@fedify/vocab-runtime 2.4.0-dev.1564 → 2.4.0-dev.1570

package/dist/tests/{url-YWJbnRlf.mjs → url-m9Qzxy-Y.mjs}

@@ -7,90 +7,6 @@ var UrlError = class extends Error {
 		this.name = "UrlError";
 	}
 };
-const PORTABLE_IRI_PATTERN = /^(ap|ap\+ef61):\/\/([^/?#]*)([^?#]*)(\?[^#]*)?(#.*)?$/i;
-const INVALID_PERCENT_ENCODING_PATTERN = /%(?![0-9A-Fa-f]{2})/;
-const DID_SCHEME_PATTERN = /^did:/i;
-const DID_PATTERN = /^did:[a-z0-9]+:[-A-Za-z0-9._%]+(?::[-A-Za-z0-9._%]+)*$/i;
-/**
-* Parses a JSON-LD `@id` value as an IRI.
-*/
-function parseJsonLdId(id, base) {
-	if (id == null || id.startsWith("_:")) return void 0;
-	try {
-		return parseIri(id, base);
-	} catch {
-		throw new TypeError("Invalid @id: " + id);
-	}
-}
-/**
-* Parses an IRI as a URL, including FEP-ef61 portable ActivityPub IRIs.
-*/
-function parseIri(iri, base) {
-	if (iri instanceof URL) return normalizePortableUrl(iri) ?? new URL(iri.href);
-	const portable = parsePortableIri(iri);
-	if (portable != null) return portable;
-	base = normalizeBaseIri(base);
-	if (!URL.canParse(iri, base) && iri.startsWith("at://")) return parseAtUri(iri);
-	const parsed = new URL(iri, base);
-	return normalizePortableUrl(parsed) ?? parsed;
-}
-/**
-* Formats a URL as an IRI, including FEP-ef61 portable ActivityPub IRIs.
-*/
-function formatIri(iri) {
-	const parsed = parsePortableIri(iri instanceof URL ? iri.href : iri);
-	if (parsed == null) return iri instanceof URL ? iri.href : URL.canParse(iri) ? new URL(iri).href : iri;
-	return `ap+ef61://${decodePortableAuthority(parsed.host)}${parsed.pathname}${parsed.search}${parsed.hash}`;
-}
-/**
-* Checks whether two IRIs have the same origin.
-*/
-function haveSameIriOrigin(left, right) {
-	return getComparableIriOrigin(left) === getComparableIriOrigin(right);
-}
-function getComparableIriOrigin(iri) {
-	iri = normalizePortableUrl(iri) ?? iri;
-	if (iri.origin !== "null") return iri.origin;
-	if (iri.host !== "") {
-		const host = iri.protocol === "ap+ef61:" ? encodeURIComponent(decodePortableAuthority(iri.host).replace(DID_SCHEME_PATTERN, "did:")) : iri.host;
-		return `${iri.protocol}//${host}`;
-	}
-	return iri.href;
-}
-function parsePortableIri(iri) {
-	const match = iri.match(PORTABLE_IRI_PATTERN);
-	if (match == null) return null;
-	const authority = decodePortableAuthority(match[2]);
-	if (!DID_PATTERN.test(authority)) throw new TypeError("Invalid portable ActivityPub IRI authority.");
-	if (match[3] === "") throw new TypeError("Invalid portable ActivityPub IRI path.");
-	return new URL(`ap+ef61://${encodeURIComponent(authority)}${match[3]}${match[4] ?? ""}${match[5] ?? ""}`);
-}
-function normalizePortableUrl(iri) {
-	if (iri.protocol !== "ap:" && iri.protocol !== "ap+ef61:") return null;
-	return parsePortableIri(`ap+ef61://${iri.host}${iri.pathname}${iri.search}${iri.hash}`);
-}
-function normalizeBaseIri(base) {
-	if (base == null) return void 0;
-	if (base instanceof URL) return normalizePortableUrl(base) ?? base;
-	return parsePortableIri(base) ?? (base.startsWith("at://") && !URL.canParse(".", base) ? parseAtUri(base) : base);
-}
-function decodePortableAuthority(authority) {
-	if (INVALID_PERCENT_ENCODING_PATTERN.test(authority)) throw new TypeError("Invalid portable ActivityPub IRI authority.");
-	if (DID_SCHEME_PATTERN.test(authority)) {
-		const decoded = authority.replace(/%25/gi, "%");
-		if (INVALID_PERCENT_ENCODING_PATTERN.test(decoded)) throw new TypeError("Invalid portable ActivityPub IRI authority.");
-		return decoded;
-	}
-	const decoded = authority.replace(/%(25|3A)/gi, (match) => match.toLowerCase() === "%3a" ? ":" : "%");
-	if (INVALID_PERCENT_ENCODING_PATTERN.test(decoded)) throw new TypeError("Invalid portable ActivityPub IRI authority.");
-	return decoded;
-}
-function parseAtUri(uri) {
-	const index = uri.indexOf("/", 5);
-	const authority = index >= 0 ? uri.slice(5, index) : uri.slice(5);
-	const path = index >= 0 ? uri.slice(index) : "";
-	return new URL("at://" + encodeURIComponent(authority) + path);
-}
 /**
 * Validates a URL to prevent SSRF attacks.
 */
@@ -257,4 +173,4 @@ function matchesIPv6Prefix(address, prefixWords, prefixLength) {
 	return true;
 }
 //#endregion
-export { isValidPublicIPv4Address as a, parseJsonLdId as c, haveSameIriOrigin as i, validatePublicUrl as l, expandIPv6Address as n, isValidPublicIPv6Address as o, formatIri as r, parseIri as s, UrlError as t };
+export { validatePublicUrl as a, isValidPublicIPv6Address as i, expandIPv6Address as n, isValidPublicIPv4Address as r, UrlError as t };

package/dist/tests/url.test.cjs

@@ -1,111 +1,8 @@
 require("./chunk-C2EiDwsr.cjs");
-const require_url = require("./url-2XwVbUS_.cjs");
+const require_url = require("./url-C20FhC7p.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 //#region src/url.test.ts
-(0, node_test.test)("parseIri() accepts portable ActivityPub URI schemes", () => {
-	for (const iri of [
-		"ap://did:key:z6Mkabc/actor",
-		"ap://did%3Akey%3Az6Mkabc/actor",
-		"ap+ef61://did:key:z6Mkabc/actor",
-		"ap+ef61://did%3Akey%3Az6Mkabc/actor",
-		"AP+EF61://did:key:z6Mkabc/actor"
-	]) (0, node_assert.deepStrictEqual)(require_url.parseIri(iri), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"));
-});
-(0, node_test.test)("parseIri() accepts DID schemes case-insensitively", () => {
-	for (const iri of ["ap://DID:key:z6Mkabc/actor", "ap://DID%3Akey%3Az6Mkabc/actor"]) (0, node_assert.deepStrictEqual)(require_url.parseIri(iri), new URL("ap+ef61://DID%3Akey%3Az6Mkabc/actor"));
-});
-(0, node_test.test)("parseIri() accepts DID method names that start with digits", () => {
-	(0, node_assert.deepStrictEqual)(require_url.parseIri("ap://did:3:abc/actor"), new URL("ap+ef61://did%3A3%3Aabc/actor"));
-});
-(0, node_test.test)("parseIri() accepts hyphens in DID method-specific IDs", () => {
-	(0, node_assert.deepStrictEqual)(require_url.parseIri("ap+ef61://did:web:foo-bar.example/actor"), new URL("ap+ef61://did%3Aweb%3Afoo-bar.example/actor"));
-});
-(0, node_test.test)("parseIri() preserves existing URL parsing behavior", () => {
-	(0, node_assert.deepStrictEqual)(require_url.parseIri("/actor", new URL("https://example.com/users/alice")), new URL("https://example.com/actor"));
-	(0, node_assert.deepStrictEqual)(require_url.parseIri("at://did:plc:example/record"), new URL("at://did%3Aplc%3Aexample/record"));
-	(0, node_assert.throws)(() => require_url.parseIri("ap://not-a-did/actor"), TypeError);
-});
-(0, node_test.test)("parseJsonLdId() parses JSON-LD ids", () => {
-	(0, node_assert.deepStrictEqual)(require_url.parseJsonLdId(void 0), void 0);
-	(0, node_assert.deepStrictEqual)(require_url.parseJsonLdId("_:blank"), void 0);
-	(0, node_assert.deepStrictEqual)(require_url.parseJsonLdId("/actor", new URL("https://example.com/users/alice")), new URL("https://example.com/actor"));
-	(0, node_assert.deepStrictEqual)(require_url.parseJsonLdId("ap://did:key:z6Mkabc/actor"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"));
-	(0, node_assert.throws)(() => require_url.parseJsonLdId("/actor"), {
-		name: "TypeError",
-		message: "Invalid @id: /actor"
-	});
-});
-(0, node_test.test)("parseIri() resolves relative IRIs against portable string bases", () => {
-	(0, node_assert.deepStrictEqual)(require_url.parseIri("/actor", "ap://did:key:z6Mkabc/objects/1"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"));
-	(0, node_assert.deepStrictEqual)(require_url.parseIri("attachments/1", "ap://did:key:z6Mkabc/objects/1"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/objects/attachments/1"));
-	(0, node_assert.throws)(() => require_url.parseIri("//example.com/outbox", "ap://did:key:z6Mkabc/objects/1"), TypeError);
-});
-(0, node_test.test)("parseIri() resolves relative IRIs against at:// string bases", () => {
-	(0, node_assert.deepStrictEqual)(require_url.parseIri("/record", "at://did:plc:example/collection/item"), new URL("at://did%3Aplc%3Aexample/record"));
-	(0, node_assert.deepStrictEqual)(require_url.parseIri("reply", "at://did:plc:example/collection/item"), new URL("at://did%3Aplc%3Aexample/collection/reply"));
-	(0, node_assert.deepStrictEqual)(require_url.parseIri("reply", "at://did%3Aplc%3Aexample/collection/item"), new URL("at://did%3Aplc%3Aexample/collection/reply"));
-});
-(0, node_test.test)("parseIri() rejects portable IRIs without paths", () => {
-	(0, node_assert.throws)(() => require_url.parseIri("ap://did:key:z6Mkabc"), TypeError);
-	(0, node_assert.throws)(() => require_url.parseIri("ap://did:key:z6Mkabc?gateways=https%3A%2F%2Fserver.example"), TypeError);
-	(0, node_assert.throws)(() => require_url.parseIri("ap://did:key:z6Mkabc#actor"), TypeError);
-});
-(0, node_test.test)("parseIri() rejects malformed portable DID authorities", () => {
-	for (const iri of [
-		"ap://did:/actor",
-		"ap://did:key/actor",
-		"ap://did%3Akey%3Aabc%25zz/actor",
-		"ap://did:key:abc%25zz/actor"
-	]) (0, node_assert.throws)(() => require_url.parseIri(iri), TypeError);
-});
-(0, node_test.test)("haveSameIriOrigin() compares portable IRI authorities", () => {
-	(0, node_assert.ok)(require_url.haveSameIriOrigin(require_url.parseIri("ap://did:key:z6Mkabc/actor"), require_url.parseIri("ap://did:key:z6Mkabc/outbox")));
-	(0, node_assert.ok)(require_url.haveSameIriOrigin(new URL("ap://did%3Akey%3Az6Mkabc/actor"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/outbox")));
-	(0, node_assert.ok)(require_url.haveSameIriOrigin(require_url.parseIri("ap://DID:key:z6Mkabc/actor"), require_url.parseIri("ap://did:key:z6Mkabc/outbox")));
-	(0, node_assert.ok)(require_url.haveSameIriOrigin(new URL("ap+ef61://DID%3Akey%3Az6Mkabc/actor"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/outbox")));
-	(0, node_assert.ok)(!require_url.haveSameIriOrigin(require_url.parseIri("ap://did:key:z6Mkabc/actor"), require_url.parseIri("ap://did:key:z6Mkdef/actor")));
-});
-(0, node_test.test)("parseIri() normalizes portable URL instances", () => {
-	(0, node_assert.deepStrictEqual)(require_url.parseIri(new URL("ap+ef61://did%3Aexample%3Aabc%2Fdef/actor")), new URL("ap+ef61://did%3Aexample%3Aabc%252Fdef/actor"));
-	(0, node_assert.throws)(() => require_url.parseIri("ap+ef61://not-a-did/actor"), TypeError);
-});
-(0, node_test.test)("formatIri() emits canonical portable ActivityPub URI syntax", () => {
-	const cases = [new URL("ap://did%3Akey%3Az6Mkabc/actor"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor")];
-	for (const iri of cases) (0, node_assert.deepStrictEqual)(require_url.formatIri(iri), "ap+ef61://did:key:z6Mkabc/actor");
-	(0, node_assert.deepStrictEqual)(require_url.formatIri(new URL("https://example.com/actor")), "https://example.com/actor");
-	(0, node_assert.deepStrictEqual)(require_url.formatIri("/actor"), "/actor");
-});
-(0, node_test.test)("formatIri() preserves DID authority pct-encoded delimiters", () => {
-	const parsed = require_url.parseIri("ap://did:example:abc%2Fdef/actor");
-	(0, node_assert.deepStrictEqual)(parsed, new URL("ap+ef61://did%3Aexample%3Aabc%252Fdef/actor"));
-	(0, node_assert.deepStrictEqual)(require_url.formatIri(parsed), "ap+ef61://did:example:abc%2Fdef/actor");
-	(0, node_assert.deepStrictEqual)(require_url.parseIri(require_url.formatIri(parsed)), parsed);
-	(0, node_assert.deepStrictEqual)(require_url.formatIri(new URL("ap+ef61://did%3Aexample%3Aabc%2Fdef/actor")), "ap+ef61://did:example:abc%2Fdef/actor");
-});
-(0, node_test.test)("parseIri() normalizes equivalent encoded DID authorities", () => {
-	(0, node_assert.deepStrictEqual)(require_url.parseIri("ap://did:example:abc%252Fdef/actor"), require_url.parseIri("ap://did%3Aexample%3Aabc%252Fdef/actor"));
-});
-(0, node_test.test)("formatIri() preserves DID-internal pct-encoded authority characters", () => {
-	const parsed = require_url.parseIri("ap://did:web:example.com%3A3000/actor");
-	(0, node_assert.deepStrictEqual)(parsed, new URL("ap+ef61://did%3Aweb%3Aexample.com%253A3000/actor"));
-	(0, node_assert.deepStrictEqual)(require_url.formatIri(parsed), "ap+ef61://did:web:example.com%3A3000/actor");
-});
-(0, node_test.test)("parseIri() accepts portable DID URLs with encoded DID delimiters", () => {
-	const parsed = require_url.parseIri("ap://did:web:example.com%3A3000/u/1");
-	(0, node_assert.deepStrictEqual)(parsed, new URL("ap+ef61://did%3Aweb%3Aexample.com%253A3000/u/1"));
-	(0, node_assert.deepStrictEqual)(require_url.formatIri(parsed), "ap+ef61://did:web:example.com%3A3000/u/1");
-});
-(0, node_test.test)("parseIri() decodes pct-encoded DID delimiters in order", () => {
-	const parsed = require_url.parseIri("ap://did%3Aweb%3Aexample.com%253A3000/u/1");
-	(0, node_assert.deepStrictEqual)(parsed, new URL("ap+ef61://did%3Aweb%3Aexample.com%253A3000/u/1"));
-	(0, node_assert.deepStrictEqual)(require_url.formatIri(parsed), "ap+ef61://did:web:example.com%3A3000/u/1");
-});
-(0, node_test.test)("parseIri() preserves encoded percent signs while decoding delimiters", () => {
-	const parsed = require_url.parseIri("ap://did%3Aweb%3Aexample.com%2500/u/1");
-	(0, node_assert.deepStrictEqual)(parsed, new URL("ap+ef61://did%3Aweb%3Aexample.com%2500/u/1"));
-	(0, node_assert.deepStrictEqual)(require_url.formatIri(parsed), "ap+ef61://did:web:example.com%00/u/1");
-});
 (0, node_test.test)("validatePublicUrl()", async () => {
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("ftp://localhost"), require_url.UrlError);
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("data:text/plain;base64,SGVsbG8sIFdvcmxkIQ=="), require_url.UrlError);

package/dist/tests/url.test.mjs

@@ -1,110 +1,7 @@
-import { a as isValidPublicIPv4Address, c as parseJsonLdId, i as haveSameIriOrigin, l as validatePublicUrl, n as expandIPv6Address, o as isValidPublicIPv6Address, r as formatIri, s as parseIri, t as UrlError } from "./url-YWJbnRlf.mjs";
-import { deepStrictEqual, ok, rejects, throws } from "node:assert";
+import { a as validatePublicUrl, i as isValidPublicIPv6Address, n as expandIPv6Address, r as isValidPublicIPv4Address, t as UrlError } from "./url-m9Qzxy-Y.mjs";
+import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
 //#region src/url.test.ts
-test("parseIri() accepts portable ActivityPub URI schemes", () => {
-	for (const iri of [
-		"ap://did:key:z6Mkabc/actor",
-		"ap://did%3Akey%3Az6Mkabc/actor",
-		"ap+ef61://did:key:z6Mkabc/actor",
-		"ap+ef61://did%3Akey%3Az6Mkabc/actor",
-		"AP+EF61://did:key:z6Mkabc/actor"
-	]) deepStrictEqual(parseIri(iri), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"));
-});
-test("parseIri() accepts DID schemes case-insensitively", () => {
-	for (const iri of ["ap://DID:key:z6Mkabc/actor", "ap://DID%3Akey%3Az6Mkabc/actor"]) deepStrictEqual(parseIri(iri), new URL("ap+ef61://DID%3Akey%3Az6Mkabc/actor"));
-});
-test("parseIri() accepts DID method names that start with digits", () => {
-	deepStrictEqual(parseIri("ap://did:3:abc/actor"), new URL("ap+ef61://did%3A3%3Aabc/actor"));
-});
-test("parseIri() accepts hyphens in DID method-specific IDs", () => {
-	deepStrictEqual(parseIri("ap+ef61://did:web:foo-bar.example/actor"), new URL("ap+ef61://did%3Aweb%3Afoo-bar.example/actor"));
-});
-test("parseIri() preserves existing URL parsing behavior", () => {
-	deepStrictEqual(parseIri("/actor", new URL("https://example.com/users/alice")), new URL("https://example.com/actor"));
-	deepStrictEqual(parseIri("at://did:plc:example/record"), new URL("at://did%3Aplc%3Aexample/record"));
-	throws(() => parseIri("ap://not-a-did/actor"), TypeError);
-});
-test("parseJsonLdId() parses JSON-LD ids", () => {
-	deepStrictEqual(parseJsonLdId(void 0), void 0);
-	deepStrictEqual(parseJsonLdId("_:blank"), void 0);
-	deepStrictEqual(parseJsonLdId("/actor", new URL("https://example.com/users/alice")), new URL("https://example.com/actor"));
-	deepStrictEqual(parseJsonLdId("ap://did:key:z6Mkabc/actor"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"));
-	throws(() => parseJsonLdId("/actor"), {
-		name: "TypeError",
-		message: "Invalid @id: /actor"
-	});
-});
-test("parseIri() resolves relative IRIs against portable string bases", () => {
-	deepStrictEqual(parseIri("/actor", "ap://did:key:z6Mkabc/objects/1"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"));
-	deepStrictEqual(parseIri("attachments/1", "ap://did:key:z6Mkabc/objects/1"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/objects/attachments/1"));
-	throws(() => parseIri("//example.com/outbox", "ap://did:key:z6Mkabc/objects/1"), TypeError);
-});
-test("parseIri() resolves relative IRIs against at:// string bases", () => {
-	deepStrictEqual(parseIri("/record", "at://did:plc:example/collection/item"), new URL("at://did%3Aplc%3Aexample/record"));
-	deepStrictEqual(parseIri("reply", "at://did:plc:example/collection/item"), new URL("at://did%3Aplc%3Aexample/collection/reply"));
-	deepStrictEqual(parseIri("reply", "at://did%3Aplc%3Aexample/collection/item"), new URL("at://did%3Aplc%3Aexample/collection/reply"));
-});
-test("parseIri() rejects portable IRIs without paths", () => {
-	throws(() => parseIri("ap://did:key:z6Mkabc"), TypeError);
-	throws(() => parseIri("ap://did:key:z6Mkabc?gateways=https%3A%2F%2Fserver.example"), TypeError);
-	throws(() => parseIri("ap://did:key:z6Mkabc#actor"), TypeError);
-});
-test("parseIri() rejects malformed portable DID authorities", () => {
-	for (const iri of [
-		"ap://did:/actor",
-		"ap://did:key/actor",
-		"ap://did%3Akey%3Aabc%25zz/actor",
-		"ap://did:key:abc%25zz/actor"
-	]) throws(() => parseIri(iri), TypeError);
-});
-test("haveSameIriOrigin() compares portable IRI authorities", () => {
-	ok(haveSameIriOrigin(parseIri("ap://did:key:z6Mkabc/actor"), parseIri("ap://did:key:z6Mkabc/outbox")));
-	ok(haveSameIriOrigin(new URL("ap://did%3Akey%3Az6Mkabc/actor"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/outbox")));
-	ok(haveSameIriOrigin(parseIri("ap://DID:key:z6Mkabc/actor"), parseIri("ap://did:key:z6Mkabc/outbox")));
-	ok(haveSameIriOrigin(new URL("ap+ef61://DID%3Akey%3Az6Mkabc/actor"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/outbox")));
-	ok(!haveSameIriOrigin(parseIri("ap://did:key:z6Mkabc/actor"), parseIri("ap://did:key:z6Mkdef/actor")));
-});
-test("parseIri() normalizes portable URL instances", () => {
-	deepStrictEqual(parseIri(new URL("ap+ef61://did%3Aexample%3Aabc%2Fdef/actor")), new URL("ap+ef61://did%3Aexample%3Aabc%252Fdef/actor"));
-	throws(() => parseIri("ap+ef61://not-a-did/actor"), TypeError);
-});
-test("formatIri() emits canonical portable ActivityPub URI syntax", () => {
-	const cases = [new URL("ap://did%3Akey%3Az6Mkabc/actor"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor")];
-	for (const iri of cases) deepStrictEqual(formatIri(iri), "ap+ef61://did:key:z6Mkabc/actor");
-	deepStrictEqual(formatIri(new URL("https://example.com/actor")), "https://example.com/actor");
-	deepStrictEqual(formatIri("/actor"), "/actor");
-});
-test("formatIri() preserves DID authority pct-encoded delimiters", () => {
-	const parsed = parseIri("ap://did:example:abc%2Fdef/actor");
-	deepStrictEqual(parsed, new URL("ap+ef61://did%3Aexample%3Aabc%252Fdef/actor"));
-	deepStrictEqual(formatIri(parsed), "ap+ef61://did:example:abc%2Fdef/actor");
-	deepStrictEqual(parseIri(formatIri(parsed)), parsed);
-	deepStrictEqual(formatIri(new URL("ap+ef61://did%3Aexample%3Aabc%2Fdef/actor")), "ap+ef61://did:example:abc%2Fdef/actor");
-});
-test("parseIri() normalizes equivalent encoded DID authorities", () => {
-	deepStrictEqual(parseIri("ap://did:example:abc%252Fdef/actor"), parseIri("ap://did%3Aexample%3Aabc%252Fdef/actor"));
-});
-test("formatIri() preserves DID-internal pct-encoded authority characters", () => {
-	const parsed = parseIri("ap://did:web:example.com%3A3000/actor");
-	deepStrictEqual(parsed, new URL("ap+ef61://did%3Aweb%3Aexample.com%253A3000/actor"));
-	deepStrictEqual(formatIri(parsed), "ap+ef61://did:web:example.com%3A3000/actor");
-});
-test("parseIri() accepts portable DID URLs with encoded DID delimiters", () => {
-	const parsed = parseIri("ap://did:web:example.com%3A3000/u/1");
-	deepStrictEqual(parsed, new URL("ap+ef61://did%3Aweb%3Aexample.com%253A3000/u/1"));
-	deepStrictEqual(formatIri(parsed), "ap+ef61://did:web:example.com%3A3000/u/1");
-});
-test("parseIri() decodes pct-encoded DID delimiters in order", () => {
-	const parsed = parseIri("ap://did%3Aweb%3Aexample.com%253A3000/u/1");
-	deepStrictEqual(parsed, new URL("ap+ef61://did%3Aweb%3Aexample.com%253A3000/u/1"));
-	deepStrictEqual(formatIri(parsed), "ap+ef61://did:web:example.com%3A3000/u/1");
-});
-test("parseIri() preserves encoded percent signs while decoding delimiters", () => {
-	const parsed = parseIri("ap://did%3Aweb%3Aexample.com%2500/u/1");
-	deepStrictEqual(parsed, new URL("ap+ef61://did%3Aweb%3Aexample.com%2500/u/1"));
-	deepStrictEqual(formatIri(parsed), "ap+ef61://did:web:example.com%00/u/1");
-});
 test("validatePublicUrl()", async () => {
 	await rejects(() => validatePublicUrl("ftp://localhost"), UrlError);
 	await rejects(() => validatePublicUrl("data:text/plain;base64,SGVsbG8sIFdvcmxkIQ=="), UrlError);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.4.0-dev.1564+5a2c6c2c",
+  "version": "2.4.0-dev.1570+f1b6aaa3",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -42,16 +42,6 @@
       "require": "./dist/jsonld.cjs",
       "default": "./dist/jsonld.js"
     },
-    "./internal/jsonld-cache": {
-      "types": {
-        "import": "./dist/internal/jsonld-cache.d.ts",
-        "require": "./dist/internal/jsonld-cache.d.cts",
-        "default": "./dist/internal/jsonld-cache.d.ts"
-      },
-      "import": "./dist/internal/jsonld-cache.js",
-      "require": "./dist/internal/jsonld-cache.cjs",
-      "default": "./dist/internal/jsonld-cache.js"
-    },
     "./temporal": {
       "types": {
         "import": "./dist/temporal.d.ts",

package/src/contexts.ts

@@ -7,7 +7,6 @@ import activitystreams from "./contexts/activitystreams.json" with {
 };
 import didV1 from "./contexts/did-v1.json" with { type: "json" };
 import fep5711 from "./contexts/fep-5711.json" with { type: "json" };
-import fep7aa9 from "./contexts/fep-7aa9.json" with { type: "json" };
 import gotosocial from "./contexts/gotosocial.json" with { type: "json" };
 import identityV1 from "./contexts/identity-v1.json" with { type: "json" };
 import joinLemmyContext from "./contexts/join-lemmy.json" with { type: "json" };
@@ -36,7 +35,6 @@ const preloadedContexts: Record<string, unknown> = {
   "http://schema.org/": schemaorg,
   "https://gotosocial.org/ns": gotosocial,
   "https://w3id.org/fep/5711": fep5711,
-  "https://w3id.org/fep/7aa9": fep7aa9,
 
   // Lemmy's context document is served as application/json without the JSON-LD
   // context Link header.  The default document loader treats that as a regular

package/src/docloader.test.ts

@@ -2,7 +2,7 @@ import fetchMock from "fetch-mock";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
 import preloadedContexts from "./contexts.ts";
-import { getDocumentLoader, getRemoteDocument } from "./docloader.ts";
+import { getDocumentLoader } from "./docloader.ts";
 import { FetchError } from "./request.ts";
 import { UrlError } from "./url.ts";
 
@@ -90,7 +90,7 @@ test("getDocumentLoader()", async (t) => {
       type: "Object",
     },
     headers: {
-      "Content-Type": "application/activity+json",
+      "Content-Type": "text/html; charset=utf-8",
       Link: '<https://example.com/object>; rel="alternate"; ' +
         'type="application/ld+json; profile="https://www.w3.org/ns/activitystreams""',
     },
@@ -247,44 +247,6 @@ test("getDocumentLoader()", async (t) => {
     });
   });
 
-  fetchMock.get("https://example.com/html-no-alternate", {
-    body: `<!DOCTYPE html>
-      <html>
-        <head>
-          <title>Not an ActivityPub document</title>
-        </head>
-        <body>Not found</body>
-      </html>`,
-    headers: { "Content-Type": "text/html; charset=utf-8" },
-  });
-
-  await t.test("HTML without ActivityPub alternate link", async () => {
-    await rejects(
-      () => fetchDocumentLoader("https://example.com/html-no-alternate"),
-      (error) => {
-        ok(error instanceof FetchError);
-        ok(
-          error.message.includes(
-            "HTML document has no ActivityPub alternate link",
-          ),
-        );
-        ok(
-          error.message.includes("Content-Type: text/html; charset=utf-8"),
-        );
-        deepStrictEqual(
-          error.url,
-          new URL("https://example.com/html-no-alternate"),
-        );
-        ok(error.response != null);
-        deepStrictEqual(
-          error.response.headers.get("Content-Type"),
-          "text/html; charset=utf-8",
-        );
-        return true;
-      },
-    );
-  });
-
   fetchMock.get("https://example.com/wrong-content-type", {
     body: {
       "@context": "https://www.w3.org/ns/activitystreams",
@@ -295,7 +257,7 @@ test("getDocumentLoader()", async (t) => {
     headers: { "Content-Type": "text/html; charset=utf-8" },
   });
 
-  await t.test("wrong Content-Type with JSON body", async () => {
+  await t.test("Wrong Content-Type", async () => {
     deepStrictEqual(
       await fetchDocumentLoader("https://example.com/wrong-content-type"),
       {
@@ -311,64 +273,6 @@ test("getDocumentLoader()", async (t) => {
     );
   });
 
-  fetchMock.get("https://example.com/large-html", {
-    body: "<!DOCTYPE html>",
-    headers: {
-      "Content-Length": String(1024 * 1024 + 1),
-      "Content-Type": "text/html; charset=utf-8",
-    },
-  });
-
-  await t.test("HTML Content-Length over limit", async () => {
-    await rejects(
-      () => fetchDocumentLoader("https://example.com/large-html"),
-      (error) => {
-        ok(error instanceof FetchError);
-        ok(
-          error.message.includes(
-            "HTML document is too large to scan for an ActivityPub alternate link",
-          ),
-        );
-        ok(error.response != null);
-        deepStrictEqual(error.response.status, 200);
-        deepStrictEqual(
-          error.response.headers.get("Content-Type"),
-          "text/html; charset=utf-8",
-        );
-        return true;
-      },
-    );
-  });
-
-  await t.test("HTML Content-Length over limit cancels body", async () => {
-    let canceled = false;
-    const response = new Response("<!DOCTYPE html>", {
-      headers: {
-        "Content-Length": String(1024 * 1024 + 1),
-        "Content-Type": "text/html; charset=utf-8",
-      },
-    });
-    Object.defineProperty(response, "body", {
-      value: {
-        cancel: () => {
-          canceled = true;
-        },
-      },
-    });
-    await rejects(
-      () =>
-        getRemoteDocument(
-          "https://example.com/large-html-cancel",
-          response,
-          () => {
-            throw new Error("unexpected alternate fetch");
-          },
-        ),
-      FetchError,
-    );
-    deepStrictEqual(canceled, true);
-  });
-
   fetchMock.get("https://example.com/404", { status: 404 });
 
   await t.test("not ok", async () => {
@@ -555,11 +459,11 @@ test("getDocumentLoader()", async (t) => {
 
   await t.test("ReDoS resistance (CVE-2025-68475)", async () => {
     const start = performance.now();
-    // The malicious HTML will fail alternate discovery, but the important
-    // thing is that it should complete quickly (not hang due to ReDoS).
+    // The malicious HTML will fail JSON parsing, but the important thing is
+    // that it should complete quickly (not hang due to ReDoS)
     await rejects(
       () => fetchDocumentLoader("https://example.com/redos"),
-      FetchError,
+      SyntaxError,
     );
     const elapsed = performance.now() - start;
 

package/src/docloader.ts

@@ -13,7 +13,6 @@ import { UrlError, validatePublicUrl } from "./url.ts";
 
 const logger = getLogger(["fedify", "runtime", "docloader"]);
 const DEFAULT_MAX_REDIRECTION = 20;
-const MAX_HTML_SIZE = 1024 * 1024; // 1MB
 
 /**
  * A remote JSON-LD document and its context fetched by
@@ -113,59 +112,6 @@ export type AuthenticatedDocumentLoaderFactory = (
   options?: DocumentLoaderFactoryOptions,
 ) => DocumentLoader;
 
-function createResponseMetadata(response: Response): Response {
-  return new Response(null, {
-    headers: response.headers,
-    status: response.status,
-    statusText: response.statusText,
-  });
-}
-
-async function cancelResponseBody(response: Response): Promise<void> {
-  if (response.body != null) {
-    await response.body.cancel();
-  }
-}
-
-async function readBoundedText(
-  response: Response,
-  maxBytes: number,
-): Promise<{ text: string; size: number; tooLarge: boolean }> {
-  const contentLength = response.headers.get("Content-Length");
-  if (contentLength != null) {
-    const size = Number(contentLength);
-    if (size > maxBytes) {
-      await cancelResponseBody(response);
-      return { text: "", size, tooLarge: true };
-    }
-  }
-
-  if (response.body == null) return { text: "", size: 0, tooLarge: false };
-
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder();
-  let text = "";
-  let size = 0;
-  try {
-    while (true) {
-      const result = await reader.read();
-      if (result.done) break;
-      const chunkSize = result.value.byteLength;
-      if (size + chunkSize > maxBytes) {
-        size += chunkSize;
-        await reader.cancel();
-        return { text: "", size, tooLarge: true };
-      }
-      size += chunkSize;
-      text += decoder.decode(result.value, { stream: true });
-    }
-    text += decoder.decode();
-    return { text, size, tooLarge: false };
-  } finally {
-    reader.releaseLock();
-  }
-}
-
 /**
  * Gets a {@link RemoteDocument} from the given response.
  * @param url The URL of the document to load.
@@ -254,19 +200,15 @@ export async function getRemoteDocument(
       contentType === "application/xhtml+xml" ||
       contentType?.startsWith("application/xhtml+xml;"))
   ) {
-    const errorResponse = createResponseMetadata(response);
-    const html = await readBoundedText(response, MAX_HTML_SIZE);
-    if (html.tooLarge) {
+    // Security: Limit HTML response size to mitigate ReDoS attacks
+    const MAX_HTML_SIZE = 1024 * 1024; // 1MB
+    const html = await response.text();
+    if (html.length > MAX_HTML_SIZE) {
       logger.warn(
         "HTML response too large, skipping alternate link discovery: {url}",
-        { url: documentUrl, size: html.size },
-      );
-      throw new FetchError(
-        documentUrl,
-        `HTML document is too large to scan for an ActivityPub alternate link ` +
-          `(Content-Type: ${contentType})`,
-        errorResponse,
+        { url: documentUrl, size: html.length },
       );
+      document = JSON.parse(html);
     } else {
       // Safe regex patterns without nested quantifiers to prevent ReDoS
       // (CVE-2025-68475)
@@ -277,7 +219,7 @@ export async function getRemoteDocument(
         /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 
       let tagMatch: RegExpExecArray | null;
-      while ((tagMatch = tagPattern.exec(html.text)) !== null) {
+      while ((tagMatch = tagPattern.exec(html)) !== null) {
         const tagContent = tagMatch[2];
         let attrMatch: RegExpExecArray | null;
         const attribs: Record<string, string> = {};
@@ -305,17 +247,7 @@ export async function getRemoteDocument(
           return await fetch(new URL(attribs.href, docUrl).href);
         }
       }
-      try {
-        document = JSON.parse(html.text);
-      } catch (error) {
-        if (!(error instanceof SyntaxError)) throw error;
-        throw new FetchError(
-          documentUrl,
-          `HTML document has no ActivityPub alternate link ` +
-            `(Content-Type: ${contentType})`,
-          errorResponse,
-        );
-      }
+      document = JSON.parse(html);
     }
   } else {
     document = await response.json();

package/src/mod.ts

@@ -51,12 +51,8 @@ export {
 } from "./preprocessor.ts";
 export {
   expandIPv6Address,
-  formatIri,
-  haveSameIriOrigin,
   isValidPublicIPv4Address,
   isValidPublicIPv6Address,
-  parseIri,
-  parseJsonLdId,
   UrlError,
   validatePublicUrl,
 } from "./url.ts";