@fedify/relay 2.4.0-dev.1964 → 2.4.0-dev.1995

package/dist/litepub.test.js

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as exportSpki, r as getDocumentLoader, t as isRelayFollowerData } from "./types-CRlN8M8T.js";
+import { n as exportSpki, r as getDocumentLoader, t as isRelayFollowerData } from "./types-C_5jld-p.js";
 import { MemoryKvStore, signRequest } from "@fedify/fedify";
 import { createRelay } from "@fedify/relay";
 import { deepStrictEqual, ok, strictEqual } from "node:assert";
@@ -25,6 +25,22 @@ const mockDocumentLoader = async (url) => {
 			}
 		}
 	};
+	else if (url === "https://remote.example.com/users/dave" || url === "https://remote.example.com/users/dave#main-key") return {
+		contextUrl: null,
+		documentUrl: url.replace(/#main-key$/, ""),
+		document: {
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
+			id: url,
+			type: "Person",
+			preferredUsername: "dave",
+			inbox: daveInbox,
+			publicKey: {
+				id: "https://remote.example.com/users/dave#main-key",
+				owner: url.replace(/#main-key$/, ""),
+				publicKeyPem: await exportSpki(rsaKeyPair.publicKey)
+			}
+		}
+	};
 	else if (url === "https://remote.example.com/notes/1") return {
 		contextUrl: null,
 		documentUrl: url,
@@ -52,6 +68,31 @@ const rsaPublicKey = {
 	id: new URL("https://remote.example.com/users/alice#main-key"),
 	...rsaKeyPair.publicKey
 };
+const davePublicKey = {
+	id: new URL("https://remote.example.com/users/dave#main-key"),
+	...rsaKeyPair.publicKey
+};
+const INBOX_PREFIX = "https://[2001:db8:1::";
+const daveInbox = `${INBOX_PREFIX}1]/users/dave/inbox`;
+const pendingInbox = `${INBOX_PREFIX}2]/users/bob/inbox`;
+const acceptedInbox = `${INBOX_PREFIX}3]/users/carol/inbox`;
+const recorders = /* @__PURE__ */ new Map();
+function recordInbox(inbox) {
+	const recorded = [];
+	recorders.set(inbox, recorded);
+	return recorded;
+}
+const nextFetch = globalThis.fetch;
+globalThis.fetch = (async (input, init) => {
+	const request = input instanceof Request ? input : new Request(input, init);
+	if (!request.url.startsWith(INBOX_PREFIX)) return await nextFetch(input, init);
+	const recorded = recorders.get(request.url);
+	if (recorded != null) recorded.push({
+		method: request.method,
+		body: await request.json()
+	});
+	return new Response(null, { status: 202 });
+});
 describe("LitePubRelay", () => {
 	test("constructor with required options", () => {
 		ok(createRelay("litepub", {
@@ -183,9 +224,9 @@ describe("LitePubRelay", () => {
 			}
 		});
 		const follower = new Person({
-			id: new URL("https://remote.example.com/users/alice"),
-			preferredUsername: "alice",
-			inbox: new URL("https://remote.example.com/users/alice/inbox")
+			id: new URL("https://remote.example.com/users/dave"),
+			preferredUsername: "dave",
+			inbox: new URL(daveInbox)
 		});
 		const followActivity = new Follow({
 			id: new URL("https://remote.example.com/activities/follow/1"),
@@ -197,32 +238,20 @@ describe("LitePubRelay", () => {
 			headers: { "Content-Type": "application/activity+json" },
 			body: JSON.stringify(await followActivity.toJsonLd({ contextLoader: mockDocumentLoader }))
 		});
-		request = await signRequest(request, rsaKeyPair.privateKey, rsaPublicKey.id);
-		const originalFetch = globalThis.fetch;
-		const deliveredActivities = [];
-		globalThis.fetch = (async (input, init) => {
-			const outboundRequest = input instanceof Request ? input : new Request(input, init);
-			if (outboundRequest.url === "https://remote.example.com/users/alice/inbox") {
-				deliveredActivities.push(await outboundRequest.json());
-				return new Response(null, { status: 202 });
-			}
-			return originalFetch(input, init);
-		});
-		try {
-			await relay.fetch(request);
-		} finally {
-			globalThis.fetch = originalFetch;
-		}
+		request = await signRequest(request, rsaKeyPair.privateKey, davePublicKey.id);
+		const deliveredActivities = recordInbox(daveInbox);
+		const response = await relay.fetch(request);
+		ok(response.status === 200 || response.status === 202, `Unexpected inbox response status: ${response.status}`);
 		strictEqual(handlerCalled, true);
 		ok(handlerActor);
-		const followerData = await kv.get(["follower", "https://remote.example.com/users/alice"]);
+		const followerData = await kv.get(["follower", "https://remote.example.com/users/dave"]);
 		ok(isRelayFollowerData(followerData));
 		strictEqual(followerData.state, "pending");
-		const reciprocalFollow = deliveredActivities.find((activity) => activity.type === "Follow");
+		const reciprocalFollow = deliveredActivities.map(({ body }) => body).find((activity) => activity.type === "Follow");
 		ok(reciprocalFollow, "Expected a reciprocal Follow activity");
 		strictEqual(reciprocalFollow.actor, "https://relay.example.com/users/relay");
-		strictEqual(reciprocalFollow.object, "https://remote.example.com/users/alice");
-		strictEqual(reciprocalFollow.to, "https://remote.example.com/users/alice");
+		strictEqual(reciprocalFollow.object, "https://remote.example.com/users/dave");
+		strictEqual(reciprocalFollow.to, "https://remote.example.com/users/dave");
 	});
 	test("handles Follow activity with subscription rejection", async () => {
 		const kv = new MemoryKvStore();
@@ -562,12 +591,12 @@ describe("LitePubRelay", () => {
 		const pendingFollower = new Person({
 			id: new URL("https://pending.example.com/users/bob"),
 			preferredUsername: "bob",
-			inbox: new URL("https://pending.example.com/users/bob/inbox")
+			inbox: new URL(pendingInbox)
 		});
 		const acceptedFollower = new Person({
 			id: new URL("https://accepted.example.com/users/carol"),
 			preferredUsername: "carol",
-			inbox: new URL("https://accepted.example.com/users/carol/inbox")
+			inbox: new URL(acceptedInbox)
 		});
 		await kv.set(["follower", pendingFollower.id.href], {
 			actor: await pendingFollower.toJsonLd(),
@@ -598,23 +627,12 @@ describe("LitePubRelay", () => {
 			body: JSON.stringify(await createActivity.toJsonLd({ contextLoader: mockDocumentLoader }))
 		});
 		request = await signRequest(request, rsaKeyPair.privateKey, rsaPublicKey.id);
-		const originalFetch = globalThis.fetch;
-		const deliveredInboxUrls = [];
-		globalThis.fetch = (async (input, init) => {
-			const outboundRequest = input instanceof Request ? input : new Request(input, init);
-			if (outboundRequest.url.endsWith("/inbox")) {
-				deliveredInboxUrls.push(outboundRequest.url);
-				return new Response(null, { status: 202 });
-			}
-			return await originalFetch(input, init);
-		});
-		try {
-			const response = await relay.fetch(request);
-			ok(response.status === 200 || response.status === 202);
-		} finally {
-			globalThis.fetch = originalFetch;
-		}
-		deepStrictEqual(deliveredInboxUrls, ["https://accepted.example.com/users/carol/inbox"]);
+		const deliveredToPending = recordInbox(pendingInbox);
+		const deliveredToAccepted = recordInbox(acceptedInbox);
+		const response = await relay.fetch(request);
+		ok(response.status === 200 || response.status === 202, `Unexpected inbox response status: ${response.status}`);
+		strictEqual(deliveredToAccepted.length, 1);
+		deepStrictEqual(deliveredToPending, []);
 	});
 	test("handles Update activity with Announce forwarding", async () => {
 		const relay = createRelay("litepub", {

package/dist/mastodon.test.js

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as exportSpki, r as getDocumentLoader, t as isRelayFollowerData } from "./types-CRlN8M8T.js";
+import { n as exportSpki, r as getDocumentLoader, t as isRelayFollowerData } from "./types-C_5jld-p.js";
 import { MemoryKvStore, signJsonLd, signRequest } from "@fedify/fedify";
 import { createRelay } from "@fedify/relay";
 import { deepStrictEqual, ok, strictEqual } from "node:assert";
@@ -52,6 +52,25 @@ const rsaPublicKey = {
 	id: new URL("https://remote.example.com/users/alice#main-key"),
 	...rsaKeyPair.publicKey
 };
+const INBOX_PREFIX = "https://[2001:db8:2::";
+const followerInbox = `${INBOX_PREFIX}1]/users/bob/inbox`;
+const recorders = /* @__PURE__ */ new Map();
+function recordInbox(inbox) {
+	const recorded = [];
+	recorders.set(inbox, recorded);
+	return recorded;
+}
+const nextFetch = globalThis.fetch;
+globalThis.fetch = (async (input, init) => {
+	const request = input instanceof Request ? input : new Request(input, init);
+	if (!request.url.startsWith(INBOX_PREFIX)) return await nextFetch(input, init);
+	const recorded = recorders.get(request.url);
+	if (recorded != null) recorded.push({
+		method: request.method,
+		body: await request.json()
+	});
+	return new Response(null, { status: 202 });
+});
 describe("MastodonRelay", () => {
 	test("constructor with required options", () => {
 		ok(createRelay("mastodon", {
@@ -439,7 +458,7 @@ describe("MastodonRelay", () => {
 		const follower = new Person({
 			id: new URL("https://follower.example.com/users/bob"),
 			preferredUsername: "bob",
-			inbox: new URL("https://follower.example.com/users/bob/inbox")
+			inbox: new URL(followerInbox)
 		});
 		await kv.set(["follower", follower.id.href], {
 			actor: await follower.toJsonLd(),
@@ -463,27 +482,12 @@ describe("MastodonRelay", () => {
 			body: JSON.stringify(signedAnnounce)
 		});
 		request = await signRequest(request, rsaKeyPair.privateKey, rsaPublicKey.id);
-		const originalFetch = globalThis.fetch;
-		let deliveryMethod;
-		let deliveredActivity;
-		globalThis.fetch = (async (input, init) => {
-			const outboundRequest = input instanceof Request ? input : new Request(input, init);
-			if (outboundRequest.url === "https://follower.example.com/users/bob/inbox") {
-				deliveryMethod = outboundRequest.method;
-				deliveredActivity = await outboundRequest.json();
-				return new Response(null, { status: 202 });
-			}
-			return originalFetch(input, init);
-		});
-		try {
-			const response = await relay.fetch(request);
-			ok(response.status === 200 || response.status === 202, `Unexpected inbox response status: ${response.status}`);
-		} finally {
-			globalThis.fetch = originalFetch;
-		}
-		ok(deliveredActivity, "Expected Announce delivery to the follower inbox");
-		strictEqual(deliveryMethod, "POST");
-		deepStrictEqual(deliveredActivity, signedAnnounce);
+		const delivered = recordInbox(followerInbox);
+		const response = await relay.fetch(request);
+		ok(response.status === 200 || response.status === 202, `Unexpected inbox response status: ${response.status}`);
+		strictEqual(delivered.length, 1, "Expected exactly one delivery");
+		strictEqual(delivered[0].method, "POST");
+		deepStrictEqual(delivered[0].body, signedAnnounce);
 	});
 	test("ignores Follow activity without required fields", async () => {
 		const kv = new MemoryKvStore();

package/dist/{types-CRlN8M8T.js → types-C_5jld-p.js}

@@ -26102,7 +26102,147 @@ const preloadedContexts = {
 	} }
 };
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1964+1d28dc03";
+var version = "2.4.0-dev.1995+618fd4e7";
+/**
+* Error thrown when fetching a JSON-LD document failed.
+*/
+var FetchError = class extends Error {
+	/**
+	* The URL that failed to fetch.
+	*/
+	url;
+	/**
+	* The HTTP response that failed, if available.
+	*/
+	response;
+	/**
+	* Constructs a new `FetchError`.
+	*
+	* @param url The URL that failed to fetch.
+	* @param message Error message.
+	* @param response The failed HTTP response, if available.
+	*/
+	constructor(url, message, response) {
+		super(message == null ? url.toString() : `${url}: ${message}`);
+		this.name = "FetchError";
+		this.url = typeof url === "string" ? new URL(url) : url;
+		this.response = response;
+	}
+};
+/**
+* Creates a request for the given URL.
+* @param url The URL to create the request for.
+* @param options The options for the request.
+* @returns The created request.
+* @internal
+*/
+function createActivityPubRequest(url, options = {}) {
+	return new Request(url, {
+		headers: {
+			Accept: "application/activity+json, application/ld+json",
+			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
+		},
+		redirect: "manual"
+	});
+}
+/**
+* Gets the user agent string for the given application and URL.
+* @param options The options for making the user agent string.
+* @returns The user agent string.
+* @since 1.3.0
+*/
+function getUserAgent({ software, url } = {}) {
+	const fedify = `Fedify/${version}`;
+	const runtime = globalThis.Deno?.version?.deno != null ? `Deno/${Deno.version.deno}` : globalThis.process?.versions?.bun != null ? `Bun/${process$1.versions.bun}` : "navigator" in globalThis && navigator.userAgent === "Cloudflare-Workers" ? navigator.userAgent : globalThis.process?.versions?.node != null ? `Node.js/${process$1.versions.node}` : null;
+	const userAgent = software == null ? [fedify] : [software, fedify];
+	if (runtime != null) userAgent.push(runtime);
+	if (url != null) userAgent.push(`+${url.toString()}`);
+	return `${userAgent.shift()} (${userAgent.join("; ")})`;
+}
+/**
+* Logs the request.
+* @param request The request to log.
+* @internal
+*/
+function logRequest(logger, request) {
+	logger.debug("Fetching document: {method} {url} {headers}", {
+		method: request.method,
+		url: request.url,
+		headers: Object.fromEntries(request.headers.entries())
+	});
+}
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 const parametersNeedLowerCase = ["rel", "type"];
 const regexpLinkWhitespace = /[\n\r\s\t]/;
 function validateURI(uri) {
@@ -26282,74 +26422,6 @@ var HttpHeaderLink = class HttpHeaderLink {
 		return new this(...inputs).toString();
 	}
 };
-/**
-* Error thrown when fetching a JSON-LD document failed.
-*/
-var FetchError = class extends Error {
-	/**
-	* The URL that failed to fetch.
-	*/
-	url;
-	/**
-	* The HTTP response that failed, if available.
-	*/
-	response;
-	/**
-	* Constructs a new `FetchError`.
-	*
-	* @param url The URL that failed to fetch.
-	* @param message Error message.
-	* @param response The failed HTTP response, if available.
-	*/
-	constructor(url, message, response) {
-		super(message == null ? url.toString() : `${url}: ${message}`);
-		this.name = "FetchError";
-		this.url = typeof url === "string" ? new URL(url) : url;
-		this.response = response;
-	}
-};
-/**
-* Creates a request for the given URL.
-* @param url The URL to create the request for.
-* @param options The options for the request.
-* @returns The created request.
-* @internal
-*/
-function createActivityPubRequest(url, options = {}) {
-	return new Request(url, {
-		headers: {
-			Accept: "application/activity+json, application/ld+json",
-			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-		},
-		redirect: "manual"
-	});
-}
-/**
-* Gets the user agent string for the given application and URL.
-* @param options The options for making the user agent string.
-* @returns The user agent string.
-* @since 1.3.0
-*/
-function getUserAgent({ software, url } = {}) {
-	const fedify = `Fedify/${version}`;
-	const runtime = globalThis.Deno?.version?.deno != null ? `Deno/${Deno.version.deno}` : globalThis.process?.versions?.bun != null ? `Bun/${process$1.versions.bun}` : "navigator" in globalThis && navigator.userAgent === "Cloudflare-Workers" ? navigator.userAgent : globalThis.process?.versions?.node != null ? `Node.js/${process$1.versions.node}` : null;
-	const userAgent = software == null ? [fedify] : [software, fedify];
-	if (runtime != null) userAgent.push(runtime);
-	if (url != null) userAgent.push(`+${url.toString()}`);
-	return `${userAgent.shift()} (${userAgent.join("; ")})`;
-}
-/**
-* Logs the request.
-* @param request The request to log.
-* @internal
-*/
-function logRequest(logger, request) {
-	logger.debug("Fetching document: {method} {url} {headers}", {
-		method: request.method,
-		url: request.url,
-		headers: Object.fromEntries(request.headers.entries())
-	});
-}
 const logger = getLogger([
 	"fedify",
 	"runtime",
@@ -26364,58 +26436,6 @@ function createResponseMetadata(response) {
 		statusText: response.statusText
 	});
 }
-async function cancelResponseBody(response) {
-	if (response.body != null) await response.body.cancel();
-}
-async function readBoundedText(response, maxBytes) {
-	const contentLength = response.headers.get("Content-Length");
-	if (contentLength != null) {
-		const size = Number(contentLength);
-		if (size > maxBytes) {
-			await cancelResponseBody(response);
-			return {
-				text: "",
-				size,
-				tooLarge: true
-			};
-		}
-	}
-	if (response.body == null) return {
-		text: "",
-		size: 0,
-		tooLarge: false
-	};
-	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
-	let text = "";
-	let size = 0;
-	try {
-		while (true) {
-			const result = await reader.read();
-			if (result.done) break;
-			const chunkSize = result.value.byteLength;
-			if (size + chunkSize > maxBytes) {
-				size += chunkSize;
-				await reader.cancel();
-				return {
-					text: "",
-					size,
-					tooLarge: true
-				};
-			}
-			size += chunkSize;
-			text += decoder.decode(result.value, { stream: true });
-		}
-		text += decoder.decode();
-		return {
-			text,
-			size,
-			tooLarge: false
-		};
-	} finally {
-		reader.releaseLock();
-	}
-}
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -26471,42 +26491,44 @@ async function getRemoteDocument(url, response, fetch) {
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
 		const errorResponse = createResponseMetadata(response);
-		const html = await readBoundedText(response, MAX_HTML_SIZE);
-		if (html.tooLarge) {
+		let html;
+		try {
+			html = await readBoundedText(response, MAX_HTML_SIZE, documentUrl);
+		} catch (error) {
+			if (!(error instanceof BodyTooLargeError)) throw error;
 			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
 				url: documentUrl,
-				size: html.size
+				maxBytes: MAX_HTML_SIZE
 			});
 			throw new FetchError(documentUrl, `HTML document is too large to scan for an ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
-		} else {
-			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
-			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
-			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html.text)) !== null) {
-				const tagContent = tagMatch[2];
-				let attrMatch;
-				const attribs = {};
-				attrPattern.lastIndex = 0;
-				while ((attrMatch = attrPattern.exec(tagContent)) !== null) {
-					const key = attrMatch[1].toLowerCase();
-					attribs[key] = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4] ?? "";
-				}
-				if (attribs.rel === "alternate" && "type" in attribs && (attribs.type === "application/activity+json" || attribs.type === "application/ld+json" || attribs.type.startsWith("application/ld+json;")) && "href" in attribs && new URL(attribs.href, docUrl).href !== docUrl.href) {
-					logger.debug("Found alternate document: {alternateUrl} from {url}", {
-						alternateUrl: attribs.href,
-						url: documentUrl
-					});
-					return await fetch(new URL(attribs.href, docUrl).href);
-				}
-			}
-			try {
-				document = JSON.parse(html.text);
-			} catch (error) {
-				if (!(error instanceof SyntaxError)) throw error;
-				throw new FetchError(documentUrl, `HTML document has no ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
+		}
+		const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
+		const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
+		let tagMatch;
+		while ((tagMatch = tagPattern.exec(html)) !== null) {
+			const tagContent = tagMatch[2];
+			let attrMatch;
+			const attribs = {};
+			attrPattern.lastIndex = 0;
+			while ((attrMatch = attrPattern.exec(tagContent)) !== null) {
+				const key = attrMatch[1].toLowerCase();
+				attribs[key] = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4] ?? "";
+			}
+			if (attribs.rel === "alternate" && "type" in attribs && (attribs.type === "application/activity+json" || attribs.type === "application/ld+json" || attribs.type.startsWith("application/ld+json;")) && "href" in attribs && new URL(attribs.href, docUrl).href !== docUrl.href) {
+				logger.debug("Found alternate document: {alternateUrl} from {url}", {
+					alternateUrl: attribs.href,
+					url: documentUrl
+				});
+				return await fetch(new URL(attribs.href, docUrl).href);
 			}
 		}
-	} else document = await response.json();
+		try {
+			document = JSON.parse(html);
+		} catch (error) {
+			if (!(error instanceof SyntaxError)) throw error;
+			throw new FetchError(documentUrl, `HTML document has no ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
+		}
+	} else document = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, documentUrl));
 	logger.debug("Fetched document: {status} {url} {headers}", {
 		status: response.status,
 		url: documentUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/relay",
-  "version": "2.4.0-dev.1964+1d28dc03",
+  "version": "2.4.0-dev.1995+618fd4e7",
   "description": "ActivityPub relay support for Fedify",
   "keywords": [
     "Fedify",
@@ -47,14 +47,14 @@
   "dependencies": {
     "@logtape/logtape": "^2.2.0",
     "temporal-polyfill": "^1.0.1",
-    "@fedify/fedify": "^2.4.0-dev.1964+1d28dc03",
-    "@fedify/vocab": "2.4.0-dev.1964+1d28dc03"
+    "@fedify/fedify": "^2.4.0-dev.1995+618fd4e7",
+    "@fedify/vocab": "2.4.0-dev.1995+618fd4e7"
   },
   "devDependencies": {
     "tsdown": "^0.22.0",
     "typescript": "^6.0.0",
     "urlpattern-polyfill": "^10.1.0",
-    "@fedify/vocab-runtime": "^2.4.0-dev.1964+1d28dc03"
+    "@fedify/vocab-runtime": "^2.4.0-dev.1995+618fd4e7"
   },
   "scripts": {
     "build:self": "tsdown",