@fedify/vocab-runtime 2.2.18 → 2.2.20

package/dist/tests/{body-CbvYxP3V.mjs → body-B9_hb-GO.mjs}

@@ -1,4 +1,4 @@
-import { t as FetchError } from "./request-BE7XIrGw.mjs";
+import { t as FetchError } from "./request-BSg3IQzf.mjs";
 import { getLogger } from "@logtape/logtape";
 //#region src/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */

package/dist/tests/{body-CaJBg0tr.cjs → body-pOSG2RFb.cjs}

@@ -1,5 +1,5 @@
 require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-BngWcP0t.cjs");
+const require_request = require("./request-B3NUKbyk.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 //#region src/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */

package/dist/tests/body.test.cjs

@@ -1,5 +1,5 @@
 require("./chunk-Do9eywBl.cjs");
-const require_body = require("./body-CaJBg0tr.cjs");
+const require_body = require("./body-pOSG2RFb.cjs");
 let node_assert_strict = require("node:assert/strict");
 let node_test = require("node:test");
 let node_zlib = require("node:zlib");

package/dist/tests/body.test.mjs

@@ -1,4 +1,4 @@
-import { r as readBoundedText, t as BodyTooLargeError } from "./body-CbvYxP3V.mjs";
+import { r as readBoundedText, t as BodyTooLargeError } from "./body-B9_hb-GO.mjs";
 import { deepStrictEqual, ok, rejects } from "node:assert/strict";
 import { test } from "node:test";
 import { gunzipSync, gzipSync } from "node:zlib";

package/dist/tests/decimal.test.cjs

@@ -1,10 +1,10 @@
 require("./chunk-Do9eywBl.cjs");
-require("./docloader-k2T5kUlV.cjs");
-require("./url-vZTgkIZg.cjs");
-require("./key-BarKGLQz.cjs");
-require("./multibase-8zhYPa7o.cjs");
-require("./langtag-DgySESmk.cjs");
-require("./langstr-BsqFJupv.cjs");
+require("./docloader-Ck3VfY29.cjs");
+require("./url-DLuSj57U.cjs");
+require("./key-L6ReMuUb.cjs");
+require("./multibase-BmWaK56H.cjs");
+require("./langtag-a2-s9uyi.cjs");
+require("./langstr-CZpWmpo5.cjs");
 let node_test = require("node:test");
 let node_assert = require("node:assert");
 //#region src/decimal.ts

package/dist/tests/decimal.test.mjs

@@ -1,9 +1,9 @@
-import "./docloader-jQMjHIRI.mjs";
-import "./url-3fyJuqC0.mjs";
-import "./key-BDIsC6hV.mjs";
-import "./multibase-Ds75BvXs.mjs";
-import "./langtag-LDBqlxHv.mjs";
-import "./langstr-ABdAOKlF.mjs";
+import "./docloader-Bdlp7FkK.mjs";
+import "./url-DQWrMGhu.mjs";
+import "./key-GEdpxA4M.mjs";
+import "./multibase-D642Uv3S.mjs";
+import "./langtag-D8FWxjv8.mjs";
+import "./langstr-DTB4sl0a.mjs";
 import { test } from "node:test";
 import { deepStrictEqual, throws } from "node:assert";
 //#region src/decimal.ts

package/dist/tests/{docloader-jQMjHIRI.mjs → docloader-Bdlp7FkK.mjs}

@@ -1,7 +1,8 @@
-import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-BE7XIrGw.mjs";
-import { n as MAX_BODY_SIZE, r as readBoundedText } from "./body-CbvYxP3V.mjs";
-import { t as HttpHeaderLink } from "./link-CYszIegt.mjs";
-import { o as validatePublicUrl, t as UrlError } from "./url-3fyJuqC0.mjs";
+import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-BSg3IQzf.mjs";
+import { n as MAX_BODY_SIZE, r as readBoundedText } from "./body-B9_hb-GO.mjs";
+import { t as HttpHeaderLink } from "./link-CHMtH2-k.mjs";
+import { t as UrlError } from "./url-DQWrMGhu.mjs";
+import { n as openDirectFetch, r as openPublicFetch } from "./public-fetch-Yi7Vks9s.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region src/contexts/activitystreams.json
@@ -4591,13 +4592,47 @@ const DEFAULT_MAX_REDIRECTION = 20;
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
 * @param response The response to get the document from.
-* @param fetch The function to fetch the document.
+* @param fetch The function to fetch the document.  It is called with the URL
+*              of an alternate document, if any, after the response body has
+*              been either read or its cancellation has been started.
 * @returns The loaded remote document.
 * @throws {FetchError} If the response is not OK.
 * @internal
 */
 async function getRemoteDocument(url, response, fetch) {
-	const documentUrl = response.url === "" ? url : response.url;
+	const result = await parseRemoteDocument(url, response);
+	if ("alternate" in result) return await fetch(result.alternate);
+	return result.document;
+}
+/**
+* Starts cancelling the body of a response without waiting for it to settle.
+* The cancellation of a branch of a tee (e.g., a body cloned by a fetch mock)
+* settles only after the other branch is cancelled too, per the Streams
+* standard, so awaiting it could block forever.  Failures are only logged.
+* @param response The response whose body is cancelled.
+* @param url The URL of the response, for logging.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
+		});
+	});
+}
+/**
+* Gets a {@link RemoteDocument} from the given response, or the URL of an
+* alternate document to load instead.  When an alternate document is found,
+* the response body has been either read or its cancellation has been started
+* (without waiting for it), so that the alternate document can be loaded after
+* the response's session is closed.
+* @param url The URL of the document to load.
+* @param response The response to get the document from.
+* @returns The loaded remote document, or the alternate document URL.
+* @throws {FetchError} If the response is not OK.
+*/
+async function parseRemoteDocument(url, response) {
+	const documentUrl = url;
 	const docUrl = new URL(documentUrl);
 	if (!response.ok) {
 		logger.error("Failed to fetch document: {status} {url} {headers}", {
@@ -4634,7 +4669,8 @@ async function getRemoteDocument(url, response, fetch) {
 						alternateUrl: altUri.href,
 						url: documentUrl
 					});
-					return await fetch(altUri.href);
+					cancelResponseBody(response, documentUrl);
+					return { alternate: altUri.href };
 				}
 			}
 		}
@@ -4659,7 +4695,7 @@ async function getRemoteDocument(url, response, fetch) {
 					alternateUrl: attribs.href,
 					url: documentUrl
 				});
-				return await fetch(new URL(attribs.href, docUrl).href);
+				return { alternate: new URL(attribs.href, docUrl).href };
 			}
 		}
 		document = JSON.parse(html);
@@ -4669,11 +4705,11 @@ async function getRemoteDocument(url, response, fetch) {
 		url: documentUrl,
 		headers: Object.fromEntries(response.headers.entries())
 	});
-	return {
+	return { document: {
 		contextUrl,
 		document,
 		documentUrl
-	};
+	} };
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
@@ -4699,13 +4735,59 @@ async function getRemoteDocument(url, response, fetch) {
 * @returns The document loader.
 * @since 1.3.0
 */
-function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedContexts, userAgent } = {}) {
+function getDocumentLoader(options = {}) {
+	return createDocumentLoader(options);
+}
+/**
+* The implementation of {@link getDocumentLoader}, with injectable
+* dependencies.  This is not exported from any entry point.
+* @param options Options for the document loader.
+* @param deps The dependencies.
+* @returns The document loader.
+*/
+function createDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedContexts, userAgent } = {}, deps = {}) {
 	const tracer = trace.getTracerProvider().getTracer(name, version);
 	const maximumRedirection = maxRedirection ?? DEFAULT_MAX_REDIRECTION;
+	async function openHop(url, signal) {
+		try {
+			if (deps.openHop != null) return await deps.openHop(url);
+			return allowPrivateAddress ? await openDirectFetch(url) : await openPublicFetch(url, { signal });
+		} catch (error) {
+			if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	async function fetchHop(session, url, span, options) {
+		try {
+			const request = createActivityPubRequest(url, { userAgent });
+			logRequest(logger, request);
+			const response = await session.fetch(request, {
+				redirect: "manual",
+				signal: options?.signal
+			});
+			span.setAttribute("http.response.status_code", response.status);
+			if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+				const location = response.headers.get("Location");
+				cancelResponseBody(response, url);
+				return { location };
+			}
+			return await parseRemoteDocument(url, response);
+		} finally {
+			await session.close();
+		}
+	}
 	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
 		const parsedUrl = new URL(url);
 		if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsedUrl.protocol}`);
+		if (parsedUrl.username !== "" || parsedUrl.password !== "") throw new UrlError("URLs with credentials are not allowed");
 		const currentUrl = parsedUrl.href;
 		if (!skipPreloadedContexts && currentUrl in preloadedContexts) {
 			logger.debug("Using preloaded context: {url}.", { url: currentUrl });
@@ -4715,33 +4797,15 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 				documentUrl: currentUrl
 			};
 		}
-		if (!allowPrivateAddress) try {
-			await validatePublicUrl(currentUrl);
-		} catch (error) {
-			if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
-				url: currentUrl,
-				error
-			});
-			else logger.error("Disallowed private URL: {url}", {
-				url: currentUrl,
-				error
-			});
-			throw error;
-		}
+		const session = await openHop(currentUrl, options?.signal);
 		visited.add(currentUrl);
 		return await tracer.startActiveSpan("activitypub.fetch_document", {
 			kind: SpanKind.CLIENT,
 			attributes: { "url.full": currentUrl }
 		}, async (span) => {
 			try {
-				const request = createActivityPubRequest(currentUrl, { userAgent });
-				logRequest(logger, request);
-				const response = await fetch(request, {
-					redirect: "manual",
-					signal: options?.signal
-				});
-				span.setAttribute("http.response.status_code", response.status);
-				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+				const outcome = await fetchHop(session, currentUrl, span, options);
+				if ("location" in outcome) {
 					if (redirected >= maximumRedirection) {
 						logger.error("Too many redirections ({redirections}) while fetching document.", {
 							redirections: redirected + 1,
@@ -4749,7 +4813,7 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 						});
 						throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
 					}
-					const redirectUrl = new URL(response.headers.get("Location"), response.url === "" ? currentUrl : response.url).href;
+					const redirectUrl = new URL(outcome.location, currentUrl).href;
 					span.setAttribute("http.redirect.url", redirectUrl);
 					if (visited.has(redirectUrl)) {
 						logger.error("Detected a redirect loop while fetching document: {url} -> {redirectUrl}", {
@@ -4760,12 +4824,14 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 					}
 					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(currentUrl, response, async (alternateUrl) => {
+				let result;
+				if ("alternate" in outcome) {
+					const alternateUrl = outcome.alternate;
 					options?.signal?.throwIfAborted();
 					if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
 					if (visited.has(alternateUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${alternateUrl}`);
-					return await load(alternateUrl, options, redirected + 1, visited);
-				});
+					result = await load(alternateUrl, options, redirected + 1, visited);
+				} else result = outcome.document;
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;
@@ -4784,4 +4850,4 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 	return (url, options) => load(url, options);
 }
 //#endregion
-export { cid_v1_default as i, getRemoteDocument as n, preloadedContexts as r, getDocumentLoader as t };
+export { cid_v1_default as a, preloadedContexts as i, getDocumentLoader as n, getRemoteDocument as r, createDocumentLoader as t };

package/dist/tests/{docloader-k2T5kUlV.cjs → docloader-Ck3VfY29.cjs}

@@ -1,8 +1,9 @@
 require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-BngWcP0t.cjs");
-const require_body = require("./body-CaJBg0tr.cjs");
+const require_request = require("./request-B3NUKbyk.cjs");
+const require_body = require("./body-pOSG2RFb.cjs");
 const require_link = require("./link-qDTmjPw_.cjs");
-const require_url = require("./url-vZTgkIZg.cjs");
+const require_url = require("./url-DLuSj57U.cjs");
+const require_public_fetch = require("./public-fetch-Ddjfxbwc.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 //#region src/contexts/activitystreams.json
@@ -4592,13 +4593,47 @@ const DEFAULT_MAX_REDIRECTION = 20;
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
 * @param response The response to get the document from.
-* @param fetch The function to fetch the document.
+* @param fetch The function to fetch the document.  It is called with the URL
+*              of an alternate document, if any, after the response body has
+*              been either read or its cancellation has been started.
 * @returns The loaded remote document.
 * @throws {FetchError} If the response is not OK.
 * @internal
 */
 async function getRemoteDocument(url, response, fetch) {
-	const documentUrl = response.url === "" ? url : response.url;
+	const result = await parseRemoteDocument(url, response);
+	if ("alternate" in result) return await fetch(result.alternate);
+	return result.document;
+}
+/**
+* Starts cancelling the body of a response without waiting for it to settle.
+* The cancellation of a branch of a tee (e.g., a body cloned by a fetch mock)
+* settles only after the other branch is cancelled too, per the Streams
+* standard, so awaiting it could block forever.  Failures are only logged.
+* @param response The response whose body is cancelled.
+* @param url The URL of the response, for logging.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
+		});
+	});
+}
+/**
+* Gets a {@link RemoteDocument} from the given response, or the URL of an
+* alternate document to load instead.  When an alternate document is found,
+* the response body has been either read or its cancellation has been started
+* (without waiting for it), so that the alternate document can be loaded after
+* the response's session is closed.
+* @param url The URL of the document to load.
+* @param response The response to get the document from.
+* @returns The loaded remote document, or the alternate document URL.
+* @throws {FetchError} If the response is not OK.
+*/
+async function parseRemoteDocument(url, response) {
+	const documentUrl = url;
 	const docUrl = new URL(documentUrl);
 	if (!response.ok) {
 		logger.error("Failed to fetch document: {status} {url} {headers}", {
@@ -4635,7 +4670,8 @@ async function getRemoteDocument(url, response, fetch) {
 						alternateUrl: altUri.href,
 						url: documentUrl
 					});
-					return await fetch(altUri.href);
+					cancelResponseBody(response, documentUrl);
+					return { alternate: altUri.href };
 				}
 			}
 		}
@@ -4660,7 +4696,7 @@ async function getRemoteDocument(url, response, fetch) {
 					alternateUrl: attribs.href,
 					url: documentUrl
 				});
-				return await fetch(new URL(attribs.href, docUrl).href);
+				return { alternate: new URL(attribs.href, docUrl).href };
 			}
 		}
 		document = JSON.parse(html);
@@ -4670,11 +4706,11 @@ async function getRemoteDocument(url, response, fetch) {
 		url: documentUrl,
 		headers: Object.fromEntries(response.headers.entries())
 	});
-	return {
+	return { document: {
 		contextUrl,
 		document,
 		documentUrl
-	};
+	} };
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
@@ -4700,13 +4736,59 @@ async function getRemoteDocument(url, response, fetch) {
 * @returns The document loader.
 * @since 1.3.0
 */
-function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedContexts, userAgent } = {}) {
+function getDocumentLoader(options = {}) {
+	return createDocumentLoader(options);
+}
+/**
+* The implementation of {@link getDocumentLoader}, with injectable
+* dependencies.  This is not exported from any entry point.
+* @param options Options for the document loader.
+* @param deps The dependencies.
+* @returns The document loader.
+*/
+function createDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedContexts, userAgent } = {}, deps = {}) {
 	const tracer = _opentelemetry_api.trace.getTracerProvider().getTracer(require_request.name, require_request.version);
 	const maximumRedirection = maxRedirection ?? DEFAULT_MAX_REDIRECTION;
+	async function openHop(url, signal) {
+		try {
+			if (deps.openHop != null) return await deps.openHop(url);
+			return allowPrivateAddress ? await require_public_fetch.openDirectFetch(url) : await require_public_fetch.openPublicFetch(url, { signal });
+		} catch (error) {
+			if (error instanceof require_url.UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	async function fetchHop(session, url, span, options) {
+		try {
+			const request = require_request.createActivityPubRequest(url, { userAgent });
+			require_request.logRequest(logger, request);
+			const response = await session.fetch(request, {
+				redirect: "manual",
+				signal: options?.signal
+			});
+			span.setAttribute("http.response.status_code", response.status);
+			if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+				const location = response.headers.get("Location");
+				cancelResponseBody(response, url);
+				return { location };
+			}
+			return await parseRemoteDocument(url, response);
+		} finally {
+			await session.close();
+		}
+	}
 	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
 		const parsedUrl = new URL(url);
 		if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new require_url.UrlError(`Unsupported protocol: ${parsedUrl.protocol}`);
+		if (parsedUrl.username !== "" || parsedUrl.password !== "") throw new require_url.UrlError("URLs with credentials are not allowed");
 		const currentUrl = parsedUrl.href;
 		if (!skipPreloadedContexts && currentUrl in preloadedContexts) {
 			logger.debug("Using preloaded context: {url}.", { url: currentUrl });
@@ -4716,33 +4798,15 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 				documentUrl: currentUrl
 			};
 		}
-		if (!allowPrivateAddress) try {
-			await require_url.validatePublicUrl(currentUrl);
-		} catch (error) {
-			if (error instanceof require_url.UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
-				url: currentUrl,
-				error
-			});
-			else logger.error("Disallowed private URL: {url}", {
-				url: currentUrl,
-				error
-			});
-			throw error;
-		}
+		const session = await openHop(currentUrl, options?.signal);
 		visited.add(currentUrl);
 		return await tracer.startActiveSpan("activitypub.fetch_document", {
 			kind: _opentelemetry_api.SpanKind.CLIENT,
 			attributes: { "url.full": currentUrl }
 		}, async (span) => {
 			try {
-				const request = require_request.createActivityPubRequest(currentUrl, { userAgent });
-				require_request.logRequest(logger, request);
-				const response = await fetch(request, {
-					redirect: "manual",
-					signal: options?.signal
-				});
-				span.setAttribute("http.response.status_code", response.status);
-				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+				const outcome = await fetchHop(session, currentUrl, span, options);
+				if ("location" in outcome) {
 					if (redirected >= maximumRedirection) {
 						logger.error("Too many redirections ({redirections}) while fetching document.", {
 							redirections: redirected + 1,
@@ -4750,7 +4814,7 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 						});
 						throw new require_request.FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
 					}
-					const redirectUrl = new URL(response.headers.get("Location"), response.url === "" ? currentUrl : response.url).href;
+					const redirectUrl = new URL(outcome.location, currentUrl).href;
 					span.setAttribute("http.redirect.url", redirectUrl);
 					if (visited.has(redirectUrl)) {
 						logger.error("Detected a redirect loop while fetching document: {url} -> {redirectUrl}", {
@@ -4761,12 +4825,14 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 					}
 					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(currentUrl, response, async (alternateUrl) => {
+				let result;
+				if ("alternate" in outcome) {
+					const alternateUrl = outcome.alternate;
 					options?.signal?.throwIfAborted();
 					if (redirected >= DEFAULT_MAX_REDIRECTION) throw new require_request.FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
 					if (visited.has(alternateUrl)) throw new require_request.FetchError(currentUrl, `Redirect loop detected: ${alternateUrl}`);
-					return await load(alternateUrl, options, redirected + 1, visited);
-				});
+					result = await load(alternateUrl, options, redirected + 1, visited);
+				} else result = outcome.document;
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;
@@ -4791,6 +4857,12 @@ Object.defineProperty(exports, "cid_v1_default", {
 		return cid_v1_default;
 	}
 });
+Object.defineProperty(exports, "createDocumentLoader", {
+	enumerable: true,
+	get: function() {
+		return createDocumentLoader;
+	}
+});
 Object.defineProperty(exports, "getDocumentLoader", {
 	enumerable: true,
 	get: function() {