@fedify/vocab-runtime 2.0.29-dev.2139 → 2.0.29

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.0.29-dev.2139+7e5d091d",
+  "version": "2.0.29",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",

package/dist/mod.cjs

@@ -4460,7 +4460,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.0.29-dev.2139+7e5d091d";
+var version = "2.0.29";
 //#endregion
 //#region src/request.ts
 /**
@@ -5088,6 +5088,8 @@ async function getRemoteDocument(url, response, fetch) {
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 *
 * The created loader preloads the below frequently used contexts by default
 * (unless `options.skipPreloadedContexts` is set to `true`):
@@ -5164,7 +5166,12 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 					}
 					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(currentUrl, response, load);
+				const result = await getRemoteDocument(currentUrl, response, async (alternateUrl) => {
+					options?.signal?.throwIfAborted();
+					if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+					if (visited.has(alternateUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${alternateUrl}`);
+					return await load(alternateUrl, options, redirected + 1, visited);
+				});
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;
@@ -5180,7 +5187,7 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 			}
 		});
 	}
-	return load;
+	return (url, options) => load(url, options);
 }
 //#endregion
 //#region src/internal/multicodec.ts

package/dist/mod.d.cts

@@ -169,6 +169,8 @@ interface GetDocumentLoaderOptions extends DocumentLoaderFactoryOptions {
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 *
 * The created loader preloads the below frequently used contexts by default
 * (unless `options.skipPreloadedContexts` is set to `true`):

package/dist/mod.d.ts

@@ -168,6 +168,8 @@ interface GetDocumentLoaderOptions extends DocumentLoaderFactoryOptions {
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 *
 * The created loader preloads the below frequently used contexts by default
 * (unless `options.skipPreloadedContexts` is set to `true`):

package/dist/mod.js

@@ -4455,7 +4455,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.0.29-dev.2139+7e5d091d";
+var version = "2.0.29";
 //#endregion
 //#region src/request.ts
 /**
@@ -5083,6 +5083,8 @@ async function getRemoteDocument(url, response, fetch) {
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 *
 * The created loader preloads the below frequently used contexts by default
 * (unless `options.skipPreloadedContexts` is set to `true`):
@@ -5159,7 +5161,12 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 					}
 					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(currentUrl, response, load);
+				const result = await getRemoteDocument(currentUrl, response, async (alternateUrl) => {
+					options?.signal?.throwIfAborted();
+					if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+					if (visited.has(alternateUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${alternateUrl}`);
+					return await load(alternateUrl, options, redirected + 1, visited);
+				});
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;
@@ -5175,7 +5182,7 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 			}
 		});
 	}
-	return load;
+	return (url, options) => load(url, options);
 }
 //#endregion
 //#region src/internal/multicodec.ts

package/dist/tests/{body-C1qEpLgG.mjs → body-Dg6PqC7C.mjs}

@@ -1,4 +1,4 @@
-import { t as FetchError } from "./request-BwoIVMwm.mjs";
+import { t as FetchError } from "./request-CHvRxsQO.mjs";
 import { getLogger } from "@logtape/logtape";
 //#region src/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */

package/dist/tests/{body-Dcc2GQXa.cjs → body-ciFbtONg.cjs}

@@ -1,5 +1,5 @@
 require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-C13rzoc1.cjs");
+const require_request = require("./request-D9e2fcok.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 //#region src/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */

package/dist/tests/body.test.cjs

@@ -1,5 +1,5 @@
 require("./chunk-Do9eywBl.cjs");
-const require_body = require("./body-Dcc2GQXa.cjs");
+const require_body = require("./body-ciFbtONg.cjs");
 let node_assert_strict = require("node:assert/strict");
 let node_test = require("node:test");
 let node_zlib = require("node:zlib");

package/dist/tests/body.test.mjs

@@ -1,4 +1,4 @@
-import { r as readBoundedText, t as BodyTooLargeError } from "./body-C1qEpLgG.mjs";
+import { r as readBoundedText, t as BodyTooLargeError } from "./body-Dg6PqC7C.mjs";
 import { deepStrictEqual, ok, rejects } from "node:assert/strict";
 import { test } from "node:test";
 import { gunzipSync, gzipSync } from "node:zlib";

package/dist/tests/docloader.test.cjs

@@ -1,6 +1,6 @@
 const require_chunk = require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-C13rzoc1.cjs");
-const require_body = require("./body-Dcc2GQXa.cjs");
+const require_request = require("./request-D9e2fcok.cjs");
+const require_body = require("./body-ciFbtONg.cjs");
 const require_link = require("./link-FguCydMA.cjs");
 const require_url = require("./url-Qk1svKZU.cjs");
 let node_test = require("node:test");
@@ -5752,6 +5752,8 @@ async function getRemoteDocument(url, response, fetch) {
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 *
 * The created loader preloads the below frequently used contexts by default
 * (unless `options.skipPreloadedContexts` is set to `true`):
@@ -5828,7 +5830,12 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 					}
 					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(currentUrl, response, load);
+				const result = await getRemoteDocument(currentUrl, response, async (alternateUrl) => {
+					options?.signal?.throwIfAborted();
+					if (redirected >= DEFAULT_MAX_REDIRECTION) throw new require_request.FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+					if (visited.has(alternateUrl)) throw new require_request.FetchError(currentUrl, `Redirect loop detected: ${alternateUrl}`);
+					return await load(alternateUrl, options, redirected + 1, visited);
+				});
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;
@@ -5844,7 +5851,7 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 			}
 		});
 	}
-	return load;
+	return (url, options) => load(url, options);
 }
 //#endregion
 //#region src/docloader.test.ts
@@ -6365,4 +6372,150 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 		}
 	});
 });
+(0, node_test.test)("getDocumentLoader() bounds alternate document chains", async (t) => {
+	const base = "https://example.com/alternate-chain/";
+	const loader = getDocumentLoader({ allowPrivateAddress: true });
+	for (const mode of [
+		"header",
+		"html",
+		"mixed"
+	]) for (const hops of [20, 21]) await t.test(`${mode}: ${hops} hops`, async () => {
+		esm_default.mockGlobal();
+		let requests = 0;
+		esm_default.get(`begin:${base}`, ({ url }) => {
+			requests++;
+			const index = Number(new URL(url).pathname.split("/").at(-1));
+			if (index === hops || requests > 30) return Response.json({ done: true });
+			const next = `${base}${index + 1}`;
+			if (mode === "mixed" && index % 2 === 1) return Response.redirect(next, 302);
+			return alternate(next, mode === "html");
+		});
+		try {
+			if (hops === 20) (0, node_assert.deepStrictEqual)((await loader(`${base}0`)).document, { done: true });
+			else await (0, node_assert.rejects)(loader(`${base}0`), (error) => {
+				(0, node_assert.ok)(error instanceof require_request.FetchError);
+				(0, node_assert.ok)(error.message.includes("Too many redirections (21)"));
+				return true;
+			});
+			(0, node_assert.deepStrictEqual)(requests, 21);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	for (const mode of [
+		"header",
+		"html",
+		"alternate-redirect",
+		"redirect-alternate",
+		"redirect-intermediate"
+	]) await t.test(`${mode}: cycle`, async () => {
+		esm_default.mockGlobal();
+		let requests = 0;
+		esm_default.get(`begin:${base}`, ({ url }) => {
+			requests++;
+			if (requests > 30) return Response.json({ stopped: true });
+			const index = Number(new URL(url).pathname.split("/").at(-1));
+			const next = `${base}${mode === "redirect-intermediate" ? index === 0 ? 1 : index === 1 ? 2 : 1 : 1 - index}`;
+			if (mode === "alternate-redirect" && index === 1 || (mode === "redirect-alternate" || mode === "redirect-intermediate") && index === 0) return Response.redirect(next, 302);
+			return alternate(next, mode === "html");
+		});
+		try {
+			await (0, node_assert.rejects)(loader(`${base}0`), (error) => {
+				(0, node_assert.ok)(error instanceof require_request.FetchError);
+				(0, node_assert.ok)(error.message.includes("Redirect loop detected:"));
+				return true;
+			});
+			(0, node_assert.deepStrictEqual)(requests, mode === "redirect-intermediate" ? 3 : 2);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	await t.test("alternate followed by 20 redirects shares the limit", async () => {
+		esm_default.mockGlobal();
+		let requests = 0;
+		esm_default.get(`begin:${base}`, ({ url }) => {
+			requests++;
+			const index = Number(new URL(url).pathname.split("/").at(-1));
+			if (index === 21) return Response.json({ done: true });
+			return index === 0 ? alternate(`${base}1`, false) : Response.redirect(`${base}${index + 1}`, 302);
+		});
+		try {
+			await (0, node_assert.rejects)(loader(`${base}0`), (error) => {
+				(0, node_assert.ok)(error instanceof require_request.FetchError);
+				(0, node_assert.ok)(error.message.includes("Too many redirections (21)"));
+				return true;
+			});
+			(0, node_assert.deepStrictEqual)(requests, 21);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	await t.test("relative alternate after redirect and isolated calls", async () => {
+		esm_default.mockGlobal();
+		esm_default.get(`${base}start`, Response.redirect(`${base}html`, 302));
+		esm_default.get(`${base}html`, alternate("./document", true));
+		esm_default.get(`${base}document`, Response.json({ done: true }));
+		try {
+			for (let i = 0; i < 2; i++) {
+				const results = await Promise.all([loader(`${base}start`), loader(`${base}start`)]);
+				for (const result of results) {
+					(0, node_assert.deepStrictEqual)(result.document, { done: true });
+					(0, node_assert.deepStrictEqual)(result.documentUrl, `${base}document`);
+				}
+			}
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	function alternate(next, html) {
+		return html ? new Response(`<link rel="alternate" type="application/activity+json" href="${next}">`, { headers: { "Content-Type": "text/html" } }) : new Response("not JSON", { headers: {
+			"Content-Type": "text/plain",
+			Link: `<${next}>; rel="alternate"; type="application/activity+json"`
+		} });
+	}
+});
+(0, node_test.test)("getDocumentLoader() preserves cancellation across alternates", async (t) => {
+	const base = "https://example.com/alternate-abort/";
+	const loader = getDocumentLoader({ allowPrivateAddress: true });
+	for (const html of [false, true]) await t.test(html ? "HTML" : "Link header", async () => {
+		esm_default.mockGlobal();
+		const controller = new AbortController();
+		let requests = 0;
+		esm_default.get(`begin:${base}`, ({ url }) => {
+			requests++;
+			const index = Number(new URL(url).pathname.split("/").at(-1));
+			if (index === 2) return Response.json({ done: true });
+			if (index === 1) controller.abort();
+			const next = `${base}${index + 1}`;
+			return new Response(html ? `<link rel="alternate" type="application/activity+json" href="${next}">` : "not JSON", { headers: html ? { "Content-Type": "text/html" } : {
+				"Content-Type": "text/plain",
+				Link: `<${next}>; rel="alternate"; type="application/activity+json"`
+			} });
+		});
+		try {
+			await (0, node_assert.rejects)(loader(`${base}0`, { signal: controller.signal }), { name: "AbortError" });
+			(0, node_assert.deepStrictEqual)(requests, 2);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
+(0, node_test.test)("getDocumentLoader() rejects cancellation before fetching", async () => {
+	esm_default.mockGlobal();
+	let requests = 0;
+	const url = "https://example.com/pre-aborted-alternate";
+	esm_default.get(url, () => {
+		requests++;
+		return Response.json({ done: true });
+	});
+	try {
+		const loader = getDocumentLoader({ allowPrivateAddress: true });
+		const controller = new AbortController();
+		controller.abort();
+		await (0, node_assert.rejects)(loader(url, { signal: controller.signal }), { name: "AbortError" });
+		(0, node_assert.deepStrictEqual)(requests, 0);
+	} finally {
+		esm_default.hardReset();
+	}
+});
 //#endregion

package/dist/tests/docloader.test.mjs

@@ -1,5 +1,5 @@
-import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-BwoIVMwm.mjs";
-import { n as MAX_BODY_SIZE, r as readBoundedText } from "./body-C1qEpLgG.mjs";
+import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-CHvRxsQO.mjs";
+import { n as MAX_BODY_SIZE, r as readBoundedText } from "./body-Dg6PqC7C.mjs";
 import { t as HttpHeaderLink } from "./link-NUUWCdnK.mjs";
 import { o as validatePublicUrl, t as UrlError } from "./url-DzlMS01z.mjs";
 import { test } from "node:test";
@@ -5770,6 +5770,8 @@ async function getRemoteDocument(url, response, fetch) {
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 *
 * The created loader preloads the below frequently used contexts by default
 * (unless `options.skipPreloadedContexts` is set to `true`):
@@ -5846,7 +5848,12 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 					}
 					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(currentUrl, response, load);
+				const result = await getRemoteDocument(currentUrl, response, async (alternateUrl) => {
+					options?.signal?.throwIfAborted();
+					if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+					if (visited.has(alternateUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${alternateUrl}`);
+					return await load(alternateUrl, options, redirected + 1, visited);
+				});
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;
@@ -5862,7 +5869,7 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 			}
 		});
 	}
-	return load;
+	return (url, options) => load(url, options);
 }
 //#endregion
 //#region src/docloader.test.ts
@@ -6383,5 +6390,151 @@ test("getDocumentLoader() logs DNS failures as such", async (t) => {
 		}
 	});
 });
+test("getDocumentLoader() bounds alternate document chains", async (t) => {
+	const base = "https://example.com/alternate-chain/";
+	const loader = getDocumentLoader({ allowPrivateAddress: true });
+	for (const mode of [
+		"header",
+		"html",
+		"mixed"
+	]) for (const hops of [20, 21]) await t.test(`${mode}: ${hops} hops`, async () => {
+		esm_default.mockGlobal();
+		let requests = 0;
+		esm_default.get(`begin:${base}`, ({ url }) => {
+			requests++;
+			const index = Number(new URL(url).pathname.split("/").at(-1));
+			if (index === hops || requests > 30) return Response.json({ done: true });
+			const next = `${base}${index + 1}`;
+			if (mode === "mixed" && index % 2 === 1) return Response.redirect(next, 302);
+			return alternate(next, mode === "html");
+		});
+		try {
+			if (hops === 20) deepStrictEqual((await loader(`${base}0`)).document, { done: true });
+			else await rejects(loader(`${base}0`), (error) => {
+				ok(error instanceof FetchError);
+				ok(error.message.includes("Too many redirections (21)"));
+				return true;
+			});
+			deepStrictEqual(requests, 21);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	for (const mode of [
+		"header",
+		"html",
+		"alternate-redirect",
+		"redirect-alternate",
+		"redirect-intermediate"
+	]) await t.test(`${mode}: cycle`, async () => {
+		esm_default.mockGlobal();
+		let requests = 0;
+		esm_default.get(`begin:${base}`, ({ url }) => {
+			requests++;
+			if (requests > 30) return Response.json({ stopped: true });
+			const index = Number(new URL(url).pathname.split("/").at(-1));
+			const next = `${base}${mode === "redirect-intermediate" ? index === 0 ? 1 : index === 1 ? 2 : 1 : 1 - index}`;
+			if (mode === "alternate-redirect" && index === 1 || (mode === "redirect-alternate" || mode === "redirect-intermediate") && index === 0) return Response.redirect(next, 302);
+			return alternate(next, mode === "html");
+		});
+		try {
+			await rejects(loader(`${base}0`), (error) => {
+				ok(error instanceof FetchError);
+				ok(error.message.includes("Redirect loop detected:"));
+				return true;
+			});
+			deepStrictEqual(requests, mode === "redirect-intermediate" ? 3 : 2);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	await t.test("alternate followed by 20 redirects shares the limit", async () => {
+		esm_default.mockGlobal();
+		let requests = 0;
+		esm_default.get(`begin:${base}`, ({ url }) => {
+			requests++;
+			const index = Number(new URL(url).pathname.split("/").at(-1));
+			if (index === 21) return Response.json({ done: true });
+			return index === 0 ? alternate(`${base}1`, false) : Response.redirect(`${base}${index + 1}`, 302);
+		});
+		try {
+			await rejects(loader(`${base}0`), (error) => {
+				ok(error instanceof FetchError);
+				ok(error.message.includes("Too many redirections (21)"));
+				return true;
+			});
+			deepStrictEqual(requests, 21);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	await t.test("relative alternate after redirect and isolated calls", async () => {
+		esm_default.mockGlobal();
+		esm_default.get(`${base}start`, Response.redirect(`${base}html`, 302));
+		esm_default.get(`${base}html`, alternate("./document", true));
+		esm_default.get(`${base}document`, Response.json({ done: true }));
+		try {
+			for (let i = 0; i < 2; i++) {
+				const results = await Promise.all([loader(`${base}start`), loader(`${base}start`)]);
+				for (const result of results) {
+					deepStrictEqual(result.document, { done: true });
+					deepStrictEqual(result.documentUrl, `${base}document`);
+				}
+			}
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	function alternate(next, html) {
+		return html ? new Response(`<link rel="alternate" type="application/activity+json" href="${next}">`, { headers: { "Content-Type": "text/html" } }) : new Response("not JSON", { headers: {
+			"Content-Type": "text/plain",
+			Link: `<${next}>; rel="alternate"; type="application/activity+json"`
+		} });
+	}
+});
+test("getDocumentLoader() preserves cancellation across alternates", async (t) => {
+	const base = "https://example.com/alternate-abort/";
+	const loader = getDocumentLoader({ allowPrivateAddress: true });
+	for (const html of [false, true]) await t.test(html ? "HTML" : "Link header", async () => {
+		esm_default.mockGlobal();
+		const controller = new AbortController();
+		let requests = 0;
+		esm_default.get(`begin:${base}`, ({ url }) => {
+			requests++;
+			const index = Number(new URL(url).pathname.split("/").at(-1));
+			if (index === 2) return Response.json({ done: true });
+			if (index === 1) controller.abort();
+			const next = `${base}${index + 1}`;
+			return new Response(html ? `<link rel="alternate" type="application/activity+json" href="${next}">` : "not JSON", { headers: html ? { "Content-Type": "text/html" } : {
+				"Content-Type": "text/plain",
+				Link: `<${next}>; rel="alternate"; type="application/activity+json"`
+			} });
+		});
+		try {
+			await rejects(loader(`${base}0`, { signal: controller.signal }), { name: "AbortError" });
+			deepStrictEqual(requests, 2);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
+test("getDocumentLoader() rejects cancellation before fetching", async () => {
+	esm_default.mockGlobal();
+	let requests = 0;
+	const url = "https://example.com/pre-aborted-alternate";
+	esm_default.get(url, () => {
+		requests++;
+		return Response.json({ done: true });
+	});
+	try {
+		const loader = getDocumentLoader({ allowPrivateAddress: true });
+		const controller = new AbortController();
+		controller.abort();
+		await rejects(loader(url, { signal: controller.signal }), { name: "AbortError" });
+		deepStrictEqual(requests, 0);
+	} finally {
+		esm_default.hardReset();
+	}
+});
 //#endregion
 export {};

package/dist/tests/{request-BwoIVMwm.mjs → request-CHvRxsQO.mjs}

@@ -1,7 +1,7 @@
 import process from "node:process";
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.0.29-dev.2139+7e5d091d";
+var version = "2.0.29";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/{request-C13rzoc1.cjs → request-D9e2fcok.cjs}

@@ -3,7 +3,7 @@ let node_process = require("node:process");
 node_process = require_chunk.__toESM(node_process);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.0.29-dev.2139+7e5d091d";
+var version = "2.0.29";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/request.test.cjs

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-C13rzoc1.cjs");
+const require_request = require("./request-D9e2fcok.cjs");
 let node_test = require("node:test");
 let node_process = require("node:process");
 node_process = require_chunk.__toESM(node_process);

package/dist/tests/request.test.mjs

@@ -1,4 +1,4 @@
-import { o as version, r as getUserAgent } from "./request-BwoIVMwm.mjs";
+import { o as version, r as getUserAgent } from "./request-CHvRxsQO.mjs";
 import { test } from "node:test";
 import process from "node:process";
 import { deepStrictEqual } from "node:assert";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.0.29-dev.2139+7e5d091d",
+  "version": "2.0.29",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",

package/src/docloader.test.ts

@@ -724,3 +724,208 @@ test("getDocumentLoader() logs DNS failures as such", async (t) => {
     });
   }
 });
+
+test("getDocumentLoader() bounds alternate document chains", async (t) => {
+  const base = "https://example.com/alternate-chain/";
+  const loader = getDocumentLoader({ allowPrivateAddress: true });
+  for (const mode of ["header", "html", "mixed"] as const) {
+    for (const hops of [20, 21]) {
+      await t.test(`${mode}: ${hops} hops`, async () => {
+        fetchMock.mockGlobal();
+        let requests = 0;
+        fetchMock.get(`begin:${base}`, ({ url }) => {
+          requests++;
+          const index = Number(new URL(url).pathname.split("/").at(-1));
+          // Keep the unpatched regression bounded too.
+          if (index === hops || requests > 30) {
+            return Response.json({ done: true });
+          }
+          const next = `${base}${index + 1}`;
+          if (mode === "mixed" && index % 2 === 1) {
+            return Response.redirect(next, 302);
+          }
+          return alternate(next, mode === "html");
+        });
+        try {
+          if (hops === 20) {
+            deepStrictEqual((await loader(`${base}0`)).document, {
+              done: true,
+            });
+          } else {
+            await rejects(loader(`${base}0`), (error: unknown) => {
+              ok(error instanceof FetchError);
+              ok(error.message.includes("Too many redirections (21)"));
+              return true;
+            });
+          }
+          deepStrictEqual(requests, 21);
+        } finally {
+          fetchMock.hardReset();
+        }
+      });
+    }
+  }
+
+  for (
+    const mode of [
+      "header",
+      "html",
+      "alternate-redirect",
+      "redirect-alternate",
+      "redirect-intermediate",
+    ]
+  ) {
+    await t.test(`${mode}: cycle`, async () => {
+      fetchMock.mockGlobal();
+      let requests = 0;
+      fetchMock.get(`begin:${base}`, ({ url }) => {
+        requests++;
+        if (requests > 30) return Response.json({ stopped: true });
+        const index = Number(new URL(url).pathname.split("/").at(-1));
+        const next = `${base}${
+          mode === "redirect-intermediate"
+            ? (index === 0 ? 1 : index === 1 ? 2 : 1)
+            : 1 - index
+        }`;
+        if (
+          (mode === "alternate-redirect" && index === 1) ||
+          ((mode === "redirect-alternate" ||
+            mode === "redirect-intermediate") && index === 0)
+        ) {
+          return Response.redirect(next, 302);
+        }
+        return alternate(next, mode === "html");
+      });
+      try {
+        await rejects(loader(`${base}0`), (error: unknown) => {
+          ok(error instanceof FetchError);
+          ok(error.message.includes("Redirect loop detected:"));
+          return true;
+        });
+        deepStrictEqual(requests, mode === "redirect-intermediate" ? 3 : 2);
+      } finally {
+        fetchMock.hardReset();
+      }
+    });
+  }
+
+  await t.test("alternate followed by 20 redirects shares the limit", async () => {
+    fetchMock.mockGlobal();
+    let requests = 0;
+    fetchMock.get(`begin:${base}`, ({ url }) => {
+      requests++;
+      const index = Number(new URL(url).pathname.split("/").at(-1));
+      if (index === 21) return Response.json({ done: true });
+      return index === 0
+        ? alternate(`${base}1`, false)
+        : Response.redirect(`${base}${index + 1}`, 302);
+    });
+    try {
+      await rejects(loader(`${base}0`), (error: unknown) => {
+        ok(error instanceof FetchError);
+        ok(error.message.includes("Too many redirections (21)"));
+        return true;
+      });
+      deepStrictEqual(requests, 21);
+    } finally {
+      fetchMock.hardReset();
+    }
+  });
+
+  await t.test("relative alternate after redirect and isolated calls", async () => {
+    fetchMock.mockGlobal();
+    fetchMock.get(`${base}start`, Response.redirect(`${base}html`, 302));
+    fetchMock.get(`${base}html`, alternate("./document", true));
+    fetchMock.get(`${base}document`, Response.json({ done: true }));
+    try {
+      for (let i = 0; i < 2; i++) {
+        const results = await Promise.all([
+          loader(`${base}start`),
+          loader(`${base}start`),
+        ]);
+        for (const result of results) {
+          deepStrictEqual(result.document, { done: true });
+          deepStrictEqual(result.documentUrl, `${base}document`);
+        }
+      }
+    } finally {
+      fetchMock.hardReset();
+    }
+  });
+
+  function alternate(next: string, html: boolean): Response {
+    return html
+      ? new Response(
+        `<link rel="alternate" type="application/activity+json" href="${next}">`,
+        {
+          headers: { "Content-Type": "text/html" },
+        },
+      )
+      : new Response("not JSON", {
+        headers: {
+          "Content-Type": "text/plain",
+          Link: `<${next}>; rel="alternate"; type="application/activity+json"`,
+        },
+      });
+  }
+});
+
+test("getDocumentLoader() preserves cancellation across alternates", async (t) => {
+  const base = "https://example.com/alternate-abort/";
+  const loader = getDocumentLoader({ allowPrivateAddress: true });
+  for (const html of [false, true]) {
+    await t.test(html ? "HTML" : "Link header", async () => {
+      fetchMock.mockGlobal();
+      const controller = new AbortController();
+      let requests = 0;
+      fetchMock.get(`begin:${base}`, ({ url }) => {
+        requests++;
+        const index = Number(new URL(url).pathname.split("/").at(-1));
+        if (index === 2) return Response.json({ done: true });
+        if (index === 1) controller.abort();
+        const next = `${base}${index + 1}`;
+        return new Response(
+          html
+            ? `<link rel="alternate" type="application/activity+json" href="${next}">`
+            : "not JSON",
+          {
+            headers: html ? { "Content-Type": "text/html" } : {
+              "Content-Type": "text/plain",
+              Link:
+                `<${next}>; rel="alternate"; type="application/activity+json"`,
+            },
+          },
+        );
+      });
+      try {
+        await rejects(loader(`${base}0`, { signal: controller.signal }), {
+          name: "AbortError",
+        });
+        deepStrictEqual(requests, 2);
+      } finally {
+        fetchMock.hardReset();
+      }
+    });
+  }
+});
+
+test("getDocumentLoader() rejects cancellation before fetching", async () => {
+  fetchMock.mockGlobal();
+  let requests = 0;
+  const url = "https://example.com/pre-aborted-alternate";
+  fetchMock.get(url, () => {
+    requests++;
+    return Response.json({ done: true });
+  });
+  try {
+    const loader = getDocumentLoader({ allowPrivateAddress: true });
+    const controller = new AbortController();
+    controller.abort();
+    await rejects(loader(url, { signal: controller.signal }), {
+      name: "AbortError",
+    });
+    deepStrictEqual(requests, 0);
+  } finally {
+    fetchMock.hardReset();
+  }
+});

package/src/docloader.ts

@@ -266,6 +266,8 @@ export interface GetDocumentLoaderOptions extends DocumentLoaderFactoryOptions {
 
 /**
  * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+ * At most 20 HTTP redirects and alternate document links are followed in total
+ * per call.  Revisiting a URL within that chain throws a {@link FetchError}.
  *
  * The created loader preloads the below frequently used contexts by default
  * (unless `options.skipPreloadedContexts` is set to `true`):
@@ -384,7 +386,26 @@ export function getDocumentLoader(
             return await load(redirectUrl, options, redirected + 1, visited);
           }
 
-          const result = await getRemoteDocument(currentUrl, response, load);
+          const result = await getRemoteDocument(
+            currentUrl,
+            response,
+            async (alternateUrl) => {
+              options?.signal?.throwIfAborted();
+              if (redirected >= DEFAULT_MAX_REDIRECTION) {
+                throw new FetchError(
+                  currentUrl,
+                  `Too many redirections (${redirected + 1})`,
+                );
+              }
+              if (visited.has(alternateUrl)) {
+                throw new FetchError(
+                  currentUrl,
+                  `Redirect loop detected: ${alternateUrl}`,
+                );
+              }
+              return await load(alternateUrl, options, redirected + 1, visited);
+            },
+          );
           span.setAttribute("docloader.document_url", result.documentUrl);
           if (result.contextUrl != null) {
             span.setAttribute("docloader.context_url", result.contextUrl);
@@ -403,5 +424,5 @@ export function getDocumentLoader(
       },
     );
   }
-  return load;
+  return (url, options) => load(url, options);
 }