@fedify/vocab-runtime 2.4.0-dev.1618 → 2.4.0-dev.1655

package/dist/mod.js

@@ -1,5 +1,5 @@
 
-import { a as formatIri, c as haveSameIriOrigin, d as parseIri, f as parseJsonLdId, i as expandIPv6Address, l as isValidPublicIPv4Address, n as arePortableUrisEqual, o as getFe34Origin, p as validatePublicUrl, r as canonicalizePortableUri, s as haveSameFe34Origin, t as UrlError, u as isValidPublicIPv6Address } from "./url-m1YxGNZ0.js";
+import { a as formatIri, c as haveSameIriOrigin, d as isValidPublicIPv6Address, f as parseGatewayUrl, h as validatePublicUrl, i as expandIPv6Address, l as isGatewayUrl, m as parseJsonLdId, n as arePortableUrisEqual, o as getFe34Origin, p as parseIri, r as canonicalizePortableUri, s as haveSameFe34Origin, t as UrlError, u as isValidPublicIPv4Address } from "./url-DGVbSVVi.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import process from "node:process";
@@ -465,10 +465,6 @@ const preloadedContexts = {
 		"id": "@id",
 		"type": "@type",
 		"@protected": true,
-		"digestMultibase": {
-			"@id": "https://w3id.org/security#digestMultibase",
-			"@type": "https://w3id.org/security#multibase"
-		},
 		"proof": {
 			"@id": "https://w3id.org/security#proof",
 			"@type": "@id",
@@ -4305,6 +4301,14 @@ const preloadedContexts = {
 			"@type": "@id"
 		}
 	} },
+	"https://w3id.org/fep/ef61": { "@context": {
+		"gateways": {
+			"@id": "https://w3id.org/fep/ef61/gateways",
+			"@type": "@id",
+			"@container": "@list"
+		},
+		"digestMultibase": "https://www.w3.org/ns/credentials/v2#digestMultibase"
+	} },
 	"https://join-lemmy.org/context.json": { "@context": ["https://w3id.org/security/v1", {
 		"as": "https://www.w3.org/ns/activitystreams#",
 		"lemmy": "https://join-lemmy.org/ns#",
@@ -4363,7 +4367,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1618+58858243";
+var version = "2.4.0-dev.1655+b8f3c3d5";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4794,8 +4798,10 @@ async function getRemoteDocument(url, response, fetch) {
 * - <https://www.w3.org/ns/activitystreams>
 * - <https://w3id.org/security/v1>
 * - <https://w3id.org/security/data-integrity/v1>
+* - <https://w3id.org/security/data-integrity/v2>
 * - <https://www.w3.org/ns/did/v1>
 * - <https://w3id.org/security/multikey/v1>
+* - <https://w3id.org/fep/ef61>
 * - <https://purl.archive.org/socialweb/webfinger>
 * - <http://schema.org/>
 * @param options Options for the document loader.
@@ -4926,8 +4932,8 @@ function validateCryptoKey(key, type) {
 }
 //#endregion
 //#region src/multibase/util.ts
-const textDecoder = new TextDecoder();
-const decodeText = (bytes) => textDecoder.decode(bytes);
+const textDecoder$1 = new TextDecoder();
+const decodeText = (bytes) => textDecoder$1.decode(bytes);
 const textEncoder = new TextEncoder();
 const encodeText = (text) => textEncoder.encode(text);
 function concat(arrs, length) {
@@ -5516,6 +5522,143 @@ function parseDecimal(value) {
 	return normalized;
 }
 //#endregion
+//#region src/digest.ts
+const SHA2_256_MULTIHASH_CODE = 18;
+const SHA2_256_DIGEST_LENGTH = 32;
+const MAX_DIGEST_MULTIBASE_LENGTH = 1 + (SHA2_256_DIGEST_LENGTH + 2) * 8;
+const textDecoder = new TextDecoder();
+const getArrayBufferByteLength = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength")?.get;
+function isCanonicalVarintPrefix(data, prefix) {
+	const canonical = addMulticodecPrefix(prefix.code, new Uint8Array());
+	if (canonical.length !== prefix.prefixLength) return false;
+	for (let i = 0; i < canonical.length; i++) if (data[i] !== canonical[i]) return false;
+	return true;
+}
+function toWebCryptoBytes(bytes) {
+	if (getArrayBufferByteLength != null) try {
+		getArrayBufferByteLength.call(bytes.buffer);
+		return bytes;
+	} catch {}
+	return new Uint8Array(bytes);
+}
+/**
+* Computes the SHA-256 digest of a byte sequence and encodes it as a
+* base58-btc multibase multihash suitable for FEP-ef61's
+* `digestMultibase` property.
+*
+* @param bytes The bytes to digest.
+* @returns The base58-btc multibase-encoded SHA-256 multihash.
+* @since 2.4.0
+*/
+async function computeDigestMultibase(bytes) {
+	const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", toWebCryptoBytes(bytes)));
+	const multihash = addMulticodecPrefix(SHA2_256_MULTIHASH_CODE, addMulticodecPrefix(digest.length, digest));
+	return textDecoder.decode(encodeMultibase("base58btc", multihash));
+}
+/**
+* Parses and validates a SHA-256 `digestMultibase` value.
+*
+* @param value The multibase-encoded multihash to parse.
+* @returns The digest algorithm and raw digest bytes.
+* @throws {TypeError} If the value is malformed or uses an unsupported hash
+*                      algorithm.
+* @since 2.4.0
+*/
+function parseDigestMultibase(value) {
+	if (value.length > MAX_DIGEST_MULTIBASE_LENGTH) throw new TypeError("Invalid digestMultibase encoding.");
+	let multihash;
+	try {
+		multihash = decodeMultibase(value);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase encoding.", { cause: error });
+	}
+	const encoding = encodingFromBaseData(value);
+	if (value !== textDecoder.decode(encodeMultibase(encoding.name, multihash))) throw new TypeError("Invalid digestMultibase encoding.");
+	let algorithmPrefix;
+	try {
+		algorithmPrefix = getMulticodecPrefix(multihash);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase multihash.", { cause: error });
+	}
+	if (!isCanonicalVarintPrefix(multihash, algorithmPrefix)) throw new TypeError("Invalid digestMultibase multihash.");
+	if (algorithmPrefix.code !== SHA2_256_MULTIHASH_CODE) throw new TypeError(`Unsupported digest algorithm: 0x${algorithmPrefix.code.toString(16)}`);
+	const lengthAndDigest = multihash.subarray(algorithmPrefix.prefixLength);
+	let lengthPrefix;
+	try {
+		lengthPrefix = getMulticodecPrefix(lengthAndDigest);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase multihash.", { cause: error });
+	}
+	if (!isCanonicalVarintPrefix(lengthAndDigest, lengthPrefix)) throw new TypeError("Invalid digestMultibase multihash.");
+	const digest = lengthAndDigest.slice(lengthPrefix.prefixLength);
+	if (lengthPrefix.code !== SHA2_256_DIGEST_LENGTH || digest.length !== SHA2_256_DIGEST_LENGTH) throw new TypeError("Invalid SHA-256 digest length.");
+	return {
+		algorithm: "sha2-256",
+		digest
+	};
+}
+function extractDigestMultibase(value) {
+	const hashlink = typeof value === "string" ? value : value.href;
+	const match = /^hl:([^:\r\n\u2028\u2029]+)$/i.exec(hashlink);
+	if (match == null || match[0].length !== hashlink.length) throw new TypeError("Invalid simple hashlink.");
+	return match[1];
+}
+/**
+* Parses a metadata-free `hl:` hashlink and validates its resource digest.
+*
+* @param value The simple hashlink to parse.
+* @returns The `digestMultibase` value carried by the hashlink.
+* @throws {TypeError} If the hashlink is malformed, contains metadata, or
+*                      carries an invalid or unsupported digest.
+* @since 2.4.0
+*/
+function parseHashlink(value) {
+	const digestMultibase = extractDigestMultibase(value);
+	parseDigestMultibase(digestMultibase);
+	return { digestMultibase };
+}
+/**
+* Creates a metadata-free `hl:` hashlink from a `digestMultibase` value.
+*
+* @param digestMultibase The SHA-256 multibase multihash to embed.
+* @returns The simple hashlink.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+function createHashlink(digestMultibase) {
+	parseDigestMultibase(digestMultibase);
+	return `hl:${digestMultibase}`;
+}
+/**
+* Verifies that bytes match a SHA-256 `digestMultibase` value.
+*
+* @param bytes The bytes to verify.
+* @param digestMultibase The expected digest.
+* @returns Whether the bytes match the digest.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+async function verifyDigestMultibase(bytes, digestMultibase) {
+	const expected = parseDigestMultibase(digestMultibase).digest;
+	const actual = new Uint8Array(await crypto.subtle.digest("SHA-256", toWebCryptoBytes(bytes)));
+	if (expected.length !== actual.length) return false;
+	let difference = 0;
+	for (let i = 0; i < expected.length; i++) difference |= expected[i] ^ actual[i];
+	return difference === 0;
+}
+/**
+* Verifies that bytes match the resource digest in a simple hashlink.
+*
+* @param bytes The bytes to verify.
+* @param hashlink The simple hashlink containing the expected digest.
+* @returns Whether the bytes match the hashlink digest.
+* @throws {TypeError} If the hashlink or digest is malformed or unsupported.
+* @since 2.4.0
+*/
+async function verifyHashlink(bytes, hashlink) {
+	return await verifyDigestMultibase(bytes, extractDigestMultibase(hashlink));
+}
+//#endregion
 //#region src/langstr.ts
 /**
 * A language-tagged string which corresponds to the `rdf:langString` type.
@@ -5544,4 +5687,4 @@ LanguageString.prototype[Symbol.for("nodejs.util.inspect.custom")] = function(_d
 	return `<${this.locale.baseName}> ${inspect(this.toString(), options)}`;
 };
 //#endregion
-export { FetchError, LanguageString, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, createActivityPubRequest, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseIri, parseJsonLdId, preloadedContexts, validatePublicUrl };
+export { FetchError, LanguageString, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, computeDigestMultibase, createActivityPubRequest, createHashlink, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseDigestMultibase, parseGatewayUrl, parseHashlink, parseIri, parseJsonLdId, preloadedContexts, validatePublicUrl, verifyDigestMultibase, verifyHashlink };

package/dist/tests/decimal.test.cjs

@@ -1,9 +1,10 @@
 require("./chunk-C2EiDwsr.cjs");
-require("./docloader-QmR6VOqT.cjs");
-require("./url-BvjYQdxL.cjs");
-require("./key-_wXwomh_.cjs");
-require("./multibase-Bz_UUDtL.cjs");
-require("./langstr-CbAxaeEZ.cjs");
+require("./docloader-DVVWmXLI.cjs");
+require("./url-CsOV_B_P.cjs");
+require("./key-BcOWDLMm.cjs");
+require("./multibase-DcDQDNnI.cjs");
+require("./digest-DLwUyHCK.cjs");
+require("./langstr-BOQHfJDr.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 //#region src/decimal.ts

package/dist/tests/decimal.test.mjs

@@ -1,8 +1,9 @@
-import "./docloader-CBVde8Va.mjs";
-import "./url-a2D8NAgh.mjs";
-import "./key-CDGDH_vC.mjs";
-import "./multibase-B4bvakyA.mjs";
-import "./langstr-Di5AvKpB.mjs";
+import "./docloader-HbEvzi-t.mjs";
+import "./url-Du7RQQgP.mjs";
+import "./key-Drbw_2tw.mjs";
+import "./multibase-Cluwl8OM.mjs";
+import "./digest-BJlumPNJ.mjs";
+import "./langstr-DDLc4833.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 import { test } from "node:test";
 //#region src/decimal.ts

package/dist/tests/digest-BJlumPNJ.mjs

@@ -0,0 +1,140 @@
+import { n as getMulticodecPrefix, t as addMulticodecPrefix } from "./multicodec-CyFp54fI.mjs";
+import { n as encodeMultibase, r as encodingFromBaseData, t as decodeMultibase } from "./multibase-Cluwl8OM.mjs";
+//#region src/digest.ts
+const SHA2_256_MULTIHASH_CODE = 18;
+const SHA2_256_DIGEST_LENGTH = 32;
+const MAX_DIGEST_MULTIBASE_LENGTH = 1 + (SHA2_256_DIGEST_LENGTH + 2) * 8;
+const textDecoder = new TextDecoder();
+const getArrayBufferByteLength = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength")?.get;
+function isCanonicalVarintPrefix(data, prefix) {
+	const canonical = addMulticodecPrefix(prefix.code, new Uint8Array());
+	if (canonical.length !== prefix.prefixLength) return false;
+	for (let i = 0; i < canonical.length; i++) if (data[i] !== canonical[i]) return false;
+	return true;
+}
+function toWebCryptoBytes(bytes) {
+	if (getArrayBufferByteLength != null) try {
+		getArrayBufferByteLength.call(bytes.buffer);
+		return bytes;
+	} catch {}
+	return new Uint8Array(bytes);
+}
+/**
+* Computes the SHA-256 digest of a byte sequence and encodes it as a
+* base58-btc multibase multihash suitable for FEP-ef61's
+* `digestMultibase` property.
+*
+* @param bytes The bytes to digest.
+* @returns The base58-btc multibase-encoded SHA-256 multihash.
+* @since 2.4.0
+*/
+async function computeDigestMultibase(bytes) {
+	const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", toWebCryptoBytes(bytes)));
+	const multihash = addMulticodecPrefix(SHA2_256_MULTIHASH_CODE, addMulticodecPrefix(digest.length, digest));
+	return textDecoder.decode(encodeMultibase("base58btc", multihash));
+}
+/**
+* Parses and validates a SHA-256 `digestMultibase` value.
+*
+* @param value The multibase-encoded multihash to parse.
+* @returns The digest algorithm and raw digest bytes.
+* @throws {TypeError} If the value is malformed or uses an unsupported hash
+*                      algorithm.
+* @since 2.4.0
+*/
+function parseDigestMultibase(value) {
+	if (value.length > MAX_DIGEST_MULTIBASE_LENGTH) throw new TypeError("Invalid digestMultibase encoding.");
+	let multihash;
+	try {
+		multihash = decodeMultibase(value);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase encoding.", { cause: error });
+	}
+	const encoding = encodingFromBaseData(value);
+	if (value !== textDecoder.decode(encodeMultibase(encoding.name, multihash))) throw new TypeError("Invalid digestMultibase encoding.");
+	let algorithmPrefix;
+	try {
+		algorithmPrefix = getMulticodecPrefix(multihash);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase multihash.", { cause: error });
+	}
+	if (!isCanonicalVarintPrefix(multihash, algorithmPrefix)) throw new TypeError("Invalid digestMultibase multihash.");
+	if (algorithmPrefix.code !== SHA2_256_MULTIHASH_CODE) throw new TypeError(`Unsupported digest algorithm: 0x${algorithmPrefix.code.toString(16)}`);
+	const lengthAndDigest = multihash.subarray(algorithmPrefix.prefixLength);
+	let lengthPrefix;
+	try {
+		lengthPrefix = getMulticodecPrefix(lengthAndDigest);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase multihash.", { cause: error });
+	}
+	if (!isCanonicalVarintPrefix(lengthAndDigest, lengthPrefix)) throw new TypeError("Invalid digestMultibase multihash.");
+	const digest = lengthAndDigest.slice(lengthPrefix.prefixLength);
+	if (lengthPrefix.code !== SHA2_256_DIGEST_LENGTH || digest.length !== SHA2_256_DIGEST_LENGTH) throw new TypeError("Invalid SHA-256 digest length.");
+	return {
+		algorithm: "sha2-256",
+		digest
+	};
+}
+function extractDigestMultibase(value) {
+	const hashlink = typeof value === "string" ? value : value.href;
+	const match = /^hl:([^:\r\n\u2028\u2029]+)$/i.exec(hashlink);
+	if (match == null || match[0].length !== hashlink.length) throw new TypeError("Invalid simple hashlink.");
+	return match[1];
+}
+/**
+* Parses a metadata-free `hl:` hashlink and validates its resource digest.
+*
+* @param value The simple hashlink to parse.
+* @returns The `digestMultibase` value carried by the hashlink.
+* @throws {TypeError} If the hashlink is malformed, contains metadata, or
+*                      carries an invalid or unsupported digest.
+* @since 2.4.0
+*/
+function parseHashlink(value) {
+	const digestMultibase = extractDigestMultibase(value);
+	parseDigestMultibase(digestMultibase);
+	return { digestMultibase };
+}
+/**
+* Creates a metadata-free `hl:` hashlink from a `digestMultibase` value.
+*
+* @param digestMultibase The SHA-256 multibase multihash to embed.
+* @returns The simple hashlink.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+function createHashlink(digestMultibase) {
+	parseDigestMultibase(digestMultibase);
+	return `hl:${digestMultibase}`;
+}
+/**
+* Verifies that bytes match a SHA-256 `digestMultibase` value.
+*
+* @param bytes The bytes to verify.
+* @param digestMultibase The expected digest.
+* @returns Whether the bytes match the digest.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+async function verifyDigestMultibase(bytes, digestMultibase) {
+	const expected = parseDigestMultibase(digestMultibase).digest;
+	const actual = new Uint8Array(await crypto.subtle.digest("SHA-256", toWebCryptoBytes(bytes)));
+	if (expected.length !== actual.length) return false;
+	let difference = 0;
+	for (let i = 0; i < expected.length; i++) difference |= expected[i] ^ actual[i];
+	return difference === 0;
+}
+/**
+* Verifies that bytes match the resource digest in a simple hashlink.
+*
+* @param bytes The bytes to verify.
+* @param hashlink The simple hashlink containing the expected digest.
+* @returns Whether the bytes match the hashlink digest.
+* @throws {TypeError} If the hashlink or digest is malformed or unsupported.
+* @since 2.4.0
+*/
+async function verifyHashlink(bytes, hashlink) {
+	return await verifyDigestMultibase(bytes, extractDigestMultibase(hashlink));
+}
+//#endregion
+export { verifyDigestMultibase as a, parseHashlink as i, createHashlink as n, verifyHashlink as o, parseDigestMultibase as r, computeDigestMultibase as t };

package/dist/tests/digest-DLwUyHCK.cjs

@@ -0,0 +1,175 @@
+const require_multicodec = require("./multicodec-CxGVGa91.cjs");
+const require_multibase = require("./multibase-DcDQDNnI.cjs");
+//#region src/digest.ts
+const SHA2_256_MULTIHASH_CODE = 18;
+const SHA2_256_DIGEST_LENGTH = 32;
+const MAX_DIGEST_MULTIBASE_LENGTH = 1 + (SHA2_256_DIGEST_LENGTH + 2) * 8;
+const textDecoder = new TextDecoder();
+const getArrayBufferByteLength = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength")?.get;
+function isCanonicalVarintPrefix(data, prefix) {
+	const canonical = require_multicodec.addMulticodecPrefix(prefix.code, new Uint8Array());
+	if (canonical.length !== prefix.prefixLength) return false;
+	for (let i = 0; i < canonical.length; i++) if (data[i] !== canonical[i]) return false;
+	return true;
+}
+function toWebCryptoBytes(bytes) {
+	if (getArrayBufferByteLength != null) try {
+		getArrayBufferByteLength.call(bytes.buffer);
+		return bytes;
+	} catch {}
+	return new Uint8Array(bytes);
+}
+/**
+* Computes the SHA-256 digest of a byte sequence and encodes it as a
+* base58-btc multibase multihash suitable for FEP-ef61's
+* `digestMultibase` property.
+*
+* @param bytes The bytes to digest.
+* @returns The base58-btc multibase-encoded SHA-256 multihash.
+* @since 2.4.0
+*/
+async function computeDigestMultibase(bytes) {
+	const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", toWebCryptoBytes(bytes)));
+	const multihash = require_multicodec.addMulticodecPrefix(SHA2_256_MULTIHASH_CODE, require_multicodec.addMulticodecPrefix(digest.length, digest));
+	return textDecoder.decode(require_multibase.encodeMultibase("base58btc", multihash));
+}
+/**
+* Parses and validates a SHA-256 `digestMultibase` value.
+*
+* @param value The multibase-encoded multihash to parse.
+* @returns The digest algorithm and raw digest bytes.
+* @throws {TypeError} If the value is malformed or uses an unsupported hash
+*                      algorithm.
+* @since 2.4.0
+*/
+function parseDigestMultibase(value) {
+	if (value.length > MAX_DIGEST_MULTIBASE_LENGTH) throw new TypeError("Invalid digestMultibase encoding.");
+	let multihash;
+	try {
+		multihash = require_multibase.decodeMultibase(value);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase encoding.", { cause: error });
+	}
+	const encoding = require_multibase.encodingFromBaseData(value);
+	if (value !== textDecoder.decode(require_multibase.encodeMultibase(encoding.name, multihash))) throw new TypeError("Invalid digestMultibase encoding.");
+	let algorithmPrefix;
+	try {
+		algorithmPrefix = require_multicodec.getMulticodecPrefix(multihash);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase multihash.", { cause: error });
+	}
+	if (!isCanonicalVarintPrefix(multihash, algorithmPrefix)) throw new TypeError("Invalid digestMultibase multihash.");
+	if (algorithmPrefix.code !== SHA2_256_MULTIHASH_CODE) throw new TypeError(`Unsupported digest algorithm: 0x${algorithmPrefix.code.toString(16)}`);
+	const lengthAndDigest = multihash.subarray(algorithmPrefix.prefixLength);
+	let lengthPrefix;
+	try {
+		lengthPrefix = require_multicodec.getMulticodecPrefix(lengthAndDigest);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase multihash.", { cause: error });
+	}
+	if (!isCanonicalVarintPrefix(lengthAndDigest, lengthPrefix)) throw new TypeError("Invalid digestMultibase multihash.");
+	const digest = lengthAndDigest.slice(lengthPrefix.prefixLength);
+	if (lengthPrefix.code !== SHA2_256_DIGEST_LENGTH || digest.length !== SHA2_256_DIGEST_LENGTH) throw new TypeError("Invalid SHA-256 digest length.");
+	return {
+		algorithm: "sha2-256",
+		digest
+	};
+}
+function extractDigestMultibase(value) {
+	const hashlink = typeof value === "string" ? value : value.href;
+	const match = /^hl:([^:\r\n\u2028\u2029]+)$/i.exec(hashlink);
+	if (match == null || match[0].length !== hashlink.length) throw new TypeError("Invalid simple hashlink.");
+	return match[1];
+}
+/**
+* Parses a metadata-free `hl:` hashlink and validates its resource digest.
+*
+* @param value The simple hashlink to parse.
+* @returns The `digestMultibase` value carried by the hashlink.
+* @throws {TypeError} If the hashlink is malformed, contains metadata, or
+*                      carries an invalid or unsupported digest.
+* @since 2.4.0
+*/
+function parseHashlink(value) {
+	const digestMultibase = extractDigestMultibase(value);
+	parseDigestMultibase(digestMultibase);
+	return { digestMultibase };
+}
+/**
+* Creates a metadata-free `hl:` hashlink from a `digestMultibase` value.
+*
+* @param digestMultibase The SHA-256 multibase multihash to embed.
+* @returns The simple hashlink.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+function createHashlink(digestMultibase) {
+	parseDigestMultibase(digestMultibase);
+	return `hl:${digestMultibase}`;
+}
+/**
+* Verifies that bytes match a SHA-256 `digestMultibase` value.
+*
+* @param bytes The bytes to verify.
+* @param digestMultibase The expected digest.
+* @returns Whether the bytes match the digest.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+async function verifyDigestMultibase(bytes, digestMultibase) {
+	const expected = parseDigestMultibase(digestMultibase).digest;
+	const actual = new Uint8Array(await crypto.subtle.digest("SHA-256", toWebCryptoBytes(bytes)));
+	if (expected.length !== actual.length) return false;
+	let difference = 0;
+	for (let i = 0; i < expected.length; i++) difference |= expected[i] ^ actual[i];
+	return difference === 0;
+}
+/**
+* Verifies that bytes match the resource digest in a simple hashlink.
+*
+* @param bytes The bytes to verify.
+* @param hashlink The simple hashlink containing the expected digest.
+* @returns Whether the bytes match the hashlink digest.
+* @throws {TypeError} If the hashlink or digest is malformed or unsupported.
+* @since 2.4.0
+*/
+async function verifyHashlink(bytes, hashlink) {
+	return await verifyDigestMultibase(bytes, extractDigestMultibase(hashlink));
+}
+//#endregion
+Object.defineProperty(exports, "computeDigestMultibase", {
+	enumerable: true,
+	get: function() {
+		return computeDigestMultibase;
+	}
+});
+Object.defineProperty(exports, "createHashlink", {
+	enumerable: true,
+	get: function() {
+		return createHashlink;
+	}
+});
+Object.defineProperty(exports, "parseDigestMultibase", {
+	enumerable: true,
+	get: function() {
+		return parseDigestMultibase;
+	}
+});
+Object.defineProperty(exports, "parseHashlink", {
+	enumerable: true,
+	get: function() {
+		return parseHashlink;
+	}
+});
+Object.defineProperty(exports, "verifyDigestMultibase", {
+	enumerable: true,
+	get: function() {
+		return verifyDigestMultibase;
+	}
+});
+Object.defineProperty(exports, "verifyHashlink", {
+	enumerable: true,
+	get: function() {
+		return verifyHashlink;
+	}
+});

package/dist/tests/digest.test.cjs

@@ -0,0 +1,103 @@
+require("./chunk-C2EiDwsr.cjs");
+const require_multicodec = require("./multicodec-CxGVGa91.cjs");
+const require_multibase = require("./multibase-DcDQDNnI.cjs");
+const require_digest = require("./digest-DLwUyHCK.cjs");
+let node_test = require("node:test");
+let node_assert_strict = require("node:assert/strict");
+//#region src/digest.test.ts
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const bytes = encoder.encode("Hello World!");
+const digestMultibase = "zQmWvQxTqbG2Z9HPJgG57jjwR154cKhbtJenbyYTWkjgF3e";
+const hashlink = `hl:${digestMultibase}`;
+(0, node_test.test)("computeDigestMultibase() computes a SHA-256 multihash", async () => {
+	(0, node_assert_strict.equal)(await require_digest.computeDigestMultibase(bytes), digestMultibase);
+	const parsed = require_digest.parseDigestMultibase(digestMultibase);
+	(0, node_assert_strict.equal)(parsed.algorithm, "sha2-256");
+	(0, node_assert_strict.deepStrictEqual)(parsed.digest, new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)));
+});
+(0, node_test.test)("digest helpers accept SharedArrayBuffer-backed bytes", async () => {
+	const sharedBytes = new Uint8Array(new SharedArrayBuffer(bytes.length));
+	sharedBytes.set(bytes);
+	Object.defineProperty(sharedBytes, "slice", { value: () => {
+		throw new Error("Shared input must not be copied with slice().");
+	} });
+	(0, node_assert_strict.equal)(await require_digest.computeDigestMultibase(sharedBytes), digestMultibase);
+	(0, node_assert_strict.equal)(await require_digest.verifyDigestMultibase(sharedBytes, digestMultibase), true);
+});
+(0, node_test.test)("digest helpers ignore spoofed shared buffer tags", async () => {
+	const taggedBytes = bytes.slice();
+	Object.defineProperty(taggedBytes.buffer, Symbol.toStringTag, { value: "SharedArrayBuffer" });
+	Object.defineProperty(taggedBytes, "slice", { value: () => {
+		throw new Error("ArrayBuffer input must not be copied.");
+	} });
+	(0, node_assert_strict.equal)(await require_digest.computeDigestMultibase(taggedBytes), digestMultibase);
+	(0, node_assert_strict.equal)(await require_digest.verifyDigestMultibase(taggedBytes, digestMultibase), true);
+});
+(0, node_test.test)("createHashlink() and parseHashlink() round-trip simple hashlinks", () => {
+	(0, node_assert_strict.equal)(require_digest.createHashlink(digestMultibase), hashlink);
+	(0, node_assert_strict.deepStrictEqual)(require_digest.parseHashlink(hashlink), { digestMultibase });
+	(0, node_assert_strict.deepStrictEqual)(require_digest.parseHashlink(new URL(hashlink)), { digestMultibase });
+	const base64DigestMultibase = decoder.decode(require_multibase.encodeMultibase("base64", require_multicodec.addMulticodecPrefix(18, require_multicodec.addMulticodecPrefix(32, new Uint8Array(32).fill(255)))));
+	const base64Hashlink = require_digest.createHashlink(base64DigestMultibase);
+	(0, node_assert_strict.equal)(base64Hashlink, "hl:mEiD//////////////////////////////////////////w");
+	(0, node_assert_strict.deepStrictEqual)(require_digest.parseHashlink(base64Hashlink), { digestMultibase: base64DigestMultibase });
+	(0, node_assert_strict.deepStrictEqual)(require_digest.parseHashlink(new URL(base64Hashlink)), { digestMultibase: base64DigestMultibase });
+});
+(0, node_test.test)("digest and hashlink verification accepts matching bytes", async () => {
+	(0, node_assert_strict.equal)(await require_digest.verifyDigestMultibase(bytes, digestMultibase), true);
+	(0, node_assert_strict.equal)(await require_digest.verifyHashlink(bytes, hashlink), true);
+	(0, node_assert_strict.equal)(await require_digest.verifyHashlink(bytes, new URL(hashlink)), true);
+});
+(0, node_test.test)("digest and hashlink verification rejects non-matching bytes", async () => {
+	const different = encoder.encode("Hello World?");
+	(0, node_assert_strict.equal)(await require_digest.verifyDigestMultibase(different, digestMultibase), false);
+	(0, node_assert_strict.equal)(await require_digest.verifyHashlink(different, hashlink), false);
+});
+(0, node_test.test)("parseDigestMultibase() rejects unsupported algorithms", () => {
+	const sha1Multihash = require_multicodec.addMulticodecPrefix(17, require_multicodec.addMulticodecPrefix(20, new Uint8Array(20)));
+	const value = decoder.decode(require_multibase.encodeMultibase("base58btc", sha1Multihash));
+	(0, node_assert_strict.throws)(() => require_digest.parseDigestMultibase(value), /* @__PURE__ */ new TypeError("Unsupported digest algorithm: 0x11"));
+});
+(0, node_test.test)("parseDigestMultibase() rejects malformed values", async () => {
+	(0, node_assert_strict.throws)(() => require_digest.parseDigestMultibase("not-multibase"), /* @__PURE__ */ new TypeError("Invalid digestMultibase encoding."));
+	const missingLength = decoder.decode(require_multibase.encodeMultibase("base58btc", Uint8Array.of(18)));
+	(0, node_assert_strict.throws)(() => require_digest.parseDigestMultibase(missingLength), /* @__PURE__ */ new TypeError("Invalid digestMultibase multihash."));
+	const multihash = require_multicodec.addMulticodecPrefix(18, require_multicodec.addMulticodecPrefix(32, new Uint8Array(32)));
+	const base2 = decoder.decode(require_multibase.encodeMultibase("base2", multihash));
+	(0, node_assert_strict.equal)(base2.length, 273);
+	(0, node_assert_strict.deepStrictEqual)(require_digest.parseDigestMultibase(base2).digest, new Uint8Array(32));
+	(0, node_assert_strict.throws)(() => require_digest.parseDigestMultibase(`${base2}0`), /* @__PURE__ */ new TypeError("Invalid digestMultibase encoding."));
+	const padded = decoder.decode(require_multibase.encodeMultibase("base64pad", multihash));
+	(0, node_assert_strict.equal)(padded.endsWith("=="), true);
+	(0, node_assert_strict.deepStrictEqual)(require_digest.parseDigestMultibase(padded).digest, new Uint8Array(32));
+	(0, node_assert_strict.throws)(() => require_digest.parseDigestMultibase(padded.slice(0, -1)), /* @__PURE__ */ new TypeError("Invalid digestMultibase encoding."));
+	(0, node_assert_strict.throws)(() => require_digest.createHashlink(`${padded}=`), /* @__PURE__ */ new TypeError("Invalid digestMultibase encoding."));
+	const overlongAlgorithm = decoder.decode(require_multibase.encodeMultibase("base58btc", Uint8Array.of(146, 0, 32, ...new Uint8Array(32))));
+	(0, node_assert_strict.throws)(() => require_digest.parseDigestMultibase(overlongAlgorithm), /* @__PURE__ */ new TypeError("Invalid digestMultibase multihash."));
+	const overlongLength = decoder.decode(require_multibase.encodeMultibase("base58btc", Uint8Array.of(18, 160, 0, ...new Uint8Array(32))));
+	(0, node_assert_strict.throws)(() => require_digest.parseDigestMultibase(overlongLength), /* @__PURE__ */ new TypeError("Invalid digestMultibase multihash."));
+	const shortDigest = decoder.decode(require_multibase.encodeMultibase("base58btc", require_multicodec.addMulticodecPrefix(18, require_multicodec.addMulticodecPrefix(31, new Uint8Array(31)))));
+	(0, node_assert_strict.throws)(() => require_digest.parseDigestMultibase(shortDigest), /* @__PURE__ */ new TypeError("Invalid SHA-256 digest length."));
+	await (0, node_assert_strict.rejects)(() => require_digest.verifyDigestMultibase(bytes, shortDigest), /* @__PURE__ */ new TypeError("Invalid SHA-256 digest length."));
+});
+(0, node_test.test)("simple hashlink helpers reject metadata and malformed forms", async () => {
+	for (const terminator of [
+		"\n",
+		"\r",
+		"\r\n",
+		"\u2028",
+		"\u2029"
+	]) {
+		const malformedHashlink = `${hashlink}${terminator}`;
+		(0, node_assert_strict.throws)(() => require_digest.parseHashlink(malformedHashlink), /* @__PURE__ */ new TypeError("Invalid simple hashlink."));
+		await (0, node_assert_strict.rejects)(() => require_digest.verifyHashlink(bytes, malformedHashlink), /* @__PURE__ */ new TypeError("Invalid simple hashlink."));
+	}
+	(0, node_assert_strict.throws)(() => require_digest.parseHashlink(`${hashlink}:zmetadata`), /* @__PURE__ */ new TypeError("Invalid simple hashlink."));
+	await (0, node_assert_strict.rejects)(() => require_digest.verifyHashlink(bytes, `${hashlink}:zmetadata`), /* @__PURE__ */ new TypeError("Invalid simple hashlink."));
+	(0, node_assert_strict.throws)(() => require_digest.parseHashlink(`https://example.com/file?hl=${digestMultibase}`), /* @__PURE__ */ new TypeError("Invalid simple hashlink."));
+	(0, node_assert_strict.throws)(() => require_digest.parseHashlink("hl:not-multibase"), /* @__PURE__ */ new TypeError("Invalid digestMultibase encoding."));
+	await (0, node_assert_strict.rejects)(() => require_digest.verifyHashlink(bytes, "hl:not-multibase"), /* @__PURE__ */ new TypeError("Invalid digestMultibase encoding."));
+	(0, node_assert_strict.throws)(() => require_digest.createHashlink("not-multibase"), /* @__PURE__ */ new TypeError("Invalid digestMultibase encoding."));
+});
+//#endregion

package/dist/tests/digest.test.d.cts

@@ -0,0 +1 @@
+export { };