@fedify/vocab-runtime 2.4.0-dev.1599 → 2.4.0-dev.1634

package/dist/tests/{url-CtKcX6ma.cjs → url-CsOV_B_P.cjs}

@@ -63,7 +63,7 @@ function canonicalizePortableUri(input) {
 	const parsed = parsePortableIri(input);
 	if (parsed == null) throw new TypeError("Invalid portable ActivityPub IRI.");
 	const match = input.match(PORTABLE_IRI_PATTERN);
-	return `ap+ef61://${normalizePortableAuthority(decodePortableAuthority(parsed.host).replace(DID_SCHEME_PATTERN, "did:"))}${normalizePortableComponent(match[3])}${match[5] == null ? "" : normalizePortableComponent(match[5])}`;
+	return `ap+ef61://${normalizePortableAuthority(getDidUrlOrigin(decodePortableAuthority(parsed.host)))}${normalizePortableComponent(match[3])}${match[5] == null ? "" : normalizePortableComponent(match[5])}`;
 }
 /**
 * Checks whether two FEP-ef61 portable ActivityPub URIs identify the same
@@ -88,6 +88,45 @@ function arePortableUrisEqual(left, right) {
 	}
 }
 /**
+* Computes an IRI's FEP-fe34 origin.
+*
+* HTTP(S) IRIs use their web origin.  FEP-ef61 portable ActivityPub IRIs and
+* DID URLs use their DID as a cryptographic origin.
+*
+* @throws {TypeError} If the IRI does not have a supported FEP-fe34 origin.
+* @since 2.4.0
+*/
+function getFe34Origin(input) {
+	if (input instanceof URL) {
+		const portable = normalizePortableUrl(input);
+		if (portable != null) return getPortableCryptographicOrigin(portable);
+		if (input.protocol === "did:") return getDidUrlOrigin(input.href);
+		if (input.protocol === "http:" || input.protocol === "https:") return input.origin;
+		throw new TypeError("Unsupported FEP-fe34 origin IRI.");
+	}
+	const portable = parsePortableIri(input);
+	if (portable != null) return getPortableCryptographicOrigin(portable);
+	if (DID_SCHEME_PATTERN.test(input)) return getDidUrlOrigin(input);
+	const parsed = new URL(input);
+	if (parsed.protocol === "http:" || parsed.protocol === "https:") return parsed.origin;
+	throw new TypeError("Unsupported FEP-fe34 origin IRI.");
+}
+/**
+* Checks whether two IRIs have the same FEP-fe34 origin.
+*
+* Malformed or unsupported IRIs are treated as non-matching.
+*
+* @since 2.4.0
+*/
+function haveSameFe34Origin(left, right) {
+	try {
+		return getFe34Origin(left) === getFe34Origin(right);
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+/**
 * Checks whether two IRIs have the same origin.
 */
 function haveSameIriOrigin(left, right) {
@@ -97,15 +136,25 @@ function getComparableIriOrigin(iri) {
 	iri = normalizePortableUrl(iri) ?? iri;
 	if (iri.origin !== "null") return iri.origin;
 	if (iri.host !== "") {
-		const host = iri.protocol === "ap+ef61:" ? encodeURIComponent(decodePortableAuthority(iri.host).replace(DID_SCHEME_PATTERN, "did:")) : iri.host;
+		const host = iri.protocol === "ap+ef61:" ? encodeURIComponent(getDidUrlOrigin(decodePortableAuthority(iri.host))) : iri.host;
 		return `${iri.protocol}//${host}`;
 	}
 	return iri.href;
 }
+function getPortableCryptographicOrigin(iri) {
+	return getDidUrlOrigin(decodePortableAuthority(iri.host));
+}
+function getDidUrlOrigin(iri) {
+	const did = iri.split(/[/?#]/, 1)[0].replace(DID_SCHEME_PATTERN, "did:");
+	if (!DID_PATTERN.test(did)) throw new TypeError("Invalid DID URL.");
+	const parts = did.split(":");
+	parts[1] = parts[1].toLowerCase();
+	return normalizePortableAuthority(parts.join(":"));
+}
 function parsePortableIri(iri) {
 	const match = iri.match(PORTABLE_IRI_PATTERN);
 	if (match == null) return null;
-	const authority = decodePortableAuthority(match[2]);
+	const authority = getDidUrlOrigin(decodePortableAuthority(match[2]));
 	if (!DID_PATTERN.test(authority)) throw new TypeError("Invalid portable ActivityPub IRI authority.");
 	if (match[3] === "") throw new TypeError("Invalid portable ActivityPub IRI path.");
 	return new URL(`ap+ef61://${encodeURIComponent(authority)}${match[3]}${match[4] ?? ""}${match[5] ?? ""}`);
@@ -162,6 +211,20 @@ function parseAtUri(uri) {
 	return new URL("at://" + encodeURIComponent(authority) + path);
 }
 /**
+* Checks whether the URL is an FEP-ef61 gateway base URI.
+*/
+function isGatewayUrl(url) {
+	return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === "";
+}
+/**
+* Parses and validates an FEP-ef61 gateway base URI.
+*/
+function parseGatewayUrl(url) {
+	const parsed = parseIri(url);
+	if (!isGatewayUrl(parsed)) throw new TypeError("FEP-ef61 gateways must be HTTP(S) base URIs with no credentials, path, query, or fragment.");
+	return parsed;
+}
+/**
 * Validates a URL to prevent SSRF attacks.
 */
 async function validatePublicUrl(url) {
@@ -357,12 +420,30 @@ Object.defineProperty(exports, "formatIri", {
 		return formatIri;
 	}
 });
+Object.defineProperty(exports, "getFe34Origin", {
+	enumerable: true,
+	get: function() {
+		return getFe34Origin;
+	}
+});
+Object.defineProperty(exports, "haveSameFe34Origin", {
+	enumerable: true,
+	get: function() {
+		return haveSameFe34Origin;
+	}
+});
 Object.defineProperty(exports, "haveSameIriOrigin", {
 	enumerable: true,
 	get: function() {
 		return haveSameIriOrigin;
 	}
 });
+Object.defineProperty(exports, "isGatewayUrl", {
+	enumerable: true,
+	get: function() {
+		return isGatewayUrl;
+	}
+});
 Object.defineProperty(exports, "isValidPublicIPv4Address", {
 	enumerable: true,
 	get: function() {
@@ -375,6 +456,12 @@ Object.defineProperty(exports, "isValidPublicIPv6Address", {
 		return isValidPublicIPv6Address;
 	}
 });
+Object.defineProperty(exports, "parseGatewayUrl", {
+	enumerable: true,
+	get: function() {
+		return parseGatewayUrl;
+	}
+});
 Object.defineProperty(exports, "parseIri", {
 	enumerable: true,
 	get: function() {

package/dist/tests/{url-D7ay_5pk.mjs → url-Du7RQQgP.mjs}

@@ -62,7 +62,7 @@ function canonicalizePortableUri(input) {
 	const parsed = parsePortableIri(input);
 	if (parsed == null) throw new TypeError("Invalid portable ActivityPub IRI.");
 	const match = input.match(PORTABLE_IRI_PATTERN);
-	return `ap+ef61://${normalizePortableAuthority(decodePortableAuthority(parsed.host).replace(DID_SCHEME_PATTERN, "did:"))}${normalizePortableComponent(match[3])}${match[5] == null ? "" : normalizePortableComponent(match[5])}`;
+	return `ap+ef61://${normalizePortableAuthority(getDidUrlOrigin(decodePortableAuthority(parsed.host)))}${normalizePortableComponent(match[3])}${match[5] == null ? "" : normalizePortableComponent(match[5])}`;
 }
 /**
 * Checks whether two FEP-ef61 portable ActivityPub URIs identify the same
@@ -87,6 +87,45 @@ function arePortableUrisEqual(left, right) {
 	}
 }
 /**
+* Computes an IRI's FEP-fe34 origin.
+*
+* HTTP(S) IRIs use their web origin.  FEP-ef61 portable ActivityPub IRIs and
+* DID URLs use their DID as a cryptographic origin.
+*
+* @throws {TypeError} If the IRI does not have a supported FEP-fe34 origin.
+* @since 2.4.0
+*/
+function getFe34Origin(input) {
+	if (input instanceof URL) {
+		const portable = normalizePortableUrl(input);
+		if (portable != null) return getPortableCryptographicOrigin(portable);
+		if (input.protocol === "did:") return getDidUrlOrigin(input.href);
+		if (input.protocol === "http:" || input.protocol === "https:") return input.origin;
+		throw new TypeError("Unsupported FEP-fe34 origin IRI.");
+	}
+	const portable = parsePortableIri(input);
+	if (portable != null) return getPortableCryptographicOrigin(portable);
+	if (DID_SCHEME_PATTERN.test(input)) return getDidUrlOrigin(input);
+	const parsed = new URL(input);
+	if (parsed.protocol === "http:" || parsed.protocol === "https:") return parsed.origin;
+	throw new TypeError("Unsupported FEP-fe34 origin IRI.");
+}
+/**
+* Checks whether two IRIs have the same FEP-fe34 origin.
+*
+* Malformed or unsupported IRIs are treated as non-matching.
+*
+* @since 2.4.0
+*/
+function haveSameFe34Origin(left, right) {
+	try {
+		return getFe34Origin(left) === getFe34Origin(right);
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+/**
 * Checks whether two IRIs have the same origin.
 */
 function haveSameIriOrigin(left, right) {
@@ -96,15 +135,25 @@ function getComparableIriOrigin(iri) {
 	iri = normalizePortableUrl(iri) ?? iri;
 	if (iri.origin !== "null") return iri.origin;
 	if (iri.host !== "") {
-		const host = iri.protocol === "ap+ef61:" ? encodeURIComponent(decodePortableAuthority(iri.host).replace(DID_SCHEME_PATTERN, "did:")) : iri.host;
+		const host = iri.protocol === "ap+ef61:" ? encodeURIComponent(getDidUrlOrigin(decodePortableAuthority(iri.host))) : iri.host;
 		return `${iri.protocol}//${host}`;
 	}
 	return iri.href;
 }
+function getPortableCryptographicOrigin(iri) {
+	return getDidUrlOrigin(decodePortableAuthority(iri.host));
+}
+function getDidUrlOrigin(iri) {
+	const did = iri.split(/[/?#]/, 1)[0].replace(DID_SCHEME_PATTERN, "did:");
+	if (!DID_PATTERN.test(did)) throw new TypeError("Invalid DID URL.");
+	const parts = did.split(":");
+	parts[1] = parts[1].toLowerCase();
+	return normalizePortableAuthority(parts.join(":"));
+}
 function parsePortableIri(iri) {
 	const match = iri.match(PORTABLE_IRI_PATTERN);
 	if (match == null) return null;
-	const authority = decodePortableAuthority(match[2]);
+	const authority = getDidUrlOrigin(decodePortableAuthority(match[2]));
 	if (!DID_PATTERN.test(authority)) throw new TypeError("Invalid portable ActivityPub IRI authority.");
 	if (match[3] === "") throw new TypeError("Invalid portable ActivityPub IRI path.");
 	return new URL(`ap+ef61://${encodeURIComponent(authority)}${match[3]}${match[4] ?? ""}${match[5] ?? ""}`);
@@ -161,6 +210,20 @@ function parseAtUri(uri) {
 	return new URL("at://" + encodeURIComponent(authority) + path);
 }
 /**
+* Checks whether the URL is an FEP-ef61 gateway base URI.
+*/
+function isGatewayUrl(url) {
+	return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === "";
+}
+/**
+* Parses and validates an FEP-ef61 gateway base URI.
+*/
+function parseGatewayUrl(url) {
+	const parsed = parseIri(url);
+	if (!isGatewayUrl(parsed)) throw new TypeError("FEP-ef61 gateways must be HTTP(S) base URIs with no credentials, path, query, or fragment.");
+	return parsed;
+}
+/**
 * Validates a URL to prevent SSRF attacks.
 */
 async function validatePublicUrl(url) {
@@ -326,4 +389,4 @@ function matchesIPv6Prefix(address, prefixWords, prefixLength) {
 	return true;
 }
 //#endregion
-export { formatIri as a, isValidPublicIPv6Address as c, validatePublicUrl as d, expandIPv6Address as i, parseIri as l, arePortableUrisEqual as n, haveSameIriOrigin as o, canonicalizePortableUri as r, isValidPublicIPv4Address as s, UrlError as t, parseJsonLdId as u };
+export { formatIri as a, haveSameIriOrigin as c, isValidPublicIPv6Address as d, parseGatewayUrl as f, validatePublicUrl as h, expandIPv6Address as i, isGatewayUrl as l, parseJsonLdId as m, arePortableUrisEqual as n, getFe34Origin as o, parseIri as p, canonicalizePortableUri as r, haveSameFe34Origin as s, UrlError as t, isValidPublicIPv4Address as u };

package/dist/tests/url.test.cjs

@@ -1,5 +1,5 @@
 require("./chunk-C2EiDwsr.cjs");
-const require_url = require("./url-CtKcX6ma.cjs");
+const require_url = require("./url-CsOV_B_P.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 //#region src/url.test.ts
@@ -12,8 +12,12 @@ let node_test = require("node:test");
 		"AP+EF61://did:key:z6Mkabc/actor"
 	]) (0, node_assert.deepStrictEqual)(require_url.parseIri(iri), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"));
 });
-(0, node_test.test)("parseIri() accepts DID schemes case-insensitively", () => {
-	for (const iri of ["ap://DID:key:z6Mkabc/actor", "ap://DID%3Akey%3Az6Mkabc/actor"]) (0, node_assert.deepStrictEqual)(require_url.parseIri(iri), new URL("ap+ef61://DID%3Akey%3Az6Mkabc/actor"));
+(0, node_test.test)("parseIri() normalizes DID scheme and method casing", () => {
+	for (const iri of [
+		"ap://DID:key:z6Mkabc/actor",
+		"ap://DID%3Akey%3Az6Mkabc/actor",
+		"ap://did:KEY:z6Mkabc/actor"
+	]) (0, node_assert.deepStrictEqual)(require_url.parseIri(iri), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"));
 });
 (0, node_test.test)("parseIri() accepts DID method names that start with digits", () => {
 	(0, node_assert.deepStrictEqual)(require_url.parseIri("ap://did:3:abc/actor"), new URL("ap+ef61://did%3A3%3Aabc/actor"));
@@ -60,12 +64,50 @@ let node_test = require("node:test");
 	]) (0, node_assert.throws)(() => require_url.parseIri(iri), TypeError);
 });
 (0, node_test.test)("haveSameIriOrigin() compares portable IRI authorities", () => {
+	(0, node_assert.ok)(require_url.haveSameIriOrigin(new URL("ftp://example.com/pub/1"), new URL("ftp://example.com/pub/2")));
+	(0, node_assert.ok)(require_url.haveSameIriOrigin(new URL("mailto:alice@example.com"), new URL("mailto:alice@example.com")));
 	(0, node_assert.ok)(require_url.haveSameIriOrigin(require_url.parseIri("ap://did:key:z6Mkabc/actor"), require_url.parseIri("ap://did:key:z6Mkabc/outbox")));
 	(0, node_assert.ok)(require_url.haveSameIriOrigin(new URL("ap://did%3Akey%3Az6Mkabc/actor"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/outbox")));
 	(0, node_assert.ok)(require_url.haveSameIriOrigin(require_url.parseIri("ap://DID:key:z6Mkabc/actor"), require_url.parseIri("ap://did:key:z6Mkabc/outbox")));
 	(0, node_assert.ok)(require_url.haveSameIriOrigin(new URL("ap+ef61://DID%3Akey%3Az6Mkabc/actor"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/outbox")));
 	(0, node_assert.ok)(!require_url.haveSameIriOrigin(require_url.parseIri("ap://did:key:z6Mkabc/actor"), require_url.parseIri("ap://did:key:z6Mkdef/actor")));
 });
+(0, node_test.test)("getFe34Origin() computes web and cryptographic origins", () => {
+	(0, node_assert.deepStrictEqual)(require_url.getFe34Origin("https://Example.COM:443/users/alice"), "https://example.com");
+	(0, node_assert.deepStrictEqual)(require_url.getFe34Origin(new URL("http://example.com:8080/notes/1")), "http://example.com:8080");
+	(0, node_assert.deepStrictEqual)(require_url.getFe34Origin("ap://did:key:z6Mkabc/actor?gateways=https%3A%2F%2Fa.example"), "did:key:z6Mkabc");
+	(0, node_assert.deepStrictEqual)(require_url.getFe34Origin("ap+ef61://did%3Akey%3Az6Mkabc/objects/1#fragment"), "did:key:z6Mkabc");
+	(0, node_assert.deepStrictEqual)(require_url.getFe34Origin(new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor")), "did:key:z6Mkabc");
+	(0, node_assert.deepStrictEqual)(require_url.getFe34Origin("did:key:z6Mkabc#z6Mkabc"), "did:key:z6Mkabc");
+	(0, node_assert.deepStrictEqual)(require_url.getFe34Origin(new URL("did:key:z6Mkabc?service=activitypub#key")), "did:key:z6Mkabc");
+	(0, node_assert.deepStrictEqual)(require_url.getFe34Origin("did:key:z6Mkabc/path/to/resource?service=activitypub#key"), "did:key:z6Mkabc");
+	(0, node_assert.deepStrictEqual)(require_url.getFe34Origin("did:KEY:z6Mkabc#z6Mkabc"), "did:key:z6Mkabc");
+	(0, node_assert.deepStrictEqual)(require_url.getFe34Origin("ap://did%3Aweb%3Afoo%2Dbar.example/actor"), "did:web:foo-bar.example");
+	(0, node_assert.deepStrictEqual)(require_url.getFe34Origin("did:web:foo%2dbar.example#key"), "did:web:foo-bar.example");
+});
+(0, node_test.test)("getFe34Origin() rejects unsupported or malformed identifiers", () => {
+	for (const iri of [
+		"mailto:alice@example.com",
+		"ap://not-a-did/actor",
+		"ap://did:key/actor",
+		"did:key",
+		"did:key:",
+		"did:"
+	]) (0, node_assert.throws)(() => require_url.getFe34Origin(iri), TypeError);
+});
+(0, node_test.test)("haveSameFe34Origin() compares web and cryptographic origins", () => {
+	(0, node_assert.ok)(require_url.haveSameFe34Origin("https://example.com/users/alice", "https://example.com/notes/1"));
+	(0, node_assert.ok)(!require_url.haveSameFe34Origin("https://example.com/users/alice", "http://example.com/users/alice"));
+	(0, node_assert.ok)(!require_url.haveSameFe34Origin("https://example.com/users/alice", "https://example.com:8443/users/alice"));
+	(0, node_assert.ok)(require_url.haveSameFe34Origin("ap://did:key:z6Mkabc/actor", "ap+ef61://did%3Akey%3Az6Mkabc/objects/1"));
+	(0, node_assert.ok)(require_url.haveSameFe34Origin("ap+ef61://did:key:z6Mkabc/actor", "did:key:z6Mkabc#z6Mkabc"));
+	(0, node_assert.ok)(require_url.haveSameFe34Origin("ap://did:KEY:z6Mkabc/actor", "did:key:z6Mkabc#z6Mkabc"));
+	(0, node_assert.ok)(require_url.haveSameFe34Origin("ap://did%3Aweb%3Afoo%2Dbar.example/actor", "ap://did:web:foo-bar.example/note"));
+	(0, node_assert.ok)(require_url.haveSameFe34Origin("ap://did%3Aexample%3Aabc%252fdef/actor", "did:example:abc%2Fdef#key"));
+	(0, node_assert.ok)(!require_url.haveSameFe34Origin("ap+ef61://did:key:z6Mkabc/actor", "did:key:z6Mkdef#z6Mkdef"));
+	(0, node_assert.ok)(!require_url.haveSameFe34Origin("ap+ef61://did:key:z6Mkabc/actor", "https://example.com/actor"));
+	(0, node_assert.ok)(!require_url.haveSameFe34Origin("ap://not-a-did/actor", "ap://not-a-did/actor"));
+});
 (0, node_test.test)("parseIri() normalizes portable URL instances", () => {
 	(0, node_assert.deepStrictEqual)(require_url.parseIri(new URL("ap+ef61://did%3Aexample%3Aabc%2Fdef/actor")), new URL("ap+ef61://did%3Aexample%3Aabc%252Fdef/actor"));
 	(0, node_assert.throws)(() => require_url.parseIri("ap+ef61://not-a-did/actor"), TypeError);
@@ -186,6 +228,23 @@ let node_test = require("node:test");
 	(0, node_assert.deepStrictEqual)(parsed, new URL("ap+ef61://did%3Aweb%3Aexample.com%2500/u/1"));
 	(0, node_assert.deepStrictEqual)(require_url.formatIri(parsed), "ap+ef61://did:web:example.com%00/u/1");
 });
+(0, node_test.test)("parseGatewayUrl() accepts only HTTP(S) base URIs", () => {
+	for (const url of ["https://server.example/", "http://server.example/"]) {
+		(0, node_assert.deepStrictEqual)(require_url.parseGatewayUrl(url), new URL(url));
+		(0, node_assert.ok)(require_url.isGatewayUrl(new URL(url)));
+	}
+	for (const url of [
+		"ftp://server.example/",
+		"https://user:pass@server.example/",
+		"https://user@server.example/",
+		"https://server.example/path",
+		"https://server.example/?x=1",
+		"https://server.example/#fragment"
+	]) {
+		(0, node_assert.throws)(() => require_url.parseGatewayUrl(url), TypeError);
+		(0, node_assert.ok)(!require_url.isGatewayUrl(new URL(url)));
+	}
+});
 (0, node_test.test)("validatePublicUrl()", async () => {
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("ftp://localhost"), require_url.UrlError);
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("data:text/plain;base64,SGVsbG8sIFdvcmxkIQ=="), require_url.UrlError);

package/dist/tests/url.test.mjs

@@ -1,4 +1,4 @@
-import { a as formatIri, c as isValidPublicIPv6Address, d as validatePublicUrl, i as expandIPv6Address, l as parseIri, n as arePortableUrisEqual, o as haveSameIriOrigin, r as canonicalizePortableUri, s as isValidPublicIPv4Address, t as UrlError, u as parseJsonLdId } from "./url-D7ay_5pk.mjs";
+import { a as formatIri, c as haveSameIriOrigin, d as isValidPublicIPv6Address, f as parseGatewayUrl, h as validatePublicUrl, i as expandIPv6Address, l as isGatewayUrl, m as parseJsonLdId, n as arePortableUrisEqual, o as getFe34Origin, p as parseIri, r as canonicalizePortableUri, s as haveSameFe34Origin, t as UrlError, u as isValidPublicIPv4Address } from "./url-Du7RQQgP.mjs";
 import { deepStrictEqual, ok, rejects, throws } from "node:assert";
 import { test } from "node:test";
 //#region src/url.test.ts
@@ -11,8 +11,12 @@ test("parseIri() accepts portable ActivityPub URI schemes", () => {
 		"AP+EF61://did:key:z6Mkabc/actor"
 	]) deepStrictEqual(parseIri(iri), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"));
 });
-test("parseIri() accepts DID schemes case-insensitively", () => {
-	for (const iri of ["ap://DID:key:z6Mkabc/actor", "ap://DID%3Akey%3Az6Mkabc/actor"]) deepStrictEqual(parseIri(iri), new URL("ap+ef61://DID%3Akey%3Az6Mkabc/actor"));
+test("parseIri() normalizes DID scheme and method casing", () => {
+	for (const iri of [
+		"ap://DID:key:z6Mkabc/actor",
+		"ap://DID%3Akey%3Az6Mkabc/actor",
+		"ap://did:KEY:z6Mkabc/actor"
+	]) deepStrictEqual(parseIri(iri), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"));
 });
 test("parseIri() accepts DID method names that start with digits", () => {
 	deepStrictEqual(parseIri("ap://did:3:abc/actor"), new URL("ap+ef61://did%3A3%3Aabc/actor"));
@@ -59,12 +63,50 @@ test("parseIri() rejects malformed portable DID authorities", () => {
 	]) throws(() => parseIri(iri), TypeError);
 });
 test("haveSameIriOrigin() compares portable IRI authorities", () => {
+	ok(haveSameIriOrigin(new URL("ftp://example.com/pub/1"), new URL("ftp://example.com/pub/2")));
+	ok(haveSameIriOrigin(new URL("mailto:alice@example.com"), new URL("mailto:alice@example.com")));
 	ok(haveSameIriOrigin(parseIri("ap://did:key:z6Mkabc/actor"), parseIri("ap://did:key:z6Mkabc/outbox")));
 	ok(haveSameIriOrigin(new URL("ap://did%3Akey%3Az6Mkabc/actor"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/outbox")));
 	ok(haveSameIriOrigin(parseIri("ap://DID:key:z6Mkabc/actor"), parseIri("ap://did:key:z6Mkabc/outbox")));
 	ok(haveSameIriOrigin(new URL("ap+ef61://DID%3Akey%3Az6Mkabc/actor"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/outbox")));
 	ok(!haveSameIriOrigin(parseIri("ap://did:key:z6Mkabc/actor"), parseIri("ap://did:key:z6Mkdef/actor")));
 });
+test("getFe34Origin() computes web and cryptographic origins", () => {
+	deepStrictEqual(getFe34Origin("https://Example.COM:443/users/alice"), "https://example.com");
+	deepStrictEqual(getFe34Origin(new URL("http://example.com:8080/notes/1")), "http://example.com:8080");
+	deepStrictEqual(getFe34Origin("ap://did:key:z6Mkabc/actor?gateways=https%3A%2F%2Fa.example"), "did:key:z6Mkabc");
+	deepStrictEqual(getFe34Origin("ap+ef61://did%3Akey%3Az6Mkabc/objects/1#fragment"), "did:key:z6Mkabc");
+	deepStrictEqual(getFe34Origin(new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor")), "did:key:z6Mkabc");
+	deepStrictEqual(getFe34Origin("did:key:z6Mkabc#z6Mkabc"), "did:key:z6Mkabc");
+	deepStrictEqual(getFe34Origin(new URL("did:key:z6Mkabc?service=activitypub#key")), "did:key:z6Mkabc");
+	deepStrictEqual(getFe34Origin("did:key:z6Mkabc/path/to/resource?service=activitypub#key"), "did:key:z6Mkabc");
+	deepStrictEqual(getFe34Origin("did:KEY:z6Mkabc#z6Mkabc"), "did:key:z6Mkabc");
+	deepStrictEqual(getFe34Origin("ap://did%3Aweb%3Afoo%2Dbar.example/actor"), "did:web:foo-bar.example");
+	deepStrictEqual(getFe34Origin("did:web:foo%2dbar.example#key"), "did:web:foo-bar.example");
+});
+test("getFe34Origin() rejects unsupported or malformed identifiers", () => {
+	for (const iri of [
+		"mailto:alice@example.com",
+		"ap://not-a-did/actor",
+		"ap://did:key/actor",
+		"did:key",
+		"did:key:",
+		"did:"
+	]) throws(() => getFe34Origin(iri), TypeError);
+});
+test("haveSameFe34Origin() compares web and cryptographic origins", () => {
+	ok(haveSameFe34Origin("https://example.com/users/alice", "https://example.com/notes/1"));
+	ok(!haveSameFe34Origin("https://example.com/users/alice", "http://example.com/users/alice"));
+	ok(!haveSameFe34Origin("https://example.com/users/alice", "https://example.com:8443/users/alice"));
+	ok(haveSameFe34Origin("ap://did:key:z6Mkabc/actor", "ap+ef61://did%3Akey%3Az6Mkabc/objects/1"));
+	ok(haveSameFe34Origin("ap+ef61://did:key:z6Mkabc/actor", "did:key:z6Mkabc#z6Mkabc"));
+	ok(haveSameFe34Origin("ap://did:KEY:z6Mkabc/actor", "did:key:z6Mkabc#z6Mkabc"));
+	ok(haveSameFe34Origin("ap://did%3Aweb%3Afoo%2Dbar.example/actor", "ap://did:web:foo-bar.example/note"));
+	ok(haveSameFe34Origin("ap://did%3Aexample%3Aabc%252fdef/actor", "did:example:abc%2Fdef#key"));
+	ok(!haveSameFe34Origin("ap+ef61://did:key:z6Mkabc/actor", "did:key:z6Mkdef#z6Mkdef"));
+	ok(!haveSameFe34Origin("ap+ef61://did:key:z6Mkabc/actor", "https://example.com/actor"));
+	ok(!haveSameFe34Origin("ap://not-a-did/actor", "ap://not-a-did/actor"));
+});
 test("parseIri() normalizes portable URL instances", () => {
 	deepStrictEqual(parseIri(new URL("ap+ef61://did%3Aexample%3Aabc%2Fdef/actor")), new URL("ap+ef61://did%3Aexample%3Aabc%252Fdef/actor"));
 	throws(() => parseIri("ap+ef61://not-a-did/actor"), TypeError);
@@ -185,6 +227,23 @@ test("parseIri() preserves encoded percent signs while decoding delimiters", ()
 	deepStrictEqual(parsed, new URL("ap+ef61://did%3Aweb%3Aexample.com%2500/u/1"));
 	deepStrictEqual(formatIri(parsed), "ap+ef61://did:web:example.com%00/u/1");
 });
+test("parseGatewayUrl() accepts only HTTP(S) base URIs", () => {
+	for (const url of ["https://server.example/", "http://server.example/"]) {
+		deepStrictEqual(parseGatewayUrl(url), new URL(url));
+		ok(isGatewayUrl(new URL(url)));
+	}
+	for (const url of [
+		"ftp://server.example/",
+		"https://user:pass@server.example/",
+		"https://user@server.example/",
+		"https://server.example/path",
+		"https://server.example/?x=1",
+		"https://server.example/#fragment"
+	]) {
+		throws(() => parseGatewayUrl(url), TypeError);
+		ok(!isGatewayUrl(new URL(url)));
+	}
+});
 test("validatePublicUrl()", async () => {
 	await rejects(() => validatePublicUrl("ftp://localhost"), UrlError);
 	await rejects(() => validatePublicUrl("data:text/plain;base64,SGVsbG8sIFdvcmxkIQ=="), UrlError);

package/dist/{url-BMDN9GnE.cjs → url-DD4F0ULf.cjs}

@@ -64,7 +64,7 @@ function canonicalizePortableUri(input) {
 	const parsed = parsePortableIri(input);
 	if (parsed == null) throw new TypeError("Invalid portable ActivityPub IRI.");
 	const match = input.match(PORTABLE_IRI_PATTERN);
-	return `ap+ef61://${normalizePortableAuthority(decodePortableAuthority(parsed.host).replace(DID_SCHEME_PATTERN, "did:"))}${normalizePortableComponent(match[3])}${match[5] == null ? "" : normalizePortableComponent(match[5])}`;
+	return `ap+ef61://${normalizePortableAuthority(getDidUrlOrigin(decodePortableAuthority(parsed.host)))}${normalizePortableComponent(match[3])}${match[5] == null ? "" : normalizePortableComponent(match[5])}`;
 }
 /**
 * Checks whether two FEP-ef61 portable ActivityPub URIs identify the same
@@ -89,6 +89,45 @@ function arePortableUrisEqual(left, right) {
 	}
 }
 /**
+* Computes an IRI's FEP-fe34 origin.
+*
+* HTTP(S) IRIs use their web origin.  FEP-ef61 portable ActivityPub IRIs and
+* DID URLs use their DID as a cryptographic origin.
+*
+* @throws {TypeError} If the IRI does not have a supported FEP-fe34 origin.
+* @since 2.4.0
+*/
+function getFe34Origin(input) {
+	if (input instanceof URL) {
+		const portable = normalizePortableUrl(input);
+		if (portable != null) return getPortableCryptographicOrigin(portable);
+		if (input.protocol === "did:") return getDidUrlOrigin(input.href);
+		if (input.protocol === "http:" || input.protocol === "https:") return input.origin;
+		throw new TypeError("Unsupported FEP-fe34 origin IRI.");
+	}
+	const portable = parsePortableIri(input);
+	if (portable != null) return getPortableCryptographicOrigin(portable);
+	if (DID_SCHEME_PATTERN.test(input)) return getDidUrlOrigin(input);
+	const parsed = new URL(input);
+	if (parsed.protocol === "http:" || parsed.protocol === "https:") return parsed.origin;
+	throw new TypeError("Unsupported FEP-fe34 origin IRI.");
+}
+/**
+* Checks whether two IRIs have the same FEP-fe34 origin.
+*
+* Malformed or unsupported IRIs are treated as non-matching.
+*
+* @since 2.4.0
+*/
+function haveSameFe34Origin(left, right) {
+	try {
+		return getFe34Origin(left) === getFe34Origin(right);
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+/**
 * Checks whether two IRIs have the same origin.
 */
 function haveSameIriOrigin(left, right) {
@@ -98,15 +137,25 @@ function getComparableIriOrigin(iri) {
 	iri = normalizePortableUrl(iri) ?? iri;
 	if (iri.origin !== "null") return iri.origin;
 	if (iri.host !== "") {
-		const host = iri.protocol === "ap+ef61:" ? encodeURIComponent(decodePortableAuthority(iri.host).replace(DID_SCHEME_PATTERN, "did:")) : iri.host;
+		const host = iri.protocol === "ap+ef61:" ? encodeURIComponent(getDidUrlOrigin(decodePortableAuthority(iri.host))) : iri.host;
 		return `${iri.protocol}//${host}`;
 	}
 	return iri.href;
 }
+function getPortableCryptographicOrigin(iri) {
+	return getDidUrlOrigin(decodePortableAuthority(iri.host));
+}
+function getDidUrlOrigin(iri) {
+	const did = iri.split(/[/?#]/, 1)[0].replace(DID_SCHEME_PATTERN, "did:");
+	if (!DID_PATTERN.test(did)) throw new TypeError("Invalid DID URL.");
+	const parts = did.split(":");
+	parts[1] = parts[1].toLowerCase();
+	return normalizePortableAuthority(parts.join(":"));
+}
 function parsePortableIri(iri) {
 	const match = iri.match(PORTABLE_IRI_PATTERN);
 	if (match == null) return null;
-	const authority = decodePortableAuthority(match[2]);
+	const authority = getDidUrlOrigin(decodePortableAuthority(match[2]));
 	if (!DID_PATTERN.test(authority)) throw new TypeError("Invalid portable ActivityPub IRI authority.");
 	if (match[3] === "") throw new TypeError("Invalid portable ActivityPub IRI path.");
 	return new URL(`ap+ef61://${encodeURIComponent(authority)}${match[3]}${match[4] ?? ""}${match[5] ?? ""}`);
@@ -163,6 +212,20 @@ function parseAtUri(uri) {
 	return new URL("at://" + encodeURIComponent(authority) + path);
 }
 /**
+* Checks whether the URL is an FEP-ef61 gateway base URI.
+*/
+function isGatewayUrl(url) {
+	return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === "";
+}
+/**
+* Parses and validates an FEP-ef61 gateway base URI.
+*/
+function parseGatewayUrl(url) {
+	const parsed = parseIri(url);
+	if (!isGatewayUrl(parsed)) throw new TypeError("FEP-ef61 gateways must be HTTP(S) base URIs with no credentials, path, query, or fragment.");
+	return parsed;
+}
+/**
 * Validates a URL to prevent SSRF attacks.
 */
 async function validatePublicUrl(url) {
@@ -358,12 +421,30 @@ Object.defineProperty(exports, "formatIri", {
 		return formatIri;
 	}
 });
+Object.defineProperty(exports, "getFe34Origin", {
+	enumerable: true,
+	get: function() {
+		return getFe34Origin;
+	}
+});
+Object.defineProperty(exports, "haveSameFe34Origin", {
+	enumerable: true,
+	get: function() {
+		return haveSameFe34Origin;
+	}
+});
 Object.defineProperty(exports, "haveSameIriOrigin", {
 	enumerable: true,
 	get: function() {
 		return haveSameIriOrigin;
 	}
 });
+Object.defineProperty(exports, "isGatewayUrl", {
+	enumerable: true,
+	get: function() {
+		return isGatewayUrl;
+	}
+});
 Object.defineProperty(exports, "isValidPublicIPv4Address", {
 	enumerable: true,
 	get: function() {
@@ -376,6 +457,12 @@ Object.defineProperty(exports, "isValidPublicIPv6Address", {
 		return isValidPublicIPv6Address;
 	}
 });
+Object.defineProperty(exports, "parseGatewayUrl", {
+	enumerable: true,
+	get: function() {
+		return parseGatewayUrl;
+	}
+});
 Object.defineProperty(exports, "parseIri", {
 	enumerable: true,
 	get: function() {