@fedify/vocab-runtime 2.4.5-dev.2453 → 2.4.5

package/dist/tests/{url-BNakuZ8k.cjs → url-Bdj-rTcC.cjs}

@@ -664,28 +664,65 @@ function replaceGatewayHints(parts, hints) {
 }
 /**
 * Validates a URL to prevent SSRF attacks.
+*
+* This function only checks the addresses that the hostname currently
+* resolves to; it does not pin the connection to those addresses.  A request
+* made after this check resolves the hostname again, so this function alone
+* does not prevent DNS rebinding.
 */
 async function validatePublicUrl(url) {
-	const parsed = new URL(url);
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
-	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
-	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
-	const hostnameFamily = (0, node_net.isIP)(hostname);
-	if (hostnameFamily !== 0) {
-		validatePublicIpAddress(hostname, hostnameFamily);
-		return;
-	}
-	if ("Deno" in globalThis && !(0, node_net.isIP)(hostname)) {
+	const { hostname, family } = parsePublicUrl(url);
+	if (family !== 0) return;
+	if ("Deno" in globalThis) {
 		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	}
 	if ("Bun" in globalThis) {
 		if (hostname === "example.com" || hostname.endsWith(".example.com")) return;
 		else if (hostname === "fedify-test.internal") throw new UrlError("Invalid or private address: fedify-test.internal");
 	}
+	await lookupPublicAddresses(hostname, lookupAllAddresses);
+}
+/**
+* Resolves all addresses of the given hostname through `node:dns/promises`.
+* The default `dns` object is looked up on every call so that tests can still
+* stub `dns.lookup()`.
+* @internal
+*/
+function lookupAllAddresses(hostname) {
+	return node_dns_promises.default.lookup(hostname, { all: true });
+}
+/**
+* Checks the parts of a URL that can be validated without resolving it:
+* the protocol, the `localhost` hostname, and IP literal hostnames.
+* @throws {UrlError} If the URL is not allowed.
+* @internal
+*/
+function parsePublicUrl(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
+	let hostname = parsed.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const family = (0, node_net.isIP)(hostname);
+	if (family !== 0) validatePublicIpAddress(hostname, family);
+	return {
+		url: parsed,
+		hostname,
+		family
+	};
+}
+/**
+* Resolves the given hostname and checks that every returned IP address is
+* public.
+* @returns The IP addresses of the hostname, without non-IP entries.
+* @throws {UrlError} If the lookup fails, returns no IP address, or returns
+*                    any non-public address.
+* @internal
+*/
+async function lookupPublicAddresses(hostname, lookup) {
 	let addresses;
 	try {
-		addresses = await node_dns_promises.default.lookup(hostname, { all: true });
+		addresses = await lookup(hostname);
 	} catch (error) {
 		throw new UrlError("DNS lookup failed", {
 			cause: error,
@@ -693,6 +730,21 @@ async function validatePublicUrl(url) {
 		});
 	}
 	validateLookupAddresses(addresses);
+	return addresses.filter(({ address }) => (0, node_net.isIP)(address) !== 0).map(({ address }) => ({
+		address,
+		family: (0, node_net.isIP)(address)
+	}));
+}
+/**
+* Checks that the given IP address is public.  This is used right before
+* connecting to an address that passed {@link lookupPublicAddresses}.
+* @throws {UrlError} If the address is not a public IP address.
+* @internal
+*/
+function assertPublicAddress(address) {
+	const family = (0, node_net.isIP)(address.address);
+	if (family === 0 || family !== address.family) throw new UrlError(`Invalid or private address: ${address.address}`);
+	validatePublicIpAddress(address.address, family);
 }
 /**
 * Validates the IP addresses returned by `node:dns.lookup()`.
@@ -876,6 +928,12 @@ Object.defineProperty(exports, "arePortableUrisEqual", {
 		return arePortableUrisEqual;
 	}
 });
+Object.defineProperty(exports, "assertPublicAddress", {
+	enumerable: true,
+	get: function() {
+		return assertPublicAddress;
+	}
+});
 Object.defineProperty(exports, "canonicalizePortableUri", {
 	enumerable: true,
 	get: function() {
@@ -942,6 +1000,18 @@ Object.defineProperty(exports, "isValidPublicIPv6Address", {
 		return isValidPublicIPv6Address;
 	}
 });
+Object.defineProperty(exports, "lookupAllAddresses", {
+	enumerable: true,
+	get: function() {
+		return lookupAllAddresses;
+	}
+});
+Object.defineProperty(exports, "lookupPublicAddresses", {
+	enumerable: true,
+	get: function() {
+		return lookupPublicAddresses;
+	}
+});
 Object.defineProperty(exports, "parseGatewayOrigin", {
 	enumerable: true,
 	get: function() {
@@ -966,6 +1036,12 @@ Object.defineProperty(exports, "parseJsonLdId", {
 		return parseJsonLdId;
 	}
 });
+Object.defineProperty(exports, "parsePublicUrl", {
+	enumerable: true,
+	get: function() {
+		return parsePublicUrl;
+	}
+});
 Object.defineProperty(exports, "toCompatibleEf61Id", {
 	enumerable: true,
 	get: function() {

package/dist/tests/{url-DMxmp7ZG.mjs → url-COj5Q8mb.mjs}

@@ -662,28 +662,65 @@ function replaceGatewayHints(parts, hints) {
 }
 /**
 * Validates a URL to prevent SSRF attacks.
+*
+* This function only checks the addresses that the hostname currently
+* resolves to; it does not pin the connection to those addresses.  A request
+* made after this check resolves the hostname again, so this function alone
+* does not prevent DNS rebinding.
 */
 async function validatePublicUrl(url) {
-	const parsed = new URL(url);
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
-	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
-	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
-	const hostnameFamily = isIP(hostname);
-	if (hostnameFamily !== 0) {
-		validatePublicIpAddress(hostname, hostnameFamily);
-		return;
-	}
-	if ("Deno" in globalThis && !isIP(hostname)) {
+	const { hostname, family } = parsePublicUrl(url);
+	if (family !== 0) return;
+	if ("Deno" in globalThis) {
 		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	}
 	if ("Bun" in globalThis) {
 		if (hostname === "example.com" || hostname.endsWith(".example.com")) return;
 		else if (hostname === "fedify-test.internal") throw new UrlError("Invalid or private address: fedify-test.internal");
 	}
+	await lookupPublicAddresses(hostname, lookupAllAddresses);
+}
+/**
+* Resolves all addresses of the given hostname through `node:dns/promises`.
+* The default `dns` object is looked up on every call so that tests can still
+* stub `dns.lookup()`.
+* @internal
+*/
+function lookupAllAddresses(hostname) {
+	return dns.lookup(hostname, { all: true });
+}
+/**
+* Checks the parts of a URL that can be validated without resolving it:
+* the protocol, the `localhost` hostname, and IP literal hostnames.
+* @throws {UrlError} If the URL is not allowed.
+* @internal
+*/
+function parsePublicUrl(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
+	let hostname = parsed.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const family = isIP(hostname);
+	if (family !== 0) validatePublicIpAddress(hostname, family);
+	return {
+		url: parsed,
+		hostname,
+		family
+	};
+}
+/**
+* Resolves the given hostname and checks that every returned IP address is
+* public.
+* @returns The IP addresses of the hostname, without non-IP entries.
+* @throws {UrlError} If the lookup fails, returns no IP address, or returns
+*                    any non-public address.
+* @internal
+*/
+async function lookupPublicAddresses(hostname, lookup) {
 	let addresses;
 	try {
-		addresses = await dns.lookup(hostname, { all: true });
+		addresses = await lookup(hostname);
 	} catch (error) {
 		throw new UrlError("DNS lookup failed", {
 			cause: error,
@@ -691,6 +728,21 @@ async function validatePublicUrl(url) {
 		});
 	}
 	validateLookupAddresses(addresses);
+	return addresses.filter(({ address }) => isIP(address) !== 0).map(({ address }) => ({
+		address,
+		family: isIP(address)
+	}));
+}
+/**
+* Checks that the given IP address is public.  This is used right before
+* connecting to an address that passed {@link lookupPublicAddresses}.
+* @throws {UrlError} If the address is not a public IP address.
+* @internal
+*/
+function assertPublicAddress(address) {
+	const family = isIP(address.address);
+	if (family === 0 || family !== address.family) throw new UrlError(`Invalid or private address: ${address.address}`);
+	validatePublicIpAddress(address.address, family);
 }
 /**
 * Validates the IP addresses returned by `node:dns.lookup()`.
@@ -856,4 +908,4 @@ function matchesIPv6Prefix(address, prefixWords, prefixLength) {
 	return true;
 }
 //#endregion
-export { withoutGatewayHints as C, withGatewayHints as S, parseIri as _, expandIPv6Address as a, validateLookupAddresses as b, getFe34Origin as c, haveSameIriOrigin as d, isGatewayUrl as f, parseGatewayUrl as g, parseGatewayOrigin as h, canonicalizePortableUri as i, getGatewayHints as l, isValidPublicIPv6Address as m, UrlError as n, formatIri as o, isValidPublicIPv4Address as p, arePortableUrisEqual as r, fromCompatibleEf61Id as s, GATEWAY_HINT_PARAMETER as t, haveSameFe34Origin as u, parseJsonLdId as v, validatePublicUrl as x, toCompatibleEf61Id as y };
+export { toCompatibleEf61Id as C, withoutGatewayHints as D, withGatewayHints as E, parsePublicUrl as S, validatePublicUrl as T, lookupPublicAddresses as _, canonicalizePortableUri as a, parseIri as b, fromCompatibleEf61Id as c, haveSameFe34Origin as d, haveSameIriOrigin as f, lookupAllAddresses as g, isValidPublicIPv6Address as h, assertPublicAddress as i, getFe34Origin as l, isValidPublicIPv4Address as m, UrlError as n, expandIPv6Address as o, isGatewayUrl as p, arePortableUrisEqual as r, formatIri as s, GATEWAY_HINT_PARAMETER as t, getGatewayHints as u, parseGatewayOrigin as v, validateLookupAddresses as w, parseJsonLdId as x, parseGatewayUrl as y };

package/dist/tests/url.test.cjs

@@ -1,4 +1,4 @@
-const require_url = require("./url-BNakuZ8k.cjs");
+const require_url = require("./url-Bdj-rTcC.cjs");
 let node_test = require("node:test");
 let node_assert = require("node:assert");
 //#region src/url.test.ts
@@ -597,6 +597,9 @@ let node_assert = require("node:assert");
 	await require_url.validatePublicUrl("https://[2001:db8::1]");
 	await require_url.validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
+(0, node_test.test)("validatePublicUrl() keeps rejecting fedify-test.internal on Bun", { skip: !("Bun" in globalThis) }, async () => {
+	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://fedify-test.internal/"), (error) => error instanceof require_url.UrlError && error.reason === "disallowed");
+});
 (0, node_test.test)("validateLookupAddresses() tolerates Cloudflare Workers CNAME entries", () => {
 	require_url.validateLookupAddresses([
 		{

package/dist/tests/url.test.mjs

@@ -1,4 +1,4 @@
-import { C as withoutGatewayHints, S as withGatewayHints, _ as parseIri, a as expandIPv6Address, b as validateLookupAddresses, c as getFe34Origin, d as haveSameIriOrigin, f as isGatewayUrl, g as parseGatewayUrl, i as canonicalizePortableUri, l as getGatewayHints, m as isValidPublicIPv6Address, n as UrlError, o as formatIri, p as isValidPublicIPv4Address, r as arePortableUrisEqual, s as fromCompatibleEf61Id, u as haveSameFe34Origin, v as parseJsonLdId, x as validatePublicUrl, y as toCompatibleEf61Id } from "./url-DMxmp7ZG.mjs";
+import { C as toCompatibleEf61Id, D as withoutGatewayHints, E as withGatewayHints, T as validatePublicUrl, a as canonicalizePortableUri, b as parseIri, c as fromCompatibleEf61Id, d as haveSameFe34Origin, f as haveSameIriOrigin, h as isValidPublicIPv6Address, l as getFe34Origin, m as isValidPublicIPv4Address, n as UrlError, o as expandIPv6Address, p as isGatewayUrl, r as arePortableUrisEqual, s as formatIri, u as getGatewayHints, w as validateLookupAddresses, x as parseJsonLdId, y as parseGatewayUrl } from "./url-COj5Q8mb.mjs";
 import { test } from "node:test";
 import { deepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert";
 //#region src/url.test.ts
@@ -597,6 +597,9 @@ test("validatePublicUrl()", async () => {
 	await validatePublicUrl("https://[2001:db8::1]");
 	await validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
+test("validatePublicUrl() keeps rejecting fedify-test.internal on Bun", { skip: !("Bun" in globalThis) }, async () => {
+	await rejects(() => validatePublicUrl("https://fedify-test.internal/"), (error) => error instanceof UrlError && error.reason === "disallowed");
+});
 test("validateLookupAddresses() tolerates Cloudflare Workers CNAME entries", () => {
 	validateLookupAddresses([
 		{

package/dist/url-4EE56sNP.d.cts

@@ -0,0 +1,352 @@
+/// <reference lib="esnext.temporal" />
+//#region src/url.d.ts
+/**
+* An address returned by a DNS lookup.  It has the same shape as
+* `ResolvedAddress` of `node:dns`, without depending on its type declarations.
+* @internal
+*/
+interface ResolvedAddress {
+  /** An IPv4 or IPv6 address. */
+  readonly address: string;
+  /** The IP family of the address: `4` or `6`. */
+  readonly family: number;
+}
+declare class UrlError extends Error {
+  /**
+  * The failure category. Defaults to `"disallowed"`.
+  * `"dns"` includes lookup errors and results with no usable IP addresses.
+  * @since 2.0.29
+  */
+  readonly reason: "dns" | "disallowed";
+  constructor(message: string, options?: {
+    cause?: unknown;
+    reason?: "dns" | "disallowed";
+  });
+}
+/**
+* Parses a JSON-LD `@id` value as an IRI, including FEP-ef61 portable
+* ActivityPub IRIs.  See {@link parseIri} for how IRIs are parsed.
+* @param id The `@id` value.
+* @param base The base IRI to resolve a relative `@id` against.
+* @returns The parsed IRI, or `undefined` if `id` is missing or a blank node
+*          identifier.
+* @throws {TypeError} If `id` is not a valid IRI.
+* @since 2.4.0
+*/
+declare function parseJsonLdId(id: string | undefined, base?: string | URL): URL | undefined;
+/**
+* Parses an IRI as a URL, including FEP-ef61 portable ActivityPub IRIs.
+* Portable URI and FEP-ef61 compatible identifier strings whose path contains
+* a `.` or `..` segment, including percent-encoded spellings, throw a
+* `TypeError`: JavaScript `URL` would otherwise identify a different object.
+* This also applies to compatible identifier strings used as relative bases.
+* A `URL` argument may already have lost such segments before this function
+* receives it.
+*
+* Portable IRIs, e.g., `ap://did:key:z6Mk.../actor`, cannot be represented by
+* JavaScript `URL` as they are, so the returned `URL` keeps the DID authority
+* percent-encoded, e.g., `ap+ef61://did%3Akey%3Az6Mk.../actor`.  Use
+* {@link formatIri} to get the canonical string back.
+* @param iri The IRI to parse.
+* @param base The base IRI to resolve a relative IRI against.
+* @returns The parsed IRI.
+* @throws {TypeError} If the IRI is malformed.
+* @since 2.4.0
+*/
+declare function parseIri(iri: string | URL, base?: string | URL): URL;
+/**
+* Formats a URL as an IRI, including FEP-ef61 portable ActivityPub IRIs.
+* Portable URI and FEP-ef61 compatible identifier strings with dot segments
+* throw a `TypeError` because their paths cannot be represented by JavaScript
+* `URL` without normalization.
+*
+* Portable IRIs are formatted with the `ap+ef61:` scheme and a decoded DID
+* authority, even if they were parsed from `ap:` IRIs.  FEP-ef61 currently
+* recommends the `ap:` scheme, so a future major version of Fedify may change
+* the scheme this function produces.  Do not compare its results as strings to
+* tell whether two portable IRIs identify the same object; use
+* `arePortableUrisEqual()` instead.
+* @param iri The IRI to format.
+* @returns The formatted IRI.  A string that cannot be parsed as a URL at all
+*          is returned unchanged.
+* @throws {TypeError} If the IRI is a malformed portable IRI or FEP-ef61
+*                     compatible identifier, e.g., one with dot segments.
+* @since 2.4.0
+*/
+declare function formatIri(iri: string | URL): string;
+/**
+* Canonicalizes a FEP-ef61 portable ActivityPub URI for comparison.
+*
+* This accepts both `ap:` and `ap+ef61:` URI strings with decoded or
+* percent-encoded DID authorities.  The returned value uses the `ap+ef61:`
+* scheme, a decoded DID authority, and no query component.  Pass the raw URI
+* string, not a `URL` object, because JavaScript `URL` normalizes opaque path
+* segments before Fedify can compare them.
+*
+* The `ap+ef61:` scheme of the result is a choice of Fedify's, whereas
+* FEP-ef61 currently canonicalizes portable URIs with the `ap:` scheme.
+* A future major version of Fedify may change the scheme of the result, so
+* do not persist the result as the only copy of an identifier; keep the
+* original URI, and canonicalize it again when comparing.
+*
+* @param input The raw portable ActivityPub URI string to canonicalize.
+* @returns The canonical portable ActivityPub URI string.
+* @throws {TypeError} If the input is not a valid portable ActivityPub IRI.
+* @since 2.4.0
+*/
+declare function canonicalizePortableUri(input: string): string;
+/**
+* Checks whether two FEP-ef61 portable ActivityPub URIs identify the same
+* portable object.
+*
+* Non-string inputs return `false`.  Non-portable URI strings use strict string
+* equality.  Portable URI strings are compared through
+* {@link canonicalizePortableUri}; malformed portable URI strings return
+* `false` unless they are exactly equal.
+*
+* @since 2.4.0
+*/
+declare function arePortableUrisEqual(left: string, right: string): boolean;
+/**
+* Computes an IRI's FEP-fe34 origin.
+*
+* HTTP(S) IRIs use their web origin.  FEP-ef61 portable ActivityPub IRIs and
+* DID URLs use their DID as a cryptographic origin.
+*
+* @throws {TypeError} If the IRI does not have a supported FEP-fe34 origin.
+* @since 2.4.0
+*/
+declare function getFe34Origin(input: string | URL): string;
+/**
+* Checks whether two IRIs have the same FEP-fe34 origin.
+*
+* Malformed or unsupported IRIs are treated as non-matching.
+*
+* @since 2.4.0
+*/
+declare function haveSameFe34Origin(left: string | URL, right: string | URL): boolean;
+/**
+* Checks whether two IRIs have the same origin.  Unlike comparing
+* `URL.origin`, which is `"null"` for URLs with non-special schemes, this
+* compares FEP-ef61 portable ActivityPub IRIs by their schemes and DIDs, so
+* that `ap:` and `ap+ef61:` IRIs of the same DID with decoded or
+* percent-encoded authorities have the same origin.  Other IRIs with
+* a non-special scheme and a host are compared by their schemes and hosts.
+*
+* This is not an FEP-fe34 origin check: an `ap+ef61:` IRI and the `did:key`
+* verification method of the same DID have different origins here.  Use
+* {@link haveSameFe34Origin} for that.
+* @param left The first IRI.
+* @param right The second IRI.
+* @returns `true` if the IRIs have the same origin.
+* @since 2.4.0
+*/
+declare function haveSameIriOrigin(left: URL, right: URL): boolean;
+/**
+* Checks whether the URL is an FEP-ef61 gateway base URI, i.e., an HTTP(S)
+* URI with no credentials, path, query, or fragment, such as
+* `https://example.com/`.  FEP-ef61 requires every item of a portable actor's
+* `gateways` to be such a URI.  A URI with an empty query or fragment
+* delimiter, such as `https://example.com/?`, is not a gateway base URI.
+*
+* Note that the `URL` class normalizes `https://example.com` to
+* `https://example.com/`, so both are gateway base URIs.
+* @param url The URL to check.
+* @returns `true` if the URL is an FEP-ef61 gateway base URI.
+* @since 2.4.0
+*/
+declare function isGatewayUrl(url: URL): boolean;
+/**
+* Parses and validates an FEP-ef61 gateway base URI, i.e., an HTTP(S) URI with
+* no credentials, path, query, or fragment, such as `https://example.com`.
+* See {@link isGatewayUrl} for the rules.
+* @param url The gateway base URI to parse.
+* @returns The parsed gateway base URI, whose path is `/`.
+* @throws {TypeError} If the URI is malformed, or is not an HTTP(S) base URI
+*                     with no credentials, path, query, or fragment.  In the
+*                     latter case, the message starts with
+*                     `Invalid FEP-ef61 gateway:`.
+* @since 2.4.0
+*/
+declare function parseGatewayUrl(url: string): URL;
+/**
+* Converts an [FEP-ef61] compatible identifier into a portable ActivityPub
+* URI.
+*
+* A compatible identifier is an HTTP(S) URL under a gateway's fixed
+* `/.well-known/apgateway/` path, such as
+* `https://server.example/.well-known/apgateway/did:key:z6Mk.../objects/1`.
+* This function removes the gateway part and returns the corresponding
+* portable URI, e.g., `ap+ef61://did:key:z6Mk.../objects/1`, in the same
+* internal `URL` form that {@link parseIri} produces.  The path, query, and
+* fragment are preserved, so the result is a portable URI, not a comparison
+* form; pass its `href` to {@link canonicalizePortableUri} or
+* {@link arePortableUrisEqual} to compare it with other portable URIs.
+*
+* The conversion only reveals the *claimed* portable identifier.  Anyone can
+* publish a compatible identifier for any DID on their own server, so the
+* gateway that served it is neither the object's origin nor authorized to act
+* for the DID.  Callers must still verify the retrieved document's Object
+* Integrity Proof against the DID, as FEP-ef61 requires, and should keep the
+* original URL if they need the gateway as a retrieval hint.
+*
+* Arbitrary gateway paths are not supported.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param input The URL to convert.
+* @returns The portable ActivityPub URI, or `null` if the input is not an
+*          HTTP(S) URL whose path starts with `/.well-known/apgateway/did:`.
+*          Other gateway routes, such as the gateway discovery endpoint and
+*          hashlink media URLs, also yield `null`.
+* @throws {TypeError} If the input looks like a compatible identifier but is
+*                     malformed, e.g., it has an invalid DID, no object path,
+*                     invalid percent-encoding, credentials, or location
+*                     hints (`@gateway` query parameters, or the legacy
+*                     `gateways` parameter), or its raw string path would
+*                     change during URL parsing.  Already-parsed `URL`
+*                     arguments cannot reveal segments lost by their parser.
+* @since 2.4.0
+*/
+declare function fromCompatibleEf61Id(input: string | URL): URL | null;
+/**
+* Converts a portable ActivityPub URI into an [FEP-ef61] compatible
+* identifier, which is an HTTP(S) URL under the gateway's fixed
+* `/.well-known/apgateway/` path.
+*
+* For example, `ap+ef61://did:key:z6Mk.../objects/1` and
+* `https://server.example` yield
+* `https://server.example/.well-known/apgateway/did:key:z6Mk.../objects/1`.
+* Both `ap:` and `ap+ef61:` URIs with decoded or percent-encoded DID
+* authorities are accepted.  Publishers should use the first gateway in the
+* actor's `gateways` list, as FEP-ef61 requires.
+*
+* The path and fragment are preserved, with characters that are not allowed
+* in HTTP(S) URLs percent-encoded the same way as
+* {@link canonicalizePortableUri} does.  FEP-ef61 location hints (`@gateway`
+* query parameters, and the legacy `gateways` parameter) are removed, since
+* compatible identifiers must not have them; other query parameters are kept
+* in order.
+*
+* Arbitrary gateway paths are not supported.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI to convert.
+* @param gateway The gateway's HTTP(S) origin, e.g., `https://server.example`.
+* @returns The compatible identifier.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI, if its path has `.` or `..` segments (which
+*                     HTTP(S) URLs cannot represent without changing the
+*                     identified object), or if the gateway is
+*                     not an HTTP(S) origin with no credentials, path, query,
+*                     or fragment.
+* @since 2.4.0
+*/
+declare function toCompatibleEf61Id(portableId: string | URL, gateway: string | URL): URL;
+/**
+* Returns a copy of an [FEP-ef61] portable ActivityPub URI with `@gateway`
+* location hints for the given gateways, which tell consumers where they can
+* retrieve the object.  Put hints on *references* to portable actors, e.g.,
+* in `actor`, `attributedTo`, `to`, or `cc`, when constructing an object, as
+* FEP-ef61 recommends:
+*
+* ~~~~ typescript
+* withGatewayHints("ap://did:key:z6Mk.../actor", [
+*   "https://server1.example",
+*   "https://server2.example",
+* ]);
+* // ap+ef61://did:key:z6Mk.../actor?@gateway=https%3A%2F%2Fserver1.example&@gateway=https%3A%2F%2Fserver2.example
+* ~~~~
+*
+* Do not put hints on an object's own `id`.  Hints do not change the
+* identity of a portable URI, since FEP-ef61 drops the query when comparing
+* portable URIs, but implementations that do not canonicalize portable URIs
+* would take a hinted ID for another object.  Add hints before signing the
+* object, since its Object Integrity Proof covers its references too.
+*
+* The hints that the URI already has, including the legacy `gateways`
+* parameter, are replaced.  Each gateway becomes a `@gateway` query
+* parameter whose value is its URI-encoded origin, e.g.,
+* `@gateway=https%3A%2F%2Fserver1.example`, in the given order after the
+* other query parameters.  Duplicate gateways are dropped, and an empty list
+* removes the hints as {@link withoutGatewayHints} does.  The other query
+* parameters, their order, and the fragment are kept, but percent-encoding
+* is normalized the same way as {@link canonicalizePortableUri} does it.
+*
+* Fedify follows at most five hints when dereferencing a portable URI
+* (three for the key ID of an HTTP Signature), so list the preferred
+* gateways first; there is no limit on the number of hints added here.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI.  Pass the raw string rather
+*                   than a `URL` if its path may have `.` or `..` segments,
+*                   because the `URL` class resolves them.
+* @param gateways The gateways, e.g., the `gateways` of the actor that the
+*                 URI refers to.  Each has to be an HTTP(S) origin with no
+*                 credentials, path, query, or fragment.
+* @returns The portable URI with the hints, in the same internal `URL` form
+*          as {@link parseIri} returns.  Use {@link formatIri} to get its
+*          canonical string.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI, e.g., it is a compatible identifier, which must
+*                     not have location hints; if its path has `.` or `..`
+*                     segments, which the `URL` class cannot represent; or
+*                     if a gateway is invalid.
+* @since 2.4.0
+*/
+declare function withGatewayHints(portableId: string | URL, gateways: Iterable<string | URL>): URL;
+/**
+* Returns a copy of an [FEP-ef61] portable ActivityPub URI without its
+* location hints, i.e., `@gateway` query parameters and the legacy
+* `gateways` parameter.  The other query parameters, their order, and the
+* fragment are kept, but percent-encoding is normalized the same way as
+* {@link canonicalizePortableUri} does it.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI.  Pass the raw string rather
+*                   than a `URL` if its path may have `.` or `..` segments,
+*                   because the `URL` class resolves them.
+* @returns The portable URI without the hints, in the same internal `URL`
+*          form as {@link parseIri} returns.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI, or if its path has `.` or `..` segments, which
+*                     the `URL` class cannot represent.
+* @since 2.4.0
+*/
+declare function withoutGatewayHints(portableId: string | URL): URL;
+/**
+* Gets the gateways in the `@gateway` location hints of an [FEP-ef61]
+* portable ActivityPub URI, in order.  Hints that are not valid gateways,
+* i.e., HTTP(S) origins with no credentials, path, query, or fragment, are
+* skipped, and so are duplicates.  The legacy `gateways` parameter is not
+* read.
+*
+* Unlike Fedify's dereferencing, which follows at most five hints, this
+* returns all of them.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI.
+* @returns The gateways, e.g., `https://server1.example/`.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI.
+* @since 2.4.0
+*/
+declare function getGatewayHints(portableId: string | URL): URL[];
+/**
+* Validates a URL to prevent SSRF attacks.
+*
+* This function only checks the addresses that the hostname currently
+* resolves to; it does not pin the connection to those addresses.  A request
+* made after this check resolves the hostname again, so this function alone
+* does not prevent DNS rebinding.
+*/
+declare function validatePublicUrl(url: string): Promise<void>;
+declare function isValidPublicIPv4Address(address: string): boolean;
+declare function isValidPublicIPv6Address(address: string): boolean;
+declare function expandIPv6Address(address: string): string;
+//#endregion
+export { parseJsonLdId as _, expandIPv6Address as a, withGatewayHints as b, getFe34Origin as c, haveSameIriOrigin as d, isGatewayUrl as f, parseIri as g, parseGatewayUrl as h, canonicalizePortableUri as i, getGatewayHints as l, isValidPublicIPv6Address as m, UrlError as n, formatIri as o, isValidPublicIPv4Address as p, arePortableUrisEqual as r, fromCompatibleEf61Id as s, ResolvedAddress as t, haveSameFe34Origin as u, toCompatibleEf61Id as v, withoutGatewayHints as x, validatePublicUrl as y };