@fedify/vocab-runtime 2.4.0-dev.1634 → 2.4.0-dev.1659

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.4.0-dev.1634+3b4bfbb6",
+  "version": "2.4.0-dev.1659+c20a23e9",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",

package/dist/mod.cjs

@@ -4371,7 +4371,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1634+3b4bfbb6";
+var version = "2.4.0-dev.1659+c20a23e9";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4936,8 +4936,8 @@ function validateCryptoKey(key, type) {
 }
 //#endregion
 //#region src/multibase/util.ts
-const textDecoder = new TextDecoder();
-const decodeText = (bytes) => textDecoder.decode(bytes);
+const textDecoder$1 = new TextDecoder();
+const decodeText = (bytes) => textDecoder$1.decode(bytes);
 const textEncoder = new TextEncoder();
 const encodeText = (text) => textEncoder.encode(text);
 function concat(arrs, length) {
@@ -5526,6 +5526,143 @@ function parseDecimal(value) {
 	return normalized;
 }
 //#endregion
+//#region src/digest.ts
+const SHA2_256_MULTIHASH_CODE = 18;
+const SHA2_256_DIGEST_LENGTH = 32;
+const MAX_DIGEST_MULTIBASE_LENGTH = 1 + (SHA2_256_DIGEST_LENGTH + 2) * 8;
+const textDecoder = new TextDecoder();
+const getArrayBufferByteLength = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength")?.get;
+function isCanonicalVarintPrefix(data, prefix) {
+	const canonical = addMulticodecPrefix(prefix.code, new Uint8Array());
+	if (canonical.length !== prefix.prefixLength) return false;
+	for (let i = 0; i < canonical.length; i++) if (data[i] !== canonical[i]) return false;
+	return true;
+}
+function toWebCryptoBytes(bytes) {
+	if (getArrayBufferByteLength != null) try {
+		getArrayBufferByteLength.call(bytes.buffer);
+		return bytes;
+	} catch {}
+	return new Uint8Array(bytes);
+}
+/**
+* Computes the SHA-256 digest of a byte sequence and encodes it as a
+* base58-btc multibase multihash suitable for FEP-ef61's
+* `digestMultibase` property.
+*
+* @param bytes The bytes to digest.
+* @returns The base58-btc multibase-encoded SHA-256 multihash.
+* @since 2.4.0
+*/
+async function computeDigestMultibase(bytes) {
+	const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", toWebCryptoBytes(bytes)));
+	const multihash = addMulticodecPrefix(SHA2_256_MULTIHASH_CODE, addMulticodecPrefix(digest.length, digest));
+	return textDecoder.decode(encodeMultibase("base58btc", multihash));
+}
+/**
+* Parses and validates a SHA-256 `digestMultibase` value.
+*
+* @param value The multibase-encoded multihash to parse.
+* @returns The digest algorithm and raw digest bytes.
+* @throws {TypeError} If the value is malformed or uses an unsupported hash
+*                      algorithm.
+* @since 2.4.0
+*/
+function parseDigestMultibase(value) {
+	if (value.length > MAX_DIGEST_MULTIBASE_LENGTH) throw new TypeError("Invalid digestMultibase encoding.");
+	let multihash;
+	try {
+		multihash = decodeMultibase(value);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase encoding.", { cause: error });
+	}
+	const encoding = encodingFromBaseData(value);
+	if (value !== textDecoder.decode(encodeMultibase(encoding.name, multihash))) throw new TypeError("Invalid digestMultibase encoding.");
+	let algorithmPrefix;
+	try {
+		algorithmPrefix = getMulticodecPrefix(multihash);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase multihash.", { cause: error });
+	}
+	if (!isCanonicalVarintPrefix(multihash, algorithmPrefix)) throw new TypeError("Invalid digestMultibase multihash.");
+	if (algorithmPrefix.code !== SHA2_256_MULTIHASH_CODE) throw new TypeError(`Unsupported digest algorithm: 0x${algorithmPrefix.code.toString(16)}`);
+	const lengthAndDigest = multihash.subarray(algorithmPrefix.prefixLength);
+	let lengthPrefix;
+	try {
+		lengthPrefix = getMulticodecPrefix(lengthAndDigest);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase multihash.", { cause: error });
+	}
+	if (!isCanonicalVarintPrefix(lengthAndDigest, lengthPrefix)) throw new TypeError("Invalid digestMultibase multihash.");
+	const digest = lengthAndDigest.slice(lengthPrefix.prefixLength);
+	if (lengthPrefix.code !== SHA2_256_DIGEST_LENGTH || digest.length !== SHA2_256_DIGEST_LENGTH) throw new TypeError("Invalid SHA-256 digest length.");
+	return {
+		algorithm: "sha2-256",
+		digest
+	};
+}
+function extractDigestMultibase(value) {
+	const hashlink = typeof value === "string" ? value : value.href;
+	const match = /^hl:([^:\r\n\u2028\u2029]+)$/i.exec(hashlink);
+	if (match == null || match[0].length !== hashlink.length) throw new TypeError("Invalid simple hashlink.");
+	return match[1];
+}
+/**
+* Parses a metadata-free `hl:` hashlink and validates its resource digest.
+*
+* @param value The simple hashlink to parse.
+* @returns The `digestMultibase` value carried by the hashlink.
+* @throws {TypeError} If the hashlink is malformed, contains metadata, or
+*                      carries an invalid or unsupported digest.
+* @since 2.4.0
+*/
+function parseHashlink(value) {
+	const digestMultibase = extractDigestMultibase(value);
+	parseDigestMultibase(digestMultibase);
+	return { digestMultibase };
+}
+/**
+* Creates a metadata-free `hl:` hashlink from a `digestMultibase` value.
+*
+* @param digestMultibase The SHA-256 multibase multihash to embed.
+* @returns The simple hashlink.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+function createHashlink(digestMultibase) {
+	parseDigestMultibase(digestMultibase);
+	return `hl:${digestMultibase}`;
+}
+/**
+* Verifies that bytes match a SHA-256 `digestMultibase` value.
+*
+* @param bytes The bytes to verify.
+* @param digestMultibase The expected digest.
+* @returns Whether the bytes match the digest.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+async function verifyDigestMultibase(bytes, digestMultibase) {
+	const expected = parseDigestMultibase(digestMultibase).digest;
+	const actual = new Uint8Array(await crypto.subtle.digest("SHA-256", toWebCryptoBytes(bytes)));
+	if (expected.length !== actual.length) return false;
+	let difference = 0;
+	for (let i = 0; i < expected.length; i++) difference |= expected[i] ^ actual[i];
+	return difference === 0;
+}
+/**
+* Verifies that bytes match the resource digest in a simple hashlink.
+*
+* @param bytes The bytes to verify.
+* @param hashlink The simple hashlink containing the expected digest.
+* @returns Whether the bytes match the hashlink digest.
+* @throws {TypeError} If the hashlink or digest is malformed or unsupported.
+* @since 2.4.0
+*/
+async function verifyHashlink(bytes, hashlink) {
+	return await verifyDigestMultibase(bytes, extractDigestMultibase(hashlink));
+}
+//#endregion
 //#region src/langstr.ts
 /**
 * A language-tagged string which corresponds to the `rdf:langString` type.
@@ -5560,7 +5697,9 @@ exports.UrlError = require_url.UrlError;
 exports.arePortableUrisEqual = require_url.arePortableUrisEqual;
 exports.canParseDecimal = canParseDecimal;
 exports.canonicalizePortableUri = require_url.canonicalizePortableUri;
+exports.computeDigestMultibase = computeDigestMultibase;
 exports.createActivityPubRequest = createActivityPubRequest;
+exports.createHashlink = createHashlink;
 exports.decodeMultibase = decodeMultibase;
 exports.encodeMultibase = encodeMultibase;
 exports.encodingFromBaseData = encodingFromBaseData;
@@ -5587,8 +5726,12 @@ exports.isValidPublicIPv6Address = require_url.isValidPublicIPv6Address;
 exports.logRequest = logRequest;
 exports.parseDecimal = parseDecimal;
 exports.parseDidKeyVerificationMethod = parseDidKeyVerificationMethod;
+exports.parseDigestMultibase = parseDigestMultibase;
 exports.parseGatewayUrl = require_url.parseGatewayUrl;
+exports.parseHashlink = parseHashlink;
 exports.parseIri = require_url.parseIri;
 exports.parseJsonLdId = require_url.parseJsonLdId;
 exports.preloadedContexts = preloadedContexts;
 exports.validatePublicUrl = require_url.validatePublicUrl;
+exports.verifyDigestMultibase = verifyDigestMultibase;
+exports.verifyHashlink = verifyHashlink;

package/dist/mod.d.cts

@@ -204,6 +204,87 @@ declare function canParseDecimal(value: string): boolean;
 */
 declare function parseDecimal(value: string): Decimal;
 //#endregion
+//#region src/digest.d.ts
+/**
+* A parsed SHA-256 resource digest.
+*
+* @since 2.4.0
+*/
+interface ParsedDigestMultibase {
+  /** The multihash algorithm represented by the digest. */
+  readonly algorithm: "sha2-256";
+  /** The raw 32-byte SHA-256 digest. */
+  readonly digest: Uint8Array;
+}
+/**
+* A parsed simple hashlink.
+*
+* @since 2.4.0
+*/
+interface ParsedHashlink {
+  /** The multibase-encoded multihash carried by the hashlink. */
+  readonly digestMultibase: string;
+}
+/**
+* Computes the SHA-256 digest of a byte sequence and encodes it as a
+* base58-btc multibase multihash suitable for FEP-ef61's
+* `digestMultibase` property.
+*
+* @param bytes The bytes to digest.
+* @returns The base58-btc multibase-encoded SHA-256 multihash.
+* @since 2.4.0
+*/
+declare function computeDigestMultibase(bytes: Uint8Array): Promise<string>;
+/**
+* Parses and validates a SHA-256 `digestMultibase` value.
+*
+* @param value The multibase-encoded multihash to parse.
+* @returns The digest algorithm and raw digest bytes.
+* @throws {TypeError} If the value is malformed or uses an unsupported hash
+*                      algorithm.
+* @since 2.4.0
+*/
+declare function parseDigestMultibase(value: string): ParsedDigestMultibase;
+/**
+* Parses a metadata-free `hl:` hashlink and validates its resource digest.
+*
+* @param value The simple hashlink to parse.
+* @returns The `digestMultibase` value carried by the hashlink.
+* @throws {TypeError} If the hashlink is malformed, contains metadata, or
+*                      carries an invalid or unsupported digest.
+* @since 2.4.0
+*/
+declare function parseHashlink(value: string | URL): ParsedHashlink;
+/**
+* Creates a metadata-free `hl:` hashlink from a `digestMultibase` value.
+*
+* @param digestMultibase The SHA-256 multibase multihash to embed.
+* @returns The simple hashlink.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+declare function createHashlink(digestMultibase: string): string;
+/**
+* Verifies that bytes match a SHA-256 `digestMultibase` value.
+*
+* @param bytes The bytes to verify.
+* @param digestMultibase The expected digest.
+* @returns Whether the bytes match the digest.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+declare function verifyDigestMultibase(bytes: Uint8Array, digestMultibase: string): Promise<boolean>;
+/**
+* Verifies that bytes match the resource digest in a simple hashlink.
+*
+* @param bytes The bytes to verify.
+* @param hashlink The simple hashlink containing the expected digest.
+* @returns Whether the bytes match the hashlink digest.
+* @throws {TypeError} If the hashlink or digest is malformed or unsupported.
+* @since 2.4.0
+*/
+declare function verifyHashlink(bytes: Uint8Array, hashlink: string | URL): Promise<boolean>;
+//#endregion
 //#region src/langstr.d.ts
 /**
 * A language-tagged string which corresponds to the `rdf:langString` type.
@@ -390,4 +471,4 @@ declare function isValidPublicIPv4Address(address: string): boolean;
 declare function isValidPublicIPv6Address(address: string): boolean;
 declare function expandIPv6Address(address: string): string;
 //#endregion
-export { type AuthenticatedDocumentLoaderFactory, type CreateRequestOptions, type Decimal, type DidKeyVerificationMethod, type DocumentLoader, type DocumentLoaderFactory, type DocumentLoaderFactoryOptions, type DocumentLoaderOptions, FetchError, type GetDocumentLoaderOptions, type GetUserAgentOptions, type Json, LanguageString, type PropertyPreprocessor, type PropertyPreprocessorContext, type RemoteDocument, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, createActivityPubRequest, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseGatewayUrl, parseIri, parseJsonLdId, preloadedContexts, validatePublicUrl };
+export { type AuthenticatedDocumentLoaderFactory, type CreateRequestOptions, type Decimal, type DidKeyVerificationMethod, type DocumentLoader, type DocumentLoaderFactory, type DocumentLoaderFactoryOptions, type DocumentLoaderOptions, FetchError, type GetDocumentLoaderOptions, type GetUserAgentOptions, type Json, LanguageString, type ParsedDigestMultibase, type ParsedHashlink, type PropertyPreprocessor, type PropertyPreprocessorContext, type RemoteDocument, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, computeDigestMultibase, createActivityPubRequest, createHashlink, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseDigestMultibase, parseGatewayUrl, parseHashlink, parseIri, parseJsonLdId, preloadedContexts, validatePublicUrl, verifyDigestMultibase, verifyHashlink };

package/dist/mod.d.ts

@@ -204,6 +204,87 @@ declare function canParseDecimal(value: string): boolean;
 */
 declare function parseDecimal(value: string): Decimal;
 //#endregion
+//#region src/digest.d.ts
+/**
+* A parsed SHA-256 resource digest.
+*
+* @since 2.4.0
+*/
+interface ParsedDigestMultibase {
+  /** The multihash algorithm represented by the digest. */
+  readonly algorithm: "sha2-256";
+  /** The raw 32-byte SHA-256 digest. */
+  readonly digest: Uint8Array;
+}
+/**
+* A parsed simple hashlink.
+*
+* @since 2.4.0
+*/
+interface ParsedHashlink {
+  /** The multibase-encoded multihash carried by the hashlink. */
+  readonly digestMultibase: string;
+}
+/**
+* Computes the SHA-256 digest of a byte sequence and encodes it as a
+* base58-btc multibase multihash suitable for FEP-ef61's
+* `digestMultibase` property.
+*
+* @param bytes The bytes to digest.
+* @returns The base58-btc multibase-encoded SHA-256 multihash.
+* @since 2.4.0
+*/
+declare function computeDigestMultibase(bytes: Uint8Array): Promise<string>;
+/**
+* Parses and validates a SHA-256 `digestMultibase` value.
+*
+* @param value The multibase-encoded multihash to parse.
+* @returns The digest algorithm and raw digest bytes.
+* @throws {TypeError} If the value is malformed or uses an unsupported hash
+*                      algorithm.
+* @since 2.4.0
+*/
+declare function parseDigestMultibase(value: string): ParsedDigestMultibase;
+/**
+* Parses a metadata-free `hl:` hashlink and validates its resource digest.
+*
+* @param value The simple hashlink to parse.
+* @returns The `digestMultibase` value carried by the hashlink.
+* @throws {TypeError} If the hashlink is malformed, contains metadata, or
+*                      carries an invalid or unsupported digest.
+* @since 2.4.0
+*/
+declare function parseHashlink(value: string | URL): ParsedHashlink;
+/**
+* Creates a metadata-free `hl:` hashlink from a `digestMultibase` value.
+*
+* @param digestMultibase The SHA-256 multibase multihash to embed.
+* @returns The simple hashlink.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+declare function createHashlink(digestMultibase: string): string;
+/**
+* Verifies that bytes match a SHA-256 `digestMultibase` value.
+*
+* @param bytes The bytes to verify.
+* @param digestMultibase The expected digest.
+* @returns Whether the bytes match the digest.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+declare function verifyDigestMultibase(bytes: Uint8Array, digestMultibase: string): Promise<boolean>;
+/**
+* Verifies that bytes match the resource digest in a simple hashlink.
+*
+* @param bytes The bytes to verify.
+* @param hashlink The simple hashlink containing the expected digest.
+* @returns Whether the bytes match the hashlink digest.
+* @throws {TypeError} If the hashlink or digest is malformed or unsupported.
+* @since 2.4.0
+*/
+declare function verifyHashlink(bytes: Uint8Array, hashlink: string | URL): Promise<boolean>;
+//#endregion
 //#region src/langstr.d.ts
 /**
 * A language-tagged string which corresponds to the `rdf:langString` type.
@@ -390,4 +471,4 @@ declare function isValidPublicIPv4Address(address: string): boolean;
 declare function isValidPublicIPv6Address(address: string): boolean;
 declare function expandIPv6Address(address: string): string;
 //#endregion
-export { type AuthenticatedDocumentLoaderFactory, type CreateRequestOptions, type Decimal, type DidKeyVerificationMethod, type DocumentLoader, type DocumentLoaderFactory, type DocumentLoaderFactoryOptions, type DocumentLoaderOptions, FetchError, type GetDocumentLoaderOptions, type GetUserAgentOptions, type Json, LanguageString, type PropertyPreprocessor, type PropertyPreprocessorContext, type RemoteDocument, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, createActivityPubRequest, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseGatewayUrl, parseIri, parseJsonLdId, preloadedContexts, validatePublicUrl };
+export { type AuthenticatedDocumentLoaderFactory, type CreateRequestOptions, type Decimal, type DidKeyVerificationMethod, type DocumentLoader, type DocumentLoaderFactory, type DocumentLoaderFactoryOptions, type DocumentLoaderOptions, FetchError, type GetDocumentLoaderOptions, type GetUserAgentOptions, type Json, LanguageString, type ParsedDigestMultibase, type ParsedHashlink, type PropertyPreprocessor, type PropertyPreprocessorContext, type RemoteDocument, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, computeDigestMultibase, createActivityPubRequest, createHashlink, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseDigestMultibase, parseGatewayUrl, parseHashlink, parseIri, parseJsonLdId, preloadedContexts, validatePublicUrl, verifyDigestMultibase, verifyHashlink };

package/dist/mod.js

@@ -4367,7 +4367,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1634+3b4bfbb6";
+var version = "2.4.0-dev.1659+c20a23e9";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4932,8 +4932,8 @@ function validateCryptoKey(key, type) {
 }
 //#endregion
 //#region src/multibase/util.ts
-const textDecoder = new TextDecoder();
-const decodeText = (bytes) => textDecoder.decode(bytes);
+const textDecoder$1 = new TextDecoder();
+const decodeText = (bytes) => textDecoder$1.decode(bytes);
 const textEncoder = new TextEncoder();
 const encodeText = (text) => textEncoder.encode(text);
 function concat(arrs, length) {
@@ -5522,6 +5522,143 @@ function parseDecimal(value) {
 	return normalized;
 }
 //#endregion
+//#region src/digest.ts
+const SHA2_256_MULTIHASH_CODE = 18;
+const SHA2_256_DIGEST_LENGTH = 32;
+const MAX_DIGEST_MULTIBASE_LENGTH = 1 + (SHA2_256_DIGEST_LENGTH + 2) * 8;
+const textDecoder = new TextDecoder();
+const getArrayBufferByteLength = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength")?.get;
+function isCanonicalVarintPrefix(data, prefix) {
+	const canonical = addMulticodecPrefix(prefix.code, new Uint8Array());
+	if (canonical.length !== prefix.prefixLength) return false;
+	for (let i = 0; i < canonical.length; i++) if (data[i] !== canonical[i]) return false;
+	return true;
+}
+function toWebCryptoBytes(bytes) {
+	if (getArrayBufferByteLength != null) try {
+		getArrayBufferByteLength.call(bytes.buffer);
+		return bytes;
+	} catch {}
+	return new Uint8Array(bytes);
+}
+/**
+* Computes the SHA-256 digest of a byte sequence and encodes it as a
+* base58-btc multibase multihash suitable for FEP-ef61's
+* `digestMultibase` property.
+*
+* @param bytes The bytes to digest.
+* @returns The base58-btc multibase-encoded SHA-256 multihash.
+* @since 2.4.0
+*/
+async function computeDigestMultibase(bytes) {
+	const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", toWebCryptoBytes(bytes)));
+	const multihash = addMulticodecPrefix(SHA2_256_MULTIHASH_CODE, addMulticodecPrefix(digest.length, digest));
+	return textDecoder.decode(encodeMultibase("base58btc", multihash));
+}
+/**
+* Parses and validates a SHA-256 `digestMultibase` value.
+*
+* @param value The multibase-encoded multihash to parse.
+* @returns The digest algorithm and raw digest bytes.
+* @throws {TypeError} If the value is malformed or uses an unsupported hash
+*                      algorithm.
+* @since 2.4.0
+*/
+function parseDigestMultibase(value) {
+	if (value.length > MAX_DIGEST_MULTIBASE_LENGTH) throw new TypeError("Invalid digestMultibase encoding.");
+	let multihash;
+	try {
+		multihash = decodeMultibase(value);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase encoding.", { cause: error });
+	}
+	const encoding = encodingFromBaseData(value);
+	if (value !== textDecoder.decode(encodeMultibase(encoding.name, multihash))) throw new TypeError("Invalid digestMultibase encoding.");
+	let algorithmPrefix;
+	try {
+		algorithmPrefix = getMulticodecPrefix(multihash);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase multihash.", { cause: error });
+	}
+	if (!isCanonicalVarintPrefix(multihash, algorithmPrefix)) throw new TypeError("Invalid digestMultibase multihash.");
+	if (algorithmPrefix.code !== SHA2_256_MULTIHASH_CODE) throw new TypeError(`Unsupported digest algorithm: 0x${algorithmPrefix.code.toString(16)}`);
+	const lengthAndDigest = multihash.subarray(algorithmPrefix.prefixLength);
+	let lengthPrefix;
+	try {
+		lengthPrefix = getMulticodecPrefix(lengthAndDigest);
+	} catch (error) {
+		throw new TypeError("Invalid digestMultibase multihash.", { cause: error });
+	}
+	if (!isCanonicalVarintPrefix(lengthAndDigest, lengthPrefix)) throw new TypeError("Invalid digestMultibase multihash.");
+	const digest = lengthAndDigest.slice(lengthPrefix.prefixLength);
+	if (lengthPrefix.code !== SHA2_256_DIGEST_LENGTH || digest.length !== SHA2_256_DIGEST_LENGTH) throw new TypeError("Invalid SHA-256 digest length.");
+	return {
+		algorithm: "sha2-256",
+		digest
+	};
+}
+function extractDigestMultibase(value) {
+	const hashlink = typeof value === "string" ? value : value.href;
+	const match = /^hl:([^:\r\n\u2028\u2029]+)$/i.exec(hashlink);
+	if (match == null || match[0].length !== hashlink.length) throw new TypeError("Invalid simple hashlink.");
+	return match[1];
+}
+/**
+* Parses a metadata-free `hl:` hashlink and validates its resource digest.
+*
+* @param value The simple hashlink to parse.
+* @returns The `digestMultibase` value carried by the hashlink.
+* @throws {TypeError} If the hashlink is malformed, contains metadata, or
+*                      carries an invalid or unsupported digest.
+* @since 2.4.0
+*/
+function parseHashlink(value) {
+	const digestMultibase = extractDigestMultibase(value);
+	parseDigestMultibase(digestMultibase);
+	return { digestMultibase };
+}
+/**
+* Creates a metadata-free `hl:` hashlink from a `digestMultibase` value.
+*
+* @param digestMultibase The SHA-256 multibase multihash to embed.
+* @returns The simple hashlink.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+function createHashlink(digestMultibase) {
+	parseDigestMultibase(digestMultibase);
+	return `hl:${digestMultibase}`;
+}
+/**
+* Verifies that bytes match a SHA-256 `digestMultibase` value.
+*
+* @param bytes The bytes to verify.
+* @param digestMultibase The expected digest.
+* @returns Whether the bytes match the digest.
+* @throws {TypeError} If the digest is malformed or unsupported.
+* @since 2.4.0
+*/
+async function verifyDigestMultibase(bytes, digestMultibase) {
+	const expected = parseDigestMultibase(digestMultibase).digest;
+	const actual = new Uint8Array(await crypto.subtle.digest("SHA-256", toWebCryptoBytes(bytes)));
+	if (expected.length !== actual.length) return false;
+	let difference = 0;
+	for (let i = 0; i < expected.length; i++) difference |= expected[i] ^ actual[i];
+	return difference === 0;
+}
+/**
+* Verifies that bytes match the resource digest in a simple hashlink.
+*
+* @param bytes The bytes to verify.
+* @param hashlink The simple hashlink containing the expected digest.
+* @returns Whether the bytes match the hashlink digest.
+* @throws {TypeError} If the hashlink or digest is malformed or unsupported.
+* @since 2.4.0
+*/
+async function verifyHashlink(bytes, hashlink) {
+	return await verifyDigestMultibase(bytes, extractDigestMultibase(hashlink));
+}
+//#endregion
 //#region src/langstr.ts
 /**
 * A language-tagged string which corresponds to the `rdf:langString` type.
@@ -5550,4 +5687,4 @@ LanguageString.prototype[Symbol.for("nodejs.util.inspect.custom")] = function(_d
 	return `<${this.locale.baseName}> ${inspect(this.toString(), options)}`;
 };
 //#endregion
-export { FetchError, LanguageString, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, createActivityPubRequest, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseGatewayUrl, parseIri, parseJsonLdId, preloadedContexts, validatePublicUrl };
+export { FetchError, LanguageString, UrlError, arePortableUrisEqual, canParseDecimal, canonicalizePortableUri, computeDigestMultibase, createActivityPubRequest, createHashlink, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, getFe34Origin, getRemoteDocument, getUserAgent, haveSameFe34Origin, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isGatewayUrl, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseDigestMultibase, parseGatewayUrl, parseHashlink, parseIri, parseJsonLdId, preloadedContexts, validatePublicUrl, verifyDigestMultibase, verifyHashlink };

package/dist/tests/decimal.test.cjs

@@ -1,9 +1,10 @@
 require("./chunk-C2EiDwsr.cjs");
-require("./docloader-CTd4XwqK.cjs");
+require("./docloader-CDetn4RD.cjs");
 require("./url-CsOV_B_P.cjs");
-require("./key-_wXwomh_.cjs");
-require("./multibase-Bz_UUDtL.cjs");
-require("./langstr-CbAxaeEZ.cjs");
+require("./key-BcOWDLMm.cjs");
+require("./multibase-DcDQDNnI.cjs");
+require("./digest-DLwUyHCK.cjs");
+require("./langstr-BOQHfJDr.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 //#region src/decimal.ts

package/dist/tests/decimal.test.mjs

@@ -1,8 +1,9 @@
-import "./docloader-CNzoXrLM.mjs";
+import "./docloader-C_0493V1.mjs";
 import "./url-Du7RQQgP.mjs";
-import "./key-CDGDH_vC.mjs";
-import "./multibase-B4bvakyA.mjs";
-import "./langstr-Di5AvKpB.mjs";
+import "./key-Drbw_2tw.mjs";
+import "./multibase-Cluwl8OM.mjs";
+import "./digest-BJlumPNJ.mjs";
+import "./langstr-DDLc4833.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 import { test } from "node:test";
 //#region src/decimal.ts