@fedify/vocab-runtime 2.4.0-dev.2233 → 2.4.0-dev.2240

package/dist/tests/{request-BQlkB8du.cjs → request-fo2l2yJS.cjs}

@@ -3,7 +3,7 @@ let node_process = require("node:process");
 node_process = require_rolldown_runtime.__toESM(node_process, 1);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.2233+abb4a6b2";
+var version = "2.4.0-dev.2240+79613fa6";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/request.test.cjs

@@ -1,5 +1,5 @@
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
-const require_request = require("./request-BQlkB8du.cjs");
+const require_request = require("./request-fo2l2yJS.cjs");
 let node_test = require("node:test");
 let node_process = require("node:process");
 node_process = require_rolldown_runtime.__toESM(node_process, 1);

package/dist/tests/request.test.mjs

@@ -1,4 +1,4 @@
-import { n as createActivityPubRequest, o as version, r as getUserAgent } from "./request-D3elVRyB.mjs";
+import { n as createActivityPubRequest, o as version, r as getUserAgent } from "./request-BRPiDcmG.mjs";
 import { test } from "node:test";
 import process from "node:process";
 import { deepStrictEqual } from "node:assert";

package/dist/tests/{url-Cdu4ASgJ.mjs → url-CWC-NI3a.mjs}

@@ -19,6 +19,26 @@ const INVALID_PERCENT_ENCODING_PATTERN = /%(?![0-9A-Fa-f]{2})/;
 const PERCENT_ENCODING_PATTERN = /%[0-9A-Fa-f]{2}/g;
 const DID_SCHEME_PATTERN = /^did:/i;
 const DID_PATTERN = /^did:[a-z0-9]+:[-A-Za-z0-9._%]+(?::[-A-Za-z0-9._%]+)*$/i;
+const DOT_SEGMENT_PATTERN = /(?:^|\/)(?:\.|%2e){1,2}(?=\/|$)/i;
+function prepareUrlInput(iri) {
+	let prepared = iri.replace(/[\t\n\r]/g, "");
+	while (prepared.length > 0 && prepared.charCodeAt(0) <= 32) prepared = prepared.slice(1);
+	while (prepared.length > 0 && prepared.charCodeAt(prepared.length - 1) <= 32) prepared = prepared.slice(0, -1);
+	return prepared;
+}
+function assertPortablePathCanBeParsed(iri) {
+	const match = prepareUrlInput(iri).match(PORTABLE_IRI_PATTERN);
+	if (match != null && DOT_SEGMENT_PATTERN.test(match[3])) throw new TypeError("Portable ActivityPub IRI paths with dot segments cannot be represented as URLs.");
+}
+function assertCompatiblePathCanBeParsed(raw, parsed) {
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return;
+	const match = prepareUrlInput(raw).match(/^https?:[\/\\]*[^/?#\\]*([^?#]*)/i);
+	if (match == null) return;
+	const rawPath = match[1].replace(/\\/g, "/");
+	const compatiblePath = parsed.pathname.startsWith(COMPATIBLE_ID_PATH_PREFIX) && COMPATIBLE_ID_DID_PATTERN.test(parsed.pathname.slice(COMPATIBLE_ID_PATH_PREFIX.length));
+	const rawCompatiblePath = rawPath.startsWith(COMPATIBLE_ID_PATH_PREFIX) && COMPATIBLE_ID_DID_PATTERN.test(rawPath.slice(COMPATIBLE_ID_PATH_PREFIX.length));
+	if ((compatiblePath || rawCompatiblePath) && DOT_SEGMENT_PATTERN.test(rawPath)) throw new TypeError("FEP-ef61 compatible identifier paths with dot segments cannot be represented as URLs.");
+}
 /**
 * Parses a JSON-LD `@id` value as an IRI.
 */
@@ -32,22 +52,40 @@ function parseJsonLdId(id, base) {
 }
 /**
 * Parses an IRI as a URL, including FEP-ef61 portable ActivityPub IRIs.
+* Portable URI and FEP-ef61 compatible identifier strings whose path contains
+* a `.` or `..` segment, including percent-encoded spellings, throw a
+* `TypeError`: JavaScript `URL` would otherwise identify a different object.
+* This also applies to compatible identifier strings used as relative bases.
+* A `URL` argument may already have lost such segments before this function
+* receives it.
 */
 function parseIri(iri, base) {
 	if (iri instanceof URL) return normalizePortableUrl(iri) ?? new URL(iri.href);
+	assertPortablePathCanBeParsed(iri);
 	const portable = parsePortableIri(iri);
 	if (portable != null) return portable;
 	base = normalizeBaseIri(base);
 	if (!URL.canParse(iri, base) && iri.startsWith("at://")) return parseAtUri(iri);
 	const parsed = new URL(iri, base);
+	assertCompatiblePathCanBeParsed(iri, parsed);
 	return normalizePortableUrl(parsed) ?? parsed;
 }
 /**
 * Formats a URL as an IRI, including FEP-ef61 portable ActivityPub IRIs.
+* Portable URI and FEP-ef61 compatible identifier strings with dot segments
+* throw a `TypeError` because their paths cannot be represented by JavaScript
+* `URL` without normalization.
 */
 function formatIri(iri) {
+	if (typeof iri === "string") assertPortablePathCanBeParsed(iri);
 	const parsed = parsePortableIri(iri instanceof URL ? iri.href : iri);
-	if (parsed == null) return iri instanceof URL ? iri.href : URL.canParse(iri) ? new URL(iri).href : iri;
+	if (parsed == null) {
+		if (iri instanceof URL) return iri.href;
+		if (!URL.canParse(iri)) return iri;
+		const url = new URL(iri);
+		assertCompatiblePathCanBeParsed(iri, url);
+		return url.href;
+	}
 	return `ap+ef61://${decodePortableAuthority(parsed.host)}${parsed.pathname}${parsed.search}${parsed.hash}`;
 }
 /**
@@ -167,11 +205,15 @@ function parsePortableIri(iri) {
 }
 function normalizePortableUrl(iri) {
 	if (iri.protocol !== "ap:" && iri.protocol !== "ap+ef61:") return null;
-	return parsePortableIri(`ap+ef61://${iri.host}${iri.pathname}${iri.search}${iri.hash}`);
+	const raw = `ap+ef61://${iri.host}${iri.pathname}${iri.search}${iri.hash}`;
+	assertPortablePathCanBeParsed(raw);
+	return parsePortableIri(raw);
 }
 function normalizeBaseIri(base) {
 	if (base == null) return void 0;
 	if (base instanceof URL) return normalizePortableUrl(base) ?? base;
+	assertPortablePathCanBeParsed(base);
+	if (URL.canParse(base)) assertCompatiblePathCanBeParsed(base, new URL(base));
 	return parsePortableIri(base) ?? (base.startsWith("at://") && !URL.canParse(".", base) ? parseAtUri(base) : base);
 }
 function decodePortableAuthority(authority) {
@@ -238,6 +280,7 @@ function parseGatewayUrl(url) {
 }
 const COMPATIBLE_ID_PATH_PREFIX = "/.well-known/apgateway/";
 const COMPATIBLE_ID_DID_PATTERN = /^did(?::|%3A)/i;
+const RAW_COMPATIBLE_ID_PREFIX_PATTERN = /^(?:[hH][tT][tT][pP][sS]?):\/\/[^/?#]*\/\.well-known\/apgateway\/(?=[dD][iI][dD](?::|%3[aA]))/;
 const LOCATION_HINT_PARAMETERS = /* @__PURE__ */ new Set(["@gateway", "gateways"]);
 /**
 * Converts an [FEP-ef61] compatible identifier into a portable ActivityPub
@@ -273,8 +316,9 @@ const LOCATION_HINT_PARAMETERS = /* @__PURE__ */ new Set(["@gateway", "gateways"
 *                     malformed, e.g., it has an invalid DID, no object path,
 *                     invalid percent-encoding, credentials, or location
 *                     hints (`@gateway` query parameters, or the legacy
-*                     `gateways` parameter), which FEP-ef61 forbids in
-*                     compatible identifiers.
+*                     `gateways` parameter), or its raw string path would
+*                     change during URL parsing.  Already-parsed `URL`
+*                     arguments cannot reveal segments lost by their parser.
 * @since 2.4.0
 */
 function fromCompatibleEf61Id(input) {
@@ -282,18 +326,29 @@ function fromCompatibleEf61Id(input) {
 }
 function convertCompatibleEf61Id(input) {
 	let url;
+	const rawPrefix = typeof input === "string" ? input.match(RAW_COMPATIBLE_ID_PREFIX_PATTERN) : null;
 	if (input instanceof URL) url = input;
 	else if (typeof input === "string" && URL.canParse(input)) url = new URL(input);
 	else return null;
 	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-	if (!url.pathname.startsWith(COMPATIBLE_ID_PATH_PREFIX)) return null;
+	if (typeof input === "string" && rawPrefix == null) {
+		if (url.pathname.startsWith(COMPATIBLE_ID_PATH_PREFIX) && COMPATIBLE_ID_DID_PATTERN.test(url.pathname.slice(23))) throw new TypeError("Invalid FEP-ef61 compatible identifier.");
+	}
+	if (!url.pathname.startsWith(COMPATIBLE_ID_PATH_PREFIX)) {
+		if (rawPrefix != null) throw new TypeError("Invalid FEP-ef61 compatible identifier.");
+		return null;
+	}
 	const tail = url.pathname.slice(23);
-	if (!COMPATIBLE_ID_DID_PATTERN.test(tail)) return null;
+	if (!COMPATIBLE_ID_DID_PATTERN.test(tail)) {
+		if (rawPrefix != null) throw new TypeError("Invalid FEP-ef61 compatible identifier.");
+		return null;
+	}
 	if (url.username !== "" || url.password !== "") throw new TypeError("Invalid FEP-ef61 compatible identifier: credentials are not allowed.");
 	const iri = "ap+ef61://" + url.href.slice(url.origin.length + 23);
 	try {
 		const parsed = parsePortableIri(iri);
 		if (parsed == null) throw new TypeError("Not a portable IRI.");
+		if (typeof input === "string" && rawPrefix != null && canonicalizePortableUri("ap://" + input.slice(rawPrefix[0].length)) !== canonicalizePortableUri(iri)) throw new TypeError("URL parsing changed the portable identifier.");
 		canonicalizePortableUri(iri);
 		if ((url.search === "" ? [] : normalizePortableComponent(url.search.slice(1)).split("&")).some(isLocationHint)) throw new TypeError("Location hints are not allowed.");
 		return {
@@ -333,7 +388,8 @@ function convertCompatibleEf61Id(input) {
 * @returns The compatible identifier.
 * @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
 *                     URI, if its path has `.` or `..` segments (which
-*                     HTTP(S) URLs cannot represent), or if the gateway is
+*                     HTTP(S) URLs cannot represent without changing the
+*                     identified object), or if the gateway is
 *                     not an HTTP(S) origin with no credentials, path, query,
 *                     or fragment.
 * @since 2.4.0

package/dist/tests/{url-CtHyzMR4.cjs → url-DsMBGqCc.cjs}

@@ -21,6 +21,26 @@ const INVALID_PERCENT_ENCODING_PATTERN = /%(?![0-9A-Fa-f]{2})/;
 const PERCENT_ENCODING_PATTERN = /%[0-9A-Fa-f]{2}/g;
 const DID_SCHEME_PATTERN = /^did:/i;
 const DID_PATTERN = /^did:[a-z0-9]+:[-A-Za-z0-9._%]+(?::[-A-Za-z0-9._%]+)*$/i;
+const DOT_SEGMENT_PATTERN = /(?:^|\/)(?:\.|%2e){1,2}(?=\/|$)/i;
+function prepareUrlInput(iri) {
+	let prepared = iri.replace(/[\t\n\r]/g, "");
+	while (prepared.length > 0 && prepared.charCodeAt(0) <= 32) prepared = prepared.slice(1);
+	while (prepared.length > 0 && prepared.charCodeAt(prepared.length - 1) <= 32) prepared = prepared.slice(0, -1);
+	return prepared;
+}
+function assertPortablePathCanBeParsed(iri) {
+	const match = prepareUrlInput(iri).match(PORTABLE_IRI_PATTERN);
+	if (match != null && DOT_SEGMENT_PATTERN.test(match[3])) throw new TypeError("Portable ActivityPub IRI paths with dot segments cannot be represented as URLs.");
+}
+function assertCompatiblePathCanBeParsed(raw, parsed) {
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return;
+	const match = prepareUrlInput(raw).match(/^https?:[\/\\]*[^/?#\\]*([^?#]*)/i);
+	if (match == null) return;
+	const rawPath = match[1].replace(/\\/g, "/");
+	const compatiblePath = parsed.pathname.startsWith(COMPATIBLE_ID_PATH_PREFIX) && COMPATIBLE_ID_DID_PATTERN.test(parsed.pathname.slice(COMPATIBLE_ID_PATH_PREFIX.length));
+	const rawCompatiblePath = rawPath.startsWith(COMPATIBLE_ID_PATH_PREFIX) && COMPATIBLE_ID_DID_PATTERN.test(rawPath.slice(COMPATIBLE_ID_PATH_PREFIX.length));
+	if ((compatiblePath || rawCompatiblePath) && DOT_SEGMENT_PATTERN.test(rawPath)) throw new TypeError("FEP-ef61 compatible identifier paths with dot segments cannot be represented as URLs.");
+}
 /**
 * Parses a JSON-LD `@id` value as an IRI.
 */
@@ -34,22 +54,40 @@ function parseJsonLdId(id, base) {
 }
 /**
 * Parses an IRI as a URL, including FEP-ef61 portable ActivityPub IRIs.
+* Portable URI and FEP-ef61 compatible identifier strings whose path contains
+* a `.` or `..` segment, including percent-encoded spellings, throw a
+* `TypeError`: JavaScript `URL` would otherwise identify a different object.
+* This also applies to compatible identifier strings used as relative bases.
+* A `URL` argument may already have lost such segments before this function
+* receives it.
 */
 function parseIri(iri, base) {
 	if (iri instanceof URL) return normalizePortableUrl(iri) ?? new URL(iri.href);
+	assertPortablePathCanBeParsed(iri);
 	const portable = parsePortableIri(iri);
 	if (portable != null) return portable;
 	base = normalizeBaseIri(base);
 	if (!URL.canParse(iri, base) && iri.startsWith("at://")) return parseAtUri(iri);
 	const parsed = new URL(iri, base);
+	assertCompatiblePathCanBeParsed(iri, parsed);
 	return normalizePortableUrl(parsed) ?? parsed;
 }
 /**
 * Formats a URL as an IRI, including FEP-ef61 portable ActivityPub IRIs.
+* Portable URI and FEP-ef61 compatible identifier strings with dot segments
+* throw a `TypeError` because their paths cannot be represented by JavaScript
+* `URL` without normalization.
 */
 function formatIri(iri) {
+	if (typeof iri === "string") assertPortablePathCanBeParsed(iri);
 	const parsed = parsePortableIri(iri instanceof URL ? iri.href : iri);
-	if (parsed == null) return iri instanceof URL ? iri.href : URL.canParse(iri) ? new URL(iri).href : iri;
+	if (parsed == null) {
+		if (iri instanceof URL) return iri.href;
+		if (!URL.canParse(iri)) return iri;
+		const url = new URL(iri);
+		assertCompatiblePathCanBeParsed(iri, url);
+		return url.href;
+	}
 	return `ap+ef61://${decodePortableAuthority(parsed.host)}${parsed.pathname}${parsed.search}${parsed.hash}`;
 }
 /**
@@ -169,11 +207,15 @@ function parsePortableIri(iri) {
 }
 function normalizePortableUrl(iri) {
 	if (iri.protocol !== "ap:" && iri.protocol !== "ap+ef61:") return null;
-	return parsePortableIri(`ap+ef61://${iri.host}${iri.pathname}${iri.search}${iri.hash}`);
+	const raw = `ap+ef61://${iri.host}${iri.pathname}${iri.search}${iri.hash}`;
+	assertPortablePathCanBeParsed(raw);
+	return parsePortableIri(raw);
 }
 function normalizeBaseIri(base) {
 	if (base == null) return void 0;
 	if (base instanceof URL) return normalizePortableUrl(base) ?? base;
+	assertPortablePathCanBeParsed(base);
+	if (URL.canParse(base)) assertCompatiblePathCanBeParsed(base, new URL(base));
 	return parsePortableIri(base) ?? (base.startsWith("at://") && !URL.canParse(".", base) ? parseAtUri(base) : base);
 }
 function decodePortableAuthority(authority) {
@@ -240,6 +282,7 @@ function parseGatewayUrl(url) {
 }
 const COMPATIBLE_ID_PATH_PREFIX = "/.well-known/apgateway/";
 const COMPATIBLE_ID_DID_PATTERN = /^did(?::|%3A)/i;
+const RAW_COMPATIBLE_ID_PREFIX_PATTERN = /^(?:[hH][tT][tT][pP][sS]?):\/\/[^/?#]*\/\.well-known\/apgateway\/(?=[dD][iI][dD](?::|%3[aA]))/;
 const LOCATION_HINT_PARAMETERS = /* @__PURE__ */ new Set(["@gateway", "gateways"]);
 /**
 * Converts an [FEP-ef61] compatible identifier into a portable ActivityPub
@@ -275,8 +318,9 @@ const LOCATION_HINT_PARAMETERS = /* @__PURE__ */ new Set(["@gateway", "gateways"
 *                     malformed, e.g., it has an invalid DID, no object path,
 *                     invalid percent-encoding, credentials, or location
 *                     hints (`@gateway` query parameters, or the legacy
-*                     `gateways` parameter), which FEP-ef61 forbids in
-*                     compatible identifiers.
+*                     `gateways` parameter), or its raw string path would
+*                     change during URL parsing.  Already-parsed `URL`
+*                     arguments cannot reveal segments lost by their parser.
 * @since 2.4.0
 */
 function fromCompatibleEf61Id(input) {
@@ -284,18 +328,29 @@ function fromCompatibleEf61Id(input) {
 }
 function convertCompatibleEf61Id(input) {
 	let url;
+	const rawPrefix = typeof input === "string" ? input.match(RAW_COMPATIBLE_ID_PREFIX_PATTERN) : null;
 	if (input instanceof URL) url = input;
 	else if (typeof input === "string" && URL.canParse(input)) url = new URL(input);
 	else return null;
 	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-	if (!url.pathname.startsWith(COMPATIBLE_ID_PATH_PREFIX)) return null;
+	if (typeof input === "string" && rawPrefix == null) {
+		if (url.pathname.startsWith(COMPATIBLE_ID_PATH_PREFIX) && COMPATIBLE_ID_DID_PATTERN.test(url.pathname.slice(23))) throw new TypeError("Invalid FEP-ef61 compatible identifier.");
+	}
+	if (!url.pathname.startsWith(COMPATIBLE_ID_PATH_PREFIX)) {
+		if (rawPrefix != null) throw new TypeError("Invalid FEP-ef61 compatible identifier.");
+		return null;
+	}
 	const tail = url.pathname.slice(23);
-	if (!COMPATIBLE_ID_DID_PATTERN.test(tail)) return null;
+	if (!COMPATIBLE_ID_DID_PATTERN.test(tail)) {
+		if (rawPrefix != null) throw new TypeError("Invalid FEP-ef61 compatible identifier.");
+		return null;
+	}
 	if (url.username !== "" || url.password !== "") throw new TypeError("Invalid FEP-ef61 compatible identifier: credentials are not allowed.");
 	const iri = "ap+ef61://" + url.href.slice(url.origin.length + 23);
 	try {
 		const parsed = parsePortableIri(iri);
 		if (parsed == null) throw new TypeError("Not a portable IRI.");
+		if (typeof input === "string" && rawPrefix != null && canonicalizePortableUri("ap://" + input.slice(rawPrefix[0].length)) !== canonicalizePortableUri(iri)) throw new TypeError("URL parsing changed the portable identifier.");
 		canonicalizePortableUri(iri);
 		if ((url.search === "" ? [] : normalizePortableComponent(url.search.slice(1)).split("&")).some(isLocationHint)) throw new TypeError("Location hints are not allowed.");
 		return {
@@ -335,7 +390,8 @@ function convertCompatibleEf61Id(input) {
 * @returns The compatible identifier.
 * @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
 *                     URI, if its path has `.` or `..` segments (which
-*                     HTTP(S) URLs cannot represent), or if the gateway is
+*                     HTTP(S) URLs cannot represent without changing the
+*                     identified object), or if the gateway is
 *                     not an HTTP(S) origin with no credentials, path, query,
 *                     or fragment.
 * @since 2.4.0

package/dist/tests/url.test.cjs

@@ -1,4 +1,4 @@
-const require_url = require("./url-CtHyzMR4.cjs");
+const require_url = require("./url-DsMBGqCc.cjs");
 let node_test = require("node:test");
 let node_assert = require("node:assert");
 //#region src/url.test.ts
@@ -11,6 +11,39 @@ let node_assert = require("node:assert");
 		"AP+EF61://did:key:z6Mkabc/actor"
 	]) (0, node_assert.deepStrictEqual)(require_url.parseIri(iri), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"));
 });
+(0, node_test.test)("portable URI parsing refuses dot segments before URL normalization", () => {
+	const base = "ap://did:key:z6Mkabc";
+	for (const segment of [
+		".",
+		"..",
+		"%2e",
+		".%2E",
+		"%2e.",
+		"%2E%2e"
+	]) for (const path of [
+		`/${segment}`,
+		`/a/${segment}/b`,
+		`/a/${segment}`
+	]) {
+		const iri = base + path;
+		(0, node_assert.throws)(() => require_url.parseIri(iri), TypeError, iri);
+		(0, node_assert.throws)(() => require_url.parseJsonLdId(iri), TypeError, iri);
+		(0, node_assert.throws)(() => require_url.formatIri(iri), TypeError, iri);
+	}
+	for (const iri of [
+		`${base}/a/.\t./b`,
+		`${base}/a/..\n/b`,
+		` ${base}/a/../b`,
+		`${base}/a/.. `
+	]) (0, node_assert.throws)(() => require_url.parseIri(iri), TypeError, iri);
+	for (const path of [
+		"/a/.../b",
+		"/a/.x/b",
+		"/a/x.y/b",
+		"/a/%252e/b"
+	]) (0, node_assert.deepStrictEqual)(require_url.formatIri(require_url.parseIri(base + path)), `ap+ef61://did:key:z6Mkabc${path}`);
+	(0, node_assert.throws)(() => require_url.parseIri("child", `${base}/a/../b`), TypeError);
+});
 (0, node_test.test)("parseIri() normalizes DID scheme and method casing", () => {
 	for (const iri of [
 		"ap://DID:key:z6Mkabc/actor",
@@ -44,6 +77,20 @@ let node_assert = require("node:assert");
 	(0, node_assert.deepStrictEqual)(require_url.parseIri("attachments/1", "ap://did:key:z6Mkabc/objects/1"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/objects/attachments/1"));
 	(0, node_assert.throws)(() => require_url.parseIri("//example.com/outbox", "ap://did:key:z6Mkabc/objects/1"), TypeError);
 });
+(0, node_test.test)("parseIri() rejects lossy compatible ID string bases", () => {
+	const base = "https://server.example/.well-known/apgateway/did:key:z6MkAlice";
+	for (const segment of [
+		".",
+		"..",
+		"%2e",
+		"%2e%2e"
+	]) {
+		const rawBase = `${base}/a/${segment}/b`;
+		(0, node_assert.throws)(() => require_url.parseIri("child", rawBase), TypeError, rawBase);
+		(0, node_assert.throws)(() => require_url.parseJsonLdId("child", rawBase), TypeError, rawBase);
+	}
+	(0, node_assert.deepStrictEqual)(require_url.parseIri("child", "https://server.example/a/../b"), new URL("https://server.example/child"));
+});
 (0, node_test.test)("parseIri() resolves relative IRIs against at:// string bases", () => {
 	(0, node_assert.deepStrictEqual)(require_url.parseIri("/record", "at://did:plc:example/collection/item"), new URL("at://did%3Aplc%3Aexample/record"));
 	(0, node_assert.deepStrictEqual)(require_url.parseIri("reply", "at://did:plc:example/collection/item"), new URL("at://did%3Aplc%3Aexample/collection/reply"));
@@ -316,6 +363,32 @@ let node_assert = require("node:assert");
 		"https://user@server.example/.well-known/apgateway/did:key:z6MkAlice/a"
 	]) (0, node_assert.throws)(() => require_url.fromCompatibleEf61Id(input), TypeError, input);
 });
+(0, node_test.test)("fromCompatibleEf61Id() refuses raw paths changed by URL parsing", () => {
+	const base = "https://server.example/.well-known/apgateway/did:key:z6MkAlice";
+	for (const path of [
+		"/a/../b",
+		"/a/%2e%2E/b",
+		"/a/.	./b",
+		"/a/.. "
+	]) {
+		(0, node_assert.throws)(() => require_url.fromCompatibleEf61Id(base + path), TypeError, path);
+		(0, node_assert.throws)(() => require_url.parseIri(base + path), TypeError, path);
+		(0, node_assert.throws)(() => require_url.formatIri(base + path), TypeError, path);
+	}
+	for (const input of [
+		"https:/server.example/.well-known/apgateway/did:key:z6MkAlice/a/../b",
+		"https:server.example/.well-known/apgateway/did:key:z6MkAlice/a/../b",
+		"https:\\\\server.example\\.well-known\\apgateway\\did:key:z6MkAlice\\a\\..\\b",
+		` ${base}/../../other`
+	]) {
+		(0, node_assert.throws)(() => require_url.parseIri(input), TypeError, input);
+		(0, node_assert.throws)(() => require_url.formatIri(input), TypeError, input);
+	}
+	(0, node_assert.throws)(() => require_url.fromCompatibleEf61Id(` ${base}/actor`), TypeError);
+	(0, node_assert.throws)(() => require_url.fromCompatibleEf61Id(`https://server.example/foo/../.well-known/apgateway/did:key:z6MkAlice/actor`), TypeError);
+	(0, node_assert.deepStrictEqual)(require_url.fromCompatibleEf61Id(`${base}/a/%252e/b`)?.pathname, "/a/%252e/b");
+	(0, node_assert.deepStrictEqual)(require_url.fromCompatibleEf61Id("https://server.example/.WELL-KNOWN/apgateway/did:key:z6MkAlice/actor"), null);
+});
 (0, node_test.test)("toCompatibleEf61Id() converts portable URIs", () => {
 	const cases = [
 		[

package/dist/tests/url.test.mjs

@@ -1,4 +1,4 @@
-import { C as withoutGatewayHints, S as withGatewayHints, _ as parseIri, a as expandIPv6Address, b as validateLookupAddresses, c as getFe34Origin, d as haveSameIriOrigin, f as isGatewayUrl, g as parseGatewayUrl, i as canonicalizePortableUri, l as getGatewayHints, m as isValidPublicIPv6Address, n as UrlError, o as formatIri, p as isValidPublicIPv4Address, r as arePortableUrisEqual, s as fromCompatibleEf61Id, u as haveSameFe34Origin, v as parseJsonLdId, x as validatePublicUrl, y as toCompatibleEf61Id } from "./url-Cdu4ASgJ.mjs";
+import { C as withoutGatewayHints, S as withGatewayHints, _ as parseIri, a as expandIPv6Address, b as validateLookupAddresses, c as getFe34Origin, d as haveSameIriOrigin, f as isGatewayUrl, g as parseGatewayUrl, i as canonicalizePortableUri, l as getGatewayHints, m as isValidPublicIPv6Address, n as UrlError, o as formatIri, p as isValidPublicIPv4Address, r as arePortableUrisEqual, s as fromCompatibleEf61Id, u as haveSameFe34Origin, v as parseJsonLdId, x as validatePublicUrl, y as toCompatibleEf61Id } from "./url-CWC-NI3a.mjs";
 import { test } from "node:test";
 import { deepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert";
 //#region src/url.test.ts
@@ -11,6 +11,39 @@ test("parseIri() accepts portable ActivityPub URI schemes", () => {
 		"AP+EF61://did:key:z6Mkabc/actor"
 	]) deepStrictEqual(parseIri(iri), new URL("ap+ef61://did%3Akey%3Az6Mkabc/actor"));
 });
+test("portable URI parsing refuses dot segments before URL normalization", () => {
+	const base = "ap://did:key:z6Mkabc";
+	for (const segment of [
+		".",
+		"..",
+		"%2e",
+		".%2E",
+		"%2e.",
+		"%2E%2e"
+	]) for (const path of [
+		`/${segment}`,
+		`/a/${segment}/b`,
+		`/a/${segment}`
+	]) {
+		const iri = base + path;
+		throws(() => parseIri(iri), TypeError, iri);
+		throws(() => parseJsonLdId(iri), TypeError, iri);
+		throws(() => formatIri(iri), TypeError, iri);
+	}
+	for (const iri of [
+		`${base}/a/.\t./b`,
+		`${base}/a/..\n/b`,
+		` ${base}/a/../b`,
+		`${base}/a/.. `
+	]) throws(() => parseIri(iri), TypeError, iri);
+	for (const path of [
+		"/a/.../b",
+		"/a/.x/b",
+		"/a/x.y/b",
+		"/a/%252e/b"
+	]) deepStrictEqual(formatIri(parseIri(base + path)), `ap+ef61://did:key:z6Mkabc${path}`);
+	throws(() => parseIri("child", `${base}/a/../b`), TypeError);
+});
 test("parseIri() normalizes DID scheme and method casing", () => {
 	for (const iri of [
 		"ap://DID:key:z6Mkabc/actor",
@@ -44,6 +77,20 @@ test("parseIri() resolves relative IRIs against portable string bases", () => {
 	deepStrictEqual(parseIri("attachments/1", "ap://did:key:z6Mkabc/objects/1"), new URL("ap+ef61://did%3Akey%3Az6Mkabc/objects/attachments/1"));
 	throws(() => parseIri("//example.com/outbox", "ap://did:key:z6Mkabc/objects/1"), TypeError);
 });
+test("parseIri() rejects lossy compatible ID string bases", () => {
+	const base = "https://server.example/.well-known/apgateway/did:key:z6MkAlice";
+	for (const segment of [
+		".",
+		"..",
+		"%2e",
+		"%2e%2e"
+	]) {
+		const rawBase = `${base}/a/${segment}/b`;
+		throws(() => parseIri("child", rawBase), TypeError, rawBase);
+		throws(() => parseJsonLdId("child", rawBase), TypeError, rawBase);
+	}
+	deepStrictEqual(parseIri("child", "https://server.example/a/../b"), new URL("https://server.example/child"));
+});
 test("parseIri() resolves relative IRIs against at:// string bases", () => {
 	deepStrictEqual(parseIri("/record", "at://did:plc:example/collection/item"), new URL("at://did%3Aplc%3Aexample/record"));
 	deepStrictEqual(parseIri("reply", "at://did:plc:example/collection/item"), new URL("at://did%3Aplc%3Aexample/collection/reply"));
@@ -316,6 +363,32 @@ test("fromCompatibleEf61Id() rejects malformed compatible identifiers", () => {
 		"https://user@server.example/.well-known/apgateway/did:key:z6MkAlice/a"
 	]) throws(() => fromCompatibleEf61Id(input), TypeError, input);
 });
+test("fromCompatibleEf61Id() refuses raw paths changed by URL parsing", () => {
+	const base = "https://server.example/.well-known/apgateway/did:key:z6MkAlice";
+	for (const path of [
+		"/a/../b",
+		"/a/%2e%2E/b",
+		"/a/.	./b",
+		"/a/.. "
+	]) {
+		throws(() => fromCompatibleEf61Id(base + path), TypeError, path);
+		throws(() => parseIri(base + path), TypeError, path);
+		throws(() => formatIri(base + path), TypeError, path);
+	}
+	for (const input of [
+		"https:/server.example/.well-known/apgateway/did:key:z6MkAlice/a/../b",
+		"https:server.example/.well-known/apgateway/did:key:z6MkAlice/a/../b",
+		"https:\\\\server.example\\.well-known\\apgateway\\did:key:z6MkAlice\\a\\..\\b",
+		` ${base}/../../other`
+	]) {
+		throws(() => parseIri(input), TypeError, input);
+		throws(() => formatIri(input), TypeError, input);
+	}
+	throws(() => fromCompatibleEf61Id(` ${base}/actor`), TypeError);
+	throws(() => fromCompatibleEf61Id(`https://server.example/foo/../.well-known/apgateway/did:key:z6MkAlice/actor`), TypeError);
+	deepStrictEqual(fromCompatibleEf61Id(`${base}/a/%252e/b`)?.pathname, "/a/%252e/b");
+	deepStrictEqual(fromCompatibleEf61Id("https://server.example/.WELL-KNOWN/apgateway/did:key:z6MkAlice/actor"), null);
+});
 test("toCompatibleEf61Id() converts portable URIs", () => {
 	const cases = [
 		[