@fedify/vocab 2.4.0-dev.1583 → 2.4.0-dev.1618

package/dist-tests/vocab.test.mjs

@@ -1,7 +1,7 @@
-import { Temporal } from "@js-temporal/polyfill";
+import { Temporal } from "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { A as Person, C as Link, D as Offer, E as Object$1, F as QuoteRequest, H as vocab_exports, I as Reject, M as Proposal, N as Question, O as OrderedCollectionPage, P as QuoteAuthorization, R as Source, S as InteractionRule, T as Note, _ as Follow, b as Intent, c as Create, d as Document, f as Endpoints, g as FeaturedItem, h as FeaturedCollection, i as Announce, j as Place, l as CryptographicKey, m as FeatureRequest, n as Activity, o as Collection, p as FeatureAuthorization, r as Agreement, s as Commitment, t as Accept, u as Delete, w as Measure, x as InteractionPolicy, y as Hashtag, z as Tombstone } from "./vocab-DOHLQ4UQ.mjs";
-import { t as assertInstanceOf } from "./utils-CE8Dk5hm.mjs";
+import { B as Tombstone, C as Link, D as Object$1, E as Note, F as QuoteAuthorization, I as QuoteRequest, L as Reject, M as Place, N as Proposal, O as Offer, P as Question, S as InteractionRule, T as Multikey, U as vocab_exports, _ as Follow, b as Intent, c as Create, d as Document, f as Endpoints, g as FeaturedItem, h as FeaturedCollection, i as Announce, j as Person, k as OrderedCollectionPage, l as CryptographicKey, m as FeatureRequest, n as Activity, o as Collection, p as FeatureAuthorization, r as Agreement, s as Commitment, t as Accept, u as Delete, w as Measure, x as InteractionPolicy, y as Hashtag, z as Source } from "./vocab-OU5GYbNg.mjs";
+import { t as assertInstanceOf } from "./utils-CQjrpUkt.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, notDeepStrictEqual, ok, rejects, throws } from "node:assert/strict";
 import { configure, reset } from "@logtape/logtape";
@@ -1311,6 +1311,25 @@ test("Endpoints.toJsonLd() omits type", async () => {
 		contextLoader: mockDocumentLoader
 	}), ep);
 });
+test("Endpoints.uploadMedia round-trips", async () => {
+	const ep = new Endpoints({ uploadMedia: new URL("https://example.com/users/alice/media") });
+	deepStrictEqual(ep.uploadMedia?.href, "https://example.com/users/alice/media");
+	deepStrictEqual((await ep.toJsonLd())["uploadMedia"], "https://example.com/users/alice/media");
+	for (const format of [
+		void 0,
+		"compact",
+		"expand"
+	]) {
+		const jsonLd = await ep.toJsonLd({
+			format,
+			contextLoader: mockDocumentLoader
+		});
+		deepStrictEqual((await Endpoints.fromJsonLd(jsonLd, {
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader
+		})).uploadMedia?.href, "https://example.com/users/alice/media", `round-trip failed for format=${format ?? "heuristic"}`);
+	}
+});
 test("Source.toJsonLd() omits type", async () => {
 	const src = new Source({
 		content: "Hello, world!",
@@ -1361,7 +1380,8 @@ test("Endpoints with all properties set omits type", async () => {
 		oauthTokenEndpoint: new URL("https://example.com/oauth/token"),
 		provideClientKey: new URL("https://example.com/provide-key"),
 		signClientKey: new URL("https://example.com/sign-key"),
-		sharedInbox: new URL("https://example.com/inbox")
+		sharedInbox: new URL("https://example.com/inbox"),
+		uploadMedia: new URL("https://example.com/upload-media")
 	});
 	const compact = await ep.toJsonLd();
 	ok(!("type" in compact), "compact output should not have 'type'");
@@ -1371,6 +1391,7 @@ test("Endpoints with all properties set omits type", async () => {
 	deepStrictEqual(compact["provideClientKey"], "https://example.com/provide-key");
 	deepStrictEqual(compact["signClientKey"], "https://example.com/sign-key");
 	deepStrictEqual(compact["sharedInbox"], "https://example.com/inbox");
+	deepStrictEqual(compact["uploadMedia"], "https://example.com/upload-media");
 	for (const format of [
 		void 0,
 		"compact",
@@ -2555,6 +2576,23 @@ test("FEP-fe34: Same origin objects are trusted", async () => {
 	deepStrictEqual(result?.id, new URL("https://example.com/note"));
 	deepStrictEqual(result?.content, "This is a legitimate note");
 });
+test("FEP-fe34: Same-authority non-FE34 embedded objects are trusted", async () => {
+	const result = await (await Create.fromJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		"@type": "Create",
+		"@id": "at://did:plc:example/collection/item",
+		"actor": "at://did:plc:example/actor/self",
+		"object": {
+			"@type": "Note",
+			"@id": "at://did:plc:example/collection/reply",
+			"content": "Embedded AT Protocol note"
+		}
+	})).getObject({ documentLoader: async (url) => {
+		throw new Error(`Unexpected fetch: ${url}`);
+	} });
+	assertInstanceOf(result, Note);
+	deepStrictEqual(result.content, "Embedded AT Protocol note");
+});
 test("FEP-fe34: Embedded cross-origin objects from JSON-LD are ignored by default", async () => {
 	const createDocumentLoader = async (url) => {
 		if (url === "https://example.com/create") return {
@@ -2656,6 +2694,47 @@ test("FEP-fe34: Portable DID authorities are cross-origin boundaries", async ()
 	assertInstanceOf(result, Note);
 	deepStrictEqual(result.content, "Fetched portable note");
 });
+test("FEP-fe34: DID verification methods share portable actor cryptographic origin", async () => {
+	const person = await Person.fromJsonLd({
+		"@id": "ap://did:key:z6MkOwner/actor",
+		"@type": ["https://www.w3.org/ns/activitystreams#Person"],
+		"https://w3id.org/security#assertionMethod": [{
+			"@id": "did:key:z6MkOwner#z6MkOwner",
+			"@type": ["https://w3id.org/security#Multikey"],
+			"https://w3id.org/security#controller": [{ "@id": "did:key:z6MkOwner" }]
+		}]
+	});
+	const documentLoader = async (url) => {
+		throw new Error(`Unexpected fetch: ${url}`);
+	};
+	const methods = [];
+	for await (const method of person.getAssertionMethods({ documentLoader })) methods.push(method);
+	deepStrictEqual(methods.length, 1);
+	assertInstanceOf(methods[0], Multikey);
+	deepStrictEqual(methods[0].id, new URL("did:key:z6MkOwner#z6MkOwner"));
+});
+test("FEP-fe34: DID verification methods from another cryptographic origin are untrusted", async () => {
+	const person = await Person.fromJsonLd({
+		"@id": "ap://did:key:z6MkOwner/actor",
+		"@type": ["https://www.w3.org/ns/activitystreams#Person"],
+		"https://w3id.org/security#assertionMethod": [{
+			"@id": "did:key:z6MkOther#z6MkOther",
+			"@type": ["https://w3id.org/security#Multikey"],
+			"https://w3id.org/security#controller": [{ "@id": "did:key:z6MkOther" }]
+		}]
+	});
+	let fetches = 0;
+	const methods = [];
+	for await (const method of person.getAssertionMethods({
+		suppressError: true,
+		documentLoader: async (url) => {
+			fetches++;
+			throw new Error(`Unexpected fetch: ${url}`);
+		}
+	})) methods.push(method);
+	deepStrictEqual(methods, []);
+	deepStrictEqual(fetches, 1);
+});
 test("FEP-fe34: Array properties respect cross-origin policy", async () => {
 	const crossOriginDocumentLoader = async (url) => {
 		if (url === "https://different-origin.com/note1") return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab",
-  "version": "2.4.0-dev.1583+1a6f31cb",
+  "version": "2.4.0-dev.1618+58858243",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -35,7 +35,6 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@js-temporal/polyfill": "^0.5.1",
     "@multiformats/base-x": "^4.0.1",
     "@logtape/logtape": "^2.2.0",
     "@opentelemetry/api": "^1.9.1",
@@ -43,9 +42,10 @@
     "es-toolkit": "1.46.1",
     "jsonld": "^9.0.0",
     "pkijs": "^3.3.3",
-    "@fedify/vocab-tools": "2.4.0-dev.1583+1a6f31cb",
-    "@fedify/vocab-runtime": "2.4.0-dev.1583+1a6f31cb",
-    "@fedify/webfinger": "2.4.0-dev.1583+1a6f31cb"
+    "temporal-polyfill": "^1.0.1",
+    "@fedify/vocab-tools": "2.4.0-dev.1618+58858243",
+    "@fedify/webfinger": "2.4.0-dev.1618+58858243",
+    "@fedify/vocab-runtime": "2.4.0-dev.1618+58858243"
   },
   "devDependencies": {
     "@types/node": "^22.17.0",

package/src/__snapshots__/vocab.test.ts.snap

@@ -5003,7 +5003,8 @@ snapshot[`Deno.inspect(Endpoints) [auto] 1`] = `
   oauthTokenEndpoint: URL "https://example.com/",
   provideClientKey: URL "https://example.com/",
   signClientKey: URL "https://example.com/",
-  sharedInbox: URL "https://example.com/"
+  sharedInbox: URL "https://example.com/",
+  uploadMedia: URL "https://example.com/"
 }'
 `;
 
@@ -5015,7 +5016,8 @@ snapshot[`Deno.inspect(Endpoints) [auto] 2`] = `
   oauthTokenEndpoint: URL "https://example.com/",
   provideClientKey: URL "https://example.com/",
   signClientKey: URL "https://example.com/",
-  sharedInbox: URL "https://example.com/"
+  sharedInbox: URL "https://example.com/",
+  uploadMedia: URL "https://example.com/"
 }'
 `;
 
@@ -5027,7 +5029,8 @@ snapshot[`Deno.inspect(Endpoints) [auto] 3`] = `
   oauthTokenEndpoint: URL "https://example.com/",
   provideClientKey: URL "https://example.com/",
   signClientKey: URL "https://example.com/",
-  sharedInbox: URL "https://example.com/"
+  sharedInbox: URL "https://example.com/",
+  uploadMedia: URL "https://example.com/"
 }'
 `;
 

package/src/cjs.test.ts

@@ -0,0 +1,31 @@
+import { ok, strictEqual, throws } from "node:assert";
+import { createRequire } from "node:module";
+import { mockDocumentLoader, test } from "@fedify/fixture";
+
+test("CommonJS entry bundles temporal-polyfill internally", {
+  ignore: "Deno" in globalThis,
+}, async () => {
+  const originalTemporal = globalThis.Temporal;
+
+  const require = createRequire(import.meta.url);
+  throws(
+    () => require("temporal-polyfill"),
+    (error: unknown) => {
+      if (error == null || typeof error !== "object") return false;
+      const { code } = error as { code?: unknown };
+      return code === "ERR_PACKAGE_PATH_NOT_EXPORTED" ||
+        code === "MODULE_NOT_FOUND";
+    },
+  );
+
+  const vocab = require("../dist/mod.cjs");
+  const obj = await vocab.Object.fromJsonLd({
+    "@context": "https://www.w3.org/ns/activitystreams",
+    type: "Object",
+    published: "2025-01-01T12:34:56Z",
+  }, { documentLoader: mockDocumentLoader, contextLoader: mockDocumentLoader });
+
+  ok(obj.published != null);
+  strictEqual(obj.published.toString(), "2025-01-01T12:34:56Z");
+  strictEqual(globalThis.Temporal, originalTemporal);
+});

package/src/endpoints.yaml

@@ -84,3 +84,17 @@ properties:
     objects which are not addressed to the `Public`` endpoint.
   range:
   - "http://www.w3.org/2001/XMLSchema#anyURI"
+
+- singularName: uploadMedia
+  functional: true
+  compactName: uploadMedia
+  uri: "https://www.w3.org/ns/activitystreams#uploadMedia"
+  description: |
+    Upload endpoint URI for this user for binary data, such as an image or
+    video, as described in the [ActivityPub Media
+    Upload](https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload) extension.
+    Clients `POST` a `multipart/form-data` request containing a `file` part
+    (the binary payload) and an `object` part (an ActivityStreams object shell)
+    to this endpoint.
+  range:
+  - "http://www.w3.org/2001/XMLSchema#anyURI"

package/src/lookup.test.ts

@@ -416,6 +416,127 @@ test("FEP-fe34: lookupObject() cross-origin security", {
     );
   });
 
+  await t.step(
+    "same-authority non-FE34 IRIs are still trusted",
+    async () => {
+      // deno-lint-ignore require-await
+      const atProtoDocumentLoader = async (url: string) => {
+        if (url === "https://gateway.example/at-item") {
+          return {
+            documentUrl: "at://did%3Aplc%3Aexample/collection/item",
+            contextUrl: null,
+            document: {
+              "@context": "https://www.w3.org/ns/activitystreams",
+              type: "Note",
+              id: "at://did:plc:example/collection/reply",
+              content: "AT Protocol note",
+            },
+          };
+        }
+        throw new Error(`Unexpected URL: ${url}`);
+      };
+
+      const result = await lookupObject(
+        "https://gateway.example/at-item",
+        {
+          documentLoader: atProtoDocumentLoader,
+          contextLoader: mockDocumentLoader,
+        },
+      );
+
+      assertInstanceOf(result, Note);
+      deepStrictEqual(
+        result.id,
+        new URL("at://did%3Aplc%3Aexample/collection/reply"),
+      );
+      deepStrictEqual(result.content, "AT Protocol note");
+    },
+  );
+
+  await t.step(
+    "portable object IDs are trusted by DID cryptographic origin",
+    async () => {
+      // deno-lint-ignore require-await
+      const portableDocumentLoader = async (url: string) => {
+        if (
+          url ===
+            "https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note"
+        ) {
+          return {
+            documentUrl: "ap+ef61://did:key:z6Mkabc/note",
+            contextUrl: null,
+            document: {
+              "@context": "https://www.w3.org/ns/activitystreams",
+              type: "Note",
+              id: "ap://did:key:z6Mkabc/note",
+              content: "Portable note",
+            },
+          };
+        }
+        throw new Error(`Unexpected URL: ${url}`);
+      };
+
+      const result = await lookupObject(
+        "https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note",
+        {
+          documentLoader: portableDocumentLoader,
+          contextLoader: mockDocumentLoader,
+        },
+      );
+
+      assertInstanceOf(result, Note);
+      deepStrictEqual(result.content, "Portable note");
+    },
+  );
+
+  await t.step(
+    "portable object IDs reject mismatched cryptographic origins",
+    async () => {
+      // deno-lint-ignore require-await
+      const portableDocumentLoader = async (url: string) => {
+        if (
+          url ===
+            "https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note"
+        ) {
+          return {
+            documentUrl: "ap+ef61://did:key:z6Mkabc/note",
+            contextUrl: null,
+            document: {
+              "@context": "https://www.w3.org/ns/activitystreams",
+              type: "Note",
+              id: "ap://did:key:z6Mkdef/note",
+              content: "Spoofed portable note",
+            },
+          };
+        }
+        throw new Error(`Unexpected URL: ${url}`);
+      };
+
+      const result = await lookupObject(
+        "https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note",
+        {
+          documentLoader: portableDocumentLoader,
+          contextLoader: mockDocumentLoader,
+        },
+      );
+
+      deepStrictEqual(result, null);
+      await rejects(
+        () =>
+          lookupObject(
+            "https://gateway.example/.well-known/apgateway/did:key:z6Mkabc/note",
+            {
+              documentLoader: portableDocumentLoader,
+              contextLoader: mockDocumentLoader,
+              crossOrigin: "throw",
+            },
+          ),
+        Error,
+        "The object's @id (ap+ef61://did%3Akey%3Az6Mkdef/note) has a different origin than the document URL (ap+ef61://did:key:z6Mkabc/note)",
+      );
+    },
+  );
+
   await t.step("objects without @id are trusted", async () => {
     // deno-lint-ignore require-await
     const noIdDocumentLoader = async (url: string) => {

package/src/lookup.ts

@@ -2,6 +2,7 @@ import type { GetUserAgentOptions } from "@fedify/vocab-runtime";
 import {
   type DocumentLoader,
   getDocumentLoader,
+  haveSameFe34Origin,
   haveSameIriOrigin,
   parseIri,
   type RemoteDocument,
@@ -335,7 +336,8 @@ async function lookupObjectInternal(
   }
   if (
     options.crossOrigin !== "trust" && object.id != null &&
-    !haveSameIriOrigin(object.id, documentUrl)
+    !haveSameIriOrigin(object.id, documentUrl) &&
+    !haveSameFe34Origin(object.id, documentUrl)
   ) {
     if (options.crossOrigin === "throw") {
       throw new Error(

package/src/vocab.test.ts

@@ -47,6 +47,7 @@ import {
   InteractionRule,
   Link,
   Measure,
+  Multikey,
   Note,
   Object,
   Offer,
@@ -1963,6 +1964,39 @@ test("Endpoints.toJsonLd() omits type", async () => {
   deepStrictEqual(restored, ep);
 });
 
+test("Endpoints.uploadMedia round-trips", async () => {
+  const ep = new Endpoints({
+    uploadMedia: new URL("https://example.com/users/alice/media"),
+  });
+  deepStrictEqual(
+    ep.uploadMedia?.href,
+    "https://example.com/users/alice/media",
+  );
+
+  const compact = await ep.toJsonLd() as Record<string, unknown>;
+  deepStrictEqual(
+    compact["uploadMedia"],
+    "https://example.com/users/alice/media",
+  );
+
+  // Round-trip through every format under the standard AS term.
+  for (const format of [undefined, "compact" as const, "expand" as const]) {
+    const jsonLd = await ep.toJsonLd({
+      format,
+      contextLoader: mockDocumentLoader,
+    });
+    const restored = await Endpoints.fromJsonLd(jsonLd, {
+      documentLoader: mockDocumentLoader,
+      contextLoader: mockDocumentLoader,
+    });
+    deepStrictEqual(
+      restored.uploadMedia?.href,
+      "https://example.com/users/alice/media",
+      `round-trip failed for format=${format ?? "heuristic"}`,
+    );
+  }
+});
+
 test("Source.toJsonLd() omits type", async () => {
   const src = new Source({
     content: "Hello, world!",
@@ -2029,6 +2063,7 @@ test("Endpoints with all properties set omits type", async () => {
     provideClientKey: new URL("https://example.com/provide-key"),
     signClientKey: new URL("https://example.com/sign-key"),
     sharedInbox: new URL("https://example.com/inbox"),
+    uploadMedia: new URL("https://example.com/upload-media"),
   });
 
   // Compact heuristic path
@@ -2049,6 +2084,7 @@ test("Endpoints with all properties set omits type", async () => {
   );
   deepStrictEqual(compact["signClientKey"], "https://example.com/sign-key");
   deepStrictEqual(compact["sharedInbox"], "https://example.com/inbox");
+  deepStrictEqual(compact["uploadMedia"], "https://example.com/upload-media");
 
   // Round-trip all three formats
   for (
@@ -3800,6 +3836,30 @@ test("FEP-fe34: Same origin objects are trusted", async () => {
   deepStrictEqual(result?.content, "This is a legitimate note");
 });
 
+test("FEP-fe34: Same-authority non-FE34 embedded objects are trusted", async () => {
+  const create = await Create.fromJsonLd({
+    "@context": "https://www.w3.org/ns/activitystreams",
+    "@type": "Create",
+    "@id": "at://did:plc:example/collection/item",
+    "actor": "at://did:plc:example/actor/self",
+    "object": {
+      "@type": "Note",
+      "@id": "at://did:plc:example/collection/reply",
+      "content": "Embedded AT Protocol note",
+    },
+  });
+
+  const result = await create.getObject({
+    // deno-lint-ignore require-await
+    documentLoader: async (url) => {
+      throw new Error(`Unexpected fetch: ${url}`);
+    },
+  });
+
+  assertInstanceOf(result, Note);
+  deepStrictEqual(result.content, "Embedded AT Protocol note");
+});
+
 test(
   "FEP-fe34: Embedded cross-origin objects from JSON-LD are ignored by default",
   async () => {
@@ -3951,6 +4011,74 @@ test(
   },
 );
 
+test(
+  "FEP-fe34: DID verification methods share portable actor cryptographic origin",
+  async () => {
+    const person = await Person.fromJsonLd({
+      "@id": "ap://did:key:z6MkOwner/actor",
+      "@type": ["https://www.w3.org/ns/activitystreams#Person"],
+      "https://w3id.org/security#assertionMethod": [{
+        "@id": "did:key:z6MkOwner#z6MkOwner",
+        "@type": ["https://w3id.org/security#Multikey"],
+        "https://w3id.org/security#controller": [{
+          "@id": "did:key:z6MkOwner",
+        }],
+      }],
+    });
+
+    // deno-lint-ignore require-await
+    const documentLoader = async (url: string) => {
+      throw new Error(`Unexpected fetch: ${url}`);
+    };
+
+    const methods = [];
+    for await (const method of person.getAssertionMethods({ documentLoader })) {
+      methods.push(method);
+    }
+
+    deepStrictEqual(methods.length, 1);
+    assertInstanceOf(methods[0], Multikey);
+    deepStrictEqual(
+      methods[0].id,
+      new URL("did:key:z6MkOwner#z6MkOwner"),
+    );
+  },
+);
+
+test(
+  "FEP-fe34: DID verification methods from another cryptographic origin are untrusted",
+  async () => {
+    const person = await Person.fromJsonLd({
+      "@id": "ap://did:key:z6MkOwner/actor",
+      "@type": ["https://www.w3.org/ns/activitystreams#Person"],
+      "https://w3id.org/security#assertionMethod": [{
+        "@id": "did:key:z6MkOther#z6MkOther",
+        "@type": ["https://w3id.org/security#Multikey"],
+        "https://w3id.org/security#controller": [{
+          "@id": "did:key:z6MkOther",
+        }],
+      }],
+    });
+
+    let fetches = 0;
+    const methods = [];
+    for await (
+      const method of person.getAssertionMethods({
+        suppressError: true,
+        // deno-lint-ignore require-await
+        documentLoader: async (url) => {
+          fetches++;
+          throw new Error(`Unexpected fetch: ${url}`);
+        },
+      })
+    ) {
+      methods.push(method);
+    }
+    deepStrictEqual(methods, []);
+    deepStrictEqual(fetches, 1);
+  },
+);
+
 test("FEP-fe34: Array properties respect cross-origin policy", async () => {
   // deno-lint-ignore require-await
   const crossOriginDocumentLoader = async (url: string) => {

package/tsdown.config.ts

@@ -1,6 +1,13 @@
 import { glob, mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join, sep } from "node:path";
 import { defineConfig } from "tsdown";
+import {
+  temporalPolyfillCjsBanner,
+  temporalPolyfillCjsDeps,
+  temporalPolyfillEsmBanner,
+  temporalPolyfillImportPlugin,
+  temporalPolyfillIntro,
+} from "../../scripts/tsdown/temporal.mts";
 
 async function copyFileSafely(
   source: string,
@@ -16,17 +23,21 @@ export default [
       "./src/mod.ts",
     ],
     dts: { compilerOptions: { isolatedDeclarations: true, declaration: true } },
-    format: ["esm", "cjs"],
+    format: {
+      esm: {
+        banner: temporalPolyfillEsmBanner(),
+      },
+      cjs: {
+        deps: temporalPolyfillCjsDeps({
+          neverBundle: [/^node:/],
+        }),
+        plugins: [temporalPolyfillImportPlugin],
+        banner: temporalPolyfillCjsBanner(),
+      },
+    },
     platform: "neutral",
-    deps: { neverBundle: [/^node:/] },
-    banner({ format }) {
-      const js = format === "cjs"
-        ? `const { Temporal } = require("@js-temporal/polyfill");`
-        : `import { Temporal } from "@js-temporal/polyfill";`;
-      return {
-        js,
-        dts: `/// <reference lib="esnext.temporal" />`,
-      };
+    deps: {
+      neverBundle: [/^node:/],
     },
   }),
   defineConfig({
@@ -49,8 +60,7 @@ export default [
       },
     },
     outputOptions: {
-      intro: `
-      import { Temporal } from "@js-temporal/polyfill";
+      intro: `${temporalPolyfillIntro}
       globalThis.addEventListener = () => {};
     `,
     },