can focus on your business logic
 and user experience.
 
+Fedify supports Node.js, Bun, and Deno.  We recommend using the latest
+version of Node.js for the best experience.
+
 Currently, Fedify provides the following features out of the box:
 
  -  Type-safe objects for [Activity Vocabulary] (including some vendor-specific

package/dist/{activity-listener-C-BSbKI7.mjs → activity-listener-CELFAodc.mjs}

@@ -14,9 +14,12 @@ var ActivityListenerSet = class {
 		clone.#listeners = new Map(this.#listeners);
 		return clone;
 	}
-	add(type, listener) {
+	add(type, listener, options = {}) {
 		if (this.#listeners.has(type)) throw new TypeError("Listener already set for this type.");
-		this.#listeners.set(type, listener);
+		this.#listeners.set(type, {
+			listener,
+			options: { ...options }
+		});
 	}
 	dispatchWithClass(activity) {
 		let cls = activity.constructor;
@@ -26,10 +29,11 @@ var ActivityListenerSet = class {
 			cls = globalThis.Object.getPrototypeOf(cls);
 		}
 		if (cls == null) return null;
-		const listener = this.#listeners.get(cls);
+		const { listener, options } = this.#listeners.get(cls);
 		return {
 			class: cls,
-			listener
+			listener,
+			options
 		};
 	}
 	dispatch(activity) {

package/dist/{builder-Da8b9O6v.mjs → builder-DphK9v7f.mjs}

@@ -2,8 +2,8 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { i as getPortableDid, l as isPortableId, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
-import { n as version, t as name } from "./deno-eNpfj4oR.mjs";
-import { t as ActivityListenerSet } from "./activity-listener-C-BSbKI7.mjs";
+import { n as version, t as name } from "./deno-iOAA7iRN.mjs";
+import { t as ActivityListenerSet } from "./activity-listener-CELFAodc.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Tombstone, getTypeId } from "@fedify/vocab";
@@ -91,7 +91,7 @@ var FederationBuilderImpl = class {
 	* specified.
 	*/
 	async build(options) {
-		const { FederationImpl } = await import("./middleware-CCDXvXOG.mjs");
+		const { FederationImpl } = await import("./middleware-BKs2DLUF.mjs");
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();
@@ -590,8 +590,8 @@ var FederationBuilderImpl = class {
 		}
 		const listeners = this.inboxListeners = new ActivityListenerSet();
 		const setters = {
-			on(type, listener) {
-				listeners.add(type, listener);
+			on(type, listener, options) {
+				listeners.add(type, listener, options);
 				return setters;
 			},
 			onError: (handler) => {

package/dist/{client-D-XP_Ccb.d.ts → client-3InDZbba.d.cts}

@@ -1,6 +1,5 @@
 /// <reference lib="esnext.temporal" />
 import { GetUserAgentOptions } from "@fedify/vocab-runtime";
-
 //#region src/nodeinfo/types.d.ts
 /**
 * The type of the result of parsing JSON.

package/dist/{client-D-XP_Ccb.d.cts → client-3InDZbba.d.ts}

@@ -1,6 +1,5 @@
 /// <reference lib="esnext.temporal" />
 import { GetUserAgentOptions } from "@fedify/vocab-runtime";
-
 //#region src/nodeinfo/types.d.ts
 /**
 * The type of the result of parsing JSON.

package/dist/{client-CEnNz8O7.mjs → client-5SIFzW3q.mjs}

@@ -2,7 +2,8 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { getLogger } from "@logtape/logtape";
-import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getUserAgent } from "@fedify/vocab-runtime";
+import { openPublicFetch } from "@fedify/vocab-runtime/internal";
 //#region src/utils/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */
 const MAX_BODY_SIZE = 16 * 1024 * 1024;
@@ -85,23 +86,34 @@ const logger = getLogger([
 ]);
 const DEFAULT_MAX_REDIRECTION = 5;
 /**
-* Fetches a URL while guarding against SSRF.  Before every request—including
-* each redirect hop—the destination is validated with
-* {@link validatePublicUrl}, so that loopback, link-local, and private
-* addresses, as well as non-HTTP(S) schemes such as `data:`, are rejected.
-* Redirects are followed manually with a cap, so that a public URL cannot
-* bounce the request to an internal address.
+* Fetches a URL while guarding against SSRF.  Every request—including each
+* redirect hop—is made in its own session opened with `openPublicFetch()`,
+* which rejects loopback, link-local, and private addresses, as well as
+* non-HTTP(S) schemes such as `data:`, and connects only to the validated
+* addresses where the runtime supports it.  Redirects are followed manually
+* with a cap, so that a public URL cannot bounce the request to an internal
+* address.
+*
+* The final response is passed to `consume`, which must consume or cancel its
+* body; the session is closed after `consume` settles.  The cancellation of
+* redirect response bodies is started before their sessions are closed.
 * @param url The URL to fetch.
 * @param headers The request headers.
-* @returns The final response, or `null` if the URL is disallowed, its
-*          hostname cannot be resolved, or there are too many redirects.
+* @param consume The function to consume the final response with.
+* @param deps The dependencies.
+* @returns The value returned by `consume`, or `null` if the URL is
+*          disallowed, its hostname cannot be resolved, or there are too many
+*          redirects.
+* @internal
 */
-async function fetchPublicUrl(url, headers) {
+async function fetchPublicUrl(url, headers, consume, deps = {}) {
+	const openHop = deps.openHop ?? ((hopUrl) => openPublicFetch(hopUrl));
 	let current = url instanceof URL ? url : new URL(url);
 	let redirected = 0;
 	while (true) {
+		let session;
 		try {
-			await validatePublicUrl(current.href);
+			session = await openHop(current.href);
 		} catch (e) {
 			if (e instanceof UrlError) {
 				if (e.reason === "dns") logger.error("DNS lookup failed for {url}: {error}", {
@@ -116,52 +128,89 @@ async function fetchPublicUrl(url, headers) {
 			}
 			throw e;
 		}
-		const response = await fetch(current, {
-			headers,
-			redirect: "manual"
-		});
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-			redirected++;
-			if (redirected >= DEFAULT_MAX_REDIRECTION) {
-				logger.error("Too many redirections ({redirections}) while fetching {url}.", {
-					redirections: redirected,
-					url: current.href
-				});
-				return null;
-			}
-			const next = new URL(response.headers.get("Location"), response.url == null || response.url === "" ? current : response.url);
-			if (next.protocol !== current.protocol) {
-				logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
-					protocol: current.protocol,
-					redirectedProtocol: next.protocol
-				});
-				return null;
-			}
-			current = next;
-			continue;
+		let location;
+		try {
+			const response = await session.fetch(current, {
+				headers,
+				redirect: "manual"
+			});
+			if (response.status < 300 || response.status >= 400 || !response.headers.has("Location")) return await consume(response);
+			location = response.headers.get("Location");
+			cancelBody(response, current);
+		} finally {
+			await session.close();
+		}
+		redirected++;
+		if (redirected >= DEFAULT_MAX_REDIRECTION) {
+			logger.error("Too many redirections ({redirections}) while fetching {url}.", {
+				redirections: redirected,
+				url: current.href
+			});
+			return null;
+		}
+		const next = new URL(location, current);
+		if (next.protocol !== current.protocol) {
+			logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
+				protocol: current.protocol,
+				redirectedProtocol: next.protocol
+			});
+			return null;
 		}
-		return response;
+		current = next;
 	}
 }
+/**
+* Starts cancelling a response body that is not read, without waiting for it
+* to settle.  The cancellation of a branch of a tee (e.g., a body cloned by
+* a fetch mock) settles only after the other branch is cancelled too, per
+* the Streams standard, so awaiting it could block forever.  A failure is
+* only logged.
+*/
+function cancelBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url: url.toString(),
+			error
+		});
+	});
+}
 async function getNodeInfo(url, options = {}) {
+	return await getNodeInfoInternal(url, options);
+}
+/**
+* The implementation of {@link getNodeInfo}, which is not exported from any
+* entry point.
+* @param url The base URL of the server, or the URL of the NodeInfo document
+*            if `options.direct` is turned on.
+* @param options Options for fetching the NodeInfo document.
+* @param deps The dependencies.
+* @returns The NodeInfo document if it could be fetched successfully.
+*          Otherwise, `undefined` is returned.
+* @internal
+*/
+async function getNodeInfoInternal(url, options = {}, deps = {}) {
 	try {
+		const headers = {
+			Accept: "application/json",
+			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
+		};
 		let nodeInfoUrl = url;
 		if (!options.direct) {
 			const wellKnownUrl = new URL("/.well-known/nodeinfo", url);
-			const wellKnownResponse = await fetchPublicUrl(wellKnownUrl, {
-				Accept: "application/json",
-				"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-			});
-			if (wellKnownResponse == null) return void 0;
-			if (!wellKnownResponse.ok) {
-				logger.error("Failed to fetch {url}: {status} {statusText}", {
-					url: wellKnownUrl.href,
-					status: wellKnownResponse.status,
-					statusText: wellKnownResponse.statusText
-				});
-				return;
-			}
-			const wellKnownRd = JSON.parse(await readBoundedText(wellKnownResponse, MAX_BODY_SIZE, wellKnownUrl));
+			const wellKnown = await fetchPublicUrl(wellKnownUrl, headers, async (response) => {
+				if (!response.ok) {
+					logger.error("Failed to fetch {url}: {status} {statusText}", {
+						url: wellKnownUrl.href,
+						status: response.status,
+						statusText: response.statusText
+					});
+					cancelBody(response, wellKnownUrl);
+					return;
+				}
+				return { rd: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, wellKnownUrl)) };
+			}, deps);
+			if (wellKnown == null) return void 0;
+			const wellKnownRd = wellKnown.rd;
 			const link = wellKnownRd?.links?.find((link) => link != null && "rel" in link && (link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.0" || link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.1") && "href" in link && link.href != null);
 			if (link == null || link.href == null) {
 				logger.error("Failed to find a NodeInfo document link from {url}: {resourceDescriptor}", {
@@ -172,20 +221,20 @@ async function getNodeInfo(url, options = {}) {
 			}
 			nodeInfoUrl = link.href;
 		}
-		const response = await fetchPublicUrl(nodeInfoUrl, {
-			Accept: "application/json",
-			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-		});
-		if (response == null) return void 0;
-		if (!response.ok) {
-			logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
-				url: nodeInfoUrl.toString(),
-				status: response.status,
-				statusText: response.statusText
-			});
-			return;
-		}
-		const data = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl));
+		const document = await fetchPublicUrl(nodeInfoUrl, headers, async (response) => {
+			if (!response.ok) {
+				logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
+					url: nodeInfoUrl.toString(),
+					status: response.status,
+					statusText: response.statusText
+				});
+				cancelBody(response, nodeInfoUrl);
+				return;
+			}
+			return { data: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl)) };
+		}, deps);
+		if (document == null) return void 0;
+		const { data } = document;
 		if (options.parse === "none") return data;
 		return parseNodeInfo(data, { tryBestEffort: options.parse === "best-effort" }) ?? void 0;
 	} catch (error) {
@@ -389,4 +438,4 @@ function parseUsage(data, options = {}) {
 	};
 }
 //#endregion
-export { parseProtocol as a, parseUsage as c, readBoundedText as d, parseOutboundService as i, BodyTooLargeError as l, parseInboundService as n, parseServices as o, parseNodeInfo as r, parseSoftware as s, getNodeInfo as t, MAX_BODY_SIZE as u };
+export { parseOutboundService as a, parseSoftware as c, MAX_BODY_SIZE as d, readBoundedText as f, parseNodeInfo as i, parseUsage as l, getNodeInfoInternal as n, parseProtocol as o, parseInboundService as r, parseServices as s, getNodeInfo as t, BodyTooLargeError as u };

package/dist/compat/mod.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { en as ActivityTransformer, n as Context } from "../context-CQ9H8vNW.cjs";
+import { in as ActivityTransformer, n as Context } from "../context-DSuL3YWx.cjs";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/mod.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { en as ActivityTransformer, n as Context } from "../context-BdB54V-A.js";
+import { in as ActivityTransformer, n as Context } from "../context-DQJE9YfH.js";
 import { Activity } from "@fedify/vocab";
 
 //#region src/compat/transformers.d.ts

package/dist/compat/transformers.test.mjs

@@ -5,7 +5,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { O as actorDehydrator, k as autoIdAssigner, n as FederationImpl } from "../middleware-CzoWvrdZ.mjs";
+import { O as actorDehydrator, k as autoIdAssigner, n as FederationImpl } from "../middleware-CoBLrTKX.mjs";
 import { Follow, Person } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 //#region src/compat/transformers.test.ts

package/dist/{compound-proof-D1djO5fa.mjs → compound-proof-cYtvlTgF.mjs}

@@ -3,9 +3,9 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { a as getRawCanonicalPortableId, l as isPortableId, n as getCanonicalPortableId } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as verificationObservation, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { c as getNormalizationContextLoader } from "./ld-CD2CsPxq.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CdvcOEXQ.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
-import { a as preparePortableObjectProofPolicy, f as verifyPreparedPortableObjectProofPolicy, n as classifyFep2277CoreType, s as verifyMapLocalProof, u as verifyPortableObjectProofPolicy } from "./proof-Cryb1c70.mjs";
+import { c as verifyMapLocalProof, f as verifyPortableObjectProofPolicy, m as verifyPreparedPortableObjectProofPolicy, n as classifyFep2277CoreType, o as preparePortableObjectProofPolicy } from "./proof-GH7Poos_.mjs";
 import { parseIri, preloadedContexts } from "@fedify/vocab-runtime";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/sig/compound-proof.ts

package/dist/{context-8Tu9kea0.mjs → context-COHd1Rsh.mjs}

@@ -3,6 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as mockDocumentLoader } from "./dist-DJQM4u7i.mjs";
 import { t as isInAudience } from "./audience-CHQ-FlLD.mjs";
+import { i as getEmptyAuthenticationEvidence } from "./inbox-authentication-DflPYlLL.mjs";
 import { RouterError } from "@fedify/uri-template";
 import { lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
@@ -120,6 +121,7 @@ function createInboxContext(args) {
 			data
 		})),
 		recipient: args.recipient ?? null,
+		authentication: args.authentication ?? getEmptyAuthenticationEvidence(),
 		forwardActivity: args.forwardActivity ?? ((_forwarder, _recipients, _options) => {
 			throw new Error("Not implemented");
 		})