@fedify/lint 2.4.0-dev.1599 → 2.4.0-dev.1634

package/README.md

@@ -127,11 +127,19 @@ federation code:
     when `setInboxListeners` is set
  -  **`actor-shared-inbox-property-mismatch`**: Validates sharedInbox URI from
     `getInboxUri`
+ -  **`actor-upload-media-property-required`**: Ensures endpoints.uploadMedia is
+    defined when `setMediaUploader` is set
+ -  **`actor-upload-media-property-mismatch`**: Validates endpoints.uploadMedia
+    URI from `getMediaUploaderUri`
 
 ### Other rules
 
  -  **`collection-filtering-not-implemented`**: Warns about missing collection
     filtering implementation (`setFollowersDispatcher` only for now)
+ -  **`media-uploader-object-uri-required`**: Warns when a `setMediaUploader`
+    callback does not derive its return value from `getObjectUri`
+ -  **`media-uploader-authorization-required`**: Warns when `setMediaUploader`
+    is registered without an `authorize` hook
 
 
 Installation

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/lint",
-  "version": "2.4.0-dev.1599+7b19967f",
+  "version": "2.4.0-dev.1634+3b4bfbb6",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",

package/dist/index.cjs

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_outbox_listener_delivery_required = require("./outbox-listener-delivery-required-BBuAbkOF.cjs");
+const require_outbox_listener_delivery_required = require("./outbox-listener-delivery-required-BhuVwj9X.cjs");
 let _fxts_core = require("@fxts/core");
 let _typescript_eslint_parser = require("@typescript-eslint/parser");
 _typescript_eslint_parser = __toESM(_typescript_eslint_parser, 1);
@@ -34,28 +34,32 @@ _typescript_eslint_parser = __toESM(_typescript_eslint_parser, 1);
 * Provides lint rules for validating Fedify federation code.
 */
 const rules = {
-	[require_outbox_listener_delivery_required.RULE_IDS.actorIdMismatch]: require_outbox_listener_delivery_required.eslint$12,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorIdRequired]: require_outbox_listener_delivery_required.eslint$11,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowingPropertyRequired]: require_outbox_listener_delivery_required.eslint$13,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowingPropertyMismatch]: require_outbox_listener_delivery_required.eslint$14,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowersPropertyRequired]: require_outbox_listener_delivery_required.eslint$15,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowersPropertyMismatch]: require_outbox_listener_delivery_required.eslint$16,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorOutboxPropertyRequired]: require_outbox_listener_delivery_required.eslint$5,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorOutboxPropertyMismatch]: require_outbox_listener_delivery_required.eslint$6,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorLikedPropertyRequired]: require_outbox_listener_delivery_required.eslint$7,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorLikedPropertyMismatch]: require_outbox_listener_delivery_required.eslint$8,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedPropertyRequired]: require_outbox_listener_delivery_required.eslint$19,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedPropertyMismatch]: require_outbox_listener_delivery_required.eslint$20,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedTagsPropertyRequired]: require_outbox_listener_delivery_required.eslint$17,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedTagsPropertyMismatch]: require_outbox_listener_delivery_required.eslint$18,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorInboxPropertyRequired]: require_outbox_listener_delivery_required.eslint$9,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorInboxPropertyMismatch]: require_outbox_listener_delivery_required.eslint$10,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorSharedInboxPropertyRequired]: require_outbox_listener_delivery_required.eslint$2,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorSharedInboxPropertyMismatch]: require_outbox_listener_delivery_required.eslint$3,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorPublicKeyRequired]: require_outbox_listener_delivery_required.eslint$4,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorAssertionMethodRequired]: require_outbox_listener_delivery_required.eslint$21,
-	[require_outbox_listener_delivery_required.RULE_IDS.collectionFilteringNotImplemented]: require_outbox_listener_delivery_required.eslint$1,
-	[require_outbox_listener_delivery_required.RULE_IDS.outboxListenerDeliveryRequired]: require_outbox_listener_delivery_required.eslint
+	[require_outbox_listener_delivery_required.RULE_IDS.actorIdMismatch]: require_outbox_listener_delivery_required.eslint$16,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorIdRequired]: require_outbox_listener_delivery_required.eslint$15,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowingPropertyRequired]: require_outbox_listener_delivery_required.eslint$17,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowingPropertyMismatch]: require_outbox_listener_delivery_required.eslint$18,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowersPropertyRequired]: require_outbox_listener_delivery_required.eslint$19,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowersPropertyMismatch]: require_outbox_listener_delivery_required.eslint$20,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorOutboxPropertyRequired]: require_outbox_listener_delivery_required.eslint$9,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorOutboxPropertyMismatch]: require_outbox_listener_delivery_required.eslint$10,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorLikedPropertyRequired]: require_outbox_listener_delivery_required.eslint$11,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorLikedPropertyMismatch]: require_outbox_listener_delivery_required.eslint$12,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedPropertyRequired]: require_outbox_listener_delivery_required.eslint$23,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedPropertyMismatch]: require_outbox_listener_delivery_required.eslint$24,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedTagsPropertyRequired]: require_outbox_listener_delivery_required.eslint$21,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedTagsPropertyMismatch]: require_outbox_listener_delivery_required.eslint$22,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorInboxPropertyRequired]: require_outbox_listener_delivery_required.eslint$13,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorInboxPropertyMismatch]: require_outbox_listener_delivery_required.eslint$14,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorSharedInboxPropertyRequired]: require_outbox_listener_delivery_required.eslint$6,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorSharedInboxPropertyMismatch]: require_outbox_listener_delivery_required.eslint$7,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorUploadMediaPropertyRequired]: require_outbox_listener_delivery_required.eslint$4,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorUploadMediaPropertyMismatch]: require_outbox_listener_delivery_required.eslint$5,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorPublicKeyRequired]: require_outbox_listener_delivery_required.eslint$8,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorAssertionMethodRequired]: require_outbox_listener_delivery_required.eslint$25,
+	[require_outbox_listener_delivery_required.RULE_IDS.collectionFilteringNotImplemented]: require_outbox_listener_delivery_required.eslint$3,
+	[require_outbox_listener_delivery_required.RULE_IDS.outboxListenerDeliveryRequired]: require_outbox_listener_delivery_required.eslint,
+	[require_outbox_listener_delivery_required.RULE_IDS.mediaUploaderObjectUriRequired]: require_outbox_listener_delivery_required.eslint$1,
+	[require_outbox_listener_delivery_required.RULE_IDS.mediaUploaderAuthorizationRequired]: require_outbox_listener_delivery_required.eslint$2
 };
 const recommendedRuleIds = [require_outbox_listener_delivery_required.RULE_IDS.actorIdMismatch, require_outbox_listener_delivery_required.RULE_IDS.actorIdRequired];
 /**

package/dist/index.js

@@ -1,4 +1,4 @@
-import { C as RULE_IDS, S as eslint$19, T as version, _ as eslint$5, a as eslint$18, b as eslint$10, c as eslint$8, d as eslint$15, f as eslint$1, g as eslint$4, h as eslint$3, i as eslint$17, l as eslint$9, m as eslint$2, n as eslint$20, o as eslint$6, p as eslint, r as eslint$16, s as eslint$7, t as eslint$21, u as eslint$14, v as eslint$12, w as name, x as eslint$11, y as eslint$13 } from "./outbox-listener-delivery-required-Cx3YNy0p.js";
+import { C as eslint$13, D as RULE_IDS, E as eslint$21, O as name, S as eslint$12, T as eslint$11, _ as eslint, a as eslint$18, b as eslint$4, c as eslint$17, d as eslint$7, f as eslint$8, g as eslint$1, h as eslint$15, i as eslint$22, k as version, l as eslint$20, m as eslint$14, n as eslint$24, o as eslint$19, p as eslint$9, r as eslint$25, s as eslint$16, t as eslint$23, u as eslint$6, v as eslint$2, w as eslint$10, x as eslint$5, y as eslint$3 } from "./outbox-listener-delivery-required-BOIQaemq.js";
 import { fromEntries, keys, map, pipe } from "@fxts/core";
 import parser from "@typescript-eslint/parser";
 //#region src/index.ts
@@ -25,10 +25,14 @@ const rules = {
 	[RULE_IDS.actorInboxPropertyMismatch]: eslint$15,
 	[RULE_IDS.actorSharedInboxPropertyRequired]: eslint$16,
 	[RULE_IDS.actorSharedInboxPropertyMismatch]: eslint$17,
-	[RULE_IDS.actorPublicKeyRequired]: eslint$18,
-	[RULE_IDS.actorAssertionMethodRequired]: eslint$19,
-	[RULE_IDS.collectionFilteringNotImplemented]: eslint$20,
-	[RULE_IDS.outboxListenerDeliveryRequired]: eslint$21
+	[RULE_IDS.actorUploadMediaPropertyRequired]: eslint$18,
+	[RULE_IDS.actorUploadMediaPropertyMismatch]: eslint$19,
+	[RULE_IDS.actorPublicKeyRequired]: eslint$20,
+	[RULE_IDS.actorAssertionMethodRequired]: eslint$21,
+	[RULE_IDS.collectionFilteringNotImplemented]: eslint$22,
+	[RULE_IDS.outboxListenerDeliveryRequired]: eslint$23,
+	[RULE_IDS.mediaUploaderObjectUriRequired]: eslint$24,
+	[RULE_IDS.mediaUploaderAuthorizationRequired]: eslint$25
 };
 const recommendedRuleIds = [RULE_IDS.actorIdMismatch, RULE_IDS.actorIdRequired];
 /**

package/dist/{outbox-listener-delivery-required-Cx3YNy0p.js → outbox-listener-delivery-required-BOIQaemq.js}

@@ -1,7 +1,7 @@
 import { always, every, head, isEmpty, isObject, negate, pipe, pipeLazy, prop, some, toArray, unless, when } from "@fxts/core";
 //#region deno.json
 var name = "@fedify/lint";
-var version = "2.4.0-dev.1599+7b19967f";
+var version = "2.4.0-dev.1634+3b4bfbb6";
 //#endregion
 //#region src/lib/const.ts
 /**
@@ -77,6 +77,17 @@ const properties = {
 			wrapper: "Endpoints"
 		}
 	},
+	uploadMedia: {
+		name: "uploadMedia",
+		path: ["endpoints", "uploadMedia"],
+		getter: "getMediaUploaderUri",
+		setter: "setMediaUploader",
+		requiresIdentifier: true,
+		nested: {
+			parent: "endpoints",
+			wrapper: "Endpoints"
+		}
+	},
 	publicKey: {
 		name: "publicKey",
 		path: ["publicKey"],
@@ -107,6 +118,7 @@ const RULE_IDS = {
 	actorFeaturedTagsPropertyRequired: "actor-featured-tags-property-required",
 	actorInboxPropertyRequired: "actor-inbox-property-required",
 	actorSharedInboxPropertyRequired: "actor-shared-inbox-property-required",
+	actorUploadMediaPropertyRequired: "actor-upload-media-property-required",
 	actorPublicKeyRequired: "actor-public-key-required",
 	actorAssertionMethodRequired: "actor-assertion-method-required",
 	actorIdMismatch: "actor-id-mismatch",
@@ -118,8 +130,11 @@ const RULE_IDS = {
 	actorFeaturedTagsPropertyMismatch: "actor-featured-tags-property-mismatch",
 	actorInboxPropertyMismatch: "actor-inbox-property-mismatch",
 	actorSharedInboxPropertyMismatch: "actor-shared-inbox-property-mismatch",
+	actorUploadMediaPropertyMismatch: "actor-upload-media-property-mismatch",
 	collectionFilteringNotImplemented: "collection-filtering-not-implemented",
-	outboxListenerDeliveryRequired: "outbox-listener-delivery-required"
+	outboxListenerDeliveryRequired: "outbox-listener-delivery-required",
+	mediaUploaderObjectUriRequired: "media-uploader-object-uri-required",
+	mediaUploaderAuthorizationRequired: "media-uploader-authorization-required"
 };
 //#endregion
 //#region src/lib/messages.ts
@@ -417,7 +432,7 @@ function createRequiredRuleEslint(config) {
 	};
 }
 createRequiredRuleDeno(properties.assertionMethod);
-const eslint$21 = createRequiredRuleEslint(properties.assertionMethod);
+const eslint$25 = createRequiredRuleEslint(properties.assertionMethod);
 //#endregion
 //#region src/lib/mismatch.ts
 const isIdentifierWithName = (name) => (node) => allOf(isNodeType("Identifier"), isNodeName(name))(node);
@@ -487,43 +502,47 @@ const createMismatchRuleEslint = (config) => ({
 	}))
 });
 createMismatchRuleDeno(properties.featured);
-const eslint$20 = createMismatchRuleEslint(properties.featured);
+const eslint$24 = createMismatchRuleEslint(properties.featured);
 createRequiredRuleDeno(properties.featured);
-const eslint$19 = createRequiredRuleEslint(properties.featured);
+const eslint$23 = createRequiredRuleEslint(properties.featured);
 createMismatchRuleDeno(properties.featuredTags);
-const eslint$18 = createMismatchRuleEslint(properties.featuredTags);
+const eslint$22 = createMismatchRuleEslint(properties.featuredTags);
 createRequiredRuleDeno(properties.featuredTags);
-const eslint$17 = createRequiredRuleEslint(properties.featuredTags);
+const eslint$21 = createRequiredRuleEslint(properties.featuredTags);
 createMismatchRuleDeno(properties.followers);
-const eslint$16 = createMismatchRuleEslint(properties.followers);
+const eslint$20 = createMismatchRuleEslint(properties.followers);
 createRequiredRuleDeno(properties.followers);
-const eslint$15 = createRequiredRuleEslint(properties.followers);
+const eslint$19 = createRequiredRuleEslint(properties.followers);
 createMismatchRuleDeno(properties.following);
-const eslint$14 = createMismatchRuleEslint(properties.following);
+const eslint$18 = createMismatchRuleEslint(properties.following);
 createRequiredRuleDeno(properties.following);
-const eslint$13 = createRequiredRuleEslint(properties.following);
+const eslint$17 = createRequiredRuleEslint(properties.following);
 createMismatchRuleDeno(properties.id);
-const eslint$12 = createMismatchRuleEslint(properties.id);
+const eslint$16 = createMismatchRuleEslint(properties.id);
 createRequiredRuleDeno(properties.id);
-const eslint$11 = createRequiredRuleEslint(properties.id);
+const eslint$15 = createRequiredRuleEslint(properties.id);
 createMismatchRuleDeno(properties.inbox);
-const eslint$10 = createMismatchRuleEslint(properties.inbox);
+const eslint$14 = createMismatchRuleEslint(properties.inbox);
 createRequiredRuleDeno(properties.inbox);
-const eslint$9 = createRequiredRuleEslint(properties.inbox);
+const eslint$13 = createRequiredRuleEslint(properties.inbox);
 createMismatchRuleDeno(properties.liked);
-const eslint$8 = createMismatchRuleEslint(properties.liked);
+const eslint$12 = createMismatchRuleEslint(properties.liked);
 createRequiredRuleDeno(properties.liked);
-const eslint$7 = createRequiredRuleEslint(properties.liked);
+const eslint$11 = createRequiredRuleEslint(properties.liked);
 createMismatchRuleDeno(properties.outbox);
-const eslint$6 = createMismatchRuleEslint(properties.outbox);
+const eslint$10 = createMismatchRuleEslint(properties.outbox);
 createRequiredRuleDeno(properties.outbox);
-const eslint$5 = createRequiredRuleEslint(properties.outbox);
+const eslint$9 = createRequiredRuleEslint(properties.outbox);
 createRequiredRuleDeno(properties.publicKey);
-const eslint$4 = createRequiredRuleEslint(properties.publicKey);
+const eslint$8 = createRequiredRuleEslint(properties.publicKey);
 createMismatchRuleDeno(properties.sharedInbox);
-const eslint$3 = createMismatchRuleEslint(properties.sharedInbox);
+const eslint$7 = createMismatchRuleEslint(properties.sharedInbox);
 createRequiredRuleDeno(properties.sharedInbox);
-const eslint$2 = createRequiredRuleEslint(properties.sharedInbox);
+const eslint$6 = createRequiredRuleEslint(properties.sharedInbox);
+createMismatchRuleDeno(properties.uploadMedia);
+const eslint$5 = createMismatchRuleEslint(properties.uploadMedia);
+createRequiredRuleDeno(properties.uploadMedia);
+const eslint$4 = createRequiredRuleEslint(properties.uploadMedia);
 //#endregion
 //#region src/rules/collection-filtering-not-implemented.ts
 /**
@@ -542,7 +561,7 @@ const isFollowersDispatcherCall = (node) => "callee" in node && node.callee && n
 * CollectionDispatcher signature: (context, identifier, cursor, filter?) => ...
 */
 const hasFilterParameter = hasMinParams(4);
-const eslint$1 = {
+const eslint$3 = {
 	meta: {
 		type: "suggestion",
 		docs: { description: "Ensure followers dispatcher implements filtering" },
@@ -567,6 +586,398 @@ const eslint$1 = {
 	}
 };
 //#endregion
+//#region src/rules/media-uploader-authorization-required.ts
+const MESSAGE$2 = "setMediaUploader() should be protected with .authorize(); without it the endpoint accepts uploads from anyone who can reach the URL.  Add .authorize() unless a public upload endpoint is intended.";
+function getParent(node) {
+	if (node == null || typeof node !== "object") return null;
+	const parent = node.parent;
+	return isNode(parent) ? parent : null;
+}
+/**
+* Whether the given `setMediaUploader(...)` call is directly chained with
+* `.authorize(...)`, i.e. `federation.setMediaUploader(...).authorize(...)`.
+*/
+function isDirectlyAuthorized(callNode) {
+	const member = getParent(callNode);
+	if (member == null || member.type !== "MemberExpression" || member.computed === true) return false;
+	const property = member.property;
+	if (!isNode(property) || property.type !== "Identifier" || property.name !== "authorize") return false;
+	const call = getParent(member);
+	return call != null && call.type === "CallExpression" && call.callee === member;
+}
+function createRule$2(buildReport) {
+	return (context) => {
+		const federationTracker = trackFederationVariables();
+		const unchained = [];
+		const authorizedVars = /* @__PURE__ */ new Set();
+		return {
+			VariableDeclarator: federationTracker.VariableDeclarator,
+			CallExpression(node) {
+				if (hasMemberExpressionCallee(node) && hasIdentifierProperty(node) && hasMethodName("authorize")(node)) {
+					const object = node.callee.object;
+					if (isNode(object) && object.type === "Identifier") authorizedVars.add(object.name);
+					return;
+				}
+				if (!hasMemberExpressionCallee(node) || !hasIdentifierProperty(node) || !hasMethodName("setMediaUploader")(node) || !federationTracker.isFederationObject(node.callee.object)) return;
+				if (isDirectlyAuthorized(node)) return;
+				const parent = getParent(node);
+				let varName = null;
+				if (parent != null && parent.type === "VariableDeclarator") {
+					const id = parent.id;
+					if (isNode(id) && id.type === "Identifier") varName = id.name;
+				}
+				unchained.push({
+					node,
+					varName
+				});
+			},
+			"Program:exit"() {
+				for (const { node, varName } of unchained) {
+					if (varName != null && authorizedVars.has(varName)) continue;
+					context.report({
+						node,
+						...buildReport
+					});
+				}
+			}
+		};
+	};
+}
+const eslint$2 = {
+	meta: {
+		type: "suggestion",
+		docs: { description: "Warn when setMediaUploader() is registered without an authorize() hook" },
+		schema: [],
+		messages: { required: "{{ message }}" }
+	},
+	create: createRule$2({
+		messageId: "required",
+		data: { message: MESSAGE$2 }
+	})
+};
+//#endregion
+//#region src/rules/media-uploader-object-uri-required.ts
+const MESSAGE$1 = "setMediaUploader() callbacks should return a value derived from ctx.getObjectUri(): either return ctx.getObjectUri(...) directly, or an object whose id is ctx.getObjectUri(...).";
+const GETTER_NAME = "getObjectUri";
+const getMemberPropertyName$1 = (node) => {
+	if (node.type !== "MemberExpression") return null;
+	const property = node.property;
+	if (property.type === "Identifier") return property.name;
+	if (property.type === "Literal" && typeof property.value === "string") return property.value;
+	return null;
+};
+function unwrapAssignmentPattern(node) {
+	let current = node ?? null;
+	while (current?.type === "AssignmentPattern") current = current.left;
+	return current;
+}
+/**
+* Resolves the callback argument to a function node, following simple bindings
+* when the callback is passed by reference (identifier or object member).
+*/
+const resolveCallbackReference = (expr, bindings, seen = /* @__PURE__ */ new Set()) => {
+	if (isFunction(expr)) return expr;
+	if (expr.type === "Identifier") {
+		if (seen.has(expr.name)) return null;
+		seen.add(expr.name);
+		const binding = bindings.get(expr.name);
+		if (binding == null || !isNode(binding)) return null;
+		if (isFunction(binding) || binding.type === "FunctionDeclaration") return binding;
+		if (binding.type === "Identifier") return resolveCallbackReference(binding, bindings, seen);
+		return null;
+	}
+	if (expr.type === "MemberExpression" && expr.object.type === "Identifier" && !expr.computed) {
+		const binding = bindings.get(expr.object.name);
+		if (binding == null || !isNode(binding) || binding.type !== "ObjectExpression") return null;
+		const propertyName = getMemberPropertyName$1(expr);
+		if (propertyName == null) return null;
+		for (const prop of binding.properties) {
+			if (!isNode(prop) || prop.type !== "Property") continue;
+			if ((prop.key.type === "Identifier" ? prop.key.name : prop.key.type === "Literal" && typeof prop.key.value === "string" ? prop.key.value : null) !== propertyName || !isNode(prop.value)) continue;
+			const value = prop.value;
+			if (isFunction(value) || value.type === "FunctionDeclaration") return value;
+		}
+	}
+	return null;
+};
+/**
+* Returns the identifier name of the callback's context parameter, used to
+* require that `getObjectUri()` is called as a member of the context itself
+* (`ctx.getObjectUri(...)`), not on some other object.  Returns `null` when the
+* parameter is destructured: destructuring `getObjectUri` off the context
+* (`({ getObjectUri }) => getObjectUri(...)`) loses the method's receiver and
+* throws at runtime, so that form is intentionally not recognized as valid.
+*/
+function getContextParamName(callback) {
+	const contextParam = unwrapAssignmentPattern(callback.params[0]);
+	return contextParam?.type === "Identifier" ? contextParam.name : null;
+}
+const FUNCTION_NODE_TYPES = new Set([
+	"FunctionDeclaration",
+	"FunctionExpression",
+	"ArrowFunctionExpression"
+]);
+/**
+* Collects `const`/`let`/`var name = init` bindings declared inside the
+* callback body (excluding nested functions), so an identifier used in a
+* returned expression can be resolved back to the expression it was assigned.
+*/
+function collectLocalBindings(node, bindings) {
+	if (node == null || typeof node !== "object") return;
+	if (Array.isArray(node)) {
+		for (const child of node) collectLocalBindings(child, bindings);
+		return;
+	}
+	const n = node;
+	if (typeof n.type !== "string") return;
+	if (FUNCTION_NODE_TYPES.has(n.type)) return;
+	if (n.type === "VariableDeclarator") {
+		const id = n.id;
+		if (id != null && isNode(id) && id.type === "Identifier" && n.init != null) {
+			if (!bindings.has(id.name)) bindings.set(id.name, n.init);
+		}
+	}
+	for (const key in n) {
+		if (key === "parent") continue;
+		collectLocalBindings(n[key], bindings);
+	}
+}
+/**
+* Collects the returned expressions of the callback: the argument of every
+* `return` statement (excluding nested functions), or, for an
+* expression-bodied arrow, the body expression itself.  A bare `return;`
+* contributes `null`.
+*/
+function collectReturnedExpressions(callback) {
+	const body = callback.body;
+	if (body != null && isNode(body) && body.type !== "BlockStatement") return [body];
+	const result = [];
+	const walk = (node) => {
+		if (node == null || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const child of node) walk(child);
+			return;
+		}
+		const n = node;
+		if (typeof n.type !== "string") return;
+		if (n.type === "ReturnStatement") {
+			result.push(n.argument ?? null);
+			return;
+		}
+		if (FUNCTION_NODE_TYPES.has(n.type)) return;
+		for (const key in n) {
+			if (key === "parent") continue;
+			walk(n[key]);
+		}
+	};
+	walk(body);
+	return result;
+}
+function toNode(value) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) return null;
+	const n = value;
+	return typeof n.type === "string" ? n : null;
+}
+/** Whether the node is a `Promise.resolve(x)` call. */
+function isPromiseResolveCall(expr) {
+	if (expr.type !== "CallExpression") return false;
+	const callee = toNode(expr.callee);
+	if (callee == null || callee.type !== "MemberExpression" || getMemberPropertyName$1(callee) !== "resolve") return false;
+	const object = toNode(callee.object);
+	return object != null && object.type === "Identifier" && object.name === "Promise";
+}
+/**
+* Strips wrapper expressions that do not change the underlying value: `await`,
+* parentheses, `as`/`<T>`/`!`/`satisfies` type assertions, and
+* `Promise.resolve(...)` (a synchronous callback may wrap its result in an
+* already-resolved promise, which `MediaUploaderCallback` permits).
+*/
+function unwrapExpression(value) {
+	let current = toNode(value);
+	while (current != null) if (current.type === "AwaitExpression") current = toNode(current.argument);
+	else if (current.type === "TSAsExpression" || current.type === "TSNonNullExpression" || current.type === "TSSatisfiesExpression" || current.type === "TSTypeAssertion" || current.type === "ParenthesizedExpression") current = toNode(current.expression);
+	else if (isPromiseResolveCall(current)) {
+		const args = current.arguments;
+		current = Array.isArray(args) && args.length === 1 ? toNode(args[0]) : null;
+	} else return current;
+	return null;
+}
+/**
+* Whether the expression is a member call `<ctx>.getObjectUri(...)` whose
+* receiver is the callback's context parameter.  A call on any other object
+* (e.g. `helper.getObjectUri(...)`), or a bare `getObjectUri(...)` from a
+* destructured parameter (which loses the receiver and throws at runtime),
+* does not count.
+*/
+function isGetObjectUriCall(expr, ctx) {
+	if (expr.type !== "CallExpression") return false;
+	if (ctx.ctxName == null) return false;
+	const callee = toNode(expr.callee);
+	if (callee == null || callee.type !== "MemberExpression" || getMemberPropertyName$1(callee) !== GETTER_NAME) return false;
+	const object = unwrapExpression(callee.object);
+	return object != null && object.type === "Identifier" && object.name === ctx.ctxName;
+}
+function isUrlConstructor(expr) {
+	const callee = toNode(expr.callee);
+	return callee != null && callee.type === "Identifier" && callee.name === "URL";
+}
+/** Finds the first `ObjectExpression` argument of a `NewExpression`. */
+function extractObjectArg(newExpr) {
+	const args = newExpr.arguments;
+	if (!Array.isArray(args)) return null;
+	for (const arg of args) {
+		const a = toNode(arg);
+		if (a != null && a.type === "ObjectExpression") return a;
+	}
+	return null;
+}
+/**
+* Whether a URL-valued expression is derived from `getObjectUri()`: a direct
+* call, an identifier whose local binding resolves to one
+* (`const uri = ctx.getObjectUri(...); return uri`), both branches of a
+* ternary, or `new URL(<derived>)`.
+*/
+function urlDerivesFromGetObjectUri(value, ctx, seen) {
+	const expr = unwrapExpression(value);
+	if (expr == null) return false;
+	if (isGetObjectUriCall(expr, ctx)) return true;
+	if (expr.type === "Identifier") {
+		const name = expr.name;
+		if (typeof name === "string" && ctx.bindings.has(name) && !seen.has(name)) return urlDerivesFromGetObjectUri(ctx.bindings.get(name), ctx, new Set(seen).add(name));
+		return false;
+	}
+	if (expr.type === "ConditionalExpression") return urlDerivesFromGetObjectUri(expr.consequent, ctx, seen) && urlDerivesFromGetObjectUri(expr.alternate, ctx, seen);
+	if (expr.type === "NewExpression" && isUrlConstructor(expr)) {
+		const args = expr.arguments;
+		return Array.isArray(args) && args.length > 0 && urlDerivesFromGetObjectUri(args[0], ctx, seen);
+	}
+	return false;
+}
+const SPREAD_TYPES = new Set([
+	"SpreadElement",
+	"SpreadProperty",
+	"ExperimentalSpreadProperty"
+]);
+/**
+* Whether an object literal's *effective* own `id` is derived from
+* `getObjectUri`.  Properties are evaluated in order so a later duplicate `id`
+* wins, and a spread or computed key appearing after the last static `id`
+* (which could override it) is treated as unsafe.  An object with no static
+* `id` property (its `id` might come from an unresolved spread) is also
+* unsafe.
+*/
+function objectIdDerivesFromGetObjectUri(objExpr, ctx, seen) {
+	const props = objExpr.properties;
+	if (!Array.isArray(props)) return false;
+	let idValue;
+	let idIsSet = false;
+	let overridableAfterId = false;
+	for (const prop of props) {
+		const p = toNode(prop);
+		if (p == null) return false;
+		if (SPREAD_TYPES.has(p.type) || p.type === "Property" && p.computed === true) {
+			if (idIsSet) overridableAfterId = true;
+			continue;
+		}
+		if (p.type !== "Property") continue;
+		const key = toNode(p.key);
+		if ((key == null ? null : key.type === "Identifier" && typeof key.name === "string" ? key.name : key.type === "Literal" && typeof key.value === "string" ? key.value : null) !== "id") continue;
+		idValue = p.value;
+		idIsSet = true;
+		overridableAfterId = false;
+	}
+	if (!idIsSet || overridableAfterId) return false;
+	return urlDerivesFromGetObjectUri(idValue, ctx, seen);
+}
+/**
+* Whether a single returned expression is valid: a URL derived from
+* `getObjectUri()`, or a vocab object (a `new X({...})` expression) whose own
+* `id` is derived from it.  The object is judged solely by its `id`, so
+* `getObjectUri()` appearing in another property (e.g. `url`) does not excuse a
+* hard-coded `id`.  A plain object literal is rejected: the handler calls
+* `toJsonLd()` on the result, so a bare `{ ... }` (which lacks it) is not a
+* valid return.
+*/
+function returnDerivesFromGetObjectUri(value, ctx, seen) {
+	const expr = unwrapExpression(value);
+	if (expr == null) return false;
+	if (expr.type === "Identifier") {
+		const name = expr.name;
+		if (typeof name === "string" && ctx.bindings.has(name) && !seen.has(name)) return returnDerivesFromGetObjectUri(ctx.bindings.get(name), ctx, new Set(seen).add(name));
+		return false;
+	}
+	if (expr.type === "ConditionalExpression") return returnDerivesFromGetObjectUri(expr.consequent, ctx, seen) && returnDerivesFromGetObjectUri(expr.alternate, ctx, seen);
+	if (expr.type === "NewExpression") {
+		if (isUrlConstructor(expr)) return urlDerivesFromGetObjectUri(expr, ctx, seen);
+		const objArg = extractObjectArg(expr);
+		if (objArg == null) return false;
+		return objectIdDerivesFromGetObjectUri(objArg, ctx, seen);
+	}
+	return urlDerivesFromGetObjectUri(expr, ctx, seen);
+}
+/**
+* Determines whether every returned value of the callback is derived from
+* `getObjectUri`.  Returns `false` when the callback has no return value or any
+* returned value is not derived from `getObjectUri`.
+*/
+function callbackDerivesFromGetObjectUri(callback) {
+	const returnedExpressions = collectReturnedExpressions(callback);
+	if (returnedExpressions.length < 1) return false;
+	const bindings = /* @__PURE__ */ new Map();
+	collectLocalBindings(callback.body, bindings);
+	const ctx = {
+		ctxName: getContextParamName(callback),
+		bindings
+	};
+	return returnedExpressions.every((expr) => returnDerivesFromGetObjectUri(expr, ctx, /* @__PURE__ */ new Set()));
+}
+function createRule$1(buildReport) {
+	return (context) => {
+		const federationTracker = trackFederationVariables();
+		const bindings = /* @__PURE__ */ new Map();
+		const pendingCalls = [];
+		const inspectCall = (node) => {
+			if (!hasMemberExpressionCallee(node) || !hasIdentifierProperty(node) || !hasMethodName("setMediaUploader")(node) || node.arguments.length < 2) return;
+			if (!federationTracker.isFederationObject(node.callee.object)) return;
+			const callbackArg = node.arguments[1];
+			const callback = isNode(callbackArg) && isFunction(callbackArg) ? callbackArg : isNode(callbackArg) ? resolveCallbackReference(callbackArg, bindings) : null;
+			if (callback == null) return;
+			if (callbackDerivesFromGetObjectUri(callback)) return;
+			context.report({
+				node: callback,
+				...buildReport
+			});
+		};
+		return {
+			VariableDeclarator(node) {
+				federationTracker.VariableDeclarator(node);
+				if (node.id.type === "Identifier" && node.init != null) bindings.set(node.id.name, node.init);
+			},
+			FunctionDeclaration(node) {
+				if (node.id != null) bindings.set(node.id.name, node);
+			},
+			CallExpression(node) {
+				pendingCalls.push(node);
+			},
+			"Program:exit"() {
+				for (const node of pendingCalls) inspectCall(node);
+			}
+		};
+	};
+}
+const eslint$1 = {
+	meta: {
+		type: "suggestion",
+		docs: { description: "Warn when a setMediaUploader() callback does not derive its return value from ctx.getObjectUri()" },
+		schema: [],
+		messages: { required: "{{ message }}" }
+	},
+	create: createRule$1({
+		messageId: "required",
+		data: { message: MESSAGE$1 }
+	})
+};
+//#endregion
 //#region src/rules/outbox-listener-delivery-required.ts
 const MESSAGE = "Outbox listeners should deliver posted activities explicitly with ctx.sendActivity() or ctx.forwardActivity().";
 const isChainedFromOutboxListeners = (expr, federationTracker) => {
@@ -819,4 +1230,4 @@ const eslint = {
 	})
 };
 //#endregion
-export { RULE_IDS as C, eslint$21 as S, version as T, eslint$16 as _, eslint$4 as a, eslint$19 as b, eslint$7 as c, eslint$10 as d, eslint$11 as f, eslint$15 as g, eslint$14 as h, eslint$3 as i, eslint$8 as l, eslint$13 as m, eslint$1 as n, eslint$5 as o, eslint$12 as p, eslint$2 as r, eslint$6 as s, eslint as t, eslint$9 as u, eslint$17 as v, name as w, eslint$20 as x, eslint$18 as y };
+export { eslint$22 as C, RULE_IDS as D, eslint$25 as E, name as O, eslint$21 as S, eslint$24 as T, eslint$16 as _, eslint$4 as a, eslint$19 as b, eslint$7 as c, eslint$10 as d, eslint$11 as f, eslint$15 as g, eslint$14 as h, eslint$3 as i, version as k, eslint$8 as l, eslint$13 as m, eslint$1 as n, eslint$5 as o, eslint$12 as p, eslint$2 as r, eslint$6 as s, eslint as t, eslint$9 as u, eslint$17 as v, eslint$23 as w, eslint$20 as x, eslint$18 as y };

package/dist/{outbox-listener-delivery-required-BBuAbkOF.cjs → outbox-listener-delivery-required-BhuVwj9X.cjs}

@@ -2,7 +2,7 @@ require("./index.cjs");
 let _fxts_core = require("@fxts/core");
 //#region deno.json
 var name = "@fedify/lint";
-var version = "2.4.0-dev.1599+7b19967f";
+var version = "2.4.0-dev.1634+3b4bfbb6";
 //#endregion
 //#region src/lib/const.ts
 /**
@@ -78,6 +78,17 @@ const properties = {
 			wrapper: "Endpoints"
 		}
 	},
+	uploadMedia: {
+		name: "uploadMedia",
+		path: ["endpoints", "uploadMedia"],
+		getter: "getMediaUploaderUri",
+		setter: "setMediaUploader",
+		requiresIdentifier: true,
+		nested: {
+			parent: "endpoints",
+			wrapper: "Endpoints"
+		}
+	},
 	publicKey: {
 		name: "publicKey",
 		path: ["publicKey"],
@@ -108,6 +119,7 @@ const RULE_IDS = {
 	actorFeaturedTagsPropertyRequired: "actor-featured-tags-property-required",
 	actorInboxPropertyRequired: "actor-inbox-property-required",
 	actorSharedInboxPropertyRequired: "actor-shared-inbox-property-required",
+	actorUploadMediaPropertyRequired: "actor-upload-media-property-required",
 	actorPublicKeyRequired: "actor-public-key-required",
 	actorAssertionMethodRequired: "actor-assertion-method-required",
 	actorIdMismatch: "actor-id-mismatch",
@@ -119,8 +131,11 @@ const RULE_IDS = {
 	actorFeaturedTagsPropertyMismatch: "actor-featured-tags-property-mismatch",
 	actorInboxPropertyMismatch: "actor-inbox-property-mismatch",
 	actorSharedInboxPropertyMismatch: "actor-shared-inbox-property-mismatch",
+	actorUploadMediaPropertyMismatch: "actor-upload-media-property-mismatch",
 	collectionFilteringNotImplemented: "collection-filtering-not-implemented",
-	outboxListenerDeliveryRequired: "outbox-listener-delivery-required"
+	outboxListenerDeliveryRequired: "outbox-listener-delivery-required",
+	mediaUploaderObjectUriRequired: "media-uploader-object-uri-required",
+	mediaUploaderAuthorizationRequired: "media-uploader-authorization-required"
 };
 //#endregion
 //#region src/lib/messages.ts
@@ -418,7 +433,7 @@ function createRequiredRuleEslint(config) {
 	};
 }
 createRequiredRuleDeno(properties.assertionMethod);
-const eslint$21 = createRequiredRuleEslint(properties.assertionMethod);
+const eslint$25 = createRequiredRuleEslint(properties.assertionMethod);
 //#endregion
 //#region src/lib/mismatch.ts
 const isIdentifierWithName = (name) => (node) => allOf(isNodeType("Identifier"), isNodeName(name))(node);
@@ -488,43 +503,47 @@ const createMismatchRuleEslint = (config) => ({
 	}))
 });
 createMismatchRuleDeno(properties.featured);
-const eslint$20 = createMismatchRuleEslint(properties.featured);
+const eslint$24 = createMismatchRuleEslint(properties.featured);
 createRequiredRuleDeno(properties.featured);
-const eslint$19 = createRequiredRuleEslint(properties.featured);
+const eslint$23 = createRequiredRuleEslint(properties.featured);
 createMismatchRuleDeno(properties.featuredTags);
-const eslint$18 = createMismatchRuleEslint(properties.featuredTags);
+const eslint$22 = createMismatchRuleEslint(properties.featuredTags);
 createRequiredRuleDeno(properties.featuredTags);
-const eslint$17 = createRequiredRuleEslint(properties.featuredTags);
+const eslint$21 = createRequiredRuleEslint(properties.featuredTags);
 createMismatchRuleDeno(properties.followers);
-const eslint$16 = createMismatchRuleEslint(properties.followers);
+const eslint$20 = createMismatchRuleEslint(properties.followers);
 createRequiredRuleDeno(properties.followers);
-const eslint$15 = createRequiredRuleEslint(properties.followers);
+const eslint$19 = createRequiredRuleEslint(properties.followers);
 createMismatchRuleDeno(properties.following);
-const eslint$14 = createMismatchRuleEslint(properties.following);
+const eslint$18 = createMismatchRuleEslint(properties.following);
 createRequiredRuleDeno(properties.following);
-const eslint$13 = createRequiredRuleEslint(properties.following);
+const eslint$17 = createRequiredRuleEslint(properties.following);
 createMismatchRuleDeno(properties.id);
-const eslint$12 = createMismatchRuleEslint(properties.id);
+const eslint$16 = createMismatchRuleEslint(properties.id);
 createRequiredRuleDeno(properties.id);
-const eslint$11 = createRequiredRuleEslint(properties.id);
+const eslint$15 = createRequiredRuleEslint(properties.id);
 createMismatchRuleDeno(properties.inbox);
-const eslint$10 = createMismatchRuleEslint(properties.inbox);
+const eslint$14 = createMismatchRuleEslint(properties.inbox);
 createRequiredRuleDeno(properties.inbox);
-const eslint$9 = createRequiredRuleEslint(properties.inbox);
+const eslint$13 = createRequiredRuleEslint(properties.inbox);
 createMismatchRuleDeno(properties.liked);
-const eslint$8 = createMismatchRuleEslint(properties.liked);
+const eslint$12 = createMismatchRuleEslint(properties.liked);
 createRequiredRuleDeno(properties.liked);
-const eslint$7 = createRequiredRuleEslint(properties.liked);
+const eslint$11 = createRequiredRuleEslint(properties.liked);
 createMismatchRuleDeno(properties.outbox);
-const eslint$6 = createMismatchRuleEslint(properties.outbox);
+const eslint$10 = createMismatchRuleEslint(properties.outbox);
 createRequiredRuleDeno(properties.outbox);
-const eslint$5 = createRequiredRuleEslint(properties.outbox);
+const eslint$9 = createRequiredRuleEslint(properties.outbox);
 createRequiredRuleDeno(properties.publicKey);
-const eslint$4 = createRequiredRuleEslint(properties.publicKey);
+const eslint$8 = createRequiredRuleEslint(properties.publicKey);
 createMismatchRuleDeno(properties.sharedInbox);
-const eslint$3 = createMismatchRuleEslint(properties.sharedInbox);
+const eslint$7 = createMismatchRuleEslint(properties.sharedInbox);
 createRequiredRuleDeno(properties.sharedInbox);
-const eslint$2 = createRequiredRuleEslint(properties.sharedInbox);
+const eslint$6 = createRequiredRuleEslint(properties.sharedInbox);
+createMismatchRuleDeno(properties.uploadMedia);
+const eslint$5 = createMismatchRuleEslint(properties.uploadMedia);
+createRequiredRuleDeno(properties.uploadMedia);
+const eslint$4 = createRequiredRuleEslint(properties.uploadMedia);
 //#endregion
 //#region src/rules/collection-filtering-not-implemented.ts
 /**
@@ -543,7 +562,7 @@ const isFollowersDispatcherCall = (node) => "callee" in node && node.callee && n
 * CollectionDispatcher signature: (context, identifier, cursor, filter?) => ...
 */
 const hasFilterParameter = hasMinParams(4);
-const eslint$1 = {
+const eslint$3 = {
 	meta: {
 		type: "suggestion",
 		docs: { description: "Ensure followers dispatcher implements filtering" },
@@ -568,6 +587,398 @@ const eslint$1 = {
 	}
 };
 //#endregion
+//#region src/rules/media-uploader-authorization-required.ts
+const MESSAGE$2 = "setMediaUploader() should be protected with .authorize(); without it the endpoint accepts uploads from anyone who can reach the URL.  Add .authorize() unless a public upload endpoint is intended.";
+function getParent(node) {
+	if (node == null || typeof node !== "object") return null;
+	const parent = node.parent;
+	return isNode(parent) ? parent : null;
+}
+/**
+* Whether the given `setMediaUploader(...)` call is directly chained with
+* `.authorize(...)`, i.e. `federation.setMediaUploader(...).authorize(...)`.
+*/
+function isDirectlyAuthorized(callNode) {
+	const member = getParent(callNode);
+	if (member == null || member.type !== "MemberExpression" || member.computed === true) return false;
+	const property = member.property;
+	if (!isNode(property) || property.type !== "Identifier" || property.name !== "authorize") return false;
+	const call = getParent(member);
+	return call != null && call.type === "CallExpression" && call.callee === member;
+}
+function createRule$2(buildReport) {
+	return (context) => {
+		const federationTracker = trackFederationVariables();
+		const unchained = [];
+		const authorizedVars = /* @__PURE__ */ new Set();
+		return {
+			VariableDeclarator: federationTracker.VariableDeclarator,
+			CallExpression(node) {
+				if (hasMemberExpressionCallee(node) && hasIdentifierProperty(node) && hasMethodName("authorize")(node)) {
+					const object = node.callee.object;
+					if (isNode(object) && object.type === "Identifier") authorizedVars.add(object.name);
+					return;
+				}
+				if (!hasMemberExpressionCallee(node) || !hasIdentifierProperty(node) || !hasMethodName("setMediaUploader")(node) || !federationTracker.isFederationObject(node.callee.object)) return;
+				if (isDirectlyAuthorized(node)) return;
+				const parent = getParent(node);
+				let varName = null;
+				if (parent != null && parent.type === "VariableDeclarator") {
+					const id = parent.id;
+					if (isNode(id) && id.type === "Identifier") varName = id.name;
+				}
+				unchained.push({
+					node,
+					varName
+				});
+			},
+			"Program:exit"() {
+				for (const { node, varName } of unchained) {
+					if (varName != null && authorizedVars.has(varName)) continue;
+					context.report({
+						node,
+						...buildReport
+					});
+				}
+			}
+		};
+	};
+}
+const eslint$2 = {
+	meta: {
+		type: "suggestion",
+		docs: { description: "Warn when setMediaUploader() is registered without an authorize() hook" },
+		schema: [],
+		messages: { required: "{{ message }}" }
+	},
+	create: createRule$2({
+		messageId: "required",
+		data: { message: MESSAGE$2 }
+	})
+};
+//#endregion
+//#region src/rules/media-uploader-object-uri-required.ts
+const MESSAGE$1 = "setMediaUploader() callbacks should return a value derived from ctx.getObjectUri(): either return ctx.getObjectUri(...) directly, or an object whose id is ctx.getObjectUri(...).";
+const GETTER_NAME = "getObjectUri";
+const getMemberPropertyName$1 = (node) => {
+	if (node.type !== "MemberExpression") return null;
+	const property = node.property;
+	if (property.type === "Identifier") return property.name;
+	if (property.type === "Literal" && typeof property.value === "string") return property.value;
+	return null;
+};
+function unwrapAssignmentPattern(node) {
+	let current = node ?? null;
+	while (current?.type === "AssignmentPattern") current = current.left;
+	return current;
+}
+/**
+* Resolves the callback argument to a function node, following simple bindings
+* when the callback is passed by reference (identifier or object member).
+*/
+const resolveCallbackReference = (expr, bindings, seen = /* @__PURE__ */ new Set()) => {
+	if (isFunction(expr)) return expr;
+	if (expr.type === "Identifier") {
+		if (seen.has(expr.name)) return null;
+		seen.add(expr.name);
+		const binding = bindings.get(expr.name);
+		if (binding == null || !isNode(binding)) return null;
+		if (isFunction(binding) || binding.type === "FunctionDeclaration") return binding;
+		if (binding.type === "Identifier") return resolveCallbackReference(binding, bindings, seen);
+		return null;
+	}
+	if (expr.type === "MemberExpression" && expr.object.type === "Identifier" && !expr.computed) {
+		const binding = bindings.get(expr.object.name);
+		if (binding == null || !isNode(binding) || binding.type !== "ObjectExpression") return null;
+		const propertyName = getMemberPropertyName$1(expr);
+		if (propertyName == null) return null;
+		for (const prop of binding.properties) {
+			if (!isNode(prop) || prop.type !== "Property") continue;
+			if ((prop.key.type === "Identifier" ? prop.key.name : prop.key.type === "Literal" && typeof prop.key.value === "string" ? prop.key.value : null) !== propertyName || !isNode(prop.value)) continue;
+			const value = prop.value;
+			if (isFunction(value) || value.type === "FunctionDeclaration") return value;
+		}
+	}
+	return null;
+};
+/**
+* Returns the identifier name of the callback's context parameter, used to
+* require that `getObjectUri()` is called as a member of the context itself
+* (`ctx.getObjectUri(...)`), not on some other object.  Returns `null` when the
+* parameter is destructured: destructuring `getObjectUri` off the context
+* (`({ getObjectUri }) => getObjectUri(...)`) loses the method's receiver and
+* throws at runtime, so that form is intentionally not recognized as valid.
+*/
+function getContextParamName(callback) {
+	const contextParam = unwrapAssignmentPattern(callback.params[0]);
+	return contextParam?.type === "Identifier" ? contextParam.name : null;
+}
+const FUNCTION_NODE_TYPES = new Set([
+	"FunctionDeclaration",
+	"FunctionExpression",
+	"ArrowFunctionExpression"
+]);
+/**
+* Collects `const`/`let`/`var name = init` bindings declared inside the
+* callback body (excluding nested functions), so an identifier used in a
+* returned expression can be resolved back to the expression it was assigned.
+*/
+function collectLocalBindings(node, bindings) {
+	if (node == null || typeof node !== "object") return;
+	if (Array.isArray(node)) {
+		for (const child of node) collectLocalBindings(child, bindings);
+		return;
+	}
+	const n = node;
+	if (typeof n.type !== "string") return;
+	if (FUNCTION_NODE_TYPES.has(n.type)) return;
+	if (n.type === "VariableDeclarator") {
+		const id = n.id;
+		if (id != null && isNode(id) && id.type === "Identifier" && n.init != null) {
+			if (!bindings.has(id.name)) bindings.set(id.name, n.init);
+		}
+	}
+	for (const key in n) {
+		if (key === "parent") continue;
+		collectLocalBindings(n[key], bindings);
+	}
+}
+/**
+* Collects the returned expressions of the callback: the argument of every
+* `return` statement (excluding nested functions), or, for an
+* expression-bodied arrow, the body expression itself.  A bare `return;`
+* contributes `null`.
+*/
+function collectReturnedExpressions(callback) {
+	const body = callback.body;
+	if (body != null && isNode(body) && body.type !== "BlockStatement") return [body];
+	const result = [];
+	const walk = (node) => {
+		if (node == null || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const child of node) walk(child);
+			return;
+		}
+		const n = node;
+		if (typeof n.type !== "string") return;
+		if (n.type === "ReturnStatement") {
+			result.push(n.argument ?? null);
+			return;
+		}
+		if (FUNCTION_NODE_TYPES.has(n.type)) return;
+		for (const key in n) {
+			if (key === "parent") continue;
+			walk(n[key]);
+		}
+	};
+	walk(body);
+	return result;
+}
+function toNode(value) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) return null;
+	const n = value;
+	return typeof n.type === "string" ? n : null;
+}
+/** Whether the node is a `Promise.resolve(x)` call. */
+function isPromiseResolveCall(expr) {
+	if (expr.type !== "CallExpression") return false;
+	const callee = toNode(expr.callee);
+	if (callee == null || callee.type !== "MemberExpression" || getMemberPropertyName$1(callee) !== "resolve") return false;
+	const object = toNode(callee.object);
+	return object != null && object.type === "Identifier" && object.name === "Promise";
+}
+/**
+* Strips wrapper expressions that do not change the underlying value: `await`,
+* parentheses, `as`/`<T>`/`!`/`satisfies` type assertions, and
+* `Promise.resolve(...)` (a synchronous callback may wrap its result in an
+* already-resolved promise, which `MediaUploaderCallback` permits).
+*/
+function unwrapExpression(value) {
+	let current = toNode(value);
+	while (current != null) if (current.type === "AwaitExpression") current = toNode(current.argument);
+	else if (current.type === "TSAsExpression" || current.type === "TSNonNullExpression" || current.type === "TSSatisfiesExpression" || current.type === "TSTypeAssertion" || current.type === "ParenthesizedExpression") current = toNode(current.expression);
+	else if (isPromiseResolveCall(current)) {
+		const args = current.arguments;
+		current = Array.isArray(args) && args.length === 1 ? toNode(args[0]) : null;
+	} else return current;
+	return null;
+}
+/**
+* Whether the expression is a member call `<ctx>.getObjectUri(...)` whose
+* receiver is the callback's context parameter.  A call on any other object
+* (e.g. `helper.getObjectUri(...)`), or a bare `getObjectUri(...)` from a
+* destructured parameter (which loses the receiver and throws at runtime),
+* does not count.
+*/
+function isGetObjectUriCall(expr, ctx) {
+	if (expr.type !== "CallExpression") return false;
+	if (ctx.ctxName == null) return false;
+	const callee = toNode(expr.callee);
+	if (callee == null || callee.type !== "MemberExpression" || getMemberPropertyName$1(callee) !== GETTER_NAME) return false;
+	const object = unwrapExpression(callee.object);
+	return object != null && object.type === "Identifier" && object.name === ctx.ctxName;
+}
+function isUrlConstructor(expr) {
+	const callee = toNode(expr.callee);
+	return callee != null && callee.type === "Identifier" && callee.name === "URL";
+}
+/** Finds the first `ObjectExpression` argument of a `NewExpression`. */
+function extractObjectArg(newExpr) {
+	const args = newExpr.arguments;
+	if (!Array.isArray(args)) return null;
+	for (const arg of args) {
+		const a = toNode(arg);
+		if (a != null && a.type === "ObjectExpression") return a;
+	}
+	return null;
+}
+/**
+* Whether a URL-valued expression is derived from `getObjectUri()`: a direct
+* call, an identifier whose local binding resolves to one
+* (`const uri = ctx.getObjectUri(...); return uri`), both branches of a
+* ternary, or `new URL(<derived>)`.
+*/
+function urlDerivesFromGetObjectUri(value, ctx, seen) {
+	const expr = unwrapExpression(value);
+	if (expr == null) return false;
+	if (isGetObjectUriCall(expr, ctx)) return true;
+	if (expr.type === "Identifier") {
+		const name = expr.name;
+		if (typeof name === "string" && ctx.bindings.has(name) && !seen.has(name)) return urlDerivesFromGetObjectUri(ctx.bindings.get(name), ctx, new Set(seen).add(name));
+		return false;
+	}
+	if (expr.type === "ConditionalExpression") return urlDerivesFromGetObjectUri(expr.consequent, ctx, seen) && urlDerivesFromGetObjectUri(expr.alternate, ctx, seen);
+	if (expr.type === "NewExpression" && isUrlConstructor(expr)) {
+		const args = expr.arguments;
+		return Array.isArray(args) && args.length > 0 && urlDerivesFromGetObjectUri(args[0], ctx, seen);
+	}
+	return false;
+}
+const SPREAD_TYPES = new Set([
+	"SpreadElement",
+	"SpreadProperty",
+	"ExperimentalSpreadProperty"
+]);
+/**
+* Whether an object literal's *effective* own `id` is derived from
+* `getObjectUri`.  Properties are evaluated in order so a later duplicate `id`
+* wins, and a spread or computed key appearing after the last static `id`
+* (which could override it) is treated as unsafe.  An object with no static
+* `id` property (its `id` might come from an unresolved spread) is also
+* unsafe.
+*/
+function objectIdDerivesFromGetObjectUri(objExpr, ctx, seen) {
+	const props = objExpr.properties;
+	if (!Array.isArray(props)) return false;
+	let idValue;
+	let idIsSet = false;
+	let overridableAfterId = false;
+	for (const prop of props) {
+		const p = toNode(prop);
+		if (p == null) return false;
+		if (SPREAD_TYPES.has(p.type) || p.type === "Property" && p.computed === true) {
+			if (idIsSet) overridableAfterId = true;
+			continue;
+		}
+		if (p.type !== "Property") continue;
+		const key = toNode(p.key);
+		if ((key == null ? null : key.type === "Identifier" && typeof key.name === "string" ? key.name : key.type === "Literal" && typeof key.value === "string" ? key.value : null) !== "id") continue;
+		idValue = p.value;
+		idIsSet = true;
+		overridableAfterId = false;
+	}
+	if (!idIsSet || overridableAfterId) return false;
+	return urlDerivesFromGetObjectUri(idValue, ctx, seen);
+}
+/**
+* Whether a single returned expression is valid: a URL derived from
+* `getObjectUri()`, or a vocab object (a `new X({...})` expression) whose own
+* `id` is derived from it.  The object is judged solely by its `id`, so
+* `getObjectUri()` appearing in another property (e.g. `url`) does not excuse a
+* hard-coded `id`.  A plain object literal is rejected: the handler calls
+* `toJsonLd()` on the result, so a bare `{ ... }` (which lacks it) is not a
+* valid return.
+*/
+function returnDerivesFromGetObjectUri(value, ctx, seen) {
+	const expr = unwrapExpression(value);
+	if (expr == null) return false;
+	if (expr.type === "Identifier") {
+		const name = expr.name;
+		if (typeof name === "string" && ctx.bindings.has(name) && !seen.has(name)) return returnDerivesFromGetObjectUri(ctx.bindings.get(name), ctx, new Set(seen).add(name));
+		return false;
+	}
+	if (expr.type === "ConditionalExpression") return returnDerivesFromGetObjectUri(expr.consequent, ctx, seen) && returnDerivesFromGetObjectUri(expr.alternate, ctx, seen);
+	if (expr.type === "NewExpression") {
+		if (isUrlConstructor(expr)) return urlDerivesFromGetObjectUri(expr, ctx, seen);
+		const objArg = extractObjectArg(expr);
+		if (objArg == null) return false;
+		return objectIdDerivesFromGetObjectUri(objArg, ctx, seen);
+	}
+	return urlDerivesFromGetObjectUri(expr, ctx, seen);
+}
+/**
+* Determines whether every returned value of the callback is derived from
+* `getObjectUri`.  Returns `false` when the callback has no return value or any
+* returned value is not derived from `getObjectUri`.
+*/
+function callbackDerivesFromGetObjectUri(callback) {
+	const returnedExpressions = collectReturnedExpressions(callback);
+	if (returnedExpressions.length < 1) return false;
+	const bindings = /* @__PURE__ */ new Map();
+	collectLocalBindings(callback.body, bindings);
+	const ctx = {
+		ctxName: getContextParamName(callback),
+		bindings
+	};
+	return returnedExpressions.every((expr) => returnDerivesFromGetObjectUri(expr, ctx, /* @__PURE__ */ new Set()));
+}
+function createRule$1(buildReport) {
+	return (context) => {
+		const federationTracker = trackFederationVariables();
+		const bindings = /* @__PURE__ */ new Map();
+		const pendingCalls = [];
+		const inspectCall = (node) => {
+			if (!hasMemberExpressionCallee(node) || !hasIdentifierProperty(node) || !hasMethodName("setMediaUploader")(node) || node.arguments.length < 2) return;
+			if (!federationTracker.isFederationObject(node.callee.object)) return;
+			const callbackArg = node.arguments[1];
+			const callback = isNode(callbackArg) && isFunction(callbackArg) ? callbackArg : isNode(callbackArg) ? resolveCallbackReference(callbackArg, bindings) : null;
+			if (callback == null) return;
+			if (callbackDerivesFromGetObjectUri(callback)) return;
+			context.report({
+				node: callback,
+				...buildReport
+			});
+		};
+		return {
+			VariableDeclarator(node) {
+				federationTracker.VariableDeclarator(node);
+				if (node.id.type === "Identifier" && node.init != null) bindings.set(node.id.name, node.init);
+			},
+			FunctionDeclaration(node) {
+				if (node.id != null) bindings.set(node.id.name, node);
+			},
+			CallExpression(node) {
+				pendingCalls.push(node);
+			},
+			"Program:exit"() {
+				for (const node of pendingCalls) inspectCall(node);
+			}
+		};
+	};
+}
+const eslint$1 = {
+	meta: {
+		type: "suggestion",
+		docs: { description: "Warn when a setMediaUploader() callback does not derive its return value from ctx.getObjectUri()" },
+		schema: [],
+		messages: { required: "{{ message }}" }
+	},
+	create: createRule$1({
+		messageId: "required",
+		data: { message: MESSAGE$1 }
+	})
+};
+//#endregion
 //#region src/rules/outbox-listener-delivery-required.ts
 const MESSAGE = "Outbox listeners should deliver posted activities explicitly with ctx.sendActivity() or ctx.forwardActivity().";
 const isChainedFromOutboxListeners = (expr, federationTracker) => {
@@ -916,6 +1327,30 @@ Object.defineProperty(exports, "eslint$21", {
 		return eslint$21;
 	}
 });
+Object.defineProperty(exports, "eslint$22", {
+	enumerable: true,
+	get: function() {
+		return eslint$22;
+	}
+});
+Object.defineProperty(exports, "eslint$23", {
+	enumerable: true,
+	get: function() {
+		return eslint$23;
+	}
+});
+Object.defineProperty(exports, "eslint$24", {
+	enumerable: true,
+	get: function() {
+		return eslint$24;
+	}
+});
+Object.defineProperty(exports, "eslint$25", {
+	enumerable: true,
+	get: function() {
+		return eslint$25;
+	}
+});
 Object.defineProperty(exports, "eslint$3", {
 	enumerable: true,
 	get: function() {

package/dist/oxlint.cjs

@@ -1,28 +1,32 @@
-const require_outbox_listener_delivery_required = require("./outbox-listener-delivery-required-BBuAbkOF.cjs");
+const require_outbox_listener_delivery_required = require("./outbox-listener-delivery-required-BhuVwj9X.cjs");
 //#region src/oxlint.ts
 const rules = {
-	[require_outbox_listener_delivery_required.RULE_IDS.actorIdMismatch]: require_outbox_listener_delivery_required.eslint$12,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorIdRequired]: require_outbox_listener_delivery_required.eslint$11,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowingPropertyRequired]: require_outbox_listener_delivery_required.eslint$13,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowingPropertyMismatch]: require_outbox_listener_delivery_required.eslint$14,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowersPropertyRequired]: require_outbox_listener_delivery_required.eslint$15,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowersPropertyMismatch]: require_outbox_listener_delivery_required.eslint$16,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorOutboxPropertyRequired]: require_outbox_listener_delivery_required.eslint$5,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorOutboxPropertyMismatch]: require_outbox_listener_delivery_required.eslint$6,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorLikedPropertyRequired]: require_outbox_listener_delivery_required.eslint$7,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorLikedPropertyMismatch]: require_outbox_listener_delivery_required.eslint$8,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedPropertyRequired]: require_outbox_listener_delivery_required.eslint$19,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedPropertyMismatch]: require_outbox_listener_delivery_required.eslint$20,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedTagsPropertyRequired]: require_outbox_listener_delivery_required.eslint$17,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedTagsPropertyMismatch]: require_outbox_listener_delivery_required.eslint$18,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorInboxPropertyRequired]: require_outbox_listener_delivery_required.eslint$9,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorInboxPropertyMismatch]: require_outbox_listener_delivery_required.eslint$10,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorSharedInboxPropertyRequired]: require_outbox_listener_delivery_required.eslint$2,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorSharedInboxPropertyMismatch]: require_outbox_listener_delivery_required.eslint$3,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorPublicKeyRequired]: require_outbox_listener_delivery_required.eslint$4,
-	[require_outbox_listener_delivery_required.RULE_IDS.actorAssertionMethodRequired]: require_outbox_listener_delivery_required.eslint$21,
-	[require_outbox_listener_delivery_required.RULE_IDS.collectionFilteringNotImplemented]: require_outbox_listener_delivery_required.eslint$1,
-	[require_outbox_listener_delivery_required.RULE_IDS.outboxListenerDeliveryRequired]: require_outbox_listener_delivery_required.eslint
+	[require_outbox_listener_delivery_required.RULE_IDS.actorIdMismatch]: require_outbox_listener_delivery_required.eslint$16,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorIdRequired]: require_outbox_listener_delivery_required.eslint$15,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowingPropertyRequired]: require_outbox_listener_delivery_required.eslint$17,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowingPropertyMismatch]: require_outbox_listener_delivery_required.eslint$18,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowersPropertyRequired]: require_outbox_listener_delivery_required.eslint$19,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFollowersPropertyMismatch]: require_outbox_listener_delivery_required.eslint$20,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorOutboxPropertyRequired]: require_outbox_listener_delivery_required.eslint$9,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorOutboxPropertyMismatch]: require_outbox_listener_delivery_required.eslint$10,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorLikedPropertyRequired]: require_outbox_listener_delivery_required.eslint$11,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorLikedPropertyMismatch]: require_outbox_listener_delivery_required.eslint$12,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedPropertyRequired]: require_outbox_listener_delivery_required.eslint$23,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedPropertyMismatch]: require_outbox_listener_delivery_required.eslint$24,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedTagsPropertyRequired]: require_outbox_listener_delivery_required.eslint$21,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorFeaturedTagsPropertyMismatch]: require_outbox_listener_delivery_required.eslint$22,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorInboxPropertyRequired]: require_outbox_listener_delivery_required.eslint$13,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorInboxPropertyMismatch]: require_outbox_listener_delivery_required.eslint$14,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorSharedInboxPropertyRequired]: require_outbox_listener_delivery_required.eslint$6,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorSharedInboxPropertyMismatch]: require_outbox_listener_delivery_required.eslint$7,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorUploadMediaPropertyRequired]: require_outbox_listener_delivery_required.eslint$4,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorUploadMediaPropertyMismatch]: require_outbox_listener_delivery_required.eslint$5,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorPublicKeyRequired]: require_outbox_listener_delivery_required.eslint$8,
+	[require_outbox_listener_delivery_required.RULE_IDS.actorAssertionMethodRequired]: require_outbox_listener_delivery_required.eslint$25,
+	[require_outbox_listener_delivery_required.RULE_IDS.collectionFilteringNotImplemented]: require_outbox_listener_delivery_required.eslint$3,
+	[require_outbox_listener_delivery_required.RULE_IDS.outboxListenerDeliveryRequired]: require_outbox_listener_delivery_required.eslint,
+	[require_outbox_listener_delivery_required.RULE_IDS.mediaUploaderObjectUriRequired]: require_outbox_listener_delivery_required.eslint$1,
+	[require_outbox_listener_delivery_required.RULE_IDS.mediaUploaderAuthorizationRequired]: require_outbox_listener_delivery_required.eslint$2
 };
 const plugin = {
 	meta: {

package/dist/oxlint.js

@@ -1,4 +1,4 @@
-import { C as RULE_IDS, S as eslint$19, T as version, _ as eslint$5, a as eslint$18, b as eslint$10, c as eslint$8, d as eslint$15, f as eslint$1, g as eslint$4, h as eslint$3, i as eslint$17, l as eslint$9, m as eslint$2, n as eslint$20, o as eslint$6, p as eslint, r as eslint$16, s as eslint$7, t as eslint$21, u as eslint$14, v as eslint$12, w as name, x as eslint$11, y as eslint$13 } from "./outbox-listener-delivery-required-Cx3YNy0p.js";
+import { C as eslint$13, D as RULE_IDS, E as eslint$21, O as name, S as eslint$12, T as eslint$11, _ as eslint, a as eslint$18, b as eslint$4, c as eslint$17, d as eslint$7, f as eslint$8, g as eslint$1, h as eslint$15, i as eslint$22, k as version, l as eslint$20, m as eslint$14, n as eslint$24, o as eslint$19, p as eslint$9, r as eslint$25, s as eslint$16, t as eslint$23, u as eslint$6, v as eslint$2, w as eslint$10, x as eslint$5, y as eslint$3 } from "./outbox-listener-delivery-required-BOIQaemq.js";
 //#region src/oxlint.ts
 const rules = {
 	[RULE_IDS.actorIdMismatch]: eslint,
@@ -19,10 +19,14 @@ const rules = {
 	[RULE_IDS.actorInboxPropertyMismatch]: eslint$15,
 	[RULE_IDS.actorSharedInboxPropertyRequired]: eslint$16,
 	[RULE_IDS.actorSharedInboxPropertyMismatch]: eslint$17,
-	[RULE_IDS.actorPublicKeyRequired]: eslint$18,
-	[RULE_IDS.actorAssertionMethodRequired]: eslint$19,
-	[RULE_IDS.collectionFilteringNotImplemented]: eslint$20,
-	[RULE_IDS.outboxListenerDeliveryRequired]: eslint$21
+	[RULE_IDS.actorUploadMediaPropertyRequired]: eslint$18,
+	[RULE_IDS.actorUploadMediaPropertyMismatch]: eslint$19,
+	[RULE_IDS.actorPublicKeyRequired]: eslint$20,
+	[RULE_IDS.actorAssertionMethodRequired]: eslint$21,
+	[RULE_IDS.collectionFilteringNotImplemented]: eslint$22,
+	[RULE_IDS.outboxListenerDeliveryRequired]: eslint$23,
+	[RULE_IDS.mediaUploaderObjectUriRequired]: eslint$24,
+	[RULE_IDS.mediaUploaderAuthorizationRequired]: eslint$25
 };
 const plugin = {
 	meta: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/lint",
-  "version": "2.4.0-dev.1599+7b19967f",
+  "version": "2.4.0-dev.1634+3b4bfbb6",
   "description": "Fedify linting rules and plugins",
   "keywords": [
     "Fedify",
@@ -51,7 +51,7 @@
   ],
   "peerDependencies": {
     "eslint": ">=9.0.0",
-    "@fedify/fedify": "^2.4.0-dev.1599+7b19967f"
+    "@fedify/fedify": "^2.4.0-dev.1634+3b4bfbb6"
   },
   "peerDependenciesMeta": {
     "eslint": {