@fedify/vocab-runtime 2.1.23 → 2.1.25

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.1.23",
+  "version": "2.1.25",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",

package/dist/mod.cjs

@@ -6,6 +6,7 @@ let _opentelemetry_api = require("@opentelemetry/api");
 let node_process = require("node:process");
 node_process = require_chunk.__toESM(node_process);
 let node_dns_promises = require("node:dns/promises");
+node_dns_promises = require_chunk.__toESM(node_dns_promises);
 let node_net = require("node:net");
 let asn1js = require("asn1js");
 let byte_encodings_base64 = require("byte-encodings/base64");
@@ -599,6 +600,30 @@ var fep_5711_default = { "@context": {
 	}
 } };
 //#endregion
+//#region src/contexts/fep-7aa9.json
+var fep_7aa9_default = { "@context": {
+	"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
+	"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
+	"FeatureRequest": "https://w3id.org/fep/7aa9#FeatureRequest",
+	"FeatureAuthorization": "https://w3id.org/fep/7aa9#FeatureAuthorization",
+	"topic": {
+		"@id": "https://w3id.org/fep/7aa9#topic",
+		"@type": "@id"
+	},
+	"featuredObject": {
+		"@id": "https://w3id.org/fep/7aa9#featuredObject",
+		"@type": "@id"
+	},
+	"canFeature": {
+		"@id": "https://w3id.org/fep/7aa9#canFeature",
+		"@type": "@id"
+	},
+	"featureAuthorization": {
+		"@id": "https://w3id.org/fep/7aa9#featureAuthorization",
+		"@type": "@id"
+	}
+} };
+//#endregion
 //#region src/contexts/fep-ef61.json
 var fep_ef61_default = { "@context": {
 	"gateways": {
@@ -4516,6 +4541,7 @@ const preloadedContexts = {
 	"https://w3id.org/fep/5711": fep_5711_default,
 	"https://www.w3.org/ns/cid/v1": cid_v1_default,
 	"https://w3id.org/fep/ef61": fep_ef61_default,
+	"https://w3id.org/fep/7aa9": fep_7aa9_default,
 	"https://join-lemmy.org/context.json": join_lemmy_default,
 	"http://joinmastodon.org/ns": joinmastodon_default,
 	"https://purl.archive.org/miscellany": miscellany_default
@@ -4523,7 +4549,151 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.1.23";
+var version = "2.1.25";
+//#endregion
+//#region src/request.ts
+/**
+* Error thrown when fetching a JSON-LD document failed.
+*/
+var FetchError = class extends Error {
+	/**
+	* The URL that failed to fetch.
+	*/
+	url;
+	/**
+	* The HTTP response that failed, if available.
+	*/
+	response;
+	/**
+	* Constructs a new `FetchError`.
+	*
+	* @param url The URL that failed to fetch.
+	* @param message Error message.
+	* @param response The failed HTTP response, if available.
+	*/
+	constructor(url, message, response) {
+		super(message == null ? url.toString() : `${url}: ${message}`);
+		this.name = "FetchError";
+		this.url = typeof url === "string" ? new URL(url) : url;
+		this.response = response;
+	}
+};
+/**
+* Creates a request for the given URL.
+* @param url The URL to create the request for.
+* @param options The options for the request.
+* @returns The created request.
+* @internal
+*/
+function createActivityPubRequest(url, options = {}) {
+	return new Request(url, {
+		headers: {
+			Accept: "application/activity+json, application/ld+json",
+			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
+		},
+		redirect: "manual"
+	});
+}
+/**
+* Gets the user agent string for the given application and URL.
+* @param options The options for making the user agent string.
+* @returns The user agent string.
+* @since 1.3.0
+*/
+function getUserAgent({ software, url } = {}) {
+	const fedify = `Fedify/${version}`;
+	const runtime = globalThis.Deno?.version?.deno != null ? `Deno/${Deno.version.deno}` : globalThis.process?.versions?.bun != null ? `Bun/${node_process.default.versions.bun}` : "navigator" in globalThis && navigator.userAgent === "Cloudflare-Workers" ? navigator.userAgent : globalThis.process?.versions?.node != null ? `Node.js/${node_process.default.versions.node}` : null;
+	const userAgent = software == null ? [fedify] : [software, fedify];
+	if (runtime != null) userAgent.push(runtime);
+	if (url != null) userAgent.push(`+${url.toString()}`);
+	return `${userAgent.shift()} (${userAgent.join("; ")})`;
+}
+/**
+* Logs the request.
+* @param request The request to log.
+* @internal
+*/
+function logRequest(logger, request) {
+	logger.debug("Fetching document: {method} {url} {headers}", {
+		method: request.method,
+		url: request.url,
+		headers: Object.fromEntries(request.headers.entries())
+	});
+}
+//#endregion
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4706,81 +4876,18 @@ var HttpHeaderLink = class HttpHeaderLink {
 	}
 };
 //#endregion
-//#region src/request.ts
-/**
-* Error thrown when fetching a JSON-LD document failed.
-*/
-var FetchError = class extends Error {
-	/**
-	* The URL that failed to fetch.
-	*/
-	url;
-	/**
-	* The HTTP response that failed, if available.
-	*/
-	response;
-	/**
-	* Constructs a new `FetchError`.
-	*
-	* @param url The URL that failed to fetch.
-	* @param message Error message.
-	* @param response The failed HTTP response, if available.
-	*/
-	constructor(url, message, response) {
-		super(message == null ? url.toString() : `${url}: ${message}`);
-		this.name = "FetchError";
-		this.url = typeof url === "string" ? new URL(url) : url;
-		this.response = response;
-	}
-};
-/**
-* Creates a request for the given URL.
-* @param url The URL to create the request for.
-* @param options The options for the request.
-* @returns The created request.
-* @internal
-*/
-function createActivityPubRequest(url, options = {}) {
-	return new Request(url, {
-		headers: {
-			Accept: "application/activity+json, application/ld+json",
-			"User-Agent": typeof options.userAgent === "string" ? options.userAgent : getUserAgent(options.userAgent)
-		},
-		redirect: "manual"
-	});
-}
-/**
-* Gets the user agent string for the given application and URL.
-* @param options The options for making the user agent string.
-* @returns The user agent string.
-* @since 1.3.0
-*/
-function getUserAgent({ software, url } = {}) {
-	const fedify = `Fedify/${version}`;
-	const runtime = globalThis.Deno?.version?.deno != null ? `Deno/${Deno.version.deno}` : globalThis.process?.versions?.bun != null ? `Bun/${node_process.default.versions.bun}` : "navigator" in globalThis && navigator.userAgent === "Cloudflare-Workers" ? navigator.userAgent : globalThis.process?.versions?.node != null ? `Node.js/${node_process.default.versions.node}` : null;
-	const userAgent = software == null ? [fedify] : [software, fedify];
-	if (runtime != null) userAgent.push(runtime);
-	if (url != null) userAgent.push(`+${url.toString()}`);
-	return `${userAgent.shift()} (${userAgent.join("; ")})`;
-}
-/**
-* Logs the request.
-* @param request The request to log.
-* @internal
-*/
-function logRequest(logger, request) {
-	logger.debug("Fetching document: {method} {url} {headers}", {
-		method: request.method,
-		url: request.url,
-		headers: Object.fromEntries(request.headers.entries())
-	});
-}
-//#endregion
 //#region src/url.ts
 var UrlError = class extends Error {
+	/**
+	* The failure category. Defaults to `"disallowed"`.
+	* `"dns"` includes lookup errors and results with no usable IP addresses.
+	* @since 2.0.29
+	*/
+	reason;
 	constructor(message, options) {
 		super(message, options);
 		this.name = "UrlError";
+		this.reason = options?.reason ?? "disallowed";
 	}
 };
 /**
@@ -4806,9 +4913,12 @@ async function validatePublicUrl(url) {
 	}
 	let addresses;
 	try {
-		addresses = await (0, node_dns_promises.lookup)(hostname, { all: true });
+		addresses = await node_dns_promises.default.lookup(hostname, { all: true });
 	} catch (error) {
-		throw new UrlError("DNS lookup failed", { cause: error });
+		throw new UrlError("DNS lookup failed", {
+			cause: error,
+			reason: "dns"
+		});
 	}
 	validateLookupAddresses(addresses);
 }
@@ -4837,7 +4947,7 @@ function validateLookupAddresses(addresses) {
 		ipAddressCount++;
 		validatePublicIpAddress(address, family);
 	}
-	if (ipAddressCount === 0) throw new UrlError("DNS lookup did not return any IP address");
+	if (ipAddressCount === 0) throw new UrlError("DNS lookup did not return any IP address", { reason: "dns" });
 }
 function validatePublicIpAddress(address, family) {
 	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
@@ -5037,38 +5147,29 @@ async function getRemoteDocument(url, response, fetch) {
 	}
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
-		const MAX_HTML_SIZE = 1024 * 1024;
-		const html = await response.text();
-		if (html.length > MAX_HTML_SIZE) {
-			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
-				url: documentUrl,
-				size: html.length
-			});
-			document = JSON.parse(html);
-		} else {
-			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
-			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
-			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html)) !== null) {
-				const tagContent = tagMatch[2];
-				let attrMatch;
-				const attribs = {};
-				attrPattern.lastIndex = 0;
-				while ((attrMatch = attrPattern.exec(tagContent)) !== null) {
-					const key = attrMatch[1].toLowerCase();
-					attribs[key] = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4] ?? "";
-				}
-				if (attribs.rel === "alternate" && "type" in attribs && (attribs.type === "application/activity+json" || attribs.type === "application/ld+json" || attribs.type.startsWith("application/ld+json;")) && "href" in attribs && new URL(attribs.href, docUrl).href !== docUrl.href) {
-					logger.debug("Found alternate document: {alternateUrl} from {url}", {
-						alternateUrl: attribs.href,
-						url: documentUrl
-					});
-					return await fetch(new URL(attribs.href, docUrl).href);
-				}
+		const html = await readBoundedText(response, 1024 * 1024, documentUrl);
+		const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
+		const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
+		let tagMatch;
+		while ((tagMatch = tagPattern.exec(html)) !== null) {
+			const tagContent = tagMatch[2];
+			let attrMatch;
+			const attribs = {};
+			attrPattern.lastIndex = 0;
+			while ((attrMatch = attrPattern.exec(tagContent)) !== null) {
+				const key = attrMatch[1].toLowerCase();
+				attribs[key] = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4] ?? "";
+			}
+			if (attribs.rel === "alternate" && "type" in attribs && (attribs.type === "application/activity+json" || attribs.type === "application/ld+json" || attribs.type.startsWith("application/ld+json;")) && "href" in attribs && new URL(attribs.href, docUrl).href !== docUrl.href) {
+				logger.debug("Found alternate document: {alternateUrl} from {url}", {
+					alternateUrl: attribs.href,
+					url: documentUrl
+				});
+				return await fetch(new URL(attribs.href, docUrl).href);
 			}
-			document = JSON.parse(html);
 		}
-	} else document = await response.json();
+		document = JSON.parse(html);
+	} else document = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, documentUrl));
 	logger.debug("Fetched document: {status} {url} {headers}", {
 		status: response.status,
 		url: documentUrl,
@@ -5082,6 +5183,8 @@ async function getRemoteDocument(url, response, fetch) {
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 *
 * The created loader preloads the below frequently used contexts by default
 * (unless `options.skipPreloadedContexts` is set to `true`):
@@ -5093,6 +5196,7 @@ async function getRemoteDocument(url, response, fetch) {
 * - <https://www.w3.org/ns/cid/v1>
 * - <https://w3id.org/security/multikey/v1>
 * - <https://w3id.org/fep/ef61>
+* - <https://w3id.org/fep/7aa9>
 * - <https://purl.archive.org/socialweb/webfinger>
 * - <http://schema.org/>
 * @param options Options for the document loader.
@@ -5115,7 +5219,11 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 		if (!allowPrivateAddress) try {
 			await validatePublicUrl(currentUrl);
 		} catch (error) {
-			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
+			if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+				url: currentUrl,
+				error
+			});
+			else logger.error("Disallowed private URL: {url}", {
 				url: currentUrl,
 				error
 			});
@@ -5153,7 +5261,12 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 					}
 					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(currentUrl, response, load);
+				const result = await getRemoteDocument(currentUrl, response, async (alternateUrl) => {
+					options?.signal?.throwIfAborted();
+					if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+					if (visited.has(alternateUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${alternateUrl}`);
+					return await load(alternateUrl, options, redirected + 1, visited);
+				});
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;
@@ -5169,7 +5282,7 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 			}
 		});
 	}
-	return load;
+	return (url, options) => load(url, options);
 }
 //#endregion
 //#region src/internal/multicodec.ts

package/dist/mod.d.cts

@@ -174,6 +174,8 @@ interface GetDocumentLoaderOptions extends DocumentLoaderFactoryOptions {
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 *
 * The created loader preloads the below frequently used contexts by default
 * (unless `options.skipPreloadedContexts` is set to `true`):
@@ -185,6 +187,7 @@ interface GetDocumentLoaderOptions extends DocumentLoaderFactoryOptions {
 * - <https://www.w3.org/ns/cid/v1>
 * - <https://w3id.org/security/multikey/v1>
 * - <https://w3id.org/fep/ef61>
+* - <https://w3id.org/fep/7aa9>
 * - <https://purl.archive.org/socialweb/webfinger>
 * - <http://schema.org/>
 * @param options Options for the document loader.
@@ -419,8 +422,15 @@ declare function encodingFromBaseData(data: string | Uint8Array): Base;
 //#endregion
 //#region src/url.d.ts
 declare class UrlError extends Error {
+  /**
+  * The failure category. Defaults to `"disallowed"`.
+  * `"dns"` includes lookup errors and results with no usable IP addresses.
+  * @since 2.0.29
+  */
+  readonly reason: "dns" | "disallowed";
   constructor(message: string, options?: {
     cause?: unknown;
+    reason?: "dns" | "disallowed";
   });
 }
 /**

package/dist/mod.d.ts

@@ -173,6 +173,8 @@ interface GetDocumentLoaderOptions extends DocumentLoaderFactoryOptions {
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 *
 * The created loader preloads the below frequently used contexts by default
 * (unless `options.skipPreloadedContexts` is set to `true`):
@@ -184,6 +186,7 @@ interface GetDocumentLoaderOptions extends DocumentLoaderFactoryOptions {
 * - <https://www.w3.org/ns/cid/v1>
 * - <https://w3id.org/security/multikey/v1>
 * - <https://w3id.org/fep/ef61>
+* - <https://w3id.org/fep/7aa9>
 * - <https://purl.archive.org/socialweb/webfinger>
 * - <http://schema.org/>
 * @param options Options for the document loader.
@@ -418,8 +421,15 @@ declare function encodingFromBaseData(data: string | Uint8Array): Base;
 //#endregion
 //#region src/url.d.ts
 declare class UrlError extends Error {
+  /**
+  * The failure category. Defaults to `"disallowed"`.
+  * `"dns"` includes lookup errors and results with no usable IP addresses.
+  * @since 2.0.29
+  */
+  readonly reason: "dns" | "disallowed";
   constructor(message: string, options?: {
     cause?: unknown;
+    reason?: "dns" | "disallowed";
   });
 }
 /**