@fedify/vocab-runtime 2.4.0-dev.1570 → 2.4.0-dev.1573

package/dist/mod.cjs

@@ -1,12 +1,11 @@
 
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-M78iaK0I.cjs");
+const require_url = require("./url-BAdyyqAa.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 let node_process = require("node:process");
 node_process = require_chunk.__toESM(node_process, 1);
-let node_dns_promises = require("node:dns/promises");
-let node_net = require("node:net");
 let asn1js = require("asn1js");
 let byte_encodings_base64 = require("byte-encodings/base64");
 let byte_encodings_base64url = require("byte-encodings/base64url");
@@ -4288,6 +4287,28 @@ const preloadedContexts = {
 			"@type": "@id"
 		}
 	} },
+	"https://w3id.org/fep/7aa9": { "@context": {
+		"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
+		"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
+		"FeatureRequest": "https://w3id.org/fep/7aa9#FeatureRequest",
+		"FeatureAuthorization": "https://w3id.org/fep/7aa9#FeatureAuthorization",
+		"topic": {
+			"@id": "https://w3id.org/fep/7aa9#topic",
+			"@type": "@id"
+		},
+		"featuredObject": {
+			"@id": "https://w3id.org/fep/7aa9#featuredObject",
+			"@type": "@id"
+		},
+		"canFeature": {
+			"@id": "https://w3id.org/fep/7aa9#canFeature",
+			"@type": "@id"
+		},
+		"featureAuthorization": {
+			"@id": "https://w3id.org/fep/7aa9#featureAuthorization",
+			"@type": "@id"
+		}
+	} },
 	"https://join-lemmy.org/context.json": { "@context": ["https://w3id.org/security/v1", {
 		"as": "https://www.w3.org/ns/activitystreams#",
 		"lemmy": "https://join-lemmy.org/ns#",
@@ -4346,7 +4367,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1570+f1b6aaa3";
+var version = "2.4.0-dev.1573+246bd0b2";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4599,179 +4620,6 @@ function logRequest(logger, request) {
 	});
 }
 //#endregion
-//#region src/url.ts
-var UrlError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "UrlError";
-	}
-};
-/**
-* Validates a URL to prevent SSRF attacks.
-*/
-async function validatePublicUrl(url) {
-	const parsed = new URL(url);
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
-	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
-	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
-	const hostnameFamily = (0, node_net.isIP)(hostname);
-	if (hostnameFamily !== 0) {
-		validatePublicIpAddress(hostname, hostnameFamily);
-		return;
-	}
-	if ("Deno" in globalThis && !(0, node_net.isIP)(hostname)) {
-		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
-	}
-	if ("Bun" in globalThis) {
-		if (hostname === "example.com" || hostname.endsWith(".example.com")) return;
-		else if (hostname === "fedify-test.internal") throw new UrlError("Invalid or private address: fedify-test.internal");
-	}
-	let addresses;
-	try {
-		addresses = await (0, node_dns_promises.lookup)(hostname, { all: true });
-	} catch {
-		addresses = [];
-	}
-	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
-}
-function validatePublicIpAddress(address, family) {
-	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
-	throw new UrlError(`Invalid or private address: ${address}`);
-}
-function isValidPublicIPv4Address(address) {
-	const parts = parseIPv4Address(address);
-	if (parts == null) return false;
-	const value = ipv4PartsToNumber(parts);
-	return !nonPublicIPv4Prefixes.some(({ base, prefix }) => matchesIPv4Prefix(value, base, prefix));
-}
-function isValidPublicIPv6Address(address) {
-	const words = parseIPv6Address(address);
-	if (words == null) return false;
-	if (nonPublicIPv6Prefixes.some(({ words: prefixWords, prefix }) => matchesIPv6Prefix(words, prefixWords, prefix))) return false;
-	for (const { extractIPv4, prefix, words: prefixWords } of ipv6WithIPv4Prefixes) {
-		if (!matchesIPv6Prefix(words, prefixWords, prefix)) continue;
-		const ipv4Address = extractIPv4(words);
-		if (ipv4Address != null && !isValidPublicIPv4Address(ipv4Address)) return false;
-	}
-	return true;
-}
-function expandIPv6Address(address) {
-	address = address.toLowerCase();
-	const ipv4Delimiter = address.lastIndexOf(":");
-	if (address.includes(".") && ipv4Delimiter >= 0) {
-		const ipv4Parts = parseIPv4Address(address.substring(ipv4Delimiter + 1));
-		if (ipv4Parts == null) return address;
-		const high = (ipv4Parts[0] << 8) + ipv4Parts[1];
-		const low = (ipv4Parts[2] << 8) + ipv4Parts[3];
-		address = address.substring(0, ipv4Delimiter + 1) + high.toString(16) + ":" + low.toString(16);
-	}
-	if (address === "::") return "0000:0000:0000:0000:0000:0000:0000:0000";
-	if (address.startsWith("::")) address = "0000" + address;
-	if (address.endsWith("::")) address = address + "0000";
-	address = address.replace("::", ":0000".repeat(8 - (address.match(/:/g) || []).length) + ":");
-	return address.split(":").map((part) => part.padStart(4, "0")).join(":");
-}
-const nonPublicIPv4Prefixes = [
-	ipv4Prefix("0.0.0.0/8", "RFC 6890"),
-	ipv4Prefix("10.0.0.0/8", "RFC 1918"),
-	ipv4Prefix("100.64.0.0/10", "RFC 6598"),
-	ipv4Prefix("127.0.0.0/8", "RFC 1122"),
-	ipv4Prefix("169.254.0.0/16", "RFC 3927"),
-	ipv4Prefix("172.16.0.0/12", "RFC 1918"),
-	ipv4Prefix("192.0.0.0/24", "RFC 6890"),
-	ipv4Prefix("192.0.2.0/24", "RFC 5737"),
-	ipv4Prefix("192.88.99.0/24", "RFC 7526"),
-	ipv4Prefix("192.168.0.0/16", "RFC 1918"),
-	ipv4Prefix("198.18.0.0/15", "RFC 2544"),
-	ipv4Prefix("198.51.100.0/24", "RFC 5737"),
-	ipv4Prefix("203.0.113.0/24", "RFC 5737"),
-	ipv4Prefix("224.0.0.0/4", "RFC 5771"),
-	ipv4Prefix("240.0.0.0/4", "RFC 1112")
-];
-const nonPublicIPv6Prefixes = [
-	ipv6Prefix("::/16", "RFC 4291"),
-	ipv6Prefix("2001::/32", "RFC 4380"),
-	ipv6Prefix("2002::/16", "RFC 3056"),
-	ipv6Prefix("64:ff9b:1::/48", "RFC 8215"),
-	ipv6Prefix("fc00::/7", "RFC 4193"),
-	ipv6Prefix("fe80::/10", "RFC 4291"),
-	ipv6Prefix("ff00::/8", "RFC 4291")
-];
-const ipv6WithIPv4Prefixes = [{
-	...ipv6Prefix("64:ff9b::/96", "RFC 6052"),
-	extractIPv4: (words) => ipv4FromWords(words[6], words[7])
-}];
-function ipv4Prefix(cidr, rfc) {
-	const [address, prefixText] = cidr.split("/");
-	const prefix = parseInt(prefixText, 10);
-	const parts = parseIPv4Address(address);
-	if (parts == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) throw new Error(`Invalid IPv4 prefix: ${cidr}`);
-	return {
-		cidr,
-		base: ipv4PartsToNumber(parts),
-		prefix,
-		rfc
-	};
-}
-function ipv6Prefix(cidr, rfc) {
-	const [address, prefixText] = cidr.split("/");
-	const prefix = parseInt(prefixText, 10);
-	const words = parseIPv6Address(address);
-	if (words == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 128) throw new Error(`Invalid IPv6 prefix: ${cidr}`);
-	return {
-		cidr,
-		words,
-		prefix,
-		rfc
-	};
-}
-function parseIPv4Address(address) {
-	const parts = address.split(".").map((part) => {
-		if (!/^\d+$/.test(part)) return NaN;
-		return parseInt(part, 10);
-	});
-	if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;
-	return parts;
-}
-function parseIPv6Address(address) {
-	const parts = expandIPv6Address(address).split(":");
-	if (parts.length !== 8) return null;
-	const words = parts.map((part) => {
-		if (!/^[0-9a-f]{1,4}$/i.test(part)) return NaN;
-		return parseInt(part, 16);
-	});
-	if (words.some((word) => !Number.isInteger(word) || word < 0 || word > 65535)) return null;
-	return words;
-}
-function ipv4PartsToNumber(parts) {
-	return parts[0] * 2 ** 24 + parts[1] * 2 ** 16 + parts[2] * 2 ** 8 + parts[3];
-}
-function ipv4FromWords(highWord, lowWord) {
-	return [
-		highWord >> 8,
-		highWord & 255,
-		lowWord >> 8,
-		lowWord & 255
-	].join(".");
-}
-function matchesIPv4Prefix(address, prefixBase, prefixLength) {
-	const blockSize = 2 ** (32 - prefixLength);
-	return Math.floor(address / blockSize) === Math.floor(prefixBase / blockSize);
-}
-function matchesIPv6Prefix(address, prefixWords, prefixLength) {
-	let remaining = prefixLength;
-	for (let i = 0; i < 8 && remaining > 0; i++) if (remaining >= 16) {
-		if (address[i] !== prefixWords[i]) return false;
-		remaining -= 16;
-	} else {
-		const mask = 65535 << 16 - remaining & 65535;
-		if ((address[i] & mask) !== (prefixWords[i] & mask)) return false;
-		remaining = 0;
-	}
-	return true;
-}
-//#endregion
 //#region src/docloader.ts
 const logger = (0, _logtape_logtape.getLogger)([
 	"fedify",
@@ -4779,6 +4627,66 @@ const logger = (0, _logtape_logtape.getLogger)([
 	"docloader"
 ]);
 const DEFAULT_MAX_REDIRECTION = 20;
+const MAX_HTML_SIZE = 1024 * 1024;
+function createResponseMetadata(response) {
+	return new Response(null, {
+		headers: response.headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
+async function cancelResponseBody(response) {
+	if (response.body != null) await response.body.cancel();
+}
+async function readBoundedText(response, maxBytes) {
+	const contentLength = response.headers.get("Content-Length");
+	if (contentLength != null) {
+		const size = Number(contentLength);
+		if (size > maxBytes) {
+			await cancelResponseBody(response);
+			return {
+				text: "",
+				size,
+				tooLarge: true
+			};
+		}
+	}
+	if (response.body == null) return {
+		text: "",
+		size: 0,
+		tooLarge: false
+	};
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let text = "";
+	let size = 0;
+	try {
+		while (true) {
+			const result = await reader.read();
+			if (result.done) break;
+			const chunkSize = result.value.byteLength;
+			if (size + chunkSize > maxBytes) {
+				size += chunkSize;
+				await reader.cancel();
+				return {
+					text: "",
+					size,
+					tooLarge: true
+				};
+			}
+			size += chunkSize;
+			text += decoder.decode(result.value, { stream: true });
+		}
+		text += decoder.decode();
+		return {
+			text,
+			size,
+			tooLarge: false
+		};
+	} finally {
+		reader.releaseLock();
+	}
+}
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4833,19 +4741,19 @@ async function getRemoteDocument(url, response, fetch) {
 	}
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
-		const MAX_HTML_SIZE = 1024 * 1024;
-		const html = await response.text();
-		if (html.length > MAX_HTML_SIZE) {
+		const errorResponse = createResponseMetadata(response);
+		const html = await readBoundedText(response, MAX_HTML_SIZE);
+		if (html.tooLarge) {
 			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
 				url: documentUrl,
-				size: html.length
+				size: html.size
 			});
-			document = JSON.parse(html);
+			throw new FetchError(documentUrl, `HTML document is too large to scan for an ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
 		} else {
 			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
 			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html)) !== null) {
+			while ((tagMatch = tagPattern.exec(html.text)) !== null) {
 				const tagContent = tagMatch[2];
 				let attrMatch;
 				const attribs = {};
@@ -4862,7 +4770,12 @@ async function getRemoteDocument(url, response, fetch) {
 					return await fetch(new URL(attribs.href, docUrl).href);
 				}
 			}
-			document = JSON.parse(html);
+			try {
+				document = JSON.parse(html.text);
+			} catch (error) {
+				if (!(error instanceof SyntaxError)) throw error;
+				throw new FetchError(documentUrl, `HTML document has no ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
+			}
 		}
 	} else document = await response.json();
 	logger.debug("Fetched document: {status} {url} {headers}", {
@@ -4908,9 +4821,9 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 			};
 		}
 		if (!allowPrivateAddress) try {
-			await validatePublicUrl(currentUrl);
+			await require_url.validatePublicUrl(currentUrl);
 		} catch (error) {
-			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
+			if (error instanceof require_url.UrlError) logger.error("Disallowed private URL: {url}", {
 				url: currentUrl,
 				error
 			});
@@ -5340,6 +5253,11 @@ const algorithms = {
 	},
 	"1.3.101.112": "Ed25519"
 };
+const DID_KEY_PREFIX = "did:key:";
+const ED25519_PUBLIC_KEY_MULTICODEC = 237;
+const ED25519_PUBLIC_KEY_LENGTH = 32;
+const DID_KEY_PATTERN = /^did:key:([^/?#]+)$/;
+const DID_KEY_VERIFICATION_METHOD_PATTERN = /^did:key:([^/?#]+)#([^/?#]+)$/;
 /**
 * Imports a PEM-SPKI formatted public key.
 * @param pem The PEM-SPKI formatted public key.
@@ -5401,6 +5319,69 @@ const PKCS1_HEADER = /^\s*-----BEGIN\s+RSA\s+PUBLIC\s+KEY-----\s*\n/;
 function importPem(pem) {
 	return PKCS1_HEADER.test(pem) ? importPkcs1(pem) : importSpki(pem);
 }
+function decodeEd25519DidKeyMultibase(multibaseKey) {
+	if (!multibaseKey.startsWith("z")) throw new TypeError("did:key must use base58-btc Multibase encoding.");
+	let decoded;
+	try {
+		decoded = decodeMultibase(multibaseKey);
+	} catch (error) {
+		throw new TypeError("Invalid did:key Multibase encoding.", { cause: error });
+	}
+	const { code } = getMulticodecPrefix(decoded);
+	if (code !== ED25519_PUBLIC_KEY_MULTICODEC) throw new TypeError("Unsupported did:key type: 0x" + code.toString(16));
+	const content = removeMulticodecPrefix(decoded);
+	if (content.length !== ED25519_PUBLIC_KEY_LENGTH) throw new TypeError("Invalid Ed25519 did:key length.");
+	return content;
+}
+/**
+* Imports an Ed25519 `did:key` DID.
+*
+* @param did The `did:key` DID.
+* @returns The imported Ed25519 public key.
+* @throws {TypeError} If the DID is malformed or uses an unsupported key type.
+* @since 2.4.0
+*/
+async function importDidKey(did) {
+	const match = (did instanceof URL ? did.href : did).match(DID_KEY_PATTERN);
+	if (match == null) throw new TypeError("Invalid did:key DID.");
+	const content = decodeEd25519DidKeyMultibase(match[1]);
+	return await crypto.subtle.importKey("raw", content.slice(), "Ed25519", true, ["verify"]);
+}
+/**
+* Exports an Ed25519 public key as a `did:key` DID.
+*
+* @param key The Ed25519 public key.
+* @returns The `did:key` DID.
+* @throws {TypeError} If the key is invalid or unsupported.
+* @since 2.4.0
+*/
+async function exportDidKey(key) {
+	if (key.algorithm.name !== "Ed25519") throw new TypeError("Unsupported key type: " + JSON.stringify(key.algorithm));
+	return DID_KEY_PREFIX + await exportMultibaseKey(key);
+}
+/**
+* Parses an Ed25519 `did:key` verification method DID URL.
+*
+* @param didUrl The `did:key` DID URL.
+* @returns The parsed verification method.
+* @throws {TypeError} If the DID URL is malformed, unsupported, or its
+*                     fragment does not identify the same key as the DID.
+* @since 2.4.0
+*/
+async function parseDidKeyVerificationMethod(didUrl) {
+	const didUrlString = didUrl instanceof URL ? didUrl.href : didUrl;
+	const match = didUrlString.match(DID_KEY_VERIFICATION_METHOD_PATTERN);
+	if (match == null) throw new TypeError("Invalid did:key verification method.");
+	const [, publicKeyMultibase, fragment] = match;
+	if (publicKeyMultibase !== fragment) throw new TypeError("Invalid did:key verification method fragment.");
+	const publicKey = await importDidKey(DID_KEY_PREFIX + publicKeyMultibase);
+	return {
+		id: new URL(didUrlString),
+		controller: new URL(DID_KEY_PREFIX + publicKeyMultibase),
+		publicKeyMultibase,
+		publicKey
+	};
+}
 /**
 * Imports a [Multibase]-encoded public key.
 *
@@ -5569,26 +5550,33 @@ LanguageString.prototype[Symbol.for("nodejs.util.inspect.custom")] = function(_d
 //#endregion
 exports.FetchError = FetchError;
 exports.LanguageString = LanguageString;
-exports.UrlError = UrlError;
+exports.UrlError = require_url.UrlError;
 exports.canParseDecimal = canParseDecimal;
 exports.createActivityPubRequest = createActivityPubRequest;
 exports.decodeMultibase = decodeMultibase;
 exports.encodeMultibase = encodeMultibase;
 exports.encodingFromBaseData = encodingFromBaseData;
-exports.expandIPv6Address = expandIPv6Address;
+exports.expandIPv6Address = require_url.expandIPv6Address;
+exports.exportDidKey = exportDidKey;
 exports.exportMultibaseKey = exportMultibaseKey;
 exports.exportSpki = exportSpki;
+exports.formatIri = require_url.formatIri;
 exports.getDocumentLoader = getDocumentLoader;
 exports.getRemoteDocument = getRemoteDocument;
 exports.getUserAgent = getUserAgent;
+exports.haveSameIriOrigin = require_url.haveSameIriOrigin;
+exports.importDidKey = importDidKey;
 exports.importMultibaseKey = importMultibaseKey;
 exports.importPem = importPem;
 exports.importPkcs1 = importPkcs1;
 exports.importSpki = importSpki;
 exports.isDecimal = isDecimal;
-exports.isValidPublicIPv4Address = isValidPublicIPv4Address;
-exports.isValidPublicIPv6Address = isValidPublicIPv6Address;
+exports.isValidPublicIPv4Address = require_url.isValidPublicIPv4Address;
+exports.isValidPublicIPv6Address = require_url.isValidPublicIPv6Address;
 exports.logRequest = logRequest;
 exports.parseDecimal = parseDecimal;
+exports.parseDidKeyVerificationMethod = parseDidKeyVerificationMethod;
+exports.parseIri = require_url.parseIri;
+exports.parseJsonLdId = require_url.parseJsonLdId;
 exports.preloadedContexts = preloadedContexts;
-exports.validatePublicUrl = validatePublicUrl;
+exports.validatePublicUrl = require_url.validatePublicUrl;