@fedify/fedify 1.10.9 → 1.10.11

package/dist/{proof-DE2Z0_uv.cjs → proof-BPEkbKl1.cjs}

@@ -1,8 +1,8 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
-const require_docloader = require("./docloader-9cG6ESUw.cjs");
-const require_actor = require("./actor-DSmY7of0.cjs");
-const require_key = require("./key-B22mXs2u.cjs");
+const require_docloader = require("./docloader-CvMstYam.cjs");
+const require_actor = require("./actor--xTQfY8h.cjs");
+const require_key = require("./key-BbdUjmdf.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 let jsonld = require("jsonld");
@@ -17,6 +17,288 @@ const logger$1 = (0, _logtape_logtape.getLogger)([
 	"sig",
 	"ld"
 ]);
+const localContext = [
+	"https://w3id.org/identity/v1",
+	"https://www.w3.org/ns/activitystreams",
+	"https://w3id.org/security/v1",
+	"https://w3id.org/security/data-integrity/v1"
+];
+const localContextUrls = new Set(localContext);
+const builtInContextLoader = require_docloader.getDocumentLoader();
+const disallowedJsonLdKeywords = new Set([
+	"@graph",
+	"@included",
+	"@reverse"
+]);
+/** @internal */
+var UnsafeJsonLdError = class extends TypeError {
+	constructor(keyword) {
+		super(`Unsupported JSON-LD keyword: ${keyword}.`);
+		this.keyword = keyword;
+		this.name = "UnsafeJsonLdError";
+	}
+};
+/** @internal */
+var InvalidContextReferenceError = class extends TypeError {
+	constructor(reference) {
+		super(`Invalid JSON-LD context reference: ${reference}.`);
+		this.reference = reference;
+		this.name = "InvalidContextReferenceError";
+	}
+};
+function createLoadingRemoteContextFailedError(reference, cause) {
+	const message = cause instanceof Error ? cause.message : String(cause);
+	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a valid JSON-LD context: ${reference}. ${message}`);
+	error.name = "jsonld.InvalidUrl";
+	error.details = {
+		code: "loading remote context failed",
+		url: reference
+	};
+	error.cause = cause;
+	return error;
+}
+/** @internal */
+function isClearlyMalformedContextReference(reference) {
+	for (const char of reference) {
+		const code = char.charCodeAt(0);
+		if (code <= 32 || code === 127) return true;
+	}
+	if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(reference) && !URL.canParse(reference)) return true;
+	for (let i = 0; i < reference.length; i++) {
+		if (reference[i] !== "%") continue;
+		if (i + 2 >= reference.length || !/[0-9A-Fa-f]/.test(reference[i + 1]) || !/[0-9A-Fa-f]/.test(reference[i + 2])) return true;
+		i += 2;
+	}
+	if (reference.startsWith("./") || reference.startsWith("../") || reference.startsWith("/") || reference.startsWith("//")) {
+		for (const char of reference) if ("[]<>\"\\^`{|}".includes(char)) return true;
+	}
+	return false;
+}
+function cloneRemoteDocument(remoteDocument) {
+	return structuredClone(remoteDocument);
+}
+function createMemoizedDocumentLoader(documentLoader) {
+	const cache = /* @__PURE__ */ new Map();
+	return async (url, options) => {
+		const cacheKey = URL.canParse(url) ? new URL(url).href : url;
+		let remoteDocument = cache.get(cacheKey);
+		if (remoteDocument == null) {
+			remoteDocument = Promise.resolve(documentLoader(url, options)).then(cloneRemoteDocument);
+			remoteDocument.catch(() => {
+				if (cache.get(cacheKey) === remoteDocument) cache.delete(cacheKey);
+			});
+			cache.set(cacheKey, remoteDocument);
+		}
+		return cloneRemoteDocument(await remoteDocument);
+	};
+}
+/** @internal */
+function wrapContextLoaderForJsonLd(contextLoader) {
+	const loader = contextLoader ?? builtInContextLoader;
+	return async (url, options) => {
+		try {
+			return await loader(url, options);
+		} catch (error) {
+			if (!isInvalidUrlTypeError(error)) throw error;
+			if (isClearlyMalformedContextReference(url)) throw new InvalidContextReferenceError(url);
+			throw createLoadingRemoteContextFailedError(url, error);
+		}
+	};
+}
+/** @internal */
+function getNormalizationContextLoader(contextLoader) {
+	const loader = wrapContextLoaderForJsonLd(contextLoader);
+	return createMemoizedDocumentLoader(async (url, options) => {
+		if (URL.canParse(url)) {
+			const normalizedUrl = new URL(url).href;
+			if (localContextUrls.has(normalizedUrl)) return await builtInContextLoader(normalizedUrl, options);
+		}
+		return await loader(url, options);
+	});
+}
+/** @internal */
+async function compactJsonLd(jsonLd, contextLoader) {
+	const hasLds = typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
+	const signature = hasLds ? jsonLd.signature : void 0;
+	const normalizationContextLoader = getNormalizationContextLoader(contextLoader);
+	const document = hasLds ? detachSignature(jsonLd) : jsonLd;
+	await assertNoGraphBeforeCompaction(document, normalizationContextLoader);
+	const compacted = await jsonld.default.compact(document, localContext, { documentLoader: normalizationContextLoader });
+	if (hasLds && typeof compacted === "object" && compacted != null) compacted.signature = signature;
+	assertSafeJsonLd(compacted);
+	return compacted;
+}
+function createInvalidRemoteContextError(reference) {
+	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a JSON object. The response was valid JSON, but it was not a JSON object. URL: "${reference}".`);
+	error.name = "jsonld.InvalidUrl";
+	error.details = {
+		code: "invalid remote context",
+		url: reference
+	};
+	return error;
+}
+function getRemoteContext(remoteDocument, reference) {
+	const { contextUrl, documentUrl } = remoteDocument;
+	let { document } = remoteDocument;
+	if (typeof document === "string") document = JSON.parse(document);
+	if (typeof document !== "object" || document == null || Array.isArray(document)) throw createInvalidRemoteContextError(reference);
+	let context = "@context" in document ? document["@context"] : {};
+	if (contextUrl != null) context = Array.isArray(context) ? [...context, contextUrl] : [context, contextUrl];
+	return {
+		context,
+		baseUrl: documentUrl ?? reference
+	};
+}
+function createGraphAliasContextState() {
+	return {
+		graphTerms: /* @__PURE__ */ new Set(),
+		jsonTerms: /* @__PURE__ */ new Set(),
+		propertyContexts: /* @__PURE__ */ new Map(),
+		termTargets: /* @__PURE__ */ new Map()
+	};
+}
+function cloneGraphAliasContextState(state) {
+	return {
+		graphTerms: new Set(state.graphTerms),
+		jsonTerms: new Set(state.jsonTerms),
+		propertyContexts: new Map(state.propertyContexts),
+		termTargets: new Map(state.termTargets)
+	};
+}
+function resolveContextTarget(target, state) {
+	if (target === "@graph") return target;
+	const mapped = state.termTargets.get(target);
+	if (mapped == null) return target;
+	return mapped;
+}
+function getDirectContextTarget(definition) {
+	if (definition === null) return null;
+	if (typeof definition === "string") return definition;
+	if (typeof definition === "object" && definition != null && "@id" in definition) {
+		const id = definition["@id"];
+		if (id === null) return null;
+		if (typeof id === "string") return id;
+	}
+}
+function isJsonTypedDefinition(definition) {
+	return typeof definition === "object" && definition != null && "@type" in definition && definition["@type"] === "@json";
+}
+function resolveLocalContextTarget(target, state, localTargets, seen = /* @__PURE__ */ new Set()) {
+	if (target === "@graph") return target;
+	if (seen.has(target)) return target;
+	seen.add(target);
+	if (localTargets.has(target)) {
+		const localTarget = localTargets.get(target);
+		return localTarget == null ? target : resolveLocalContextTarget(localTarget, state, localTargets, seen);
+	}
+	return resolveContextTarget(target, state);
+}
+function refreshGraphAliases(state) {
+	state.graphTerms.clear();
+	for (const [term, target] of state.termTargets) if (target === "@graph") state.graphTerms.add(term);
+}
+function normalizeContextReference(reference, baseUrl) {
+	if (baseUrl != null) return new URL(reference, baseUrl).href;
+	return URL.canParse(reference) ? new URL(reference).href : reference;
+}
+/** @internal */
+function isInvalidUrlTypeError(error) {
+	const code = error.code;
+	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+}
+async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
+	if (context === null) return createGraphAliasContextState();
+	let nextState = cloneGraphAliasContextState(state);
+	if (Array.isArray(context)) {
+		for (const item of context) nextState = await applyGraphAliasContext(nextState, item, documentLoader, remoteContextCache, baseUrl, processingContexts);
+		return nextState;
+	}
+	if (typeof context === "string") {
+		const reference = normalizeContextReference(context, baseUrl);
+		const cacheKey = `${baseUrl ?? ""}\n${reference}`;
+		if (processingContexts.has(cacheKey)) return nextState;
+		processingContexts.add(cacheKey);
+		try {
+			let remoteContext = remoteContextCache.get(cacheKey);
+			if (remoteContext == null) {
+				remoteContext = (async () => {
+					try {
+						return getRemoteContext(await documentLoader(reference), reference);
+					} catch (error) {
+						if (reference === context && isInvalidUrlTypeError(error) && isClearlyMalformedContextReference(context)) throw new InvalidContextReferenceError(context);
+						throw error;
+					}
+				})();
+				remoteContextCache.set(cacheKey, remoteContext);
+			}
+			const loadedRemoteContext = await remoteContext;
+			return await applyGraphAliasContext(nextState, loadedRemoteContext.context, documentLoader, remoteContextCache, loadedRemoteContext.baseUrl, processingContexts);
+		} finally {
+			processingContexts.delete(cacheKey);
+		}
+	}
+	if (typeof context === "object" && context != null) {
+		if ("@import" in context && typeof context["@import"] === "string") nextState = await applyGraphAliasContext(nextState, context["@import"], documentLoader, remoteContextCache, baseUrl, processingContexts);
+		const localTargets = /* @__PURE__ */ new Map();
+		for (const [term, definition] of globalThis.Object.entries(context)) {
+			if (term.startsWith("@")) continue;
+			const target = getDirectContextTarget(definition);
+			if (target == null) localTargets.set(term, null);
+			else if (typeof target === "string") localTargets.set(term, target);
+			else localTargets.delete(term);
+		}
+		for (const [term, definition] of globalThis.Object.entries(context)) {
+			if (term.startsWith("@")) continue;
+			if (localTargets.has(term)) {
+				const directTarget = localTargets.get(term);
+				if (directTarget == null) nextState.termTargets.set(term, null);
+				else nextState.termTargets.set(term, resolveLocalContextTarget(directTarget, nextState, localTargets));
+			} else nextState.termTargets.delete(term);
+			if (typeof definition === "object" && definition != null && "@context" in definition) nextState.propertyContexts.set(term, {
+				context: definition["@context"],
+				baseUrl
+			});
+			else nextState.propertyContexts.delete(term);
+			if (isJsonTypedDefinition(definition)) nextState.jsonTerms.add(term);
+			else nextState.jsonTerms.delete(term);
+		}
+		refreshGraphAliases(nextState);
+	}
+	return nextState;
+}
+async function assertNoGraphBeforeCompaction(jsonLd, documentLoader, inheritedState = createGraphAliasContextState(), propertyContext, remoteContextCache = /* @__PURE__ */ new Map()) {
+	if (Array.isArray(jsonLd)) {
+		for (const item of jsonLd) await assertNoGraphBeforeCompaction(item, documentLoader, inheritedState, propertyContext, remoteContextCache);
+		return;
+	}
+	if (typeof jsonLd !== "object" || jsonLd == null) return;
+	const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
+	let state = inheritedState;
+	if (propertyContext !== void 0) state = await applyGraphAliasContext(state, propertyContext.context, documentLoader, remoteContextCache, propertyContext.baseUrl);
+	if ("@context" in jsonLd) state = await applyGraphAliasContext(state, jsonLd["@context"], documentLoader, remoteContextCache);
+	for (const [key, value] of globalThis.Object.entries(jsonLd)) {
+		if (key === "@context") continue;
+		if (jsonLiteralWrapper && key === "@value") continue;
+		if (key === "@graph" || state.graphTerms.has(key)) throw new UnsafeJsonLdError("@graph");
+		if (state.jsonTerms.has(key)) continue;
+		await assertNoGraphBeforeCompaction(value, documentLoader, state, state.propertyContexts.get(key), remoteContextCache);
+	}
+}
+function isJsonLiteralWrapper(value) {
+	return "@value" in value && (value["@type"] === "@json" || value.type === "@json");
+}
+/** @internal */
+function assertSafeJsonLd(jsonLd) {
+	if (Array.isArray(jsonLd)) for (const item of jsonLd) assertSafeJsonLd(item);
+	else if (typeof jsonLd === "object" && jsonLd != null) {
+		const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
+		for (const [key, value] of globalThis.Object.entries(jsonLd)) {
+			if (disallowedJsonLdKeywords.has(key)) throw new UnsafeJsonLdError(key);
+			if (jsonLiteralWrapper && key === "@value") continue;
+			assertSafeJsonLd(value);
+		}
+	}
+}
 /**
 * Attaches a LD signature to the given JSON-LD document.
 * @param jsonLd The JSON-LD document to attach the signature to.  It is not
@@ -210,9 +492,21 @@ async function verifySignature(jsonLd, options = {}) {
 * @returns `true` if the document is authentic; `false` otherwise.
 */
 async function verifyJsonLd(jsonLd, options = {}) {
+	return await verifyJsonLdInternal(jsonLd, options, true);
+}
+/** @internal */
+async function verifyCompactJsonLd(jsonLd, options = {}) {
+	return await verifyJsonLdInternal(jsonLd, options, false);
+}
+async function verifyJsonLdInternal(jsonLd, options, compact) {
 	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(require_docloader.name, require_docloader.version).startActiveSpan("ld_signatures.verify", async (span) => {
 		try {
-			const object = await require_actor.Object.fromJsonLd(jsonLd, options);
+			const verificationOptions = hasSignature(jsonLd) ? {
+				...options,
+				contextLoader: getNormalizationContextLoader(options.contextLoader)
+			} : options;
+			const compacted = compact ? hasSignature(jsonLd) ? await compactJsonLd(jsonLd, options.contextLoader) : jsonLd : jsonLd;
+			const object = await require_actor.Object.fromJsonLd(compacted, verificationOptions);
 			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
 			span.setAttribute("activitypub.object.type", require_actor.getTypeId(object).href);
 			if (typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd && typeof jsonLd.signature === "object" && jsonLd.signature != null) {
@@ -222,7 +516,7 @@ async function verifyJsonLd(jsonLd, options = {}) {
 			}
 			const attributions = new Set(object.attributionIds.map((uri) => uri.href));
 			if (object instanceof require_actor.Activity) for (const uri of object.actorIds) attributions.add(uri.href);
-			const key = await verifySignature(jsonLd, options);
+			const key = await verifySignature(compacted, verificationOptions);
 			if (key == null) return false;
 			if (key.ownerId == null) {
 				logger$1.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
@@ -604,12 +898,30 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	return object;
 }
 //#endregion
+Object.defineProperty(exports, "InvalidContextReferenceError", {
+	enumerable: true,
+	get: function() {
+		return InvalidContextReferenceError;
+	}
+});
+Object.defineProperty(exports, "assertSafeJsonLd", {
+	enumerable: true,
+	get: function() {
+		return assertSafeJsonLd;
+	}
+});
 Object.defineProperty(exports, "attachSignature", {
 	enumerable: true,
 	get: function() {
 		return attachSignature;
 	}
 });
+Object.defineProperty(exports, "compactJsonLd", {
+	enumerable: true,
+	get: function() {
+		return compactJsonLd;
+	}
+});
 Object.defineProperty(exports, "createProof", {
 	enumerable: true,
 	get: function() {
@@ -640,12 +952,30 @@ Object.defineProperty(exports, "getKeyOwner", {
 		return getKeyOwner;
 	}
 });
+Object.defineProperty(exports, "getNormalizationContextLoader", {
+	enumerable: true,
+	get: function() {
+		return getNormalizationContextLoader;
+	}
+});
 Object.defineProperty(exports, "hasSignature", {
 	enumerable: true,
 	get: function() {
 		return hasSignature;
 	}
 });
+Object.defineProperty(exports, "isClearlyMalformedContextReference", {
+	enumerable: true,
+	get: function() {
+		return isClearlyMalformedContextReference;
+	}
+});
+Object.defineProperty(exports, "isInvalidUrlTypeError", {
+	enumerable: true,
+	get: function() {
+		return isInvalidUrlTypeError;
+	}
+});
 Object.defineProperty(exports, "signJsonLd", {
 	enumerable: true,
 	get: function() {
@@ -658,6 +988,12 @@ Object.defineProperty(exports, "signObject", {
 		return signObject;
 	}
 });
+Object.defineProperty(exports, "verifyCompactJsonLd", {
+	enumerable: true,
+	get: function() {
+		return verifyCompactJsonLd;
+	}
+});
 Object.defineProperty(exports, "verifyJsonLd", {
 	enumerable: true,
 	get: function() {
@@ -682,3 +1018,9 @@ Object.defineProperty(exports, "verifySignature", {
 		return verifySignature;
 	}
 });
+Object.defineProperty(exports, "wrapContextLoaderForJsonLd", {
+	enumerable: true,
+	get: function() {
+		return wrapContextLoaderForJsonLd;
+	}
+});

package/dist/{proof-B67QOiuS.mjs → proof-De_2gCxi.mjs}

@@ -1,8 +1,8 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { U as getTypeId, c as DataIntegrityProof, g as Multikey, ot as name, st as version, t as Activity } from "./vocab-C60RNInZ.mjs";
-import { a as validateCryptoKey, n as fetchKey } from "./key-Dnc1ekhA.mjs";
+import { U as getTypeId, c as DataIntegrityProof, g as Multikey, ot as name, st as version, t as Activity } from "./vocab-C0yDmtpE.mjs";
+import { a as validateCryptoKey, n as fetchKey } from "./key-LJoRzwG2.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { encodeHex } from "byte-encodings/hex";

package/dist/runtime/authdocloader.test.mjs

@@ -1,15 +1,15 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { $ as UrlError } from "../vocab-C60RNInZ.mjs";
-import { a as mockDocumentLoader, t as test } from "../testing-zWgaXBJW.mjs";
+import { $ as UrlError } from "../vocab-C0yDmtpE.mjs";
+import { a as mockDocumentLoader, t as test } from "../testing-DskvUSfh.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-2v7gYiZp.mjs";
 import { t as assertRejects } from "../assert_rejects-CJC9ThS-.mjs";
-import { l as verifyRequest } from "../http-D5CDiVKf.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../authdocloader-C7iVUcxr.mjs";
-import { t as esm_default } from "../esm-Bfj-SwEx.mjs";
-import { i as rsaPrivateKey2 } from "../keys-C4Ms2Cy-.mjs";
+import { l as verifyRequest } from "../http-CiqAQGRx.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../authdocloader-DJ-h-WMy.mjs";
+import { t as esm_default } from "../esm-CzaH6D4W.mjs";
+import { i as rsaPrivateKey2 } from "../keys-wZip1i2J.mjs";
 //#region src/runtime/authdocloader.test.ts
 test("getAuthenticatedDocumentLoader()", async (t) => {
 	esm_default.spyGlobal();

package/dist/runtime/docloader.test.mjs

@@ -1,16 +1,16 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { $ as UrlError, G as FetchError, J as getDocumentLoader, X as getUserAgent, Z as kvCache, at as preloadedContexts, st as version } from "../vocab-C60RNInZ.mjs";
-import { a as mockDocumentLoader, t as test } from "../testing-zWgaXBJW.mjs";
+import { $ as UrlError, G as FetchError, J as getDocumentLoader, X as getUserAgent, Z as kvCache, at as preloadedContexts, st as version } from "../vocab-C0yDmtpE.mjs";
+import { a as mockDocumentLoader, t as test } from "../testing-DskvUSfh.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-2v7gYiZp.mjs";
 import { t as assertRejects } from "../assert_rejects-CJC9ThS-.mjs";
 import { t as assertThrows } from "../assert_throws-BIL7gChy.mjs";
 import { t as assert } from "../assert-DikXweDx.mjs";
 import { t as MemoryKvStore } from "../kv-OuT2IU64.mjs";
-import { t as esm_default } from "../esm-Bfj-SwEx.mjs";
-import { t as createTestTracerProvider } from "../otel-0v4Zy01l.mjs";
+import { t as esm_default } from "../esm-CzaH6D4W.mjs";
+import { t as createTestTracerProvider } from "../otel-D00WjYJ1.mjs";
 import process from "node:process";
 //#region src/runtime/docloader.test.ts
 test("new FetchError()", () => {

package/dist/runtime/key.test.mjs

@@ -1,11 +1,11 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { F as importPkcs1, I as importSpki, M as exportSpki, N as importMultibaseKey, P as importPem, j as exportMultibaseKey } from "../vocab-C60RNInZ.mjs";
-import { t as test } from "../testing-zWgaXBJW.mjs";
+import { F as importPkcs1, I as importSpki, M as exportSpki, N as importMultibaseKey, P as importPem, j as exportMultibaseKey } from "../vocab-C0yDmtpE.mjs";
+import { t as test } from "../testing-DskvUSfh.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-2v7gYiZp.mjs";
-import { i as importJwk, t as exportJwk } from "../key-Dnc1ekhA.mjs";
+import { i as importJwk, t as exportJwk } from "../key-LJoRzwG2.mjs";
 //#region src/runtime/key.test.ts
 const rsaSpki = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxsRuvCkgJtflBTl4OVsm\nnt/J1mQfZasfJtN33dcZ3d1lJroxmgmMu69zjGEAwkNbMQaWNLqC4eogkJaeJ4RR\n5MHYXkL9nNilVoTkjX5BVit3puzs7XJ7WQnKQgQMI+ezn24GHsZ/v1JIo77lerX5\nk4HNwTNVt+yaZVQWaOMR3+6FwziQR6kd0VuG9/a9dgAnz2cEoORRC1i4W7IZaB1s\nZnh1WbHbevlGd72HSXll5rocPIHn8gq6xpBgpHwRphlRsgn4KHaJ6brXDIJjrnQh\nIe/YUBOGj/ImSEXhRwlFerKsoAVnZ0Hwbfa46qk44TAt8CyoPMWmpK6pt0ng4pQ2\nuwIDAQAB\n-----END PUBLIC KEY-----\n";
 const rsaPkcs1 = "-----BEGIN RSA PUBLIC KEY-----\nMIIBCgKCAQEAxsRuvCkgJtflBTl4OVsmnt/J1mQfZasfJtN33dcZ3d1lJroxmgmM\nu69zjGEAwkNbMQaWNLqC4eogkJaeJ4RR5MHYXkL9nNilVoTkjX5BVit3puzs7XJ7\nWQnKQgQMI+ezn24GHsZ/v1JIo77lerX5k4HNwTNVt+yaZVQWaOMR3+6FwziQR6kd\n0VuG9/a9dgAnz2cEoORRC1i4W7IZaB1sZnh1WbHbevlGd72HSXll5rocPIHn8gq6\nxpBgpHwRphlRsgn4KHaJ6brXDIJjrnQhIe/YUBOGj/ImSEXhRwlFerKsoAVnZ0Hw\nbfa46qk44TAt8CyoPMWmpK6pt0ng4pQ2uwIDAQAB\n-----END RSA PUBLIC KEY-----\n";

package/dist/runtime/langstr.test.mjs

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { A as LanguageString } from "../vocab-C60RNInZ.mjs";
-import { t as test } from "../testing-zWgaXBJW.mjs";
+import { A as LanguageString } from "../vocab-C0yDmtpE.mjs";
+import { t as test } from "../testing-DskvUSfh.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-2v7gYiZp.mjs";
 import { parseLanguageTag } from "@phensley/language-tag";

package/dist/runtime/link.test.mjs

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { it as HttpHeaderLink } from "../vocab-C60RNInZ.mjs";
-import { t as test } from "../testing-zWgaXBJW.mjs";
+import { it as HttpHeaderLink } from "../vocab-C0yDmtpE.mjs";
+import { t as test } from "../testing-DskvUSfh.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 //#region src/runtime/link.test.ts
 test("String Good 1", () => {

package/dist/runtime/mod.cjs

@@ -1,9 +1,9 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_docloader = require("../docloader-9cG6ESUw.cjs");
-const require_actor = require("../actor-DSmY7of0.cjs");
-const require_authdocloader = require("../authdocloader-YXazGK4I.cjs");
+const require_docloader = require("../docloader-CvMstYam.cjs");
+const require_actor = require("../actor--xTQfY8h.cjs");
+const require_authdocloader = require("../authdocloader-DMkkNwRc.cjs");
 exports.FetchError = require_docloader.FetchError;
 exports.LanguageString = require_actor.LanguageString;
 exports.exportMultibaseKey = require_actor.exportMultibaseKey;

package/dist/runtime/mod.js

@@ -1,6 +1,6 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
-import { i as getDocumentLoader, o as getUserAgent, r as fetchDocumentLoader, s as kvCache, t as FetchError } from "../docloader-DXUkyjIx.js";
-import { Ct as importPkcs1, St as importPem, bt as exportSpki, vt as LanguageString, wt as importSpki, xt as importMultibaseKey, yt as exportMultibaseKey } from "../actor-CMBXPdjk.js";
-import { t as getAuthenticatedDocumentLoader } from "../authdocloader-B4QKchy5.js";
+import { i as getDocumentLoader, o as getUserAgent, r as fetchDocumentLoader, s as kvCache, t as FetchError } from "../docloader-Ca6-eCr_.js";
+import { Ct as importPkcs1, St as importPem, bt as exportSpki, vt as LanguageString, wt as importSpki, xt as importMultibaseKey, yt as exportMultibaseKey } from "../actor-B7XRaa54.js";
+import { t as getAuthenticatedDocumentLoader } from "../authdocloader-_h7VKnUP.js";
 export { FetchError, LanguageString, exportMultibaseKey, exportSpki, fetchDocumentLoader, getAuthenticatedDocumentLoader, getDocumentLoader, getUserAgent, importMultibaseKey, importPem, importPkcs1, importSpki, kvCache };

package/dist/runtime/multibase/multibase.test.mjs

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { B as names, H as encodeText, L as decode, R as encode, V as decodeText, z as codes } from "../../vocab-C60RNInZ.mjs";
-import { t as test } from "../../testing-zWgaXBJW.mjs";
+import { B as names, H as encodeText, L as decode, R as encode, V as decodeText, z as codes } from "../../vocab-C0yDmtpE.mjs";
+import { t as test } from "../../testing-DskvUSfh.mjs";
 import { t as assertEquals } from "../../assert_equals-Ew3jOFa3.mjs";
 import "../../std__assert-2v7gYiZp.mjs";
 //#region src/runtime/multibase/multibase.test.ts

package/dist/runtime/url.test.mjs

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { $ as UrlError, et as expandIPv6Address, nt as isValidPublicIPv6Address, rt as validatePublicUrl, tt as isValidPublicIPv4Address } from "../vocab-C60RNInZ.mjs";
-import { t as test } from "../testing-zWgaXBJW.mjs";
+import { $ as UrlError, et as expandIPv6Address, nt as isValidPublicIPv6Address, rt as validatePublicUrl, tt as isValidPublicIPv4Address } from "../vocab-C0yDmtpE.mjs";
+import { t as test } from "../testing-DskvUSfh.mjs";
 import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import { n as assertFalse, t as assertRejects } from "../assert_rejects-CJC9ThS-.mjs";
 import { t as assert } from "../assert-DikXweDx.mjs";
@@ -14,7 +14,24 @@ test("validatePublicUrl()", async () => {
 	await assertRejects(() => validatePublicUrl("https://127.0.0.1"), UrlError);
 	await assertRejects(() => validatePublicUrl("https://[::1]"), UrlError);
 	await assertRejects(() => validatePublicUrl("http://[::ffff:7f00:1]/"), UrlError);
+	await assertRejects(() => validatePublicUrl("https://[64:ff9b::7f00:1]/"), UrlError);
+	await assertRejects(() => validatePublicUrl("https://[64:ff9b::a00:1]/"), UrlError);
+	await assertRejects(() => validatePublicUrl("https://[64:ff9b:1::a00:1]/"), UrlError);
+	await assertRejects(() => validatePublicUrl("https://[64:ff9b:1::808:808]/"), UrlError);
+	await assertRejects(() => validatePublicUrl("https://[2001::]/"), UrlError);
+	await assertRejects(() => validatePublicUrl("https://[2002:a00:1::]/"), UrlError);
+	for (const url of [
+		"https://100.64.0.1",
+		"https://198.18.0.1",
+		"https://224.0.0.1",
+		"https://240.0.0.1",
+		"https://192.0.2.1",
+		"https://192.88.99.1",
+		"https://198.51.100.1",
+		"https://203.0.113.1"
+	]) await assertRejects(() => validatePublicUrl(url), UrlError);
 	await validatePublicUrl("https://[2001:db8::1]");
+	await validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
 test("isValidPublicIPv4Address()", () => {
 	assert(isValidPublicIPv4Address("8.8.8.8"));
@@ -23,6 +40,24 @@ test("isValidPublicIPv4Address()", () => {
 	assertFalse(isValidPublicIPv4Address("10.0.0.1"));
 	assertFalse(isValidPublicIPv4Address("127.16.0.1"));
 	assertFalse(isValidPublicIPv4Address("169.254.0.1"));
+	assertFalse(isValidPublicIPv4Address("100.64.0.1"));
+	assertFalse(isValidPublicIPv4Address("100.127.255.255"));
+	assertFalse(isValidPublicIPv4Address("192.0.0.1"));
+	assertFalse(isValidPublicIPv4Address("192.0.2.1"));
+	assertFalse(isValidPublicIPv4Address("192.88.99.0"));
+	assertFalse(isValidPublicIPv4Address("192.88.99.1"));
+	assertFalse(isValidPublicIPv4Address("192.88.99.2"));
+	assertFalse(isValidPublicIPv4Address("192.88.99.255"));
+	assertFalse(isValidPublicIPv4Address("198.18.0.1"));
+	assertFalse(isValidPublicIPv4Address("198.19.255.255"));
+	assertFalse(isValidPublicIPv4Address("198.51.100.1"));
+	assertFalse(isValidPublicIPv4Address("203.0.113.1"));
+	assertFalse(isValidPublicIPv4Address("224.0.0.1"));
+	assertFalse(isValidPublicIPv4Address("239.255.255.255"));
+	assertFalse(isValidPublicIPv4Address("240.0.0.1"));
+	assertFalse(isValidPublicIPv4Address("255.255.255.255"));
+	assertFalse(isValidPublicIPv4Address("1.2.3"));
+	assertFalse(isValidPublicIPv4Address("999.1.1.1"));
 });
 test("isValidPublicIPv6Address()", () => {
 	assert(isValidPublicIPv6Address("2001:db8::1"));
@@ -32,12 +67,28 @@ test("isValidPublicIPv6Address()", () => {
 	assertFalse(isValidPublicIPv6Address("ff00::1"));
 	assertFalse(isValidPublicIPv6Address("::"));
 	assertFalse(isValidPublicIPv6Address("::ffff:7f00:1"));
+	assertFalse(isValidPublicIPv6Address("64:ff9b::7f00:1"));
+	assertFalse(isValidPublicIPv6Address("64:ff9b::127.0.0.1"));
+	assertFalse(isValidPublicIPv6Address("64:ff9b::a00:1"));
+	assertFalse(isValidPublicIPv6Address("64:ff9b::10.0.0.1"));
+	assertFalse(isValidPublicIPv6Address("64:ff9b:1::"));
+	assertFalse(isValidPublicIPv6Address("64:ff9b:1::a00:1"));
+	assertFalse(isValidPublicIPv6Address("64:ff9b:1::10.0.0.1"));
+	assertFalse(isValidPublicIPv6Address("2001::"));
+	assertFalse(isValidPublicIPv6Address("2001:0:4136:e378:8000:63bf:3fff:fdd2"));
+	assertFalse(isValidPublicIPv6Address("2002:a00:1::"));
+	assertFalse(isValidPublicIPv6Address("2002:7f00:1::"));
+	assertFalse(isValidPublicIPv6Address("2002:c0a8:1::"));
+	assertFalse(isValidPublicIPv6Address("2002:a9fe:1::"));
+	assert(isValidPublicIPv6Address("64:ff9b::808:808"));
+	assert(isValidPublicIPv6Address("64:ff9b::8.8.8.8"));
 });
 test("expandIPv6Address()", () => {
 	assertEquals(expandIPv6Address("::"), "0000:0000:0000:0000:0000:0000:0000:0000");
 	assertEquals(expandIPv6Address("::1"), "0000:0000:0000:0000:0000:0000:0000:0001");
 	assertEquals(expandIPv6Address("2001:db8::"), "2001:0db8:0000:0000:0000:0000:0000:0000");
 	assertEquals(expandIPv6Address("2001:db8::1"), "2001:0db8:0000:0000:0000:0000:0000:0001");
+	assertEquals(expandIPv6Address("64:ff9b::8.8.8.8"), "0064:ff9b:0000:0000:0000:0000:0808:0808");
 });
 //#endregion
 export {};

package/dist/{send-7RGxOhrY.mjs → send-C7irF8CJ.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { ot as name, st as version } from "./vocab-C60RNInZ.mjs";
-import { n as doubleKnock } from "./http-D5CDiVKf.mjs";
+import { ot as name, st as version } from "./vocab-C0yDmtpE.mjs";
+import { n as doubleKnock } from "./http-CiqAQGRx.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region src/federation/send.ts