@fedify/vocab-runtime 2.4.5-dev.2453 → 2.4.5

package/dist/tests/pinners/bun.test.cjs

@@ -0,0 +1,166 @@
+const require_pin_grant = require("../pin-grant-CPrpk1l4.cjs");
+const require_pinners = require("../pinners-CJi9ZkYs.cjs");
+const require_support = require("../support-BmzI3dRJ.cjs");
+let node_assert = require("node:assert");
+let _fedify_fixture = require("@fedify/fixture");
+let node_fs = require("node:fs");
+let node_https = require("node:https");
+//#region src/pinners/bun.test.ts
+(0, _fedify_fixture.test)("createBunPinner() falls back to the next address for GET and HEAD", { ignore: !require_support.isBun }, async () => {
+	if (!(await require_support.getLoopbackSupport()).ipv6) return;
+	const { server, port, requests } = await require_support.startRecordingServer();
+	try {
+		const pinner = require_pinners.createBunPinner(require_support.allowAll);
+		const url = new URL(`http://pinned-host.invalid:${port}/`);
+		const grant = require_pin_grant.issuePinGrant(url, [require_support.ipv6("::1"), require_support.ipv4("127.0.0.1")]);
+		(0, node_assert.deepStrictEqual)(await (await pinner.fetch(grant, new Request(url))).text(), "pinned");
+		(0, node_assert.deepStrictEqual)((await pinner.fetch(grant, new Request(url, { method: "HEAD" }))).status, 200);
+		(0, node_assert.deepStrictEqual)(requests.map(({ method, localAddress }) => [method, localAddress]), [["GET", "127.0.0.1"], ["HEAD", "127.0.0.1"]]);
+	} finally {
+		await require_support.closeServer(server);
+	}
+});
+(0, _fedify_fixture.test)("createBunPinner() does not fall back for POST", { ignore: !require_support.isBun }, async () => {
+	if (!(await require_support.getLoopbackSupport()).ipv6) return;
+	const { server, port, requests } = await require_support.startRecordingServer();
+	try {
+		const pinner = require_pinners.createBunPinner(require_support.allowAll);
+		const url = new URL(`http://pinned-host.invalid:${port}/`);
+		const grant = require_pin_grant.issuePinGrant(url, [require_support.ipv6("::1"), require_support.ipv4("127.0.0.1")]);
+		await (0, node_assert.rejects)(() => pinner.fetch(grant, new Request(url, {
+			method: "POST",
+			body: "payload"
+		})));
+		(0, node_assert.deepStrictEqual)(requests, []);
+	} finally {
+		await require_support.closeServer(server);
+	}
+});
+function runProxyChild(proxyEnv, httpPort, httpsPort) {
+	return require_support.runChild(require_support.resolveTestdata("proxy-child.ts", require("url").pathToFileURL(__filename).href), [String(httpPort), String(httpsPort)], proxyEnv);
+}
+function getBun() {
+	return globalThis.Bun;
+}
+/**
+* Whether the current Bun refuses pinned requests to HTTPS servers on
+* non-default ports, since it cannot verify their certificates against
+* the original hostname.
+*/
+function refusesNonDefaultHttpsPorts() {
+	const bun = getBun();
+	return bun.semver.satisfies(bun.version, "<1.3.11");
+}
+(0, _fedify_fixture.test)("createBunPinner() bypasses environment proxies", { ignore: !require_support.isBun }, async (t) => {
+	const bun = getBun();
+	const honorsProxyFalse = bun.semver.satisfies(bun.version, ">=1.4.3");
+	const refusesHttps = refusesNonDefaultHttpsPorts();
+	for (const names of [[
+		"HTTP_PROXY",
+		"HTTPS_PROXY",
+		"ALL_PROXY"
+	], ["ALL_PROXY"]]) await t.step(names.join(", "), async () => {
+		const proxy = await require_support.startRecordingProxy();
+		const origin = await require_support.startRecordingServer();
+		const tls = await require_support.startCountingServer();
+		try {
+			const proxyUrl = `http://127.0.0.1:${proxy.port}`;
+			const output = await runProxyChild(Object.fromEntries(names.map((name) => [name, proxyUrl])), origin.port, tls.port);
+			const targets = JSON.stringify(proxy.targets);
+			(0, node_assert.deepStrictEqual)(output.version, bun.version);
+			(0, node_assert.ok)(proxy.targets.every((target) => !target.includes("pinned-host")), targets);
+			const proxyInEffect = output.control.body === "via-proxy";
+			if (names.length > 1 || honorsProxyFalse || proxyInEffect) {
+				(0, node_assert.deepStrictEqual)(output.control, {
+					status: 200,
+					body: "via-proxy"
+				});
+				(0, node_assert.ok)(proxy.targets.includes(`GET http://127.0.0.1:${origin.port}/control`), targets);
+			} else (0, node_assert.deepStrictEqual)(output.control, {
+				status: 200,
+				body: "pinned"
+			});
+			const pinnedTargets = proxy.targets.filter((target) => !target.endsWith("/control"));
+			if (honorsProxyFalse || !proxyInEffect) {
+				(0, node_assert.deepStrictEqual)(pinnedTargets, [], targets);
+				(0, node_assert.deepStrictEqual)(output.http, {
+					status: 200,
+					body: "pinned"
+				});
+				(0, node_assert.deepStrictEqual)(origin.requests.filter(({ url }) => url === "/pinned").map(({ host }) => host), [`pinned-host.invalid:${origin.port}`]);
+				(0, node_assert.deepStrictEqual)(tls.counter.connections, refusesHttps ? 0 : 1);
+			} else {
+				(0, node_assert.deepStrictEqual)(pinnedTargets, [`GET http://127.0.0.1:${origin.port}/pinned`, ...refusesHttps ? [] : [`CONNECT 127.0.0.1:${tls.port}`]]);
+				(0, node_assert.deepStrictEqual)(output.http, {
+					status: 200,
+					body: "via-proxy"
+				});
+				(0, node_assert.deepStrictEqual)(origin.requests, []);
+				(0, node_assert.deepStrictEqual)(tls.counter.connections, 0);
+			}
+			(0, node_assert.ok)(refusesHttps ? output.https.error?.startsWith("TypeError") : output.https.error != null, JSON.stringify(output.https));
+			(0, node_assert.deepStrictEqual)(output.warnings.length, honorsProxyFalse ? 0 : 1);
+		} finally {
+			await require_support.closeServer(proxy.server);
+			await require_support.closeServer(origin.server);
+			await require_support.closeServer(tls.server);
+		}
+	});
+});
+(0, _fedify_fixture.test)("createBunPinner() verifies certificates on non-default ports", { ignore: !require_support.isBun }, async () => {
+	const bun = getBun();
+	const refuses = refusesNonDefaultHttpsPorts();
+	const certPath = require_support.resolveTestdata("tls-cert.pem", require("url").pathToFileURL(__filename).href);
+	const hosts = [];
+	const server = (0, node_https.createServer)({
+		cert: (0, node_fs.readFileSync)(certPath),
+		key: (0, node_fs.readFileSync)(require_support.resolveTestdata("tls-key.pem", require("url").pathToFileURL(__filename).href))
+	}, (req, res) => {
+		hosts.push(req.headers.host ?? "");
+		res.end(req.headers.host);
+	});
+	const port = await require_support.listen(server);
+	try {
+		const output = await require_support.runChild(require_support.resolveTestdata("tls-child.ts", require("url").pathToFileURL(__filename).href), [String(port)], { NODE_EXTRA_CA_CERTS: certPath });
+		(0, node_assert.deepStrictEqual)(output.version, bun.version);
+		const json = JSON.stringify(output.results);
+		if (refuses) {
+			(0, node_assert.ok)(output.results.every((result) => "error" in result && result.error.startsWith("TypeError")), json);
+			(0, node_assert.deepStrictEqual)(hosts, []);
+			return;
+		}
+		(0, node_assert.deepStrictEqual)(output.results, [
+			{
+				case: "pinned",
+				status: 200,
+				body: `pinned-host.invalid:${port}`
+			},
+			{
+				case: "unlisted",
+				error: "ERR_TLS_CERT_ALTNAME_INVALID"
+			},
+			{
+				case: "unlisted-again",
+				error: "ERR_TLS_CERT_ALTNAME_INVALID"
+			},
+			{
+				case: "alternate",
+				status: 200,
+				body: `alternate-host.invalid:${port}`
+			},
+			{
+				case: "signals",
+				status: 200,
+				body: `pinned-host.invalid:${port}`
+			}
+		], json);
+		(0, node_assert.deepStrictEqual)(hosts, [
+			`pinned-host.invalid:${port}`,
+			`alternate-host.invalid:${port}`,
+			`pinned-host.invalid:${port}`
+		]);
+	} finally {
+		await require_support.closeServer(server);
+	}
+});
+//#endregion

package/dist/tests/pinners/bun.test.d.cts

@@ -0,0 +1 @@
+export { };

package/dist/tests/pinners/bun.test.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/tests/pinners/bun.test.mjs

@@ -0,0 +1,167 @@
+import { t as issuePinGrant } from "../pin-grant-H5XhM1Xs.mjs";
+import { r as createBunPinner } from "../pinners-zSofbiy2.mjs";
+import { a as ipv6, d as resolveTestdata, f as runChild, h as startRecordingServer, i as ipv4, l as listen, m as startRecordingProxy, n as closeServer, p as startCountingServer, r as getLoopbackSupport, s as isBun, t as allowAll } from "../support-CiHDVJgh.mjs";
+import { deepStrictEqual, ok, rejects } from "node:assert";
+import { test } from "@fedify/fixture";
+import { readFileSync } from "node:fs";
+import { createServer } from "node:https";
+//#region src/pinners/bun.test.ts
+test("createBunPinner() falls back to the next address for GET and HEAD", { ignore: !isBun }, async () => {
+	if (!(await getLoopbackSupport()).ipv6) return;
+	const { server, port, requests } = await startRecordingServer();
+	try {
+		const pinner = createBunPinner(allowAll);
+		const url = new URL(`http://pinned-host.invalid:${port}/`);
+		const grant = issuePinGrant(url, [ipv6("::1"), ipv4("127.0.0.1")]);
+		deepStrictEqual(await (await pinner.fetch(grant, new Request(url))).text(), "pinned");
+		deepStrictEqual((await pinner.fetch(grant, new Request(url, { method: "HEAD" }))).status, 200);
+		deepStrictEqual(requests.map(({ method, localAddress }) => [method, localAddress]), [["GET", "127.0.0.1"], ["HEAD", "127.0.0.1"]]);
+	} finally {
+		await closeServer(server);
+	}
+});
+test("createBunPinner() does not fall back for POST", { ignore: !isBun }, async () => {
+	if (!(await getLoopbackSupport()).ipv6) return;
+	const { server, port, requests } = await startRecordingServer();
+	try {
+		const pinner = createBunPinner(allowAll);
+		const url = new URL(`http://pinned-host.invalid:${port}/`);
+		const grant = issuePinGrant(url, [ipv6("::1"), ipv4("127.0.0.1")]);
+		await rejects(() => pinner.fetch(grant, new Request(url, {
+			method: "POST",
+			body: "payload"
+		})));
+		deepStrictEqual(requests, []);
+	} finally {
+		await closeServer(server);
+	}
+});
+function runProxyChild(proxyEnv, httpPort, httpsPort) {
+	return runChild(resolveTestdata("proxy-child.ts", import.meta.url), [String(httpPort), String(httpsPort)], proxyEnv);
+}
+function getBun() {
+	return globalThis.Bun;
+}
+/**
+* Whether the current Bun refuses pinned requests to HTTPS servers on
+* non-default ports, since it cannot verify their certificates against
+* the original hostname.
+*/
+function refusesNonDefaultHttpsPorts() {
+	const bun = getBun();
+	return bun.semver.satisfies(bun.version, "<1.3.11");
+}
+test("createBunPinner() bypasses environment proxies", { ignore: !isBun }, async (t) => {
+	const bun = getBun();
+	const honorsProxyFalse = bun.semver.satisfies(bun.version, ">=1.4.3");
+	const refusesHttps = refusesNonDefaultHttpsPorts();
+	for (const names of [[
+		"HTTP_PROXY",
+		"HTTPS_PROXY",
+		"ALL_PROXY"
+	], ["ALL_PROXY"]]) await t.step(names.join(", "), async () => {
+		const proxy = await startRecordingProxy();
+		const origin = await startRecordingServer();
+		const tls = await startCountingServer();
+		try {
+			const proxyUrl = `http://127.0.0.1:${proxy.port}`;
+			const output = await runProxyChild(Object.fromEntries(names.map((name) => [name, proxyUrl])), origin.port, tls.port);
+			const targets = JSON.stringify(proxy.targets);
+			deepStrictEqual(output.version, bun.version);
+			ok(proxy.targets.every((target) => !target.includes("pinned-host")), targets);
+			const proxyInEffect = output.control.body === "via-proxy";
+			if (names.length > 1 || honorsProxyFalse || proxyInEffect) {
+				deepStrictEqual(output.control, {
+					status: 200,
+					body: "via-proxy"
+				});
+				ok(proxy.targets.includes(`GET http://127.0.0.1:${origin.port}/control`), targets);
+			} else deepStrictEqual(output.control, {
+				status: 200,
+				body: "pinned"
+			});
+			const pinnedTargets = proxy.targets.filter((target) => !target.endsWith("/control"));
+			if (honorsProxyFalse || !proxyInEffect) {
+				deepStrictEqual(pinnedTargets, [], targets);
+				deepStrictEqual(output.http, {
+					status: 200,
+					body: "pinned"
+				});
+				deepStrictEqual(origin.requests.filter(({ url }) => url === "/pinned").map(({ host }) => host), [`pinned-host.invalid:${origin.port}`]);
+				deepStrictEqual(tls.counter.connections, refusesHttps ? 0 : 1);
+			} else {
+				deepStrictEqual(pinnedTargets, [`GET http://127.0.0.1:${origin.port}/pinned`, ...refusesHttps ? [] : [`CONNECT 127.0.0.1:${tls.port}`]]);
+				deepStrictEqual(output.http, {
+					status: 200,
+					body: "via-proxy"
+				});
+				deepStrictEqual(origin.requests, []);
+				deepStrictEqual(tls.counter.connections, 0);
+			}
+			ok(refusesHttps ? output.https.error?.startsWith("TypeError") : output.https.error != null, JSON.stringify(output.https));
+			deepStrictEqual(output.warnings.length, honorsProxyFalse ? 0 : 1);
+		} finally {
+			await closeServer(proxy.server);
+			await closeServer(origin.server);
+			await closeServer(tls.server);
+		}
+	});
+});
+test("createBunPinner() verifies certificates on non-default ports", { ignore: !isBun }, async () => {
+	const bun = getBun();
+	const refuses = refusesNonDefaultHttpsPorts();
+	const certPath = resolveTestdata("tls-cert.pem", import.meta.url);
+	const hosts = [];
+	const server = createServer({
+		cert: readFileSync(certPath),
+		key: readFileSync(resolveTestdata("tls-key.pem", import.meta.url))
+	}, (req, res) => {
+		hosts.push(req.headers.host ?? "");
+		res.end(req.headers.host);
+	});
+	const port = await listen(server);
+	try {
+		const output = await runChild(resolveTestdata("tls-child.ts", import.meta.url), [String(port)], { NODE_EXTRA_CA_CERTS: certPath });
+		deepStrictEqual(output.version, bun.version);
+		const json = JSON.stringify(output.results);
+		if (refuses) {
+			ok(output.results.every((result) => "error" in result && result.error.startsWith("TypeError")), json);
+			deepStrictEqual(hosts, []);
+			return;
+		}
+		deepStrictEqual(output.results, [
+			{
+				case: "pinned",
+				status: 200,
+				body: `pinned-host.invalid:${port}`
+			},
+			{
+				case: "unlisted",
+				error: "ERR_TLS_CERT_ALTNAME_INVALID"
+			},
+			{
+				case: "unlisted-again",
+				error: "ERR_TLS_CERT_ALTNAME_INVALID"
+			},
+			{
+				case: "alternate",
+				status: 200,
+				body: `alternate-host.invalid:${port}`
+			},
+			{
+				case: "signals",
+				status: 200,
+				body: `pinned-host.invalid:${port}`
+			}
+		], json);
+		deepStrictEqual(hosts, [
+			`pinned-host.invalid:${port}`,
+			`alternate-host.invalid:${port}`,
+			`pinned-host.invalid:${port}`
+		]);
+	} finally {
+		await closeServer(server);
+	}
+});
+//#endregion
+export {};

package/dist/tests/pinners/node.test.cjs

@@ -0,0 +1,269 @@
+const require_rolldown_runtime = require("../rolldown-runtime-emK7D4bc.cjs");
+const require_pin_grant = require("../pin-grant-CPrpk1l4.cjs");
+const require_url = require("../url-Bdj-rTcC.cjs");
+const require_node = require("../node-BvS3AhZ2.cjs");
+const require_public_fetch = require("../public-fetch-U822jbKB.cjs");
+const require_support = require("../support-BmzI3dRJ.cjs");
+let node_process = require("node:process");
+node_process = require_rolldown_runtime.__toESM(node_process, 1);
+let node_assert = require("node:assert");
+let _fedify_fixture = require("@fedify/fixture");
+let node_fs = require("node:fs");
+let node_https = require("node:https");
+//#region src/pinners/node.test.ts
+/**
+* Creates a Node.js pinner whose undici agent the test can also use
+* directly, by injecting an `Agent` class that remembers its instance.
+*/
+async function createPinnerWithAgent(options) {
+	const undici = await import("undici");
+	const agents = [];
+	class Agent extends undici.Agent {
+		constructor(options) {
+			super(options);
+			agents.push(this);
+		}
+	}
+	const pinner = require_node.createNodePinner({
+		...options,
+		undici: { Agent }
+	});
+	(0, node_assert.strictEqual)(agents.length, 1);
+	return {
+		pinner,
+		agent: agents[0]
+	};
+}
+/**
+* Sends a request through the agent directly, without redeeming a grant.
+*/
+function fetchThrough(agent, url) {
+	return fetch(url, { dispatcher: agent });
+}
+/**
+* Whether the error is the failure of the agent's lookup to find a live
+* grant for the hostname.
+*/
+function isNoValidatedAddress(error) {
+	return error instanceof TypeError && error.cause instanceof require_url.UrlError && error.cause.message.startsWith("No validated address to connect to:");
+}
+/** Responds without keeping the connection alive. */
+function respondAndClose(_, res) {
+	res.setHeader("Connection", "close");
+	res.end("pinned");
+}
+(0, _fedify_fixture.test)("createNodePinner() checks IP literal hostnames before fetching", { ignore: !require_support.isNode }, async () => {
+	const { server, port, requests } = await require_support.startRecordingServer();
+	try {
+		const pinner = require_node.createNodePinner({
+			verifyAddress: require_url.assertPublicAddress,
+			undici: await import("undici")
+		});
+		const url = new URL(`http://127.0.0.1:${port}/`);
+		const grant = require_pin_grant.issuePinGrant(url, [require_support.ipv4("127.0.0.1")]);
+		await (0, node_assert.rejects)(() => pinner.fetch(grant, new Request(url)), require_url.UrlError);
+		(0, node_assert.deepStrictEqual)(requests, []);
+	} finally {
+		await require_support.closeServer(server);
+	}
+});
+(0, _fedify_fixture.test)("createNodePinner() connects only for live grants", { ignore: !require_support.isNode }, async () => {
+	const { server, port, requests } = await require_support.startRecordingServer("127.0.0.1", respondAndClose);
+	try {
+		const { pinner, agent } = await createPinnerWithAgent(require_support.allowAll);
+		const url = new URL(`http://pinned-host.invalid:${port}/`);
+		await (0, node_assert.rejects)(() => fetchThrough(agent, url), isNoValidatedAddress);
+		const grant = require_pin_grant.issuePinGrant(url, [require_support.ipv4("127.0.0.1")]);
+		(0, node_assert.deepStrictEqual)(await (await pinner.fetch(grant, new Request(url))).text(), "pinned");
+		(0, node_assert.deepStrictEqual)(await (await fetchThrough(agent, url)).text(), "pinned");
+		await (0, node_assert.rejects)(() => fetchThrough(agent, `http://other-host.invalid:${port}/`), isNoValidatedAddress);
+		require_pin_grant.revokePinGrant(grant);
+		await (0, node_assert.rejects)(() => pinner.fetch(grant, new Request(url)), TypeError);
+		await (0, node_assert.rejects)(() => fetchThrough(agent, url), isNoValidatedAddress);
+		(0, node_assert.deepStrictEqual)(requests.length, 2);
+	} finally {
+		await require_support.closeServer(server);
+	}
+});
+(0, _fedify_fixture.test)("createNodePinner() forgets released grants", { ignore: !require_support.isNode }, async () => {
+	const { server, port, requests } = await require_support.startRecordingServer("127.0.0.1", respondAndClose);
+	try {
+		const { pinner, agent } = await createPinnerWithAgent(require_support.allowAll);
+		const url = new URL(`http://pinned-host.invalid:${port}/`);
+		const grants = [require_pin_grant.issuePinGrant(url, [require_support.ipv4("127.0.0.1")]), require_pin_grant.issuePinGrant(url, [require_support.ipv4("127.0.0.1")])];
+		for (const grant of grants) (0, node_assert.deepStrictEqual)(await (await pinner.fetch(grant, new Request(url))).text(), "pinned");
+		await pinner.release(grants[0]);
+		(0, node_assert.deepStrictEqual)(await (await fetchThrough(agent, url)).text(), "pinned");
+		await pinner.release(grants[1]);
+		await (0, node_assert.rejects)(() => fetchThrough(agent, url), isNoValidatedAddress);
+		await pinner.release(grants[1]);
+		(0, node_assert.deepStrictEqual)(requests.length, 3);
+	} finally {
+		await require_support.closeServer(server);
+	}
+});
+(0, _fedify_fixture.test)("createNodePinner() connects to the next address on failure", { ignore: !require_support.isNode }, async () => {
+	if (!(await require_support.getLoopbackSupport()).ipv6) return;
+	const { server, port, requests } = await require_support.startRecordingServer();
+	try {
+		const pinner = require_node.createNodePinner({
+			...require_support.allowAll,
+			undici: await import("undici")
+		});
+		const url = new URL(`http://pinned-host.invalid:${port}/`);
+		const grant = require_pin_grant.issuePinGrant(url, [require_support.ipv6("::1"), require_support.ipv4("127.0.0.1")]);
+		(0, node_assert.deepStrictEqual)(await (await pinner.fetch(grant, new Request(url))).text(), "pinned");
+		(0, node_assert.deepStrictEqual)(await (await pinner.fetch(grant, new Request(url, {
+			method: "POST",
+			body: "payload"
+		}))).text(), "pinned");
+		(0, node_assert.deepStrictEqual)(requests.map(({ method, localAddress }) => [method, localAddress]), [["GET", "127.0.0.1"], ["POST", "127.0.0.1"]]);
+	} finally {
+		await require_support.closeServer(server);
+	}
+});
+/**
+* Replaces the global `fetch()` while running the given function, as
+* fetch-mock does, but returns the given responses as they are, while
+* fetch-mock returns clones (tees) of them.
+*/
+async function withFetchStub(respond, fn) {
+	const original = globalThis.fetch;
+	globalThis.fetch = (_, init) => Promise.resolve(respond(init));
+	try {
+		return await fn();
+	} finally {
+		globalThis.fetch = original;
+	}
+}
+(0, _fedify_fixture.test)("createNodePinner() forgets the grants of closed sessions", { ignore: !require_support.isNode }, async (t) => {
+	for (const cancelFails of [false, true]) await t.step(`cancelFails: ${cancelFails}`, async () => {
+		const checked = [];
+		const { pinner, agent } = await createPinnerWithAgent({ verifyAddress({ address }) {
+			checked.push(address);
+			throw new require_url.UrlError(`Refused for the test: ${address}`);
+		} });
+		const released = [];
+		const observed = {
+			supports: (url) => pinner.supports(url),
+			fetch: (grant, request, signal) => pinner.fetch(grant, request, signal),
+			async release(grant) {
+				released.push(grant);
+				await pinner.release(grant);
+			}
+		};
+		const { openPublicFetch } = require_public_fetch.createPublicFetch({
+			pinner: () => Promise.resolve(observed),
+			lookup: () => Promise.reject(/* @__PURE__ */ new Error("Not used."))
+		});
+		const url = "http://pinned-host.invalid/";
+		const session = await openPublicFetch(url, { lookup: () => Promise.resolve([require_support.ipv4("8.8.8.8")]) });
+		const dispatchers = [];
+		let cancelled = 0;
+		const response = await withFetchStub((init) => {
+			dispatchers.push(init.dispatcher);
+			return new Response(new ReadableStream({ cancel() {
+				cancelled++;
+				if (cancelFails) throw new Error("Failed to cancel.");
+			} }));
+		}, () => session.fetch(url));
+		(0, node_assert.deepStrictEqual)(dispatchers, [agent]);
+		await (0, node_assert.rejects)(() => fetchThrough(agent, url), (error) => error instanceof TypeError && error.cause instanceof require_url.UrlError && error.cause.message === "Refused for the test: 8.8.8.8");
+		(0, node_assert.deepStrictEqual)(checked, ["8.8.8.8"]);
+		(0, node_assert.ok)(!response.bodyUsed);
+		await session.close();
+		(0, node_assert.deepStrictEqual)(cancelled, 1);
+		(0, node_assert.deepStrictEqual)(released.length, 1);
+		await (0, node_assert.rejects)(() => fetchThrough(agent, url), isNoValidatedAddress);
+		(0, node_assert.deepStrictEqual)(checked, ["8.8.8.8"]);
+	});
+});
+(0, _fedify_fixture.test)("createNodePinner() bypasses environment proxies", { ignore: !require_support.isNode }, async (t) => {
+	const major = Number(node_process.default.versions.node.split(".")[0]);
+	const names = [
+		"HTTP_PROXY",
+		"HTTPS_PROXY",
+		"ALL_PROXY"
+	];
+	for (const useEnvProxy of [false, true]) await t.step(`NODE_USE_ENV_PROXY: ${useEnvProxy}`, async () => {
+		const proxy = await require_support.startRecordingProxy({ refuseTunnels: true });
+		const origin = await require_support.startRecordingServer();
+		const tls = await require_support.startCountingServer();
+		try {
+			const proxyUrl = `http://127.0.0.1:${proxy.port}`;
+			const output = await require_support.runChild(require_support.resolveCompiledTestdata("node-child.mjs", require("url").pathToFileURL(__filename).href), [
+				"proxy",
+				String(origin.port),
+				String(tls.port)
+			], {
+				...Object.fromEntries(names.map((name) => [name, proxyUrl])),
+				...useEnvProxy ? { NODE_USE_ENV_PROXY: "1" } : {}
+			});
+			const targets = JSON.stringify(proxy.targets);
+			(0, node_assert.deepStrictEqual)(output.version, node_process.default.version);
+			const controlTargets = [`GET http://127.0.0.1:${origin.port}/control`, `CONNECT 127.0.0.1:${origin.port}`];
+			if (useEnvProxy && major >= 24) (0, node_assert.ok)(proxy.targets.some((target) => controlTargets.includes(target)), targets);
+			(0, node_assert.deepStrictEqual)(proxy.targets.filter((target) => !controlTargets.includes(target)), [], targets);
+			(0, node_assert.deepStrictEqual)(output.http, {
+				status: 200,
+				body: "pinned"
+			});
+			(0, node_assert.deepStrictEqual)(origin.requests.filter(({ url }) => url === "/pinned").map(({ host }) => host), [`pinned-host.invalid:${origin.port}`]);
+			(0, node_assert.ok)(output.https.error != null, JSON.stringify(output.https));
+			(0, node_assert.deepStrictEqual)(tls.counter.connections, 1);
+		} finally {
+			await require_support.closeServer(proxy.server);
+			await require_support.closeServer(origin.server);
+			await require_support.closeServer(tls.server);
+		}
+	});
+});
+(0, _fedify_fixture.test)("createNodePinner() verifies certificates against the hostname", { ignore: !require_support.isNode }, async () => {
+	const certPath = require_support.resolveTestdata("tls-cert.pem", require("url").pathToFileURL(__filename).href);
+	const hosts = [];
+	const server = (0, node_https.createServer)({
+		cert: (0, node_fs.readFileSync)(certPath),
+		key: (0, node_fs.readFileSync)(require_support.resolveTestdata("tls-key.pem", require("url").pathToFileURL(__filename).href))
+	}, (req, res) => {
+		hosts.push(req.headers.host ?? "");
+		res.end(req.headers.host);
+	});
+	const port = await require_support.listen(server);
+	try {
+		const output = await require_support.runChild(require_support.resolveCompiledTestdata("node-child.mjs", require("url").pathToFileURL(__filename).href), ["tls", String(port)], { NODE_EXTRA_CA_CERTS: certPath });
+		(0, node_assert.deepStrictEqual)(output.version, node_process.default.version);
+		(0, node_assert.deepStrictEqual)(output.results, [
+			{
+				case: "pinned",
+				status: 200,
+				body: `pinned-host.invalid:${port}`
+			},
+			{
+				case: "unlisted",
+				error: "ERR_TLS_CERT_ALTNAME_INVALID"
+			},
+			{
+				case: "unlisted-again",
+				error: "ERR_TLS_CERT_ALTNAME_INVALID"
+			},
+			{
+				case: "alternate",
+				status: 200,
+				body: `alternate-host.invalid:${port}`
+			},
+			{
+				case: "signals",
+				status: 200,
+				body: `pinned-host.invalid:${port}`
+			}
+		], JSON.stringify(output.results));
+		(0, node_assert.deepStrictEqual)(hosts, [
+			`pinned-host.invalid:${port}`,
+			`alternate-host.invalid:${port}`,
+			`pinned-host.invalid:${port}`
+		]);
+	} finally {
+		await require_support.closeServer(server);
+	}
+});
+//#endregion

package/dist/tests/pinners/node.test.d.cts

@@ -0,0 +1 @@
+export { };

package/dist/tests/pinners/node.test.d.mts

@@ -0,0 +1 @@
+export { };