@fedify/relay 2.0.35-dev.2470 → 2.0.35-dev.2485

package/dist/{types-CfiYZC9a.js → types-BQoCDX2S.js}

@@ -1,34 +1,736 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { createRequire } from "node:module";
+import { n as __require, r as __toESM, t as __commonJSMin } from "./chunk-D_gRT_KG.js";
 import { getLogger } from "@logtape/logtape";
-import process$1 from "node:process";
 import dns from "node:dns/promises";
 import { isIP } from "node:net";
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+import process$1 from "node:process";
+//#region ../vocab-runtime/dist/public-fetch-Dfmc_Kfy.js
+const grants = /* @__PURE__ */ new WeakMap();
+/**
+* Issues a grant for the given URL's origin and addresses.  This does not
+* validate the addresses; callers validate them before issuing, and pinners
+* validate them again right before connecting.
+* @param url The URL whose origin the grant is bound to.
+* @param addresses The addresses to connect to.
+* @returns A new grant.
+*/
+function issuePinGrant(url, addresses) {
+	const grant = Object.freeze(Object.create(null));
+	let hostname = url.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	const record = Object.freeze({
+		origin: url.origin,
+		hostname,
+		addresses: Object.freeze(addresses.map(({ address, family }) => Object.freeze({
+			address,
+			family
+		})))
+	});
+	grants.set(grant, {
+		record,
+		revoked: false
+	});
+	return grant;
+}
+/**
+* Checks that the given grant was issued by {@link issuePinGrant}, has not
+* been revoked, and was issued for the origin of the given URL.
+* @param grant The grant to redeem.
+* @param url The URL to connect to.
+* @returns What the grant stands for.
+* @throws {TypeError} If the grant cannot be used for the URL.
+*/
+function redeemPinGrant(grant, url) {
+	const state = typeof grant === "object" && grant !== null ? grants.get(grant) : void 0;
+	if (state == null) throw new TypeError("Invalid pin grant.");
+	if (state.revoked) throw new TypeError("The pin grant has been revoked.");
+	if (url.origin !== state.record.origin) throw new TypeError(`The pin grant for ${state.record.origin} cannot be used for ${url.origin}.`);
+	return state.record;
+}
+/**
+* Revokes the given grant so that it can no longer be redeemed.
+* @param grant The grant to revoke.
+*/
+function revokePinGrant(grant) {
+	const state = grants.get(grant);
+	if (state != null) state.revoked = true;
+}
+var UrlError = class extends Error {
+	/**
+	* The failure category. Defaults to `"disallowed"`.
+	* `"dns"` includes lookup errors and results with no usable IP addresses.
+	* @since 2.0.29
+	*/
+	reason;
+	constructor(message, options) {
+		super(message, options);
+		this.name = "UrlError";
+		this.reason = options?.reason ?? "disallowed";
+	}
+};
+/**
+* Resolves all addresses of the given hostname through `node:dns/promises`.
+* The default `dns` object is looked up on every call so that tests can still
+* stub `dns.lookup()`.
+* @internal
+*/
+function lookupAllAddresses(hostname) {
+	return dns.lookup(hostname, { all: true });
+}
+/**
+* Checks the parts of a URL that can be validated without resolving it:
+* the protocol, the `localhost` hostname, and IP literal hostnames.
+* @throws {UrlError} If the URL is not allowed.
+* @internal
+*/
+function parsePublicUrl(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
+	let hostname = parsed.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const family = isIP(hostname);
+	if (family !== 0) validatePublicIpAddress(hostname, family);
+	return {
+		url: parsed,
+		hostname,
+		family
+	};
+}
+/**
+* Resolves the given hostname and checks that every returned IP address is
+* public.
+* @returns The IP addresses of the hostname, without non-IP entries.
+* @throws {UrlError} If the lookup fails, returns no IP address, or returns
+*                    any non-public address.
+* @internal
+*/
+async function lookupPublicAddresses(hostname, lookup) {
+	let addresses;
+	try {
+		addresses = await lookup(hostname);
+	} catch (error) {
+		throw new UrlError("DNS lookup failed", {
+			cause: error,
+			reason: "dns"
+		});
+	}
+	validateLookupAddresses(addresses);
+	return addresses.filter(({ address }) => isIP(address) !== 0).map(({ address }) => ({
+		address,
+		family: isIP(address)
+	}));
+}
+/**
+* Checks that the given IP address is public.  This is used right before
+* connecting to an address that passed {@link lookupPublicAddresses}.
+* @throws {UrlError} If the address is not a public IP address.
+* @internal
+*/
+function assertPublicAddress(address) {
+	const family = isIP(address.address);
+	if (family === 0 || family !== address.family) throw new UrlError(`Invalid or private address: ${address.address}`);
+	validatePublicIpAddress(address.address, family);
+}
+/**
+* Validates the IP addresses returned by `node:dns.lookup()`.
+*
+* Cloudflare Workers' `node:dns` implementation currently maps every record
+* in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
+* `LookupAddress`, even though Node.js specifies that the `address` field must
+* contain an IPv4 or IPv6 literal.  See:
+* https://github.com/cloudflare/workerd/issues/6886
+*
+* Work around that bug by ignoring non-IP entries only when the lookup also
+* returns at least one actual IP address.  This remains fail-closed: a result
+* containing no IP addresses is rejected, and every returned IP address is
+* still validated and must be public.  This workaround can be revisited once
+* the Workerd issue is fixed in supported Cloudflare Workers runtimes.
+*
+* @internal
+*/
+function validateLookupAddresses(addresses) {
+	let ipAddressCount = 0;
+	for (const { address } of addresses) {
+		const family = isIP(address);
+		if (family === 0) continue;
+		ipAddressCount++;
+		validatePublicIpAddress(address, family);
+	}
+	if (ipAddressCount === 0) throw new UrlError("DNS lookup did not return any IP address", { reason: "dns" });
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
+}
+function isValidPublicIPv4Address(address) {
+	const parts = parseIPv4Address(address);
+	if (parts == null) return false;
+	const value = ipv4PartsToNumber(parts);
+	return !nonPublicIPv4Prefixes.some(({ base, prefix }) => matchesIPv4Prefix(value, base, prefix));
+}
+function isValidPublicIPv6Address(address) {
+	const words = parseIPv6Address(address);
+	if (words == null) return false;
+	if (nonPublicIPv6Prefixes.some(({ words: prefixWords, prefix }) => matchesIPv6Prefix(words, prefixWords, prefix))) return false;
+	for (const { extractIPv4, prefix, words: prefixWords } of ipv6WithIPv4Prefixes) {
+		if (!matchesIPv6Prefix(words, prefixWords, prefix)) continue;
+		const ipv4Address = extractIPv4(words);
+		if (ipv4Address != null && !isValidPublicIPv4Address(ipv4Address)) return false;
+	}
+	return true;
+}
+function expandIPv6Address(address) {
+	address = address.toLowerCase();
+	const ipv4Delimiter = address.lastIndexOf(":");
+	if (address.includes(".") && ipv4Delimiter >= 0) {
+		const ipv4Parts = parseIPv4Address(address.substring(ipv4Delimiter + 1));
+		if (ipv4Parts == null) return address;
+		const high = (ipv4Parts[0] << 8) + ipv4Parts[1];
+		const low = (ipv4Parts[2] << 8) + ipv4Parts[3];
+		address = address.substring(0, ipv4Delimiter + 1) + high.toString(16) + ":" + low.toString(16);
+	}
+	if (address === "::") return "0000:0000:0000:0000:0000:0000:0000:0000";
+	if (address.startsWith("::")) address = "0000" + address;
+	if (address.endsWith("::")) address = address + "0000";
+	address = address.replace("::", ":0000".repeat(8 - (address.match(/:/g) || []).length) + ":");
+	return address.split(":").map((part) => part.padStart(4, "0")).join(":");
+}
+const nonPublicIPv4Prefixes = [
+	ipv4Prefix("0.0.0.0/8", "RFC 6890"),
+	ipv4Prefix("10.0.0.0/8", "RFC 1918"),
+	ipv4Prefix("100.64.0.0/10", "RFC 6598"),
+	ipv4Prefix("127.0.0.0/8", "RFC 1122"),
+	ipv4Prefix("169.254.0.0/16", "RFC 3927"),
+	ipv4Prefix("172.16.0.0/12", "RFC 1918"),
+	ipv4Prefix("192.0.0.0/24", "RFC 6890"),
+	ipv4Prefix("192.0.2.0/24", "RFC 5737"),
+	ipv4Prefix("192.88.99.0/24", "RFC 7526"),
+	ipv4Prefix("192.168.0.0/16", "RFC 1918"),
+	ipv4Prefix("198.18.0.0/15", "RFC 2544"),
+	ipv4Prefix("198.51.100.0/24", "RFC 5737"),
+	ipv4Prefix("203.0.113.0/24", "RFC 5737"),
+	ipv4Prefix("224.0.0.0/4", "RFC 5771"),
+	ipv4Prefix("240.0.0.0/4", "RFC 1112")
+];
+const nonPublicIPv6Prefixes = [
+	ipv6Prefix("::/16", "RFC 4291"),
+	ipv6Prefix("2001::/32", "RFC 4380"),
+	ipv6Prefix("2002::/16", "RFC 3056"),
+	ipv6Prefix("64:ff9b:1::/48", "RFC 8215"),
+	ipv6Prefix("fc00::/7", "RFC 4193"),
+	ipv6Prefix("fe80::/10", "RFC 4291"),
+	ipv6Prefix("ff00::/8", "RFC 4291")
+];
+const ipv6WithIPv4Prefixes = [{
+	...ipv6Prefix("64:ff9b::/96", "RFC 6052"),
+	extractIPv4: (words) => ipv4FromWords(words[6], words[7])
+}];
+function ipv4Prefix(cidr, rfc) {
+	const [address, prefixText] = cidr.split("/");
+	const prefix = parseInt(prefixText, 10);
+	const parts = parseIPv4Address(address);
+	if (parts == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) throw new Error(`Invalid IPv4 prefix: ${cidr}`);
+	return {
+		cidr,
+		base: ipv4PartsToNumber(parts),
+		prefix,
+		rfc
+	};
+}
+function ipv6Prefix(cidr, rfc) {
+	const [address, prefixText] = cidr.split("/");
+	const prefix = parseInt(prefixText, 10);
+	const words = parseIPv6Address(address);
+	if (words == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 128) throw new Error(`Invalid IPv6 prefix: ${cidr}`);
+	return {
+		cidr,
+		words,
+		prefix,
+		rfc
+	};
+}
+function parseIPv4Address(address) {
+	const parts = address.split(".").map((part) => {
+		if (!/^\d+$/.test(part)) return NaN;
+		return parseInt(part, 10);
+	});
+	if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;
+	return parts;
+}
+function parseIPv6Address(address) {
+	const parts = expandIPv6Address(address).split(":");
+	if (parts.length !== 8) return null;
+	const words = parts.map((part) => {
+		if (!/^[0-9a-f]{1,4}$/i.test(part)) return NaN;
+		return parseInt(part, 16);
+	});
+	if (words.some((word) => !Number.isInteger(word) || word < 0 || word > 65535)) return null;
+	return words;
+}
+function ipv4PartsToNumber(parts) {
+	return parts[0] * 2 ** 24 + parts[1] * 2 ** 16 + parts[2] * 2 ** 8 + parts[3];
+}
+function ipv4FromWords(highWord, lowWord) {
+	return [
+		highWord >> 8,
+		highWord & 255,
+		lowWord >> 8,
+		lowWord & 255
+	].join(".");
+}
+function matchesIPv4Prefix(address, prefixBase, prefixLength) {
+	const blockSize = 2 ** (32 - prefixLength);
+	return Math.floor(address / blockSize) === Math.floor(prefixBase / blockSize);
+}
+function matchesIPv6Prefix(address, prefixWords, prefixLength) {
+	let remaining = prefixLength;
+	for (let i = 0; i < 8 && remaining > 0; i++) if (remaining >= 16) {
+		if (address[i] !== prefixWords[i]) return false;
+		remaining -= 16;
+	} else {
+		const mask = 65535 << 16 - remaining & 65535;
+		if ((address[i] & mask) !== (prefixWords[i] & mask)) return false;
+		remaining = 0;
+	}
+	return true;
+}
+const logger$1 = getLogger([
+	"fedify",
+	"runtime",
+	"fetch"
+]);
+/**
+* The first Bun version that honors `proxy: false` when proxy environment
+* variables are set at startup.  Earlier versions send pinned requests
+* through the proxy, with the validated IP address as the target.
+*/
+const PROXY_FALSE_MIN_VERSION = "1.4.3";
+const PROXY_VARIABLES = [
+	"HTTP_PROXY",
+	"http_proxy",
+	"HTTPS_PROXY",
+	"https_proxy",
+	"ALL_PROXY",
+	"all_proxy"
+];
+const FALLBACK_ERROR_CODES = new Set([
+	"ConnectionRefused",
+	"ECONNREFUSED",
+	"EHOSTUNREACH",
+	"ENETUNREACH",
+	"ETIMEDOUT"
+]);
+/**
+* Bun versions before 1.3.11 verify the server certificate against the `Host`
+* header, including a non-default port, instead of `tls.serverName`, so
+* pinned requests to HTTPS servers on non-default ports always fail the check
+* there.  A custom `checkServerIdentity` cannot stand in for it: these
+* versions send the whole request before a failing custom check aborts it
+* (and 1.3.10 even reuses the connection for the next request), so such
+* requests are refused instead.
+*/
+const HOST_HEADER_IDENTITY_RANGE = "<1.3.11";
+/**
+* Creates a pinner for Bun.  Every request is sent to an IP literal URL with
+* the original `Host` header, `tls.serverName` set to the original hostname
+* (so that the certificate is still verified against it), and `proxy: false`.
+*
+* GET and HEAD requests fall back to the next address on transport errors
+* raised before a response arrives.  Other methods use only the first
+* address, since a transport error does not guarantee that the request did
+* not reach the server, and retrying it could deliver an activity twice.
+* Together with the transport retries of `doubleKnock()`, a GET request is
+* attempted at most twice per address.  Note that Bun 1.4 also reports
+* a connection reset after the request was sent as a `TypeError`, so GET and
+* HEAD requests may be repeated against the next address in that case, which
+* is acceptable for these idempotent methods.
+*
+* Bun versions before 1.3.11 verify certificates against the `Host` header,
+* which includes a non-default port, and cannot safely check them against
+* the original hostname in any other way, so requests to HTTPS servers on
+* non-default ports fail there with a `TypeError` before connecting.
+*
+* Bun versions before 1.4.3 ignore `proxy: false` when proxy environment
+* variables are set, so requests go through the proxy with the validated IP
+* address as the target.  In that case a warning is logged once.
+* @param options The pinner options.
+* @returns The pinner.
+*/
+function createBunPinner({ verifyAddress }) {
+	let proxyWarningPending = ignoresProxyFalse() && hasProxyVariables();
+	return {
+		supports(url) {
+			return url.protocol === "http:" || url.protocol === "https:";
+		},
+		async fetch(grant, request, signal) {
+			const url = new URL(request.url);
+			const { hostname, addresses } = redeemPinGrant(grant, url);
+			if (proxyWarningPending) {
+				proxyWarningPending = false;
+				logger$1.warn("Bun {version} ignores proxy: false while proxy environment variables are set, so outbound requests go through the proxy instead of connecting directly to the validated addresses.  Upgrade to Bun {minVersion} or later, or unset the proxy environment variables; see {url}.", {
+					version: getBun()?.version,
+					minVersion: PROXY_FALSE_MIN_VERSION,
+					url: "https://fedify.dev/manual/deploy#bun-behind-an-http-proxy"
+				});
+			}
+			const fallback = request.method === "GET" || request.method === "HEAD";
+			const candidates = fallback ? addresses : addresses.slice(0, 1);
+			const body = request.body == null ? null : await request.arrayBuffer();
+			let lastError = /* @__PURE__ */ new TypeError(`No address to connect to for ${url.host}.`);
+			for (const address of candidates) {
+				throwIfAborted(signal, request.signal);
+				verifyAddress(address);
+				const headers = new Headers(request.headers);
+				headers.set("Host", url.host);
+				const init = {
+					method: request.method,
+					headers,
+					body,
+					redirect: "manual",
+					signal: signal == null || signal === request.signal ? request.signal : anySignal(signal, request.signal),
+					proxy: false
+				};
+				if (url.protocol === "https:") init.tls = getTlsOptions(url, hostname);
+				try {
+					return await fetch(toAddressUrl(url, address), init);
+				} catch (error) {
+					throwIfAborted(signal, request.signal);
+					if (!fallback || !isFallbackError(error)) throw error;
+					lastError = error;
+				}
+			}
+			throw lastError;
+		},
+		release() {}
+	};
+}
+function getTlsOptions(url, hostname) {
+	const bun = getBun();
+	if (url.port !== "" && bun != null && bun.semver.satisfies(bun.version, HOST_HEADER_IDENTITY_RANGE)) throw new TypeError(`Bun ${bun.version} cannot verify the certificate of ${url.host} when connecting to a validated address; upgrade to Bun 1.3.11 or later to fetch from HTTPS servers on non-default ports.`);
+	return isIP(hostname) === 0 ? { serverName: hostname } : {};
+}
+/**
+* Combines two signals without `AbortSignal.any()`, which Bun 1.1.0 lacks.
+*/
+function anySignal(a, b) {
+	if (a.aborted) return a;
+	if (b.aborted) return b;
+	const controller = new AbortController();
+	const abort = (event) => {
+		controller.abort(event.target.reason);
+		a.removeEventListener("abort", abort);
+		b.removeEventListener("abort", abort);
+	};
+	a.addEventListener("abort", abort);
+	b.addEventListener("abort", abort);
+	return controller.signal;
+}
+function toAddressUrl(url, address) {
+	const result = new URL(url);
+	result.hostname = address.family === 6 ? `[${address.address}]` : address.address;
+	return result;
+}
+function isFallbackError(error) {
+	if (error instanceof Error && error.name === "AbortError") return false;
+	if (error instanceof TypeError) return true;
+	const code = error?.code;
+	return typeof code === "string" && FALLBACK_ERROR_CODES.has(code);
+}
+function throwIfAborted(...signals) {
+	for (const signal of signals) signal?.throwIfAborted();
+}
+function getBun() {
+	return globalThis.Bun;
+}
+function ignoresProxyFalse() {
+	const bun = getBun();
+	if (bun == null) return false;
+	return !bun.semver.satisfies(bun.version, `>=${PROXY_FALSE_MIN_VERSION}`);
+}
+function hasProxyVariables() {
+	const env = globalThis.process?.env;
+	if (env == null) return false;
+	return PROXY_VARIABLES.some((name) => (env[name] ?? "") !== "");
+}
+/**
+* Creates a pinner for Node.js.  Every request is sent through the global
+* `fetch()` with an undici `Agent` as the `dispatcher`.  The agent's
+* `connect.lookup` answers only with the addresses of live grants for
+* the hostname, checking each of them again right before connecting, and
+* fails when there are none, so a connection can never be made to an address
+* that was not validated.
+*
+* The agent is shared by the requests of all grants, so keep-alive
+* connections are reused.  A pooled connection was made to an address of
+* a grant that was valid when it was connected, so reusing it from another
+* session of the same origin still reaches a validated address.  Response
+* bodies have to be consumed or cancelled for their connections to return to
+* the pool, which sessions do when they are closed.
+*
+* Since the dispatcher is passed explicitly, neither proxy environment
+* variables nor the global dispatcher (e.g., `NODE_USE_ENV_PROXY=1`) apply.
+* @param options The pinner options.
+* @returns The pinner.
+*/
+function createNodePinner({ verifyAddress, undici }) {
+	const grants = /* @__PURE__ */ new Map();
+	function lookup(hostname, options, callback) {
+		let addresses;
+		try {
+			addresses = getGrantedAddresses(hostname, options.family);
+		} catch (error) {
+			callback(error, []);
+			return;
+		}
+		if (options.all) callback(null, addresses);
+		else callback(null, addresses[0].address, addresses[0].family);
+	}
+	function getGrantedAddresses(hostname, family) {
+		const addresses = /* @__PURE__ */ new Map();
+		for (const [grant, record] of grants.get(hostname) ?? []) {
+			try {
+				redeemPinGrant(grant, new URL(record.origin));
+			} catch {
+				continue;
+			}
+			for (const address of record.addresses) addresses.set(address.address, address);
+		}
+		const familyNumber = family === "IPv4" ? 4 : family === "IPv6" ? 6 : typeof family === "number" ? family : 0;
+		const result = [...addresses.values()].filter((address) => familyNumber === 0 || address.family === familyNumber);
+		if (result.length < 1) throw new UrlError(`No validated address to connect to: ${hostname}`);
+		for (const address of result) verifyAddress(address);
+		return result;
+	}
+	const agent = new undici.Agent({ connect: { lookup } });
+	return {
+		supports(url) {
+			return url.protocol === "http:" || url.protocol === "https:";
+		},
+		async fetch(grant, request, signal) {
+			const record = redeemPinGrant(grant, new URL(request.url));
+			if (isIP(record.hostname) !== 0) for (const address of record.addresses) verifyAddress(address);
+			let registered = grants.get(record.hostname);
+			if (registered == null) {
+				registered = /* @__PURE__ */ new Map();
+				grants.set(record.hostname, registered);
+			}
+			registered.set(grant, record);
+			return await fetch(request, {
+				redirect: "manual",
+				signal: signal == null || signal === request.signal ? request.signal : AbortSignal.any([signal, request.signal]),
+				dispatcher: agent
+			});
+		},
+		release(grant) {
+			for (const [hostname, registered] of grants) {
+				if (!registered.delete(grant)) continue;
+				if (registered.size < 1) grants.delete(hostname);
+				break;
+			}
+		}
+	};
+}
+/**
+* Detects the current runtime.  Cloudflare Workers is checked first, since
+* `process` can exist there with `nodejs_compat`, and Deno and Bun before
+* Node.js, since both provide `process.versions.node`.
+* @returns The current runtime.
+*/
+function detectRuntime() {
+	const g = globalThis;
+	if (g.navigator?.userAgent === "Cloudflare-Workers") return "cfworkers";
+	if ("Deno" in globalThis) return "deno";
+	if ("Bun" in globalThis) return "bun";
+	if (g.process?.versions?.node != null) return "node";
+	return "other";
+}
+let runtimePinner;
+/**
+* Gets the production pinner of the current runtime, which rejects
+* non-public addresses right before connecting.  Deno and Cloudflare Workers
+* have no pinner.
+* @returns The pinner, or `null` if the runtime has none.
+*/
+function getRuntimePinner() {
+	runtimePinner ??= createRuntimePinner(detectRuntime());
+	return runtimePinner;
+}
+async function createRuntimePinner(runtime) {
+	switch (runtime) {
+		case "bun": return createBunPinner({ verifyAddress: assertPublicAddress });
+		case "node": return createNodePinner({
+			verifyAddress: assertPublicAddress,
+			undici: await import("./undici-CjF8_EAQ.js").then((m) => /* @__PURE__ */ __toESM(m.default, 1))
+		});
+		default: return null;
+	}
+}
+const logger$2 = getLogger([
+	"fedify",
+	"runtime",
+	"fetch"
+]);
+/**
+* Creates {@link PublicFetch.openPublicFetch} and
+* {@link PublicFetch.withPublicFetch} bound to the given pinner and lookup.
+* This is exported only for tests; it is not exported from any entry point.
+* @param dependencies The pinner and the default lookup function.
+* @returns The functions.
+*/
+function createPublicFetch(dependencies) {
+	async function openPublicFetch(url, options = {}) {
+		const { url: parsed, hostname, family } = parsePublicUrl(url);
+		if (parsed.username !== "" || parsed.password !== "") throw new UrlError("URLs with credentials are not allowed");
+		const lookup = options.lookup ?? dependencies.lookup;
+		let addresses;
+		if (family !== 0) addresses = [{
+			address: hostname,
+			family
+		}];
+		else if (lookup === lookupAllAddresses && !await canResolve()) return createSession(parsed, globalFetch);
+		else {
+			options.signal?.throwIfAborted();
+			addresses = await lookupPublicAddresses(hostname, lookup);
+			options.signal?.throwIfAborted();
+		}
+		const pinner = await dependencies.pinner();
+		if (pinner == null || !pinner.supports(parsed)) {
+			logUnpinned(parsed);
+			return createSession(parsed, globalFetch);
+		}
+		const grant = issuePinGrant(parsed, addresses);
+		return createSession(parsed, (input, init) => pinner.fetch(grant, new Request(input, init), init.signal ?? void 0), {
+			grant,
+			pinner
+		});
+	}
+	async function withPublicFetch(url, fn, options) {
+		const session = await openPublicFetch(url, options);
+		try {
+			const result = await fn(session.fetch);
+			if (result instanceof Response) throw new TypeError("withPublicFetch() callbacks must not return a Response, since its body is cancelled when the session is closed.");
+			return result;
+		} catch (error) {
+			logger$2.debug("Failed while fetching {url}; closing the session: {error}", {
+				url: session.url.href,
+				error
+			});
+			throw error;
+		} finally {
+			await session.close();
+		}
+	}
+	return {
+		openPublicFetch,
+		withPublicFetch
+	};
+}
+const runtimePublicFetch = createPublicFetch({
+	pinner: getRuntimePinner,
+	lookup: lookupAllAddresses
+});
+/**
+* Validates the URL, resolves its hostname, checks that every resolved
+* address is public, and opens a session that connects only to those
+* addresses.  Connections are pinned on Node.js and Bun.  On other runtimes,
+* the session uses the global `fetch()` after the check.
+* @param url The URL to open a session for.
+* @param options The options.
+* @returns The session.  It must be closed.
+* @throws {UrlError} If the URL is not allowed, or its hostname cannot be
+*                    resolved (with `reason: "dns"`).
+*/
+const openPublicFetch = runtimePublicFetch.openPublicFetch;
+runtimePublicFetch.withPublicFetch;
+/**
+* Opens a session that neither validates nor pins addresses, for callers that
+* allow private addresses.  It has the same rules as {@link openPublicFetch}
+* sessions otherwise: requests are limited to the URL's origin, redirects are
+* never followed, and unconsumed response bodies are cancelled on close.
+* It grants nothing beyond calling the global `fetch()` directly.
+* @param url The URL to open a session for.
+* @returns The session.  It must be closed.
+*/
+function openDirectFetch(url) {
+	return Promise.resolve(createSession(new URL(url), globalFetch));
+}
+/**
+* Starts cancelling the body of a response without waiting for it to settle.
+* The cancellation of a branch of a tee (e.g., a body cloned by a fetch mock)
+* settles only after the other branch is cancelled too, per the Streams
+* standard, so awaiting it could block forever.  Failures are only logged.
+*/
+function cancelResponseBody$1(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger$2.debug("Failed to cancel a response body from {url}: {error}", {
+			url: url.href,
+			error
+		});
+	});
+}
+function globalFetch(input, init) {
+	return fetch(input, init);
+}
+function createSession(url, send, pin) {
+	const origin = url.origin;
+	const tracked = [];
+	let closed = false;
+	async function sessionFetch(input, init) {
+		if (closed) throw new TypeError("The fetch session is closed.");
+		const target = new URL(input instanceof Request ? input.url : input);
+		if (target.origin !== origin) throw new TypeError(`A fetch session for ${origin} cannot fetch ${target.origin}.`);
+		const response = await send(input, {
+			...init,
+			redirect: "manual"
 		});
+		if (closed) {
+			cancelResponseBody$1(response, url);
+			throw new TypeError("The fetch session is closed.");
+		}
+		tracked.push(response);
+		return response;
 	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
+	async function close() {
+		if (closed) return;
+		closed = true;
+		for (const response of tracked) {
+			if (response.body == null || response.bodyUsed) continue;
+			if (response.body.locked) {
+				logger$2.debug("Cannot cancel a locked response body from {url}.", { url: url.href });
+				continue;
+			}
+			cancelResponseBody$1(response, url);
+		}
+		if (pin == null) return;
+		revokePinGrant(pin.grant);
+		await pin.pinner.release(pin.grant);
+	}
+	return {
+		get url() {
+			return new URL(url);
+		},
+		fetch: sessionFetch,
+		close
+	};
+}
+async function canResolve() {
+	if (!("Deno" in globalThis)) return true;
+	return (await Deno.permissions.query({ name: "net" })).state === "granted";
+}
+const loggedUnpinned = /* @__PURE__ */ new Set();
+function logUnpinned(url) {
+	const runtime = detectRuntime();
+	const key = `${runtime} ${url.protocol}`;
+	if (loggedUnpinned.has(key)) return;
+	loggedUnpinned.add(key);
+	logger$2.debug("Outbound {protocol} connections are not pinned to validated addresses on {runtime}; the hostname is resolved again when connecting.", {
+		runtime,
+		protocol: url.protocol
+	});
+}
 //#endregion
 //#region ../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/platform/node/globalThis.js
 /** only globals that common to node and browsers are allowed */
@@ -25710,7 +26412,7 @@ const preloadedContexts = {
 	"https://purl.archive.org/miscellany": miscellany_default
 };
 var name = "@fedify/vocab-runtime";
-var version = "2.0.35-dev.2470+891ba128";
+var version = "2.0.35-dev.2485+75206550";
 /**
 * Error thrown when fetching a JSON-LD document failed.
 */
@@ -26024,214 +26726,6 @@ var HttpHeaderLink = class HttpHeaderLink {
 		return new this(...inputs).toString();
 	}
 };
-var UrlError = class extends Error {
-	/**
-	* The failure category. Defaults to `"disallowed"`.
-	* `"dns"` includes lookup errors and results with no usable IP addresses.
-	* @since 2.0.29
-	*/
-	reason;
-	constructor(message, options) {
-		super(message, options);
-		this.name = "UrlError";
-		this.reason = options?.reason ?? "disallowed";
-	}
-};
-/**
-* Validates a URL to prevent SSRF attacks.
-*/
-async function validatePublicUrl(url) {
-	const parsed = new URL(url);
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
-	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
-	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
-	const hostnameFamily = isIP(hostname);
-	if (hostnameFamily !== 0) {
-		validatePublicIpAddress(hostname, hostnameFamily);
-		return;
-	}
-	if ("Deno" in globalThis && !isIP(hostname)) {
-		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
-	}
-	if ("Bun" in globalThis) {
-		if (hostname === "example.com" || hostname.endsWith(".example.com")) return;
-		else if (hostname === "fedify-test.internal") throw new UrlError("Invalid or private address: fedify-test.internal");
-	}
-	let addresses;
-	try {
-		addresses = await dns.lookup(hostname, { all: true });
-	} catch (error) {
-		throw new UrlError("DNS lookup failed", {
-			cause: error,
-			reason: "dns"
-		});
-	}
-	validateLookupAddresses(addresses);
-}
-/**
-* Validates the IP addresses returned by `node:dns.lookup()`.
-*
-* Cloudflare Workers' `node:dns` implementation currently maps every record
-* in a DNS-over-HTTPS `Answer` array—including CNAME records—to a
-* `LookupAddress`, even though Node.js specifies that the `address` field must
-* contain an IPv4 or IPv6 literal.  See:
-* https://github.com/cloudflare/workerd/issues/6886
-*
-* Work around that bug by ignoring non-IP entries only when the lookup also
-* returns at least one actual IP address.  This remains fail-closed: a result
-* containing no IP addresses is rejected, and every returned IP address is
-* still validated and must be public.  This workaround can be revisited once
-* the Workerd issue is fixed in supported Cloudflare Workers runtimes.
-*
-* @internal
-*/
-function validateLookupAddresses(addresses) {
-	let ipAddressCount = 0;
-	for (const { address } of addresses) {
-		const family = isIP(address);
-		if (family === 0) continue;
-		ipAddressCount++;
-		validatePublicIpAddress(address, family);
-	}
-	if (ipAddressCount === 0) throw new UrlError("DNS lookup did not return any IP address", { reason: "dns" });
-}
-function validatePublicIpAddress(address, family) {
-	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
-	throw new UrlError(`Invalid or private address: ${address}`);
-}
-function isValidPublicIPv4Address(address) {
-	const parts = parseIPv4Address(address);
-	if (parts == null) return false;
-	const value = ipv4PartsToNumber(parts);
-	return !nonPublicIPv4Prefixes.some(({ base, prefix }) => matchesIPv4Prefix(value, base, prefix));
-}
-function isValidPublicIPv6Address(address) {
-	const words = parseIPv6Address(address);
-	if (words == null) return false;
-	if (nonPublicIPv6Prefixes.some(({ words: prefixWords, prefix }) => matchesIPv6Prefix(words, prefixWords, prefix))) return false;
-	for (const { extractIPv4, prefix, words: prefixWords } of ipv6WithIPv4Prefixes) {
-		if (!matchesIPv6Prefix(words, prefixWords, prefix)) continue;
-		const ipv4Address = extractIPv4(words);
-		if (ipv4Address != null && !isValidPublicIPv4Address(ipv4Address)) return false;
-	}
-	return true;
-}
-function expandIPv6Address(address) {
-	address = address.toLowerCase();
-	const ipv4Delimiter = address.lastIndexOf(":");
-	if (address.includes(".") && ipv4Delimiter >= 0) {
-		const ipv4Parts = parseIPv4Address(address.substring(ipv4Delimiter + 1));
-		if (ipv4Parts == null) return address;
-		const high = (ipv4Parts[0] << 8) + ipv4Parts[1];
-		const low = (ipv4Parts[2] << 8) + ipv4Parts[3];
-		address = address.substring(0, ipv4Delimiter + 1) + high.toString(16) + ":" + low.toString(16);
-	}
-	if (address === "::") return "0000:0000:0000:0000:0000:0000:0000:0000";
-	if (address.startsWith("::")) address = "0000" + address;
-	if (address.endsWith("::")) address = address + "0000";
-	address = address.replace("::", ":0000".repeat(8 - (address.match(/:/g) || []).length) + ":");
-	return address.split(":").map((part) => part.padStart(4, "0")).join(":");
-}
-const nonPublicIPv4Prefixes = [
-	ipv4Prefix("0.0.0.0/8", "RFC 6890"),
-	ipv4Prefix("10.0.0.0/8", "RFC 1918"),
-	ipv4Prefix("100.64.0.0/10", "RFC 6598"),
-	ipv4Prefix("127.0.0.0/8", "RFC 1122"),
-	ipv4Prefix("169.254.0.0/16", "RFC 3927"),
-	ipv4Prefix("172.16.0.0/12", "RFC 1918"),
-	ipv4Prefix("192.0.0.0/24", "RFC 6890"),
-	ipv4Prefix("192.0.2.0/24", "RFC 5737"),
-	ipv4Prefix("192.88.99.0/24", "RFC 7526"),
-	ipv4Prefix("192.168.0.0/16", "RFC 1918"),
-	ipv4Prefix("198.18.0.0/15", "RFC 2544"),
-	ipv4Prefix("198.51.100.0/24", "RFC 5737"),
-	ipv4Prefix("203.0.113.0/24", "RFC 5737"),
-	ipv4Prefix("224.0.0.0/4", "RFC 5771"),
-	ipv4Prefix("240.0.0.0/4", "RFC 1112")
-];
-const nonPublicIPv6Prefixes = [
-	ipv6Prefix("::/16", "RFC 4291"),
-	ipv6Prefix("2001::/32", "RFC 4380"),
-	ipv6Prefix("2002::/16", "RFC 3056"),
-	ipv6Prefix("64:ff9b:1::/48", "RFC 8215"),
-	ipv6Prefix("fc00::/7", "RFC 4193"),
-	ipv6Prefix("fe80::/10", "RFC 4291"),
-	ipv6Prefix("ff00::/8", "RFC 4291")
-];
-const ipv6WithIPv4Prefixes = [{
-	...ipv6Prefix("64:ff9b::/96", "RFC 6052"),
-	extractIPv4: (words) => ipv4FromWords(words[6], words[7])
-}];
-function ipv4Prefix(cidr, rfc) {
-	const [address, prefixText] = cidr.split("/");
-	const prefix = parseInt(prefixText, 10);
-	const parts = parseIPv4Address(address);
-	if (parts == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) throw new Error(`Invalid IPv4 prefix: ${cidr}`);
-	return {
-		cidr,
-		base: ipv4PartsToNumber(parts),
-		prefix,
-		rfc
-	};
-}
-function ipv6Prefix(cidr, rfc) {
-	const [address, prefixText] = cidr.split("/");
-	const prefix = parseInt(prefixText, 10);
-	const words = parseIPv6Address(address);
-	if (words == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 128) throw new Error(`Invalid IPv6 prefix: ${cidr}`);
-	return {
-		cidr,
-		words,
-		prefix,
-		rfc
-	};
-}
-function parseIPv4Address(address) {
-	const parts = address.split(".").map((part) => {
-		if (!/^\d+$/.test(part)) return NaN;
-		return parseInt(part, 10);
-	});
-	if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;
-	return parts;
-}
-function parseIPv6Address(address) {
-	const parts = expandIPv6Address(address).split(":");
-	if (parts.length !== 8) return null;
-	const words = parts.map((part) => {
-		if (!/^[0-9a-f]{1,4}$/i.test(part)) return NaN;
-		return parseInt(part, 16);
-	});
-	if (words.some((word) => !Number.isInteger(word) || word < 0 || word > 65535)) return null;
-	return words;
-}
-function ipv4PartsToNumber(parts) {
-	return parts[0] * 2 ** 24 + parts[1] * 2 ** 16 + parts[2] * 2 ** 8 + parts[3];
-}
-function ipv4FromWords(highWord, lowWord) {
-	return [
-		highWord >> 8,
-		highWord & 255,
-		lowWord >> 8,
-		lowWord & 255
-	].join(".");
-}
-function matchesIPv4Prefix(address, prefixBase, prefixLength) {
-	const blockSize = 2 ** (32 - prefixLength);
-	return Math.floor(address / blockSize) === Math.floor(prefixBase / blockSize);
-}
-function matchesIPv6Prefix(address, prefixWords, prefixLength) {
-	let remaining = prefixLength;
-	for (let i = 0; i < 8 && remaining > 0; i++) if (remaining >= 16) {
-		if (address[i] !== prefixWords[i]) return false;
-		remaining -= 16;
-	} else {
-		const mask = 65535 << 16 - remaining & 65535;
-		if ((address[i] & mask) !== (prefixWords[i] & mask)) return false;
-		remaining = 0;
-	}
-	return true;
-}
 const logger = getLogger([
 	"fedify",
 	"runtime",
@@ -26239,16 +26733,34 @@ const logger = getLogger([
 ]);
 const DEFAULT_MAX_REDIRECTION = 20;
 /**
-* Gets a {@link RemoteDocument} from the given response.
+* Starts cancelling the body of a response without waiting for it to settle.
+* The cancellation of a branch of a tee (e.g., a body cloned by a fetch mock)
+* settles only after the other branch is cancelled too, per the Streams
+* standard, so awaiting it could block forever.  Failures are only logged.
+* @param response The response whose body is cancelled.
+* @param url The URL of the response, for logging.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
+		});
+	});
+}
+/**
+* Gets a {@link RemoteDocument} from the given response, or the URL of an
+* alternate document to load instead.  When an alternate document is found,
+* the response body has been either read or its cancellation has been started
+* (without waiting for it), so that the alternate document can be loaded after
+* the response's session is closed.
 * @param url The URL of the document to load.
 * @param response The response to get the document from.
-* @param fetch The function to fetch the document.
-* @returns The loaded remote document.
+* @returns The loaded remote document, or the alternate document URL.
 * @throws {FetchError} If the response is not OK.
-* @internal
 */
-async function getRemoteDocument(url, response, fetch) {
-	const documentUrl = response.url === "" ? url : response.url;
+async function parseRemoteDocument(url, response) {
+	const documentUrl = url;
 	const docUrl = new URL(documentUrl);
 	if (!response.ok) {
 		logger.error("Failed to fetch document: {status} {url} {headers}", {
@@ -26285,7 +26797,8 @@ async function getRemoteDocument(url, response, fetch) {
 						alternateUrl: altUri.href,
 						url: documentUrl
 					});
-					return await fetch(altUri.href);
+					cancelResponseBody(response, documentUrl);
+					return { alternate: altUri.href };
 				}
 			}
 		}
@@ -26310,7 +26823,7 @@ async function getRemoteDocument(url, response, fetch) {
 					alternateUrl: attribs.href,
 					url: documentUrl
 				});
-				return await fetch(new URL(attribs.href, docUrl).href);
+				return { alternate: new URL(attribs.href, docUrl).href };
 			}
 		}
 		document = JSON.parse(html);
@@ -26320,11 +26833,11 @@ async function getRemoteDocument(url, response, fetch) {
 		url: documentUrl,
 		headers: Object.fromEntries(response.headers.entries())
 	});
-	return {
+	return { document: {
 		contextUrl,
 		document,
 		documentUrl
-	};
+	} };
 }
 /**
 * Creates a JSON-LD document loader that utilizes the browser's `fetch` API.
@@ -26350,8 +26863,53 @@ async function getRemoteDocument(url, response, fetch) {
 * @returns The document loader.
 * @since 1.3.0
 */
-function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAgent } = {}) {
+function getDocumentLoader(options = {}) {
+	return createDocumentLoader(options);
+}
+/**
+* The implementation of {@link getDocumentLoader}, with injectable
+* dependencies.  This is not exported from any entry point.
+* @param options Options for the document loader.
+* @param deps The dependencies.
+* @returns The document loader.
+*/
+function createDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAgent } = {}, deps = {}) {
 	const tracer = trace.getTracerProvider().getTracer(name, version);
+	async function openHop(url, signal) {
+		try {
+			if (deps.openHop != null) return await deps.openHop(url);
+			return allowPrivateAddress ? await openDirectFetch(url) : await openPublicFetch(url, { signal });
+		} catch (error) {
+			if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	async function fetchHop(session, url, span, options) {
+		try {
+			const request = createActivityPubRequest(url, { userAgent });
+			logRequest(logger, request);
+			const response = await session.fetch(request, {
+				redirect: "manual",
+				signal: options?.signal
+			});
+			span.setAttribute("http.response.status_code", response.status);
+			if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+				const location = response.headers.get("Location");
+				cancelResponseBody(response, url);
+				return { location };
+			}
+			return await parseRemoteDocument(url, response);
+		} finally {
+			await session.close();
+		}
+	}
 	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
 		const parsedUrl = new URL(url);
@@ -26366,33 +26924,15 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 				documentUrl: currentUrl
 			};
 		}
-		if (!allowPrivateAddress) try {
-			await validatePublicUrl(currentUrl);
-		} catch (error) {
-			if (error instanceof UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
-				url: currentUrl,
-				error
-			});
-			else logger.error("Disallowed private URL: {url}", {
-				url: currentUrl,
-				error
-			});
-			throw error;
-		}
+		const session = await openHop(currentUrl, options?.signal);
 		visited.add(currentUrl);
 		return await tracer.startActiveSpan("activitypub.fetch_document", {
 			kind: SpanKind.CLIENT,
 			attributes: { "url.full": currentUrl }
 		}, async (span) => {
 			try {
-				const request = createActivityPubRequest(currentUrl, { userAgent });
-				logRequest(logger, request);
-				const response = await fetch(request, {
-					redirect: "manual",
-					signal: options?.signal
-				});
-				span.setAttribute("http.response.status_code", response.status);
-				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+				const outcome = await fetchHop(session, currentUrl, span, options);
+				if ("location" in outcome) {
 					if (redirected >= DEFAULT_MAX_REDIRECTION) {
 						logger.error("Too many redirections ({redirections}) while fetching document.", {
 							redirections: redirected + 1,
@@ -26400,7 +26940,7 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 						});
 						throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
 					}
-					const redirectUrl = new URL(response.headers.get("Location"), response.url === "" ? currentUrl : response.url).href;
+					const redirectUrl = new URL(outcome.location, currentUrl).href;
 					span.setAttribute("http.redirect.url", redirectUrl);
 					if (visited.has(redirectUrl)) {
 						logger.error("Detected a redirect loop while fetching document: {url} -> {redirectUrl}", {
@@ -26411,12 +26951,14 @@ function getDocumentLoader({ allowPrivateAddress, skipPreloadedContexts, userAge
 					}
 					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(currentUrl, response, async (alternateUrl) => {
+				let result;
+				if ("alternate" in outcome) {
+					const alternateUrl = outcome.alternate;
 					options?.signal?.throwIfAborted();
 					if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
 					if (visited.has(alternateUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${alternateUrl}`);
-					return await load(alternateUrl, options, redirected + 1, visited);
-				});
+					result = await load(alternateUrl, options, redirected + 1, visited);
+				} else result = outcome.document;
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;