@fedify/fedify 2.5.0-dev.2448 → 2.5.0-dev.2492

package/dist/sig/mod.js

@@ -1,5 +1,5 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { F as hasSignatureLike, H as verifySignature, J as generateCryptoKeyPair, K as fetchKey, M as detachSignature, St as validateAcceptSignature, T as verifyProof, V as verifyJsonLd, W as exportJwk, Y as importJwk, _ as signObject, a as signRequest, bt as fulfillAcceptSignature, c as verifyRequestDetailed, h as hasProofLike, j as createSignature, k as attachSignature, p as createProof, q as fetchKeyDetailed, s as verifyRequest, x as verifyPortableObjectProof, xt as parseAcceptSignature, y as verifyObject, yt as formatAcceptSignature, z as signJsonLd } from "../http-BBr-VLil.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-DUlQ3s2M.js";
+import { F as hasSignatureLike, H as verifySignature, J as generateCryptoKeyPair, K as fetchKey, M as detachSignature, St as validateAcceptSignature, T as verifyProof, V as verifyJsonLd, W as exportJwk, Y as importJwk, _ as signObject, a as signRequest, bt as fulfillAcceptSignature, c as verifyRequestDetailed, h as hasProofLike, j as createSignature, k as attachSignature, p as createProof, q as fetchKeyDetailed, s as verifyRequest, x as verifyPortableObjectProof, xt as parseAcceptSignature, y as verifyObject, yt as formatAcceptSignature, z as signJsonLd } from "../http-ChXUU_3c.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "../portable-collection-TmtpzD4E.js";
 export { attachSignature, createProof, createSignature, detachSignature, doesActorOwnKey, exportJwk, fetchKey, fetchKeyDetailed, formatAcceptSignature, fulfillAcceptSignature, generateCryptoKeyPair, getKeyOwner, hasProofLike, hasSignatureLike, importJwk, parseAcceptSignature, signJsonLd, signObject, signRequest, validateAcceptSignature, verifyJsonLd, verifyObject, verifyPortableObject, verifyPortableObjectProof, verifyProof, verifyRequest, verifyRequestDetailed, verifySignature };

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-ccKkQOAf.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DTnVpUKA.mjs";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/owner.test.ts

package/dist/sig/portable-collection.test.mjs

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { t as verifyPortableObject } from "../portable-collection-CndnpXfo.mjs";
+import { t as verifyPortableObject } from "../portable-collection-CJeYTL61.mjs";
 import { Collection, CollectionPage, Note, OrderedCollection, Person, traverseCollection } from "@fedify/vocab";
 import { FetchError, encodeMultibase, exportDidKey, preloadedContexts } from "@fedify/vocab-runtime";
 import { test } from "@fedify/fixture";

package/dist/sig/portable-interop.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { d as verifyPortableObjectProof, h as verifyProof } from "../proof-DPoF06nz.mjs";
-import { n as getKeyOwner } from "../owner-ccKkQOAf.mjs";
-import { t as verifyPortableObject } from "../portable-collection-CndnpXfo.mjs";
+import { d as verifyPortableObjectProof, h as verifyProof } from "../proof-GH7Poos_.mjs";
+import { n as getKeyOwner } from "../owner-DTnVpUKA.mjs";
+import { t as verifyPortableObject } from "../portable-collection-CJeYTL61.mjs";
 import { Application, DataIntegrityProof, lookupObject } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 //#region test-vectors/fep-ef61/tootik-v0.25.4/actor.json

package/dist/sig/portable-key.test.mjs

@@ -2,12 +2,12 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
-import { C as fetchKey, _ as verifyJsonLd, m as signJsonLd, w as fetchKeyDetailed } from "../ld-CQFuiah9.mjs";
-import { h as verifyProof, r as createProof } from "../proof-DPoF06nz.mjs";
-import { n as resolvePortableActorKey } from "../portable-key-D5tFOoV-.mjs";
-import { f as verifyRequest, l as signRequest, p as verifyRequestDetailed } from "../http-BZkyQIkb.mjs";
+import { C as fetchKey, _ as verifyJsonLd, m as signJsonLd, w as fetchKeyDetailed } from "../ld-CdvcOEXQ.mjs";
+import { h as verifyProof, r as createProof } from "../proof-GH7Poos_.mjs";
+import { n as resolvePortableActorKey } from "../portable-key-DcYok4ki.mjs";
+import { m as verifyRequestDetailed, p as verifyRequest, u as signRequest } from "../http-BoJCMnjY.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-ccKkQOAf.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-DTnVpUKA.mjs";
 import { t as KvKeyCache } from "../keycache-N2opu4-3.mjs";
 import { Create, CryptographicKey, Multikey, Note, Person } from "@fedify/vocab";
 import { FetchError, encodeMultibase, exportDidKey, exportSpki, parseIri, preloadedContexts } from "@fedify/vocab-runtime";

package/dist/sig/proof.test.mjs

@@ -11,10 +11,10 @@ import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { a as verificationObservation } from "../verification-Dpfcw8ml.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as hasProofLike, c as verifyMapLocalProof, d as verifyPortableObjectProof, h as verifyProof, l as verifyObject, r as createProof, s as signObject, u as verifyObjectDetailed } from "../proof-DPoF06nz.mjs";
-import { f as verifyRequest } from "../http-BZkyQIkb.mjs";
+import { a as hasProofLike, c as verifyMapLocalProof, d as verifyPortableObjectProof, h as verifyProof, l as verifyObject, r as createProof, s as signObject, u as verifyObjectDetailed } from "../proof-GH7Poos_.mjs";
+import { p as verifyRequest } from "../http-BoJCMnjY.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-CpsDyqVN.mjs";
+import { n as getAuthenticatedDocumentLoader } from "../docloader-DCZkiTeF.mjs";
 import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place, Translation } from "@fedify/vocab";
 import { FetchError, decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
@@ -2530,7 +2530,7 @@ test("getAuthenticatedDocumentLoader() signs portable object requests to gateway
 			documentLoader: getAuthenticatedDocumentLoader({
 				keyId: new URL("https://example.com/key2"),
 				privateKey: rsaPrivateKey2
-			}),
+			}, { allowPrivateAddress: true }),
 			contextLoader: mockDocumentLoader,
 			gateways: ["https://example.com"],
 			verifyPortableObject: verifyPortableObjectProof

package/dist/sig/tootik-request-interop.test.mjs

@@ -5,10 +5,10 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { d as verifyPortableObjectProof } from "../proof-DPoF06nz.mjs";
-import { p as verifyRequestDetailed } from "../http-BZkyQIkb.mjs";
-import { o as createFederation } from "../middleware-CuVa0UuS.mjs";
-import { t as doesActorOwnKey } from "../owner-ccKkQOAf.mjs";
+import { d as verifyPortableObjectProof } from "../proof-GH7Poos_.mjs";
+import { m as verifyRequestDetailed } from "../http-BoJCMnjY.mjs";
+import { o as createFederation } from "../middleware-CoBLrTKX.mjs";
+import { t as doesActorOwnKey } from "../owner-DTnVpUKA.mjs";
 import { Follow, Person } from "@fedify/vocab";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { encodeHex } from "byte-encodings/hex";

package/dist/sig/tootik-send-interop.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { d as verifyPortableObjectProof } from "../proof-DPoF06nz.mjs";
-import { p as verifyRequestDetailed } from "../http-BZkyQIkb.mjs";
-import { t as doesActorOwnKey } from "../owner-ccKkQOAf.mjs";
+import { d as verifyPortableObjectProof } from "../proof-GH7Poos_.mjs";
+import { m as verifyRequestDetailed } from "../http-BoJCMnjY.mjs";
+import { t as doesActorOwnKey } from "../owner-DTnVpUKA.mjs";
 import { Create } from "@fedify/vocab";
 import { decodeMultibase, importDidKey } from "@fedify/vocab-runtime";
 import { mockDocumentLoader, test } from "@fedify/fixture";

package/dist/sig/verification.test.mjs

@@ -2,9 +2,9 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { a as verificationObservation } from "../verification-Dpfcw8ml.mjs";
-import { _ as verifyJsonLd, m as signJsonLd } from "../ld-CQFuiah9.mjs";
-import { l as verifyObject, s as signObject } from "../proof-DPoF06nz.mjs";
-import { l as signRequest, p as verifyRequestDetailed } from "../http-BZkyQIkb.mjs";
+import { _ as verifyJsonLd, m as signJsonLd } from "../ld-CdvcOEXQ.mjs";
+import { l as verifyObject, s as signObject } from "../proof-GH7Poos_.mjs";
+import { m as verifyRequestDetailed, u as signRequest } from "../http-BoJCMnjY.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, o as rsaPublicKey1, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
 import { Activity, Create, CryptographicKey, Multikey } from "@fedify/vocab";
 import { FetchError } from "@fedify/vocab-runtime";

package/dist/{temporal-XlZ4Wb94.mjs → temporal-gJINzcL4.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-CQFuiah9.mjs";
+import { c as getNormalizationContextLoader } from "./ld-CdvcOEXQ.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/kv.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-IG3pHfvZ.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
-import { o as createFederation } from "../middleware-CuVa0UuS.mjs";
+import { o as createFederation } from "../middleware-CoBLrTKX.mjs";
 //#region src/testing/kv.test.ts
 test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
 	const kv = new ManualClockKvStore();

package/dist/testing/mod.d.mts

@@ -4695,6 +4695,11 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * Gets the public key of the sender, if any exists and it is verified.
    * Otherwise, `null` is returned.
    *
+   * Successful results are reused for this request regardless of the options.
+   * Pending checks and `null` results are reused for the same effective
+   * document and context loaders, including failed lookups.  Rejected checks
+   * can be retried.  Shared work uses the first caller's tracer provider.
+   *
    * This can be used for implementing [authorized fetch] (also known as
    * secure mode) in ActivityPub.
    *
@@ -4708,6 +4713,11 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * Gets the public key of the sender, if any exists and it is verified.
    * Otherwise, `null` is returned.
    *
+   * Successful results are reused for this request regardless of the options.
+   * Pending checks and `null` results are reused for the same effective
+   * document and context loaders, including failed lookups.  Rejected checks
+   * can be retried.  Shared work uses the first caller's tracer provider.
+   *
    * This can be used for implementing [authorized fetch] (also known as
    * secure mode) in ActivityPub.
    *
@@ -4727,6 +4737,14 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * Gets the owner of the signed key, if any exists and it is verified.
    * Otherwise, `null` is returned.
    *
+   * Verified keys and owners are reused for this request regardless of the
+   * options.  Pending checks are shared for the same effective document and
+   * context loaders.  A `null` result from an owner lookup after key
+   * verification is retained for those loaders.  A `null` result caused by
+   * an unverified key is not retained, allowing an owner lookup after another
+   * loader verifies the key.  Rejected checks can be retried.  Shared work
+   * uses the first caller's tracer provider.
+   *
    * This can be used for implementing [authorized fetch] (also known as
    * secure mode) in ActivityPub.
    *
@@ -4741,6 +4759,14 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * Gets the owner of the signed key, if any exists and it is verified.
    * Otherwise, `null` is returned.
    *
+   * Verified keys and owners are reused for this request regardless of the
+   * options.  Pending checks are shared for the same effective document and
+   * context loaders.  A `null` result from an owner lookup after key
+   * verification is retained for those loaders.  A `null` result caused by
+   * an unverified key is not retained, allowing an owner lookup after another
+   * loader verifies the key.  Rejected checks can be retried.  Shared work
+   * uses the first caller's tracer provider.
+   *
    * This can be used for implementing [authorized fetch] (also known as
    * secure mode) in ActivityPub.
    *

package/dist/{types-_S2_MeLF.js → types-DUjZb4i6.js}

@@ -1,7 +1,8 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { getLogger } from "@logtape/logtape";
-import { FetchError, UrlError, getUserAgent, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError, getUserAgent } from "@fedify/vocab-runtime";
+import { openPublicFetch } from "@fedify/vocab-runtime/internal";
 //#region src/utils/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */
 const MAX_BODY_SIZE = 16 * 1024 * 1024;
@@ -84,23 +85,34 @@ const logger = getLogger([
 ]);
 const DEFAULT_MAX_REDIRECTION = 5;
 /**
-* Fetches a URL while guarding against SSRF.  Before every request—including
-* each redirect hop—the destination is validated with
-* {@link validatePublicUrl}, so that loopback, link-local, and private
-* addresses, as well as non-HTTP(S) schemes such as `data:`, are rejected.
-* Redirects are followed manually with a cap, so that a public URL cannot
-* bounce the request to an internal address.
+* Fetches a URL while guarding against SSRF.  Every request—including each
+* redirect hop—is made in its own session opened with `openPublicFetch()`,
+* which rejects loopback, link-local, and private addresses, as well as
+* non-HTTP(S) schemes such as `data:`, and connects only to the validated
+* addresses where the runtime supports it.  Redirects are followed manually
+* with a cap, so that a public URL cannot bounce the request to an internal
+* address.
+*
+* The final response is passed to `consume`, which must consume or cancel its
+* body; the session is closed after `consume` settles.  The cancellation of
+* redirect response bodies is started before their sessions are closed.
 * @param url The URL to fetch.
 * @param headers The request headers.
-* @returns The final response, or `null` if the URL is disallowed, its
-*          hostname cannot be resolved, or there are too many redirects.
+* @param consume The function to consume the final response with.
+* @param deps The dependencies.
+* @returns The value returned by `consume`, or `null` if the URL is
+*          disallowed, its hostname cannot be resolved, or there are too many
+*          redirects.
+* @internal
 */
-async function fetchPublicUrl(url, headers) {
+async function fetchPublicUrl(url, headers, consume, deps = {}) {
+	const openHop = deps.openHop ?? ((hopUrl) => openPublicFetch(hopUrl));
 	let current = url instanceof URL ? url : new URL(url);
 	let redirected = 0;
 	while (true) {
+		let session;
 		try {
-			await validatePublicUrl(current.href);
+			session = await openHop(current.href);
 		} catch (e) {
 			if (e instanceof UrlError) {
 				if (e.reason === "dns") logger.error("DNS lookup failed for {url}: {error}", {
@@ -115,52 +127,89 @@ async function fetchPublicUrl(url, headers) {
 			}
 			throw e;
 		}
-		const response = await fetch(current, {
-			headers,
-			redirect: "manual"
-		});
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-			redirected++;
-			if (redirected >= DEFAULT_MAX_REDIRECTION) {
-				logger.error("Too many redirections ({redirections}) while fetching {url}.", {
-					redirections: redirected,
-					url: current.href
-				});
-				return null;
-			}
-			const next = new URL(response.headers.get("Location"), response.url == null || response.url === "" ? current : response.url);
-			if (next.protocol !== current.protocol) {
-				logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
-					protocol: current.protocol,
-					redirectedProtocol: next.protocol
-				});
-				return null;
-			}
-			current = next;
-			continue;
+		let location;
+		try {
+			const response = await session.fetch(current, {
+				headers,
+				redirect: "manual"
+			});
+			if (response.status < 300 || response.status >= 400 || !response.headers.has("Location")) return await consume(response);
+			location = response.headers.get("Location");
+			cancelBody(response, current);
+		} finally {
+			await session.close();
+		}
+		redirected++;
+		if (redirected >= DEFAULT_MAX_REDIRECTION) {
+			logger.error("Too many redirections ({redirections}) while fetching {url}.", {
+				redirections: redirected,
+				url: current.href
+			});
+			return null;
+		}
+		const next = new URL(location, current);
+		if (next.protocol !== current.protocol) {
+			logger.error("Refused a redirect to a different protocol ({protocol} to {redirectedProtocol}) while fetching NodeInfo.", {
+				protocol: current.protocol,
+				redirectedProtocol: next.protocol
+			});
+			return null;
 		}
-		return response;
+		current = next;
 	}
 }
+/**
+* Starts cancelling a response body that is not read, without waiting for it
+* to settle.  The cancellation of a branch of a tee (e.g., a body cloned by
+* a fetch mock) settles only after the other branch is cancelled too, per
+* the Streams standard, so awaiting it could block forever.  A failure is
+* only logged.
+*/
+function cancelBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url: url.toString(),
+			error
+		});
+	});
+}
 async function getNodeInfo(url, options = {}) {
+	return await getNodeInfoInternal(url, options);
+}
+/**
+* The implementation of {@link getNodeInfo}, which is not exported from any
+* entry point.
+* @param url The base URL of the server, or the URL of the NodeInfo document
+*            if `options.direct` is turned on.
+* @param options Options for fetching the NodeInfo document.
+* @param deps The dependencies.
+* @returns The NodeInfo document if it could be fetched successfully.
+*          Otherwise, `undefined` is returned.
+* @internal
+*/
+async function getNodeInfoInternal(url, options = {}, deps = {}) {
 	try {
+		const headers = {
+			Accept: "application/json",
+			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
+		};
 		let nodeInfoUrl = url;
 		if (!options.direct) {
 			const wellKnownUrl = new URL("/.well-known/nodeinfo", url);
-			const wellKnownResponse = await fetchPublicUrl(wellKnownUrl, {
-				Accept: "application/json",
-				"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-			});
-			if (wellKnownResponse == null) return void 0;
-			if (!wellKnownResponse.ok) {
-				logger.error("Failed to fetch {url}: {status} {statusText}", {
-					url: wellKnownUrl.href,
-					status: wellKnownResponse.status,
-					statusText: wellKnownResponse.statusText
-				});
-				return;
-			}
-			const wellKnownRd = JSON.parse(await readBoundedText(wellKnownResponse, MAX_BODY_SIZE, wellKnownUrl));
+			const wellKnown = await fetchPublicUrl(wellKnownUrl, headers, async (response) => {
+				if (!response.ok) {
+					logger.error("Failed to fetch {url}: {status} {statusText}", {
+						url: wellKnownUrl.href,
+						status: response.status,
+						statusText: response.statusText
+					});
+					cancelBody(response, wellKnownUrl);
+					return;
+				}
+				return { rd: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, wellKnownUrl)) };
+			}, deps);
+			if (wellKnown == null) return void 0;
+			const wellKnownRd = wellKnown.rd;
 			const link = wellKnownRd?.links?.find((link) => link != null && "rel" in link && (link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.0" || link.rel === "http://nodeinfo.diaspora.software/ns/schema/2.1") && "href" in link && link.href != null);
 			if (link == null || link.href == null) {
 				logger.error("Failed to find a NodeInfo document link from {url}: {resourceDescriptor}", {
@@ -171,20 +220,20 @@ async function getNodeInfo(url, options = {}) {
 			}
 			nodeInfoUrl = link.href;
 		}
-		const response = await fetchPublicUrl(nodeInfoUrl, {
-			Accept: "application/json",
-			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-		});
-		if (response == null) return void 0;
-		if (!response.ok) {
-			logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
-				url: nodeInfoUrl.toString(),
-				status: response.status,
-				statusText: response.statusText
-			});
-			return;
-		}
-		const data = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl));
+		const document = await fetchPublicUrl(nodeInfoUrl, headers, async (response) => {
+			if (!response.ok) {
+				logger.error("Failed to fetch NodeInfo document from {url}: {status} {statusText}", {
+					url: nodeInfoUrl.toString(),
+					status: response.status,
+					statusText: response.statusText
+				});
+				cancelBody(response, nodeInfoUrl);
+				return;
+			}
+			return { data: JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, nodeInfoUrl)) };
+		}, deps);
+		if (document == null) return void 0;
+		const { data } = document;
 		if (options.parse === "none") return data;
 		return parseNodeInfo(data, { tryBestEffort: options.parse === "best-effort" }) ?? void 0;
 	} catch (error) {