@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/utils/docloader.test.mjs

@@ -1,15 +1,18 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { t as esm_default } from "../esm-yYQfPhIY.mjs";
-import { t as assertEquals } from "../assert_equals-BV7oLMxm.mjs";
-import "../std__assert-B2NnY9bq.mjs";
-import { t as assertRejects } from "../assert_rejects-EgstcQy5.mjs";
-import { l as verifyRequest } from "../http-CPVMUgsW.mjs";
-import { i as rsaPrivateKey2 } from "../keys-Dbyd7bhl.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-e1khNUKy.mjs";
+import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
+import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
+import "../std__assert-DvMDRPes.mjs";
+import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
+import { f as verifyRequest } from "../http-siciWkmx.mjs";
+import { i as rsaPrivateKey2 } from "../keys-DIJNHW-Y.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-DBoYbvYW.mjs";
+import { configure, reset } from "@logtape/logtape";
+import { FetchError, UrlError } from "@fedify/vocab-runtime";
 import { mockDocumentLoader, test } from "@fedify/fixture";
-import { UrlError } from "@fedify/vocab-runtime";
+import dns from "node:dns/promises";
+import { deepStrictEqual, ok, rejects } from "node:assert/strict";
 //#region src/utils/docloader.test.ts
 test("getAuthenticatedDocumentLoader()", async (t) => {
 	esm_default.spyGlobal();
@@ -63,6 +66,39 @@ test("getAuthenticatedDocumentLoader()", async (t) => {
 		esm_default.hardReset();
 	});
 });
+test("getAuthenticatedDocumentLoader() validates redirects", async (t) => {
+	esm_default.spyGlobal();
+	let privateRequestCount = 0;
+	esm_default.get("https://example.com/redirect-to-private", () => Response.redirect("http://localhost/private", 302));
+	esm_default.get("http://localhost/private", () => {
+		privateRequestCount++;
+		return Response.json({ private: true });
+	});
+	await t.step("deny public-to-private redirects", async () => {
+		const loader = getAuthenticatedDocumentLoader({
+			keyId: new URL("https://example.com/key2"),
+			privateKey: rsaPrivateKey2
+		});
+		await assertRejects(() => loader("https://example.com/redirect-to-private"), UrlError);
+		assertEquals(privateRequestCount, 0);
+	});
+	esm_default.get("https://example.com/redirect-to-public", () => Response.redirect("https://www.example.com/document", 302));
+	esm_default.get("https://www.example.com/document", () => Response.json({ public: true }));
+	await t.step("allow public-to-public redirects", async () => {
+		assertEquals((await getAuthenticatedDocumentLoader({
+			keyId: new URL("https://example.com/key2"),
+			privateKey: rsaPrivateKey2
+		})("https://example.com/redirect-to-public")).document, { public: true });
+	});
+	await t.step("allow private redirects when explicitly enabled", async () => {
+		assertEquals((await getAuthenticatedDocumentLoader({
+			keyId: new URL("https://example.com/key2"),
+			privateKey: rsaPrivateKey2
+		}, { allowPrivateAddress: true })("https://example.com/redirect-to-private")).document, { private: true });
+		assertEquals(privateRequestCount, 1);
+	});
+	esm_default.hardReset();
+});
 test("getAuthenticatedDocumentLoader() cancellation", {
 	sanitizeResources: false,
 	sanitizeOps: false
@@ -103,5 +139,491 @@ test("getAuthenticatedDocumentLoader() cancellation", {
 	});
 	esm_default.hardReset();
 });
+test("getAuthenticatedDocumentLoader() bounds JSON after redirects", async () => {
+	esm_default.mockGlobal();
+	let oversized = true;
+	try {
+		const url = "https://example.com/bounded";
+		esm_default.get(url, {
+			status: 302,
+			headers: { Location: `${url}/document` }
+		});
+		esm_default.get(`${url}/document`, () => new Response("{\"name\":\"hello\"}", { headers: {
+			"Content-Type": "application/activity+json",
+			...oversized ? { "Content-Length": String(16777217) } : {}
+		} }));
+		const loader = getAuthenticatedDocumentLoader({
+			privateKey: rsaPrivateKey2,
+			keyId: new URL("https://example.com/key2")
+		}, { allowPrivateAddress: true });
+		await assertRejects(() => loader(url), FetchError);
+		oversized = false;
+		assertEquals((await loader(url)).document, { name: "hello" });
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("authenticated document loader suppresses HTTP failure logs", async () => {
+	const records = [];
+	const url = "https://example.com/missing-authenticated-document";
+	const loader = getAuthenticatedDocumentLoader({
+		keyId: new URL("https://example.com/key2"),
+		privateKey: rsaPrivateKey2
+	}, { allowPrivateAddress: true });
+	await reset();
+	await configure({
+		sinks: { capture: (record) => records.push(record) },
+		loggers: [{
+			category: ["fedify"],
+			lowestLevel: "debug",
+			sinks: ["capture"]
+		}]
+	});
+	esm_default.mockGlobal();
+	esm_default.get(url, { status: 404 });
+	try {
+		for (const suppressError of [
+			true,
+			false,
+			void 0
+		]) {
+			records.length = 0;
+			assertEquals((await assertRejects(() => loader(url, { suppressError }), FetchError)).response?.status, 404);
+			const failures = records.filter((record) => record.rawMessage === "Failed to fetch document: {status} {url} {headers}");
+			assertEquals(failures.length, 1);
+			assertEquals(failures[0].level, suppressError ? "warning" : "error");
+			if (suppressError) assertEquals(records.filter((record) => record.level === "error"), []);
+		}
+	} finally {
+		esm_default.hardReset();
+		await reset();
+	}
+});
+test("authenticated document loader suppresses private URL logs", async () => {
+	const records = [];
+	const loader = getAuthenticatedDocumentLoader({
+		keyId: new URL("https://example.com/key2"),
+		privateKey: rsaPrivateKey2
+	});
+	await reset();
+	await configure({
+		sinks: { capture: (record) => {
+			records.push(record);
+		} },
+		loggers: [{
+			category: ["fedify"],
+			lowestLevel: "debug",
+			sinks: ["capture"]
+		}]
+	});
+	esm_default.spyGlobal();
+	let requests = 0;
+	esm_default.get("https://example.com/private-redirect", () => {
+		requests++;
+		return Response.redirect("http://127.0.0.1/private", 302);
+	});
+	try {
+		for (const url of ["http://127.0.0.1/private", "https://example.com/private-redirect"]) for (const suppressError of [
+			true,
+			false,
+			void 0
+		]) {
+			records.length = 0;
+			requests = 0;
+			await assertRejects(() => loader(url, { suppressError }), UrlError);
+			const failures = records.filter((r) => r.rawMessage === "Disallowed private URL: {url}");
+			assertEquals(failures.length, 1);
+			assertEquals(failures[0].level, suppressError ? "warning" : "error");
+			assertEquals(requests, url.startsWith("http://127") ? 0 : 1);
+		}
+	} finally {
+		esm_default.hardReset();
+		await reset();
+	}
+});
+test("getAuthenticatedDocumentLoader() logs DNS failures as such", { ignore: "Deno" in globalThis && (await Deno.permissions.query({ name: "net" })).state !== "granted" }, async (t) => {
+	const loader = getAuthenticatedDocumentLoader({
+		keyId: new URL("https://example.com/key2"),
+		privateKey: rsaPrivateKey2
+	});
+	for (const result of [
+		"throws",
+		"empty",
+		"private"
+	]) await t.step(result, async () => {
+		const originalLookup = dns.lookup;
+		dns.lookup = (() => result === "throws" ? Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")) : Promise.resolve(result === "empty" ? [] : [{
+			address: "127.0.0.1",
+			family: 4
+		}]));
+		const records = [];
+		await configure({
+			sinks: { buffer: (record) => records.push(record) },
+			loggers: [{
+				category: "fedify",
+				sinks: ["buffer"],
+				lowestLevel: "debug"
+			}, {
+				category: ["logtape", "meta"],
+				sinks: []
+			}],
+			reset: true
+		});
+		try {
+			const url = "https://dns-failure.invalid/object";
+			const error = await assertRejects(() => loader(url), UrlError);
+			assertEquals(error.reason, result === "private" ? "disallowed" : "dns");
+			assertEquals(records.map((r) => [
+				r.level,
+				r.rawMessage,
+				r.properties.url
+			]), [result === "private" ? [
+				"error",
+				"Disallowed private URL: {url}",
+				url
+			] : [
+				"debug",
+				"DNS lookup failed for {url}",
+				url
+			]]);
+			assertEquals(records[0].properties.error, error);
+		} finally {
+			await reset();
+			dns.lookup = originalLookup;
+		}
+	});
+});
+test("getAuthenticatedDocumentLoader() bounds alternate document chains", async (t) => {
+	const base = "https://example.com/alternate-chain/";
+	const loader = getAuthenticatedDocumentLoader({
+		keyId: new URL("https://example.com/key2"),
+		privateKey: rsaPrivateKey2
+	}, { allowPrivateAddress: true });
+	for (const mode of [
+		"header",
+		"html",
+		"mixed"
+	]) for (const hops of [20, 21]) await t.step(`${mode}: ${hops} hops`, async () => {
+		esm_default.mockGlobal();
+		let requests = 0;
+		esm_default.get(`begin:${base}`, ({ url }) => {
+			requests++;
+			const index = Number(new URL(url).pathname.split("/").at(-1));
+			if (index === hops || requests > 30) return Response.json({ done: true });
+			const next = `${base}${index + 1}`;
+			if (mode === "mixed" && index % 2 === 1) return Response.redirect(next, 302);
+			return alternate(next, mode === "html");
+		});
+		try {
+			if (hops === 20) deepStrictEqual((await loader(`${base}0`)).document, { done: true });
+			else await rejects(loader(`${base}0`), (error) => {
+				ok(error instanceof FetchError);
+				ok(error.message.includes("Too many redirections (21)"));
+				return true;
+			});
+			deepStrictEqual(requests, 21);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	for (const mode of [
+		"header",
+		"html",
+		"alternate-redirect",
+		"redirect-alternate",
+		"redirect-intermediate"
+	]) await t.step(`${mode}: cycle`, async () => {
+		esm_default.mockGlobal();
+		let requests = 0;
+		esm_default.get(`begin:${base}`, ({ url }) => {
+			requests++;
+			if (requests > 30) return Response.json({ stopped: true });
+			const index = Number(new URL(url).pathname.split("/").at(-1));
+			const next = `${base}${mode === "redirect-intermediate" ? index === 0 ? 1 : index === 1 ? 2 : 1 : 1 - index}`;
+			if (mode === "alternate-redirect" && index === 1 || (mode === "redirect-alternate" || mode === "redirect-intermediate") && index === 0) return Response.redirect(next, 302);
+			return alternate(next, mode === "html");
+		});
+		try {
+			await rejects(loader(`${base}0`), (error) => {
+				ok(error instanceof FetchError);
+				ok(error.message.includes("Redirect loop detected:"));
+				return true;
+			});
+			deepStrictEqual(requests, mode === "redirect-intermediate" ? 3 : 2);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	await t.step("alternate followed by 20 redirects shares the limit", async () => {
+		esm_default.mockGlobal();
+		let requests = 0;
+		esm_default.get(`begin:${base}`, ({ url }) => {
+			requests++;
+			const index = Number(new URL(url).pathname.split("/").at(-1));
+			if (index === 21) return Response.json({ done: true });
+			return index === 0 ? alternate(`${base}1`, false) : Response.redirect(`${base}${index + 1}`, 302);
+		});
+		try {
+			await rejects(loader(`${base}0`), (error) => {
+				ok(error instanceof FetchError);
+				ok(error.message.includes("Too many redirections (21)"));
+				return true;
+			});
+			deepStrictEqual(requests, 21);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	await t.step("relative alternate after redirect and isolated calls", async () => {
+		esm_default.mockGlobal();
+		esm_default.get(`${base}start`, Response.redirect(`${base}html`, 302));
+		esm_default.get(`${base}html`, alternate("./document", true));
+		esm_default.get(`${base}document`, Response.json({ done: true }));
+		try {
+			for (let i = 0; i < 2; i++) {
+				const results = await Promise.all([loader(`${base}start`), loader(`${base}start`)]);
+				for (const result of results) {
+					deepStrictEqual(result.document, { done: true });
+					deepStrictEqual(result.documentUrl, `${base}document`);
+				}
+			}
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	function alternate(next, html) {
+		return html ? new Response(`<link rel="alternate" type="application/activity+json" href="${next}">`, { headers: { "Content-Type": "text/html" } }) : new Response("not JSON", { headers: {
+			"Content-Type": "text/plain",
+			Link: `<${next}>; rel="alternate"; type="application/activity+json"`
+		} });
+	}
+});
+test("getAuthenticatedDocumentLoader() preserves cancellation across alternates", async (t) => {
+	const base = "https://example.com/alternate-abort/";
+	const loader = getAuthenticatedDocumentLoader({
+		keyId: new URL("https://example.com/key2"),
+		privateKey: rsaPrivateKey2
+	}, { allowPrivateAddress: true });
+	for (const html of [false, true]) await t.step(html ? "HTML" : "Link header", async () => {
+		esm_default.mockGlobal();
+		const controller = new AbortController();
+		const reason = /* @__PURE__ */ new Error("Alternate document loading cancelled");
+		let requests = 0;
+		esm_default.get(`begin:${base}`, ({ url }) => {
+			requests++;
+			const index = Number(new URL(url).pathname.split("/").at(-1));
+			if (index === 2) return Response.json({ done: true });
+			if (index === 1) controller.abort(reason);
+			const next = `${base}${index + 1}`;
+			return new Response(html ? `<link rel="alternate" type="application/activity+json" href="${next}">` : "not JSON", { headers: html ? { "Content-Type": "text/html" } : {
+				"Content-Type": "text/plain",
+				Link: `<${next}>; rel="alternate"; type="application/activity+json"`
+			} });
+		});
+		try {
+			await rejects(loader(`${base}0`, { signal: controller.signal }), (error) => {
+				ok(error === reason);
+				return true;
+			});
+			deepStrictEqual(requests, 2);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
+test("getAuthenticatedDocumentLoader() tracks fallback redirects after alternates", async () => {
+	esm_default.mockGlobal();
+	let requests = 0;
+	let knocks = 0;
+	const first = "https://example.com/fallback-alternate/a";
+	const second = "https://example.com/fallback-alternate/b";
+	esm_default.get(first, () => {
+		requests++;
+		if (requests > 30) return Response.json({ stopped: true });
+		return new Response("", { headers: {
+			"Content-Type": "text/plain",
+			Link: `<${second}>; rel="alternate"; type="application/activity+json"`
+		} });
+	});
+	esm_default.get(second, () => {
+		requests++;
+		return ++knocks % 2 === 1 ? new Response("", { status: 401 }) : Response.redirect(first, 302);
+	});
+	try {
+		const loader = getAuthenticatedDocumentLoader({
+			keyId: new URL("https://example.com/key2"),
+			privateKey: rsaPrivateKey2
+		}, { allowPrivateAddress: true });
+		await assertRejects(() => loader(first), FetchError, "Redirect loop detected:");
+		assertEquals(requests, 3);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("getAuthenticatedDocumentLoader() resolves relative alternates without response URLs", async () => {
+	const originalFetch = globalThis.fetch;
+	const base = "https://example.com/empty-response-url/";
+	const urls = [];
+	globalThis.fetch = (input) => {
+		const url = input instanceof Request ? input.url : String(input);
+		urls.push(url);
+		if (url === `${base}start`) return Promise.resolve(Response.redirect(`${base}nested/page`, 302));
+		if (url === `${base}nested/page`) return Promise.resolve(new Response("<link rel=\"alternate\" type=\"application/activity+json\" href=\"document\">", { headers: { "Content-Type": "text/html" } }));
+		assertEquals(url, `${base}nested/document`);
+		return Promise.resolve(Response.json({ done: true }));
+	};
+	try {
+		assertEquals(await getAuthenticatedDocumentLoader({
+			keyId: new URL("https://example.com/key2"),
+			privateKey: rsaPrivateKey2
+		}, { allowPrivateAddress: true })(`${base}start`), {
+			contextUrl: null,
+			document: { done: true },
+			documentUrl: `${base}nested/document`
+		});
+		assertEquals(urls, [
+			`${base}start`,
+			`${base}nested/page`,
+			`${base}nested/document`
+		]);
+	} finally {
+		globalThis.fetch = originalFetch;
+	}
+});
+test("getAuthenticatedDocumentLoader() validates alternate addresses", async () => {
+	esm_default.mockGlobal();
+	let privateRequests = 0;
+	const url = "https://8.8.8.8/alternate";
+	esm_default.get(url, new Response("", { headers: {
+		"Content-Type": "text/plain",
+		Link: "<http://127.0.0.1/private>; rel=\"alternate\"; type=\"application/activity+json\""
+	} }));
+	esm_default.get("http://127.0.0.1/private", () => {
+		privateRequests++;
+		return Response.json({ private: true });
+	});
+	try {
+		const loader = getAuthenticatedDocumentLoader({
+			keyId: new URL("https://example.com/key2"),
+			privateKey: rsaPrivateKey2
+		});
+		await assertRejects(() => loader(url), UrlError);
+		assertEquals(privateRequests, 0);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("getAuthenticatedDocumentLoader() rejects cancellation before fetching", async () => {
+	esm_default.mockGlobal();
+	let requests = 0;
+	const url = "https://example.com/pre-aborted-alternate";
+	esm_default.get(url, () => {
+		requests++;
+		return Response.json({ done: true });
+	});
+	try {
+		const loader = getAuthenticatedDocumentLoader({
+			keyId: new URL("https://example.com/key2"),
+			privateKey: rsaPrivateKey2
+		}, { allowPrivateAddress: true });
+		const controller = new AbortController();
+		controller.abort();
+		await rejects(loader(url, { signal: controller.signal }), { name: "AbortError" });
+		deepStrictEqual(requests, 0);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+function assertTimeoutFetchError(error, url) {
+	ok(error instanceof FetchError, String(error));
+	deepStrictEqual(error.url.href, url);
+	deepStrictEqual(error.response, void 0);
+	ok(error.cause instanceof DOMException);
+	deepStrictEqual(error.cause.name, "TimeoutError");
+	return true;
+}
+test("getAuthenticatedDocumentLoader() times out", async (t) => {
+	const identity = {
+		keyId: new URL("https://example.com/key2"),
+		privateKey: rsaPrivateKey2
+	};
+	const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+	await t.step("a request without a response", async () => {
+		esm_default.mockGlobal();
+		const url = "https://example.com/hang";
+		esm_default.get(url, () => new Promise(() => {}));
+		try {
+			await rejects(getAuthenticatedDocumentLoader(identity, {
+				allowPrivateAddress: true,
+				timeout: 100
+			})(url), (e) => assertTimeoutFetchError(e, url));
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	await t.step("double-knocking shares the timeout", async () => {
+		esm_default.mockGlobal();
+		const url = "https://example.com/double-knock";
+		let requests = 0;
+		esm_default.get(url, async () => {
+			requests++;
+			await delay(200);
+			return new Response(null, { status: 401 });
+		});
+		try {
+			await rejects(getAuthenticatedDocumentLoader(identity, {
+				allowPrivateAddress: true,
+				timeout: 300
+			})(url), (e) => assertTimeoutFetchError(e, url));
+			deepStrictEqual(requests, 2);
+			await delay(250);
+			deepStrictEqual(requests, 2);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	for (const step of ["determineSpec", "rememberSpec"]) await t.step(`a slow ${step}()`, async () => {
+		esm_default.mockGlobal();
+		const url = `https://example.com/slow-${step}`;
+		let requests = 0;
+		esm_default.get(url, () => {
+			requests++;
+			return Response.json({ parsed: true });
+		});
+		try {
+			await rejects(getAuthenticatedDocumentLoader(identity, {
+				allowPrivateAddress: true,
+				timeout: 50,
+				specDeterminer: {
+					async determineSpec() {
+						if (step === "determineSpec") await delay(150);
+						return "rfc9421";
+					},
+					async rememberSpec() {
+						if (step === "rememberSpec") await delay(150);
+					}
+				}
+			})(url), (e) => assertTimeoutFetchError(e, url));
+			await delay(200);
+			deepStrictEqual(requests, step === "determineSpec" ? 0 : 1);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+	await t.step("the caller's signal still aborts", async () => {
+		esm_default.mockGlobal();
+		const url = "https://example.com/hang";
+		esm_default.get(url, () => new Promise(() => {}));
+		try {
+			const loader = getAuthenticatedDocumentLoader(identity, { allowPrivateAddress: true });
+			const controller = new AbortController();
+			const reason = /* @__PURE__ */ new Error("Canceled by the caller");
+			setTimeout(() => controller.abort(reason), 50);
+			await rejects(loader(url, { signal: controller.signal }), (e) => e === reason);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
 //#endregion
 export {};

package/dist/utils/kv-cache.test.mjs

@@ -1,10 +1,10 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-KyGqJqSp.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-BF1hnW65.mjs";
+import { preloadedContexts } from "@fedify/vocab-runtime";
 import { deepStrictEqual, throws } from "node:assert";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
-import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.test.ts
 test("kvCache()", async (t) => {
 	const kv = new MockKvStore();

package/dist/utils/mod.cjs

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-DQ29C4XL.cjs");
+const require_kv_cache = require("../kv-cache-DCac1nEU.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.d.cts

@@ -1,3 +1,3 @@
 /// <reference lib="esnext.temporal" />
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-BtEaIEcD.cjs";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-Dw-nPxQh.cjs";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.d.ts

@@ -1,3 +1,3 @@
 /// <reference lib="esnext.temporal" />
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-UMmveiO0.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-DEZXwV6J.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-5bnX3-Jq.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-CTQr1tbn.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/verification-C3954hQh.mjs

@@ -0,0 +1,5 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { a as verificationObservation, r as snapshotKey } from "./verification-Dpfcw8ml.mjs";
+export { snapshotKey, verificationObservation };