@fedify/fedify 2.4.5-dev.2462 → 2.4.6-dev.2628

package/dist/utils/docloader.test.mjs

@@ -5,15 +5,30 @@ import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { f as verifyRequest } from "../http-D7L2pqLT.mjs";
+import { p as verifyRequest } from "../http-BSARoDPh.mjs";
 import { i as rsaPrivateKey2 } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-DQNRDYDb.mjs";
+import { n as getAuthenticatedDocumentLoader, t as createAuthenticatedDocumentLoader } from "../docloader-BhVNi06k.mjs";
 import { configure, reset } from "@logtape/logtape";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";
 import { mockDocumentLoader, test } from "@fedify/fixture";
-import dns from "node:dns/promises";
+import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";
 import { deepStrictEqual, ok, rejects } from "node:assert/strict";
 //#region src/utils/docloader.test.ts
+const identity = {
+	keyId: new URL("https://example.com/key2"),
+	privateKey: rsaPrivateKey2
+};
+const directDeps = { openHop: openDirectFetch };
+function publicPolicyHop(lookup) {
+	return async (url) => {
+		await (await openPublicFetch(url, { lookup })).close();
+		return openDirectFetch(url);
+	};
+}
+const publicLookup = () => Promise.resolve([{
+	address: "8.8.8.8",
+	family: 4
+}]);
 test("getAuthenticatedDocumentLoader()", async (t) => {
 	esm_default.spyGlobal();
 	esm_default.get("begin:https://example.com/object", async (cl) => {
@@ -25,10 +40,7 @@ test("getAuthenticatedDocumentLoader()", async (t) => {
 		return new Response(JSON.stringify(v != null), { headers: { "Content-Type": "application/json" } });
 	});
 	await t.step("test", async () => {
-		assertEquals(await (await getAuthenticatedDocumentLoader({
-			keyId: new URL("https://example.com/key2"),
-			privateKey: rsaPrivateKey2
-		}))("https://example.com/object"), {
+		assertEquals(await createAuthenticatedDocumentLoader(identity, {}, directDeps)("https://example.com/object"), {
 			contextUrl: null,
 			documentUrl: "https://example.com/object",
 			document: true
@@ -57,10 +69,10 @@ test("getAuthenticatedDocumentLoader()", async (t) => {
 			const index = Number(cl.url.split("/").at(-1));
 			return Response.redirect(`https://example.com/custom-too-many-redirects/${index + 1}`, 302);
 		});
-		const loader = getAuthenticatedDocumentLoader({
+		const loader = createAuthenticatedDocumentLoader({
 			keyId: new URL("https://example.com/key2"),
 			privateKey: rsaPrivateKey2
-		}, { maxRedirection: 1 });
+		}, { maxRedirection: 1 }, directDeps);
 		await assertRejects(() => loader("https://example.com/custom-too-many-redirects/0"), Error, "Too many redirections");
 		assertEquals(requestCount, 2);
 		esm_default.hardReset();
@@ -74,21 +86,16 @@ test("getAuthenticatedDocumentLoader() validates redirects", async (t) => {
 		privateRequestCount++;
 		return Response.json({ private: true });
 	});
+	const policyDeps = { openHop: publicPolicyHop(publicLookup) };
 	await t.step("deny public-to-private redirects", async () => {
-		const loader = getAuthenticatedDocumentLoader({
-			keyId: new URL("https://example.com/key2"),
-			privateKey: rsaPrivateKey2
-		});
+		const loader = createAuthenticatedDocumentLoader(identity, {}, policyDeps);
 		await assertRejects(() => loader("https://example.com/redirect-to-private"), UrlError);
 		assertEquals(privateRequestCount, 0);
 	});
 	esm_default.get("https://example.com/redirect-to-public", () => Response.redirect("https://www.example.com/document", 302));
 	esm_default.get("https://www.example.com/document", () => Response.json({ public: true }));
 	await t.step("allow public-to-public redirects", async () => {
-		assertEquals((await getAuthenticatedDocumentLoader({
-			keyId: new URL("https://example.com/key2"),
-			privateKey: rsaPrivateKey2
-		})("https://example.com/redirect-to-public")).document, { public: true });
+		assertEquals((await createAuthenticatedDocumentLoader(identity, {}, policyDeps)("https://example.com/redirect-to-public")).document, { public: true });
 	});
 	await t.step("allow private redirects when explicitly enabled", async () => {
 		assertEquals((await getAuthenticatedDocumentLoader({
@@ -118,10 +125,7 @@ test("getAuthenticatedDocumentLoader() cancellation", async (t) => {
 						});
 					}, 1e3);
 				}));
-				const loader = getAuthenticatedDocumentLoader({
-					keyId: new URL("https://example.com/key2"),
-					privateKey: rsaPrivateKey2
-				});
+				const loader = createAuthenticatedDocumentLoader(identity, {}, directDeps);
 				const controller = new AbortController();
 				const promise = loader("https://example.com/slow-object", { signal: controller.signal });
 				controller.abort();
@@ -132,10 +136,7 @@ test("getAuthenticatedDocumentLoader() cancellation", async (t) => {
 			}
 		});
 		await t.step("immediate cancellation", async () => {
-			const loader = getAuthenticatedDocumentLoader({
-				keyId: new URL("https://example.com/key2"),
-				privateKey: rsaPrivateKey2
-			});
+			const loader = createAuthenticatedDocumentLoader(identity, {}, directDeps);
 			const controller = new AbortController();
 			controller.abort();
 			await assertRejects(() => loader("https://example.com/object", { signal: controller.signal }), Error);
@@ -206,10 +207,10 @@ test("authenticated document loader suppresses HTTP failure logs", async () => {
 });
 test("authenticated document loader suppresses private URL logs", async () => {
 	const records = [];
-	const loader = getAuthenticatedDocumentLoader({
+	const loader = createAuthenticatedDocumentLoader({
 		keyId: new URL("https://example.com/key2"),
 		privateKey: rsaPrivateKey2
-	});
+	}, {}, { openHop: publicPolicyHop(publicLookup) });
 	await reset();
 	await configure({
 		sinks: { capture: (record) => {
@@ -246,21 +247,17 @@ test("authenticated document loader suppresses private URL logs", async () => {
 		await reset();
 	}
 });
-test("getAuthenticatedDocumentLoader() logs DNS failures as such", { ignore: "Deno" in globalThis && (await Deno.permissions.query({ name: "net" })).state !== "granted" }, async (t) => {
-	const loader = getAuthenticatedDocumentLoader({
-		keyId: new URL("https://example.com/key2"),
-		privateKey: rsaPrivateKey2
-	});
+test("getAuthenticatedDocumentLoader() logs DNS failures as such", async (t) => {
 	for (const result of [
 		"throws",
 		"empty",
 		"private"
 	]) await t.step(result, async () => {
-		const originalLookup = dns.lookup;
-		dns.lookup = (() => result === "throws" ? Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")) : Promise.resolve(result === "empty" ? [] : [{
+		const lookup = () => result === "throws" ? Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")) : Promise.resolve(result === "empty" ? [] : [{
 			address: "127.0.0.1",
 			family: 4
-		}]));
+		}]);
+		const loader = createAuthenticatedDocumentLoader(identity, {}, { openHop: (url) => openPublicFetch(url, { lookup }) });
 		const records = [];
 		await configure({
 			sinks: { buffer: (record) => records.push(record) },
@@ -294,7 +291,6 @@ test("getAuthenticatedDocumentLoader() logs DNS failures as such", { ignore: "De
 			assertEquals(records[0].properties.error, error);
 		} finally {
 			await reset();
-			dns.lookup = originalLookup;
 		}
 	});
 });
@@ -630,6 +626,211 @@ test("getAuthenticatedDocumentLoader() times out", async (t) => {
 		}
 	});
 });
+test("getAuthenticatedDocumentLoader() closes each hop before opening the next", async (t) => {
+	await t.step("redirect", async () => {
+		const start = "https://example.com/lifecycle/start";
+		const next = "https://example.com/lifecycle/document";
+		const hops = recordHops((request) => request.url === start ? {
+			status: 302,
+			headers: { Location: next },
+			body: "Found"
+		} : {
+			headers: { "Content-Type": "application/activity+json" },
+			body: "{\"done\":true}"
+		});
+		deepStrictEqual(await createAuthenticatedDocumentLoader(identity, {}, hops)(start), {
+			contextUrl: null,
+			document: { done: true },
+			documentUrl: next
+		});
+		deepStrictEqual(hops.events, [
+			`open ${start}`,
+			`fetch #1 ${start}`,
+			"cancel #1",
+			`close ${start}`,
+			`open ${next}`,
+			`fetch #2 ${next}`,
+			"consumed #2",
+			`close ${next}`
+		]);
+		hops.assertInvariants();
+	});
+	await t.step("Link header alternate", async () => {
+		const start = "https://example.com/lifecycle/page";
+		const next = "https://example.com/lifecycle/alternate";
+		const hops = recordHops((request) => request.url === start ? {
+			headers: {
+				"Content-Type": "text/plain",
+				Link: `<${next}>; rel="alternate"; type="application/activity+json"`
+			},
+			body: "not JSON"
+		} : {
+			headers: { "Content-Type": "application/activity+json" },
+			body: "{\"done\":true}"
+		});
+		deepStrictEqual((await createAuthenticatedDocumentLoader(identity, {}, hops)(start)).document, { done: true });
+		deepStrictEqual(hops.events, [
+			`open ${start}`,
+			`fetch #1 ${start}`,
+			"cancel #1",
+			`close ${start}`,
+			`open ${next}`,
+			`fetch #2 ${next}`,
+			"consumed #2",
+			`close ${next}`
+		]);
+		hops.assertInvariants();
+	});
+	await t.step("one lookup per hop", async () => {
+		const start = "https://first.example/start";
+		const next = "https://second.example/document";
+		const lookups = [];
+		const lookup = (hostname) => {
+			lookups.push(hostname);
+			return Promise.resolve([{
+				address: "8.8.8.8",
+				family: 4
+			}]);
+		};
+		await withFetchStub((request) => new URL(request.url).pathname === "/start" ? Response.redirect(next, 302) : Response.json({ done: true }), async (fetched) => {
+			deepStrictEqual((await createAuthenticatedDocumentLoader(identity, {}, { openHop: (url) => openPublicFetch(url, { lookup }) })(start)).document, { done: true });
+			deepStrictEqual(lookups, ["first.example", "second.example"]);
+			deepStrictEqual(fetched.length, 2);
+		});
+	});
+});
+async function captureLogs(fn) {
+	const records = [];
+	await configure({
+		sinks: { buffer: (record) => records.push(record) },
+		loggers: [{
+			category: "fedify",
+			sinks: ["buffer"],
+			lowestLevel: "debug"
+		}, {
+			category: ["logtape", "meta"],
+			sinks: []
+		}],
+		reset: true
+	});
+	try {
+		await fn();
+		await new Promise((resolve) => setTimeout(resolve, 0));
+	} finally {
+		await reset();
+	}
+	return records;
+}
+function getCancelFailures(records) {
+	return records.filter((r) => r.rawMessage === "Failed to cancel the response body from {url}: {error}").map((r) => r.properties.error.message);
+}
+const linkAlternate = (next) => ({
+	headers: {
+		"Content-Type": "text/plain",
+		Link: `<${next}>; rel="alternate"; type="application/activity+json"`
+	},
+	body: "not JSON"
+});
+const jsonDocument = {
+	headers: { "Content-Type": "application/activity+json" },
+	body: "{\"done\":true}"
+};
+test("getAuthenticatedDocumentLoader() logs bodies failing to cancel and loads the next hop", async (t) => {
+	for (const kind of ["redirect", "Link header alternate"]) await t.step(kind, async () => {
+		const start = "https://example.com/lifecycle/cancel-failure";
+		const next = "https://example.com/lifecycle/cancel-failure-next";
+		const hops = recordHops((request) => request.url === start ? {
+			...kind === "redirect" ? {
+				status: 302,
+				headers: { Location: next },
+				body: "Found"
+			} : linkAlternate(next),
+			failCancel: true
+		} : jsonDocument);
+		const loader = createAuthenticatedDocumentLoader(identity, {}, hops);
+		let document;
+		const records = await captureLogs(async () => {
+			document = (await loader(start)).document;
+		});
+		deepStrictEqual(document, { done: true });
+		deepStrictEqual(hops.events, [
+			`open ${start}`,
+			`fetch #1 ${start}`,
+			"cancel #1",
+			`close ${start}`,
+			`open ${next}`,
+			`fetch #2 ${next}`,
+			"consumed #2",
+			`close ${next}`
+		]);
+		deepStrictEqual(getCancelFailures(records), ["cancel #1 failed"]);
+		hops.assertInvariants();
+	});
+});
+test("getAuthenticatedDocumentLoader() is not blocked by a body cancellation that never settles", async (t) => {
+	await t.step("redirect and Link header alternate", async () => {
+		const start = "https://example.com/lifecycle/hanging-start";
+		const page = "https://example.com/lifecycle/hanging-page";
+		const next = "https://example.com/lifecycle/hanging-document";
+		const hops = recordHops((request) => ({
+			...request.url === start ? {
+				status: 302,
+				headers: { Location: page },
+				body: "Found"
+			} : request.url === page ? linkAlternate(next) : jsonDocument,
+			hangCancel: true
+		}));
+		deepStrictEqual((await createAuthenticatedDocumentLoader(identity, {}, hops)(start)).document, { done: true });
+		deepStrictEqual(hops.events, [
+			`open ${start}`,
+			`fetch #1 ${start}`,
+			"cancel #1",
+			`close ${start}`,
+			`open ${page}`,
+			`fetch #2 ${page}`,
+			"cancel #2",
+			`close ${page}`,
+			`open ${next}`,
+			`fetch #3 ${next}`,
+			"consumed #3",
+			`close ${next}`
+		]);
+		hops.assertInvariants();
+	});
+	await t.step("not found", async () => {
+		const url = "https://example.com/lifecycle/hanging-missing";
+		const hops = recordHops(() => ({
+			status: 404,
+			body: "Not Found",
+			hangCancel: true
+		}));
+		await rejects(createAuthenticatedDocumentLoader(identity, {}, hops)(url), FetchError);
+		deepStrictEqual(hops.events.slice(0, 2), [`open ${url}`, `fetch #1 ${url}`]);
+		deepStrictEqual(hops.events.at(-1), `close ${url}`);
+		hops.assertInvariants();
+	});
+});
+test("getAuthenticatedDocumentLoader() completes with responses cloned by fetch-mock", async () => {
+	esm_default.mockGlobal();
+	try {
+		const base = "https://example.com/tee/";
+		esm_default.get(`${base}start`, () => new Response("Found", {
+			status: 302,
+			headers: { Location: `${base}page` }
+		}));
+		esm_default.get(`${base}page`, () => new Response("not JSON", { headers: {
+			"Content-Type": "text/plain",
+			Link: `<${base}document>; rel="alternate"; type="application/activity+json"`
+		} }));
+		esm_default.get(`${base}document`, () => new Response("{\"done\":true}", { headers: { "Content-Type": "application/activity+json" } }));
+		esm_default.get(`${base}missing`, () => new Response("Not Found", { status: 404 }));
+		const loader = createAuthenticatedDocumentLoader(identity, {}, directDeps);
+		deepStrictEqual((await loader(`${base}start`)).document, { done: true });
+		await rejects(loader(`${base}missing`), FetchError);
+	} finally {
+		esm_default.hardReset();
+	}
+});
 const unsupportedUrls = [
 	"ftp://example.com/collection",
 	"file:///collection",
@@ -764,5 +965,112 @@ for (const url of unsupportedUrls) {
 		});
 	});
 }
+function createRecordedResponse(events, index, init, cancelSuffix = () => "") {
+	const bytes = new TextEncoder().encode(init.body ?? "");
+	const chunkSize = init.chunkSize ?? 256;
+	let offset = 0;
+	let settled = false;
+	const body = new ReadableStream({
+		pull(controller) {
+			if (offset >= bytes.length) {
+				settled = true;
+				events.push(`consumed #${index}`);
+				controller.close();
+				return;
+			}
+			controller.enqueue(bytes.slice(offset, offset + chunkSize));
+			offset += chunkSize;
+		},
+		cancel() {
+			settled = true;
+			events.push(`cancel #${index}${cancelSuffix()}`);
+			if (init.failCancel) throw new Error(`cancel #${index} failed`);
+			if (init.hangCancel) return new Promise(() => {});
+		}
+	}, { highWaterMark: 0 });
+	return {
+		response: new Response(body, {
+			status: init.status ?? 200,
+			headers: init.headers
+		}),
+		settled: () => settled
+	};
+}
+function recordHops(respond) {
+	const events = [];
+	const requests = [];
+	const unsettledAtClose = [];
+	let opens = 0;
+	let closes = 0;
+	let fetches = 0;
+	return {
+		events,
+		requests,
+		openHop(url) {
+			opens++;
+			events.push(`open ${url}`);
+			const tracked = [];
+			let closed = false;
+			let closing = false;
+			return Promise.resolve({
+				url: new URL(url),
+				async fetch(input, init) {
+					if (closed) throw new TypeError("The session is closed.");
+					const request = new Request(input instanceof Request ? input.clone() : input, init);
+					const index = ++fetches;
+					requests.push(request);
+					events.push(`fetch #${index} ${request.url}`);
+					const recorded = createRecordedResponse(events, index, await respond(request, index), () => closing ? " by close" : "");
+					tracked.push({
+						...recorded,
+						index
+					});
+					return recorded.response;
+				},
+				close() {
+					if (closed) return Promise.resolve();
+					closed = true;
+					closes++;
+					closing = true;
+					for (const { response, settled, index } of tracked) {
+						if (settled()) continue;
+						if (response.body?.locked) unsettledAtClose.push(index);
+						else response.body?.cancel().catch(() => {});
+					}
+					events.push(`close ${url}`);
+					return Promise.resolve();
+				}
+			});
+		},
+		assertInvariants() {
+			deepStrictEqual(opens, closes);
+			deepStrictEqual(unsettledAtClose, []);
+		}
+	};
+}
+test("authenticated loader closes a hop that opens after its timeout", async () => {
+	const url = "https://example.com/late-open";
+	let release = () => {};
+	const opened = new Promise((resolve) => release = resolve);
+	let closed = () => {};
+	const closure = new Promise((resolve) => closed = resolve);
+	const hops = recordHops(() => jsonDocument);
+	await rejects(createAuthenticatedDocumentLoader(identity, { timeout: 20 }, { async openHop(url) {
+		await opened;
+		const session = await hops.openHop(url);
+		return {
+			...session,
+			async close() {
+				await session.close();
+				closed();
+			}
+		};
+	} })(url), (error) => assertTimeoutFetchError(error, url));
+	release();
+	await closure;
+	deepStrictEqual(hops.requests, []);
+	deepStrictEqual(hops.events, [`open ${url}`, `close ${url}`]);
+	hops.assertInvariants();
+});
 //#endregion
 export {};

package/dist/utils/kv-cache.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-m3RIr811.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-Cxn7pNMx.mjs";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 import { deepStrictEqual, throws } from "node:assert";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";

package/dist/utils/mod.cjs

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-Dkzuqs8B.cjs");
+const require_kv_cache = require("../kv-cache-BpGIONmd.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.d.cts

@@ -1,3 +1,3 @@
 /// <reference lib="esnext.temporal" />
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-Dw-nPxQh.cjs";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-ss0wBUH1.cjs";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.d.ts

@@ -1,3 +1,3 @@
 /// <reference lib="esnext.temporal" />
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-DEZXwV6J.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-B1Qt5cQQ.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-DoZoRS9p.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-CNfNI_95.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/fedify",
-  "version": "2.4.5-dev.2462+46a3f2c5",
+  "version": "2.4.6-dev.2628+2a78382f",
   "description": "An ActivityPub server framework",
   "keywords": [
     "ActivityPub",
@@ -137,7 +137,7 @@
   },
   "dependencies": {
     "@logtape/logtape": "^2.2.0",
-    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/api": "~1.9.1",
     "@opentelemetry/core": "^2.7.1",
     "@opentelemetry/sdk-metrics": "2.7.1",
     "@opentelemetry/sdk-trace-base": "^2.7.1",
@@ -151,10 +151,10 @@
     "structured-field-values": "^2.0.4",
     "temporal-polyfill": "^1.0.1",
     "urlpattern-polyfill": "^10.1.0",
-    "@fedify/uri-template": "2.4.5-dev.2462+46a3f2c5",
-    "@fedify/vocab": "2.4.5-dev.2462+46a3f2c5",
-    "@fedify/vocab-runtime": "2.4.5-dev.2462+46a3f2c5",
-    "@fedify/webfinger": "2.4.5-dev.2462+46a3f2c5"
+    "@fedify/uri-template": "2.4.6-dev.2628+2a78382f",
+    "@fedify/vocab": "2.4.6-dev.2628+2a78382f",
+    "@fedify/webfinger": "2.4.6-dev.2628+2a78382f",
+    "@fedify/vocab-runtime": "2.4.6-dev.2628+2a78382f"
   },
   "devDependencies": {
     "@std/assert": "npm:@jsr/std__assert@^0.226.0",
@@ -167,7 +167,7 @@
     "typescript": "^6.0.0",
     "wrangler": "^4.17.0",
     "@fedify/fixture": "2.0.0",
-    "@fedify/vocab-tools": "^2.4.5-dev.2462+46a3f2c5"
+    "@fedify/vocab-tools": "^2.4.6-dev.2628+2a78382f"
   },
   "scripts": {
     "build:self": "tsdown",

package/dist/docloader-DQNRDYDb.mjs

@@ -1,91 +0,0 @@
-import "temporal-polyfill";
-import "urlpattern-polyfill";
-globalThis.addEventListener = () => {};
-import { T as validateCryptoKey } from "./ld-PJLGA2MJ.mjs";
-import { n as doubleKnock } from "./http-D7L2pqLT.mjs";
-import { getLogger } from "@logtape/logtape";
-import { FetchError, UrlError, createActivityPubRequest, getRemoteDocument, logRequest, resolveDocumentLoaderTimeout, validatePublicUrl, withDocumentLoaderTimeout } from "@fedify/vocab-runtime";
-import { curry } from "es-toolkit";
-//#region src/utils/docloader.ts
-const logger = getLogger([
-	"fedify",
-	"utils",
-	"docloader"
-]);
-const DEFAULT_MAX_REDIRECTION = 20;
-/**
-* Gets an authenticated {@link DocumentLoader} for the given identity.
-* Note that an authenticated document loader intentionally does not cache
-* the fetched documents.
-* At most 20 HTTP redirects and alternate document links are followed in total
-* per call.  Revisiting a URL within that chain throws a {@link FetchError}.
-* Each call, including its double-knocking retries, times out after
-* 10 seconds by default; see {@link DocumentLoaderFactoryOptions.timeout}.
-* @param identity The identity to get the document loader for.
-*                 The actor's key pair.
-* @param options The options for the document loader.
-* @returns The authenticated document loader.
-* @throws {TypeError} If the key is invalid or unsupported.
-* @throws {RangeError} If the `timeout` option is invalid.
-* @since 0.4.0
-*/
-function getAuthenticatedDocumentLoader(identity, { allowPrivateAddress, maxRedirection, userAgent, specDeterminer, timeout, tracerProvider } = {}) {
-	validateCryptoKey(identity.privateKey);
-	const resolvedTimeout = resolveDocumentLoaderTimeout(timeout);
-	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
-		options?.signal?.throwIfAborted();
-		let currentUrl = new URL(url).href;
-		await validateUrl(currentUrl, options);
-		visited.add(currentUrl);
-		const originalRequest = createActivityPubRequest(currentUrl, { userAgent });
-		function follow(nextUrl) {
-			options?.signal?.throwIfAborted();
-			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
-			if (visited.has(nextUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${nextUrl}`);
-			redirected++;
-		}
-		const response = await doubleKnock(originalRequest, identity, {
-			maxRedirection,
-			specDeterminer,
-			log: curry(logRequest)(logger),
-			tracerProvider,
-			signal: options?.signal,
-			validateRedirect: async (nextUrl) => {
-				follow(nextUrl);
-				await validateUrl(nextUrl, options);
-				visited.add(nextUrl);
-				currentUrl = nextUrl;
-			}
-		});
-		options?.signal?.throwIfAborted();
-		return getRemoteDocument(currentUrl, response, (alternateUrl) => {
-			follow(alternateUrl);
-			return load(alternateUrl, options, redirected, visited);
-		}, options);
-	}
-	async function validateUrl(url, options) {
-		const parsedUrl = new URL(url);
-		const protocol = parsedUrl.protocol;
-		if (protocol !== "http:" && protocol !== "https:") throw new UrlError(`Unsupported protocol: ${protocol}`);
-		if (parsedUrl.username !== "" || parsedUrl.password !== "") throw new UrlError("URLs with credentials are not allowed");
-		if (!allowPrivateAddress) {
-			try {
-				await validatePublicUrl(url);
-			} catch (error) {
-				if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
-					url,
-					error
-				});
-				else logger[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
-					url,
-					error
-				});
-				throw error;
-			}
-			options?.signal?.throwIfAborted();
-		}
-	}
-	return withDocumentLoaderTimeout((url, options) => load(url, options), resolvedTimeout);
-}
-//#endregion
-export { getAuthenticatedDocumentLoader as t };