@fedify/vocab-runtime 2.1.23 → 2.1.25

package/dist/tests/body.test.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/tests/body.test.mjs

@@ -0,0 +1,90 @@
+import { r as readBoundedText, t as BodyTooLargeError } from "./body-DBqFojnW.mjs";
+import { deepStrictEqual, ok, rejects } from "node:assert/strict";
+import { test } from "node:test";
+import { gunzipSync, gzipSync } from "node:zlib";
+//#region src/body.test.ts
+const url = "https://example.com/document";
+test("readBoundedText handles empty bodies and flushes incomplete UTF-8", async () => {
+	deepStrictEqual(await readBoundedText(new Response(null), 1, url), "");
+	deepStrictEqual(await readBoundedText(new Response(""), 1, url), "");
+	deepStrictEqual(await readBoundedText(new Response(new Uint8Array([226, 130])), 2, url), "�");
+});
+test("readBoundedText counts bytes and preserves split UTF-8", async () => {
+	const bytes = new TextEncoder().encode("\"안녕\"");
+	const stream = new ReadableStream({ start(controller) {
+		for (const byte of bytes) controller.enqueue(new Uint8Array([byte]));
+		controller.close();
+	} });
+	deepStrictEqual(await readBoundedText(new Response(stream), bytes.length, url), "\"안녕\"");
+	await rejects(readBoundedText(new Response(bytes), bytes.length - 1, url), BodyTooLargeError);
+});
+test("readBoundedText rejects a declared oversized body without pulling", async () => {
+	let pulled = false;
+	let canceled = false;
+	const response = new Response(new ReadableStream({
+		pull() {
+			pulled = true;
+		},
+		cancel() {
+			canceled = true;
+		}
+	}, { highWaterMark: 0 }), { headers: { "Content-Length": "100" } });
+	await rejects(readBoundedText(response, 10, url), BodyTooLargeError);
+	deepStrictEqual(pulled, false);
+	deepStrictEqual(canceled, true);
+	deepStrictEqual(response.body?.locked, false);
+});
+test("readBoundedText cancels chunked bodies despite absent or false lengths", async () => {
+	for (const length of [
+		void 0,
+		"1",
+		"invalid"
+	]) {
+		let pulls = 0;
+		let canceled = false;
+		const stream = new ReadableStream({
+			pull(controller) {
+				pulls++;
+				controller.enqueue(new Uint8Array(4));
+			},
+			cancel() {
+				canceled = true;
+			}
+		}, { highWaterMark: 0 });
+		const response = new Response(stream, { headers: length == null ? {} : { "Content-Length": length } });
+		await rejects(readBoundedText(response, 8, url), BodyTooLargeError);
+		deepStrictEqual(pulls, 3);
+		deepStrictEqual(canceled, true);
+		deepStrictEqual(response.body?.locked, false);
+	}
+});
+test("readBoundedText limits decoded gzip bytes, not the compressed length", async () => {
+	const compressed = gzipSync("\"" + "a".repeat(4096) + "\"");
+	ok(compressed.length < 128);
+	const decoded = gunzipSync(compressed);
+	await rejects(readBoundedText(new Response(decoded, { headers: {
+		"Content-Encoding": "gzip",
+		"Content-Length": String(compressed.length)
+	} }), 128, url), BodyTooLargeError);
+	deepStrictEqual(await readBoundedText(new Response("{}", { headers: {
+		"Content-Encoding": "gzip",
+		"Content-Length": "22"
+	} }), 2, url), "{}");
+});
+test("readBoundedText rejects invalid limits and releases failed streams", async () => {
+	for (const limit of [
+		0,
+		-1,
+		NaN,
+		Infinity,
+		1.5
+	]) await rejects(readBoundedText(new Response("{}"), limit, url), RangeError);
+	const failure = /* @__PURE__ */ new Error("broken stream");
+	const response = new Response(new ReadableStream({ pull(controller) {
+		controller.error(failure);
+	} }));
+	await rejects(readBoundedText(response, 10, url), (error) => error === failure);
+	deepStrictEqual(response.body?.locked, false);
+});
+//#endregion
+export {};

package/dist/tests/decimal.test.cjs

@@ -1,11 +1,11 @@
 require("./chunk-Do9eywBl.cjs");
-require("./docloader-BcWmxXdo.cjs");
-require("./url-CWU5HT3Y.cjs");
-require("./key-DTTIntwb.cjs");
-require("./multibase-F7LtMMsK.cjs");
-require("./langstr-CbAxaeEZ.cjs");
-let node_assert = require("node:assert");
+require("./docloader-fn4ICzFS.cjs");
+require("./url-vZTgkIZg.cjs");
+require("./key-BarKGLQz.cjs");
+require("./multibase-8zhYPa7o.cjs");
+require("./langstr-BOQHfJDr.cjs");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 //#region src/decimal.ts
 const DECIMAL_PATTERN = /^(\+|-)?([0-9]+(\.[0-9]*)?|\.[0-9]+)$/;
 const XML_SCHEMA_WHITESPACE_PATTERN = /[\t\n\r ]+/g;

package/dist/tests/decimal.test.mjs

@@ -1,10 +1,10 @@
-import "./docloader-D-CBVlrJ.mjs";
-import "./url-o0e-aXQY.mjs";
-import "./key-BeTHFQJK.mjs";
-import "./multibase-BgU9XRf7.mjs";
-import "./langstr-Di5AvKpB.mjs";
-import { deepStrictEqual, throws } from "node:assert";
+import "./docloader-Beoc8qTH.mjs";
+import "./url-3fyJuqC0.mjs";
+import "./key-BDIsC6hV.mjs";
+import "./multibase-Ds75BvXs.mjs";
+import "./langstr-DDLc4833.mjs";
 import { test } from "node:test";
+import { deepStrictEqual, throws } from "node:assert";
 //#region src/decimal.ts
 const DECIMAL_PATTERN = /^(\+|-)?([0-9]+(\.[0-9]*)?|\.[0-9]+)$/;
 const XML_SCHEMA_WHITESPACE_PATTERN = /[\t\n\r ]+/g;

package/dist/tests/{docloader-D-CBVlrJ.mjs → docloader-Beoc8qTH.mjs}

@@ -1,6 +1,7 @@
-import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-DqsgdBUH.mjs";
-import { t as HttpHeaderLink } from "./link-NUUWCdnK.mjs";
-import { o as validatePublicUrl, t as UrlError } from "./url-o0e-aXQY.mjs";
+import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-DxeGyJVh.mjs";
+import { n as MAX_BODY_SIZE, r as readBoundedText } from "./body-DBqFojnW.mjs";
+import { t as HttpHeaderLink } from "./link-CYszIegt.mjs";
+import { o as validatePublicUrl, t as UrlError } from "./url-3fyJuqC0.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region src/contexts/activitystreams.json
@@ -588,6 +589,30 @@ var fep_5711_default = { "@context": {
 	}
 } };
 //#endregion
+//#region src/contexts/fep-7aa9.json
+var fep_7aa9_default = { "@context": {
+	"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
+	"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
+	"FeatureRequest": "https://w3id.org/fep/7aa9#FeatureRequest",
+	"FeatureAuthorization": "https://w3id.org/fep/7aa9#FeatureAuthorization",
+	"topic": {
+		"@id": "https://w3id.org/fep/7aa9#topic",
+		"@type": "@id"
+	},
+	"featuredObject": {
+		"@id": "https://w3id.org/fep/7aa9#featuredObject",
+		"@type": "@id"
+	},
+	"canFeature": {
+		"@id": "https://w3id.org/fep/7aa9#canFeature",
+		"@type": "@id"
+	},
+	"featureAuthorization": {
+		"@id": "https://w3id.org/fep/7aa9#featureAuthorization",
+		"@type": "@id"
+	}
+} };
+//#endregion
 //#region src/contexts/fep-ef61.json
 var fep_ef61_default = { "@context": {
 	"gateways": {
@@ -4505,6 +4530,7 @@ const preloadedContexts = {
 	"https://w3id.org/fep/5711": fep_5711_default,
 	"https://www.w3.org/ns/cid/v1": cid_v1_default,
 	"https://w3id.org/fep/ef61": fep_ef61_default,
+	"https://w3id.org/fep/7aa9": fep_7aa9_default,
 	"https://join-lemmy.org/context.json": join_lemmy_default,
 	"http://joinmastodon.org/ns": joinmastodon_default,
 	"https://purl.archive.org/miscellany": miscellany_default
@@ -4571,38 +4597,29 @@ async function getRemoteDocument(url, response, fetch) {
 	}
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
-		const MAX_HTML_SIZE = 1024 * 1024;
-		const html = await response.text();
-		if (html.length > MAX_HTML_SIZE) {
-			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
-				url: documentUrl,
-				size: html.length
-			});
-			document = JSON.parse(html);
-		} else {
-			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
-			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
-			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html)) !== null) {
-				const tagContent = tagMatch[2];
-				let attrMatch;
-				const attribs = {};
-				attrPattern.lastIndex = 0;
-				while ((attrMatch = attrPattern.exec(tagContent)) !== null) {
-					const key = attrMatch[1].toLowerCase();
-					attribs[key] = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4] ?? "";
-				}
-				if (attribs.rel === "alternate" && "type" in attribs && (attribs.type === "application/activity+json" || attribs.type === "application/ld+json" || attribs.type.startsWith("application/ld+json;")) && "href" in attribs && new URL(attribs.href, docUrl).href !== docUrl.href) {
-					logger.debug("Found alternate document: {alternateUrl} from {url}", {
-						alternateUrl: attribs.href,
-						url: documentUrl
-					});
-					return await fetch(new URL(attribs.href, docUrl).href);
-				}
+		const html = await readBoundedText(response, 1024 * 1024, documentUrl);
+		const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
+		const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
+		let tagMatch;
+		while ((tagMatch = tagPattern.exec(html)) !== null) {
+			const tagContent = tagMatch[2];
+			let attrMatch;
+			const attribs = {};
+			attrPattern.lastIndex = 0;
+			while ((attrMatch = attrPattern.exec(tagContent)) !== null) {
+				const key = attrMatch[1].toLowerCase();
+				attribs[key] = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4] ?? "";
+			}
+			if (attribs.rel === "alternate" && "type" in attribs && (attribs.type === "application/activity+json" || attribs.type === "application/ld+json" || attribs.type.startsWith("application/ld+json;")) && "href" in attribs && new URL(attribs.href, docUrl).href !== docUrl.href) {
+				logger.debug("Found alternate document: {alternateUrl} from {url}", {
+					alternateUrl: attribs.href,
+					url: documentUrl
+				});
+				return await fetch(new URL(attribs.href, docUrl).href);
 			}
-			document = JSON.parse(html);
 		}
-	} else document = await response.json();
+		document = JSON.parse(html);
+	} else document = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, documentUrl));
 	logger.debug("Fetched document: {status} {url} {headers}", {
 		status: response.status,
 		url: documentUrl,
@@ -4616,6 +4633,8 @@ async function getRemoteDocument(url, response, fetch) {
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 *
 * The created loader preloads the below frequently used contexts by default
 * (unless `options.skipPreloadedContexts` is set to `true`):
@@ -4627,6 +4646,7 @@ async function getRemoteDocument(url, response, fetch) {
 * - <https://www.w3.org/ns/cid/v1>
 * - <https://w3id.org/security/multikey/v1>
 * - <https://w3id.org/fep/ef61>
+* - <https://w3id.org/fep/7aa9>
 * - <https://purl.archive.org/socialweb/webfinger>
 * - <http://schema.org/>
 * @param options Options for the document loader.
@@ -4649,7 +4669,11 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 		if (!allowPrivateAddress) try {
 			await validatePublicUrl(currentUrl);
 		} catch (error) {
-			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
+			if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+				url: currentUrl,
+				error
+			});
+			else logger.error("Disallowed private URL: {url}", {
 				url: currentUrl,
 				error
 			});
@@ -4687,7 +4711,12 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 					}
 					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(currentUrl, response, load);
+				const result = await getRemoteDocument(currentUrl, response, async (alternateUrl) => {
+					options?.signal?.throwIfAborted();
+					if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+					if (visited.has(alternateUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${alternateUrl}`);
+					return await load(alternateUrl, options, redirected + 1, visited);
+				});
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;
@@ -4703,7 +4732,7 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 			}
 		});
 	}
-	return load;
+	return (url, options) => load(url, options);
 }
 //#endregion
-export { preloadedContexts as n, cid_v1_default as r, getDocumentLoader as t };
+export { cid_v1_default as i, getRemoteDocument as n, preloadedContexts as r, getDocumentLoader as t };

package/dist/tests/{docloader-BcWmxXdo.cjs → docloader-fn4ICzFS.cjs}

@@ -1,7 +1,8 @@
 require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-CdMLb0ba.cjs");
-const require_link = require("./link-FguCydMA.cjs");
-const require_url = require("./url-CWU5HT3Y.cjs");
+const require_request = require("./request-DrO5xzev.cjs");
+const require_body = require("./body-D-gC5vdl.cjs");
+const require_link = require("./link-qDTmjPw_.cjs");
+const require_url = require("./url-vZTgkIZg.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 //#region src/contexts/activitystreams.json
@@ -589,6 +590,30 @@ var fep_5711_default = { "@context": {
 	}
 } };
 //#endregion
+//#region src/contexts/fep-7aa9.json
+var fep_7aa9_default = { "@context": {
+	"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
+	"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
+	"FeatureRequest": "https://w3id.org/fep/7aa9#FeatureRequest",
+	"FeatureAuthorization": "https://w3id.org/fep/7aa9#FeatureAuthorization",
+	"topic": {
+		"@id": "https://w3id.org/fep/7aa9#topic",
+		"@type": "@id"
+	},
+	"featuredObject": {
+		"@id": "https://w3id.org/fep/7aa9#featuredObject",
+		"@type": "@id"
+	},
+	"canFeature": {
+		"@id": "https://w3id.org/fep/7aa9#canFeature",
+		"@type": "@id"
+	},
+	"featureAuthorization": {
+		"@id": "https://w3id.org/fep/7aa9#featureAuthorization",
+		"@type": "@id"
+	}
+} };
+//#endregion
 //#region src/contexts/fep-ef61.json
 var fep_ef61_default = { "@context": {
 	"gateways": {
@@ -4506,6 +4531,7 @@ const preloadedContexts = {
 	"https://w3id.org/fep/5711": fep_5711_default,
 	"https://www.w3.org/ns/cid/v1": cid_v1_default,
 	"https://w3id.org/fep/ef61": fep_ef61_default,
+	"https://w3id.org/fep/7aa9": fep_7aa9_default,
 	"https://join-lemmy.org/context.json": join_lemmy_default,
 	"http://joinmastodon.org/ns": joinmastodon_default,
 	"https://purl.archive.org/miscellany": miscellany_default
@@ -4572,38 +4598,29 @@ async function getRemoteDocument(url, response, fetch) {
 	}
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
-		const MAX_HTML_SIZE = 1024 * 1024;
-		const html = await response.text();
-		if (html.length > MAX_HTML_SIZE) {
-			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
-				url: documentUrl,
-				size: html.length
-			});
-			document = JSON.parse(html);
-		} else {
-			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
-			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
-			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html)) !== null) {
-				const tagContent = tagMatch[2];
-				let attrMatch;
-				const attribs = {};
-				attrPattern.lastIndex = 0;
-				while ((attrMatch = attrPattern.exec(tagContent)) !== null) {
-					const key = attrMatch[1].toLowerCase();
-					attribs[key] = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4] ?? "";
-				}
-				if (attribs.rel === "alternate" && "type" in attribs && (attribs.type === "application/activity+json" || attribs.type === "application/ld+json" || attribs.type.startsWith("application/ld+json;")) && "href" in attribs && new URL(attribs.href, docUrl).href !== docUrl.href) {
-					logger.debug("Found alternate document: {alternateUrl} from {url}", {
-						alternateUrl: attribs.href,
-						url: documentUrl
-					});
-					return await fetch(new URL(attribs.href, docUrl).href);
-				}
+		const html = await require_body.readBoundedText(response, 1024 * 1024, documentUrl);
+		const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
+		const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
+		let tagMatch;
+		while ((tagMatch = tagPattern.exec(html)) !== null) {
+			const tagContent = tagMatch[2];
+			let attrMatch;
+			const attribs = {};
+			attrPattern.lastIndex = 0;
+			while ((attrMatch = attrPattern.exec(tagContent)) !== null) {
+				const key = attrMatch[1].toLowerCase();
+				attribs[key] = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4] ?? "";
+			}
+			if (attribs.rel === "alternate" && "type" in attribs && (attribs.type === "application/activity+json" || attribs.type === "application/ld+json" || attribs.type.startsWith("application/ld+json;")) && "href" in attribs && new URL(attribs.href, docUrl).href !== docUrl.href) {
+				logger.debug("Found alternate document: {alternateUrl} from {url}", {
+					alternateUrl: attribs.href,
+					url: documentUrl
+				});
+				return await fetch(new URL(attribs.href, docUrl).href);
 			}
-			document = JSON.parse(html);
 		}
-	} else document = await response.json();
+		document = JSON.parse(html);
+	} else document = JSON.parse(await require_body.readBoundedText(response, require_body.MAX_BODY_SIZE, documentUrl));
 	logger.debug("Fetched document: {status} {url} {headers}", {
 		status: response.status,
 		url: documentUrl,
@@ -4617,6 +4634,8 @@ async function getRemoteDocument(url, response, fetch) {
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
+* At most 20 HTTP redirects and alternate document links are followed in total
+* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
 *
 * The created loader preloads the below frequently used contexts by default
 * (unless `options.skipPreloadedContexts` is set to `true`):
@@ -4628,6 +4647,7 @@ async function getRemoteDocument(url, response, fetch) {
 * - <https://www.w3.org/ns/cid/v1>
 * - <https://w3id.org/security/multikey/v1>
 * - <https://w3id.org/fep/ef61>
+* - <https://w3id.org/fep/7aa9>
 * - <https://purl.archive.org/socialweb/webfinger>
 * - <http://schema.org/>
 * @param options Options for the document loader.
@@ -4650,7 +4670,11 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 		if (!allowPrivateAddress) try {
 			await require_url.validatePublicUrl(currentUrl);
 		} catch (error) {
-			if (error instanceof require_url.UrlError) logger.error("Disallowed private URL: {url}", {
+			if (error instanceof require_url.UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+				url: currentUrl,
+				error
+			});
+			else logger.error("Disallowed private URL: {url}", {
 				url: currentUrl,
 				error
 			});
@@ -4688,7 +4712,12 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 					}
 					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(currentUrl, response, load);
+				const result = await getRemoteDocument(currentUrl, response, async (alternateUrl) => {
+					options?.signal?.throwIfAborted();
+					if (redirected >= DEFAULT_MAX_REDIRECTION) throw new require_request.FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
+					if (visited.has(alternateUrl)) throw new require_request.FetchError(currentUrl, `Redirect loop detected: ${alternateUrl}`);
+					return await load(alternateUrl, options, redirected + 1, visited);
+				});
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;
@@ -4704,7 +4733,7 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 			}
 		});
 	}
-	return load;
+	return (url, options) => load(url, options);
 }
 //#endregion
 Object.defineProperty(exports, "cid_v1_default", {
@@ -4719,6 +4748,12 @@ Object.defineProperty(exports, "getDocumentLoader", {
 		return getDocumentLoader;
 	}
 });
+Object.defineProperty(exports, "getRemoteDocument", {
+	enumerable: true,
+	get: function() {
+		return getRemoteDocument;
+	}
+});
 Object.defineProperty(exports, "preloadedContexts", {
 	enumerable: true,
 	get: function() {