@fedify/vocab-runtime 2.4.5-dev.2462 → 2.4.5

package/dist/tests/pinners/node.test.mjs

@@ -0,0 +1,268 @@
+import { r as revokePinGrant, t as issuePinGrant } from "../pin-grant-H5XhM1Xs.mjs";
+import { i as assertPublicAddress, n as UrlError } from "../url-COj5Q8mb.mjs";
+import { t as createNodePinner } from "../node-Cg4pRuYy.mjs";
+import { t as createPublicFetch } from "../public-fetch-DNkPoks1.mjs";
+import { a as ipv6, c as isNode, d as resolveTestdata, f as runChild, h as startRecordingServer, i as ipv4, l as listen, m as startRecordingProxy, n as closeServer, p as startCountingServer, r as getLoopbackSupport, t as allowAll, u as resolveCompiledTestdata } from "../support-CiHDVJgh.mjs";
+import process from "node:process";
+import { deepStrictEqual, ok, rejects, strictEqual } from "node:assert";
+import { test } from "@fedify/fixture";
+import { readFileSync } from "node:fs";
+import { createServer } from "node:https";
+//#region src/pinners/node.test.ts
+/**
+* Creates a Node.js pinner whose undici agent the test can also use
+* directly, by injecting an `Agent` class that remembers its instance.
+*/
+async function createPinnerWithAgent(options) {
+	const undici = await import("undici");
+	const agents = [];
+	class Agent extends undici.Agent {
+		constructor(options) {
+			super(options);
+			agents.push(this);
+		}
+	}
+	const pinner = createNodePinner({
+		...options,
+		undici: { Agent }
+	});
+	strictEqual(agents.length, 1);
+	return {
+		pinner,
+		agent: agents[0]
+	};
+}
+/**
+* Sends a request through the agent directly, without redeeming a grant.
+*/
+function fetchThrough(agent, url) {
+	return fetch(url, { dispatcher: agent });
+}
+/**
+* Whether the error is the failure of the agent's lookup to find a live
+* grant for the hostname.
+*/
+function isNoValidatedAddress(error) {
+	return error instanceof TypeError && error.cause instanceof UrlError && error.cause.message.startsWith("No validated address to connect to:");
+}
+/** Responds without keeping the connection alive. */
+function respondAndClose(_, res) {
+	res.setHeader("Connection", "close");
+	res.end("pinned");
+}
+test("createNodePinner() checks IP literal hostnames before fetching", { ignore: !isNode }, async () => {
+	const { server, port, requests } = await startRecordingServer();
+	try {
+		const pinner = createNodePinner({
+			verifyAddress: assertPublicAddress,
+			undici: await import("undici")
+		});
+		const url = new URL(`http://127.0.0.1:${port}/`);
+		const grant = issuePinGrant(url, [ipv4("127.0.0.1")]);
+		await rejects(() => pinner.fetch(grant, new Request(url)), UrlError);
+		deepStrictEqual(requests, []);
+	} finally {
+		await closeServer(server);
+	}
+});
+test("createNodePinner() connects only for live grants", { ignore: !isNode }, async () => {
+	const { server, port, requests } = await startRecordingServer("127.0.0.1", respondAndClose);
+	try {
+		const { pinner, agent } = await createPinnerWithAgent(allowAll);
+		const url = new URL(`http://pinned-host.invalid:${port}/`);
+		await rejects(() => fetchThrough(agent, url), isNoValidatedAddress);
+		const grant = issuePinGrant(url, [ipv4("127.0.0.1")]);
+		deepStrictEqual(await (await pinner.fetch(grant, new Request(url))).text(), "pinned");
+		deepStrictEqual(await (await fetchThrough(agent, url)).text(), "pinned");
+		await rejects(() => fetchThrough(agent, `http://other-host.invalid:${port}/`), isNoValidatedAddress);
+		revokePinGrant(grant);
+		await rejects(() => pinner.fetch(grant, new Request(url)), TypeError);
+		await rejects(() => fetchThrough(agent, url), isNoValidatedAddress);
+		deepStrictEqual(requests.length, 2);
+	} finally {
+		await closeServer(server);
+	}
+});
+test("createNodePinner() forgets released grants", { ignore: !isNode }, async () => {
+	const { server, port, requests } = await startRecordingServer("127.0.0.1", respondAndClose);
+	try {
+		const { pinner, agent } = await createPinnerWithAgent(allowAll);
+		const url = new URL(`http://pinned-host.invalid:${port}/`);
+		const grants = [issuePinGrant(url, [ipv4("127.0.0.1")]), issuePinGrant(url, [ipv4("127.0.0.1")])];
+		for (const grant of grants) deepStrictEqual(await (await pinner.fetch(grant, new Request(url))).text(), "pinned");
+		await pinner.release(grants[0]);
+		deepStrictEqual(await (await fetchThrough(agent, url)).text(), "pinned");
+		await pinner.release(grants[1]);
+		await rejects(() => fetchThrough(agent, url), isNoValidatedAddress);
+		await pinner.release(grants[1]);
+		deepStrictEqual(requests.length, 3);
+	} finally {
+		await closeServer(server);
+	}
+});
+test("createNodePinner() connects to the next address on failure", { ignore: !isNode }, async () => {
+	if (!(await getLoopbackSupport()).ipv6) return;
+	const { server, port, requests } = await startRecordingServer();
+	try {
+		const pinner = createNodePinner({
+			...allowAll,
+			undici: await import("undici")
+		});
+		const url = new URL(`http://pinned-host.invalid:${port}/`);
+		const grant = issuePinGrant(url, [ipv6("::1"), ipv4("127.0.0.1")]);
+		deepStrictEqual(await (await pinner.fetch(grant, new Request(url))).text(), "pinned");
+		deepStrictEqual(await (await pinner.fetch(grant, new Request(url, {
+			method: "POST",
+			body: "payload"
+		}))).text(), "pinned");
+		deepStrictEqual(requests.map(({ method, localAddress }) => [method, localAddress]), [["GET", "127.0.0.1"], ["POST", "127.0.0.1"]]);
+	} finally {
+		await closeServer(server);
+	}
+});
+/**
+* Replaces the global `fetch()` while running the given function, as
+* fetch-mock does, but returns the given responses as they are, while
+* fetch-mock returns clones (tees) of them.
+*/
+async function withFetchStub(respond, fn) {
+	const original = globalThis.fetch;
+	globalThis.fetch = (_, init) => Promise.resolve(respond(init));
+	try {
+		return await fn();
+	} finally {
+		globalThis.fetch = original;
+	}
+}
+test("createNodePinner() forgets the grants of closed sessions", { ignore: !isNode }, async (t) => {
+	for (const cancelFails of [false, true]) await t.step(`cancelFails: ${cancelFails}`, async () => {
+		const checked = [];
+		const { pinner, agent } = await createPinnerWithAgent({ verifyAddress({ address }) {
+			checked.push(address);
+			throw new UrlError(`Refused for the test: ${address}`);
+		} });
+		const released = [];
+		const observed = {
+			supports: (url) => pinner.supports(url),
+			fetch: (grant, request, signal) => pinner.fetch(grant, request, signal),
+			async release(grant) {
+				released.push(grant);
+				await pinner.release(grant);
+			}
+		};
+		const { openPublicFetch } = createPublicFetch({
+			pinner: () => Promise.resolve(observed),
+			lookup: () => Promise.reject(/* @__PURE__ */ new Error("Not used."))
+		});
+		const url = "http://pinned-host.invalid/";
+		const session = await openPublicFetch(url, { lookup: () => Promise.resolve([ipv4("8.8.8.8")]) });
+		const dispatchers = [];
+		let cancelled = 0;
+		const response = await withFetchStub((init) => {
+			dispatchers.push(init.dispatcher);
+			return new Response(new ReadableStream({ cancel() {
+				cancelled++;
+				if (cancelFails) throw new Error("Failed to cancel.");
+			} }));
+		}, () => session.fetch(url));
+		deepStrictEqual(dispatchers, [agent]);
+		await rejects(() => fetchThrough(agent, url), (error) => error instanceof TypeError && error.cause instanceof UrlError && error.cause.message === "Refused for the test: 8.8.8.8");
+		deepStrictEqual(checked, ["8.8.8.8"]);
+		ok(!response.bodyUsed);
+		await session.close();
+		deepStrictEqual(cancelled, 1);
+		deepStrictEqual(released.length, 1);
+		await rejects(() => fetchThrough(agent, url), isNoValidatedAddress);
+		deepStrictEqual(checked, ["8.8.8.8"]);
+	});
+});
+test("createNodePinner() bypasses environment proxies", { ignore: !isNode }, async (t) => {
+	const major = Number(process.versions.node.split(".")[0]);
+	const names = [
+		"HTTP_PROXY",
+		"HTTPS_PROXY",
+		"ALL_PROXY"
+	];
+	for (const useEnvProxy of [false, true]) await t.step(`NODE_USE_ENV_PROXY: ${useEnvProxy}`, async () => {
+		const proxy = await startRecordingProxy({ refuseTunnels: true });
+		const origin = await startRecordingServer();
+		const tls = await startCountingServer();
+		try {
+			const proxyUrl = `http://127.0.0.1:${proxy.port}`;
+			const output = await runChild(resolveCompiledTestdata("node-child.mjs", import.meta.url), [
+				"proxy",
+				String(origin.port),
+				String(tls.port)
+			], {
+				...Object.fromEntries(names.map((name) => [name, proxyUrl])),
+				...useEnvProxy ? { NODE_USE_ENV_PROXY: "1" } : {}
+			});
+			const targets = JSON.stringify(proxy.targets);
+			deepStrictEqual(output.version, process.version);
+			const controlTargets = [`GET http://127.0.0.1:${origin.port}/control`, `CONNECT 127.0.0.1:${origin.port}`];
+			if (useEnvProxy && major >= 24) ok(proxy.targets.some((target) => controlTargets.includes(target)), targets);
+			deepStrictEqual(proxy.targets.filter((target) => !controlTargets.includes(target)), [], targets);
+			deepStrictEqual(output.http, {
+				status: 200,
+				body: "pinned"
+			});
+			deepStrictEqual(origin.requests.filter(({ url }) => url === "/pinned").map(({ host }) => host), [`pinned-host.invalid:${origin.port}`]);
+			ok(output.https.error != null, JSON.stringify(output.https));
+			deepStrictEqual(tls.counter.connections, 1);
+		} finally {
+			await closeServer(proxy.server);
+			await closeServer(origin.server);
+			await closeServer(tls.server);
+		}
+	});
+});
+test("createNodePinner() verifies certificates against the hostname", { ignore: !isNode }, async () => {
+	const certPath = resolveTestdata("tls-cert.pem", import.meta.url);
+	const hosts = [];
+	const server = createServer({
+		cert: readFileSync(certPath),
+		key: readFileSync(resolveTestdata("tls-key.pem", import.meta.url))
+	}, (req, res) => {
+		hosts.push(req.headers.host ?? "");
+		res.end(req.headers.host);
+	});
+	const port = await listen(server);
+	try {
+		const output = await runChild(resolveCompiledTestdata("node-child.mjs", import.meta.url), ["tls", String(port)], { NODE_EXTRA_CA_CERTS: certPath });
+		deepStrictEqual(output.version, process.version);
+		deepStrictEqual(output.results, [
+			{
+				case: "pinned",
+				status: 200,
+				body: `pinned-host.invalid:${port}`
+			},
+			{
+				case: "unlisted",
+				error: "ERR_TLS_CERT_ALTNAME_INVALID"
+			},
+			{
+				case: "unlisted-again",
+				error: "ERR_TLS_CERT_ALTNAME_INVALID"
+			},
+			{
+				case: "alternate",
+				status: 200,
+				body: `alternate-host.invalid:${port}`
+			},
+			{
+				case: "signals",
+				status: 200,
+				body: `pinned-host.invalid:${port}`
+			}
+		], JSON.stringify(output.results));
+		deepStrictEqual(hosts, [
+			`pinned-host.invalid:${port}`,
+			`alternate-host.invalid:${port}`,
+			`pinned-host.invalid:${port}`
+		]);
+	} finally {
+		await closeServer(server);
+	}
+});
+//#endregion
+export {};

package/dist/tests/pinners/pinners.test.cjs

@@ -0,0 +1,196 @@
+const require_pin_grant = require("../pin-grant-CPrpk1l4.cjs");
+const require_url = require("../url-Bdj-rTcC.cjs");
+const require_pinners = require("../pinners-CJi9ZkYs.cjs");
+const require_node = require("../node-BvS3AhZ2.cjs");
+const require_support = require("../support-BmzI3dRJ.cjs");
+let node_assert = require("node:assert");
+let node_net = require("node:net");
+let _fedify_fixture = require("@fedify/fixture");
+let node_http = require("node:http");
+//#region src/pinners/pinners.test.ts
+/**
+* The pinners of all runtimes.  The behaviors they share are tested here, and
+* the ones specific to each runtime in *bun.test.ts* and *node.test.ts*.
+*/
+const pinners = [{
+	name: "createBunPinner()",
+	connects: require_support.isBun,
+	checksBeforeFetch: true,
+	create: (options) => Promise.resolve(require_pinners.createBunPinner(options))
+}, {
+	name: "createNodePinner()",
+	connects: require_support.isNode,
+	checksBeforeFetch: false,
+	create: async (options) => require_node.createNodePinner({
+		...options,
+		undici: await import("undici")
+	})
+}];
+for (const { name, connects, checksBeforeFetch, create } of pinners) {
+	(0, _fedify_fixture.test)(`${name} supports only HTTP and HTTPS`, async () => {
+		const pinner = await create(require_support.allowAll);
+		(0, node_assert.ok)(pinner.supports(new URL("http://pinned-host.invalid/")));
+		(0, node_assert.ok)(pinner.supports(new URL("https://pinned-host.invalid/")));
+		(0, node_assert.ok)(!pinner.supports(new URL("ftp://pinned-host.invalid/")));
+		(0, node_assert.ok)(!pinner.supports(new URL("ws://pinned-host.invalid/")));
+	});
+	(0, _fedify_fixture.test)(`${name} checks addresses right before connecting`, { ignore: !connects && !checksBeforeFetch }, async () => {
+		const { server, port, requests } = await require_support.startRecordingServer();
+		try {
+			const pinner = await create({ verifyAddress: require_url.assertPublicAddress });
+			const url = new URL(`http://pinned-host.invalid:${port}/`);
+			const grant = require_pin_grant.issuePinGrant(url, [require_support.ipv4("127.0.0.1")]);
+			for (const method of ["GET", "POST"]) await (0, node_assert.rejects)(() => pinner.fetch(grant, new Request(url, { method })), require_support.isAddressRejection);
+			(0, node_assert.deepStrictEqual)(requests, []);
+		} finally {
+			await require_support.closeServer(server);
+		}
+	});
+	(0, _fedify_fixture.test)(`${name} does not fall back past a failed check`, { ignore: !connects && !checksBeforeFetch }, async () => {
+		const { server, port, requests } = await require_support.startRecordingServer();
+		try {
+			const checked = [];
+			const pinner = await create({ verifyAddress({ address }) {
+				checked.push(address);
+				if (address !== "127.0.0.1") throw new require_url.UrlError(`Invalid or private address: ${address}`);
+			} });
+			const url = new URL(`http://pinned-host.invalid:${port}/`);
+			const grant = require_pin_grant.issuePinGrant(url, [require_support.ipv4("192.0.2.1"), require_support.ipv4("127.0.0.1")]);
+			await (0, node_assert.rejects)(() => pinner.fetch(grant, new Request(url)), require_support.isAddressRejection);
+			(0, node_assert.deepStrictEqual)(checked, ["192.0.2.1"]);
+			(0, node_assert.deepStrictEqual)(requests, []);
+		} finally {
+			await require_support.closeServer(server);
+		}
+	});
+	(0, _fedify_fixture.test)(`${name} redeems the grant for every request`, async () => {
+		const { server, port, requests } = await require_support.startRecordingServer();
+		try {
+			const pinner = await create(require_support.allowAll);
+			const url = new URL(`http://pinned-host.invalid:${port}/`);
+			const grant = require_pin_grant.issuePinGrant(url, [require_support.ipv4("127.0.0.1")]);
+			for (const other of [
+				`http://other-host.invalid:${port}/`,
+				`https://pinned-host.invalid:${port}/`,
+				`http://pinned-host.invalid:${port + 1}/`
+			]) await (0, node_assert.rejects)(() => pinner.fetch(grant, new Request(other)), TypeError);
+			for (const forged of [{}, Object.freeze(Object.create(null))]) await (0, node_assert.rejects)(() => pinner.fetch(forged, new Request(url)), TypeError);
+			require_pin_grant.revokePinGrant(grant);
+			await (0, node_assert.rejects)(() => pinner.fetch(grant, new Request(url)), TypeError);
+			(0, node_assert.deepStrictEqual)(requests, []);
+		} finally {
+			await require_support.closeServer(server);
+		}
+	});
+	(0, _fedify_fixture.test)(`${name} connects to the pinned address`, { ignore: !connects }, async () => {
+		const { server, port, requests } = await require_support.startRecordingServer();
+		try {
+			const pinner = await create(require_support.allowAll);
+			const url = new URL(`http://pinned-host.invalid:${port}/path?query`);
+			const grant = require_pin_grant.issuePinGrant(url, [require_support.ipv4("127.0.0.1")]);
+			const response = await pinner.fetch(grant, new Request(url, { headers: { "X-Test": "header" } }));
+			(0, node_assert.deepStrictEqual)(response.status, 200);
+			(0, node_assert.deepStrictEqual)(await response.text(), "pinned");
+			(0, node_assert.deepStrictEqual)(await (await pinner.fetch(grant, new Request(url, {
+				method: "POST",
+				body: "payload"
+			}))).text(), "pinned");
+			(0, node_assert.deepStrictEqual)(requests.map(({ method, url, host, body }) => ({
+				method,
+				url,
+				host,
+				body
+			})), [{
+				method: "GET",
+				url: "/path?query",
+				host: `pinned-host.invalid:${port}`,
+				body: ""
+			}, {
+				method: "POST",
+				url: "/path?query",
+				host: `pinned-host.invalid:${port}`,
+				body: "payload"
+			}]);
+		} finally {
+			await require_support.closeServer(server);
+		}
+	});
+	(0, _fedify_fixture.test)(`${name} does not follow redirects`, { ignore: !connects }, async () => {
+		const { server, port, requests } = await require_support.startRecordingServer("127.0.0.1", (_, res) => {
+			res.writeHead(302, { Location: "/target" });
+			res.end();
+		});
+		try {
+			const pinner = await create(require_support.allowAll);
+			const url = new URL(`http://pinned-host.invalid:${port}/`);
+			const grant = require_pin_grant.issuePinGrant(url, [require_support.ipv4("127.0.0.1")]);
+			const response = await pinner.fetch(grant, new Request(url, { redirect: "follow" }));
+			(0, node_assert.deepStrictEqual)(response.status, 302);
+			(0, node_assert.deepStrictEqual)(response.headers.get("Location"), "/target");
+			(0, node_assert.deepStrictEqual)(requests.length, 1);
+		} finally {
+			await require_support.closeServer(server);
+		}
+	});
+	(0, _fedify_fixture.test)(`${name} aborts requests on either signal`, { ignore: !connects }, async () => {
+		let notifyReceived = () => {};
+		const server = (0, node_http.createServer)(() => notifyReceived());
+		const port = await require_support.listen(server);
+		try {
+			const pinner = await create(require_support.allowAll);
+			const url = new URL(`http://pinned-host.invalid:${port}/`);
+			const grant = require_pin_grant.issuePinGrant(url, [require_support.ipv4("127.0.0.1")]);
+			for (const which of ["request", "separate"]) {
+				const requestController = new AbortController();
+				const separateController = new AbortController();
+				const received = new Promise((resolve) => notifyReceived = resolve);
+				const response = pinner.fetch(grant, new Request(url, { signal: requestController.signal }), separateController.signal);
+				await received;
+				(which === "request" ? requestController : separateController).abort();
+				await (0, node_assert.rejects)(response, { name: "AbortError" }, which);
+			}
+		} finally {
+			await require_support.closeServer(server);
+		}
+	});
+	(0, _fedify_fixture.test)(`${name} does not deliver a POST request twice`, { ignore: !connects }, async () => {
+		if (!(await require_support.getLoopbackSupport()).dualStack) return;
+		let received = 0;
+		const server = (0, node_net.createServer)((socket) => {
+			let data = "";
+			socket.setEncoding("latin1");
+			socket.on("error", () => {});
+			socket.on("data", (chunk) => {
+				data += chunk;
+				const headEnd = data.indexOf("\r\n\r\n");
+				if (headEnd < 0) return;
+				const length = /^content-length:\s*(\d+)/im.exec(data.slice(0, headEnd))?.[1];
+				if (!(length == null ? data.endsWith("\r\n0\r\n\r\n") : data.length - headEnd - 4 >= Number(length))) return;
+				received++;
+				socket.destroy();
+			});
+		});
+		const port = await require_support.listen(server, "::");
+		try {
+			const pinner = await create(require_support.allowAll);
+			const url = new URL(`http://pinned-host.invalid:${port}/inbox`);
+			const grant = require_pin_grant.issuePinGrant(url, [require_support.ipv4("127.0.0.1"), require_support.ipv6("::1")]);
+			await (0, node_assert.rejects)(() => pinner.fetch(grant, new Request(url, {
+				method: "POST",
+				body: "activity"
+			})));
+			(0, node_assert.deepStrictEqual)(received, 1);
+			require_pin_grant.revokePinGrant(grant);
+			await pinner.release(grant);
+			const second = require_pin_grant.issuePinGrant(url, [require_support.ipv6("::1")]);
+			await (0, node_assert.rejects)(() => pinner.fetch(second, new Request(url, {
+				method: "POST",
+				body: "activity"
+			})));
+			(0, node_assert.deepStrictEqual)(received, 2);
+		} finally {
+			await require_support.closeServer(server);
+		}
+	});
+}
+//#endregion

package/dist/tests/pinners/pinners.test.d.cts

@@ -0,0 +1 @@
+export { };

package/dist/tests/pinners/pinners.test.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/tests/pinners/pinners.test.mjs

@@ -0,0 +1,197 @@
+import { r as revokePinGrant, t as issuePinGrant } from "../pin-grant-H5XhM1Xs.mjs";
+import { i as assertPublicAddress, n as UrlError } from "../url-COj5Q8mb.mjs";
+import { r as createBunPinner } from "../pinners-zSofbiy2.mjs";
+import { t as createNodePinner } from "../node-Cg4pRuYy.mjs";
+import { a as ipv6, c as isNode, h as startRecordingServer, i as ipv4, l as listen, n as closeServer, o as isAddressRejection, r as getLoopbackSupport, s as isBun, t as allowAll } from "../support-CiHDVJgh.mjs";
+import { deepStrictEqual, ok, rejects } from "node:assert";
+import { createServer } from "node:net";
+import { test } from "@fedify/fixture";
+import { createServer as createServer$1 } from "node:http";
+//#region src/pinners/pinners.test.ts
+/**
+* The pinners of all runtimes.  The behaviors they share are tested here, and
+* the ones specific to each runtime in *bun.test.ts* and *node.test.ts*.
+*/
+const pinners = [{
+	name: "createBunPinner()",
+	connects: isBun,
+	checksBeforeFetch: true,
+	create: (options) => Promise.resolve(createBunPinner(options))
+}, {
+	name: "createNodePinner()",
+	connects: isNode,
+	checksBeforeFetch: false,
+	create: async (options) => createNodePinner({
+		...options,
+		undici: await import("undici")
+	})
+}];
+for (const { name, connects, checksBeforeFetch, create } of pinners) {
+	test(`${name} supports only HTTP and HTTPS`, async () => {
+		const pinner = await create(allowAll);
+		ok(pinner.supports(new URL("http://pinned-host.invalid/")));
+		ok(pinner.supports(new URL("https://pinned-host.invalid/")));
+		ok(!pinner.supports(new URL("ftp://pinned-host.invalid/")));
+		ok(!pinner.supports(new URL("ws://pinned-host.invalid/")));
+	});
+	test(`${name} checks addresses right before connecting`, { ignore: !connects && !checksBeforeFetch }, async () => {
+		const { server, port, requests } = await startRecordingServer();
+		try {
+			const pinner = await create({ verifyAddress: assertPublicAddress });
+			const url = new URL(`http://pinned-host.invalid:${port}/`);
+			const grant = issuePinGrant(url, [ipv4("127.0.0.1")]);
+			for (const method of ["GET", "POST"]) await rejects(() => pinner.fetch(grant, new Request(url, { method })), isAddressRejection);
+			deepStrictEqual(requests, []);
+		} finally {
+			await closeServer(server);
+		}
+	});
+	test(`${name} does not fall back past a failed check`, { ignore: !connects && !checksBeforeFetch }, async () => {
+		const { server, port, requests } = await startRecordingServer();
+		try {
+			const checked = [];
+			const pinner = await create({ verifyAddress({ address }) {
+				checked.push(address);
+				if (address !== "127.0.0.1") throw new UrlError(`Invalid or private address: ${address}`);
+			} });
+			const url = new URL(`http://pinned-host.invalid:${port}/`);
+			const grant = issuePinGrant(url, [ipv4("192.0.2.1"), ipv4("127.0.0.1")]);
+			await rejects(() => pinner.fetch(grant, new Request(url)), isAddressRejection);
+			deepStrictEqual(checked, ["192.0.2.1"]);
+			deepStrictEqual(requests, []);
+		} finally {
+			await closeServer(server);
+		}
+	});
+	test(`${name} redeems the grant for every request`, async () => {
+		const { server, port, requests } = await startRecordingServer();
+		try {
+			const pinner = await create(allowAll);
+			const url = new URL(`http://pinned-host.invalid:${port}/`);
+			const grant = issuePinGrant(url, [ipv4("127.0.0.1")]);
+			for (const other of [
+				`http://other-host.invalid:${port}/`,
+				`https://pinned-host.invalid:${port}/`,
+				`http://pinned-host.invalid:${port + 1}/`
+			]) await rejects(() => pinner.fetch(grant, new Request(other)), TypeError);
+			for (const forged of [{}, Object.freeze(Object.create(null))]) await rejects(() => pinner.fetch(forged, new Request(url)), TypeError);
+			revokePinGrant(grant);
+			await rejects(() => pinner.fetch(grant, new Request(url)), TypeError);
+			deepStrictEqual(requests, []);
+		} finally {
+			await closeServer(server);
+		}
+	});
+	test(`${name} connects to the pinned address`, { ignore: !connects }, async () => {
+		const { server, port, requests } = await startRecordingServer();
+		try {
+			const pinner = await create(allowAll);
+			const url = new URL(`http://pinned-host.invalid:${port}/path?query`);
+			const grant = issuePinGrant(url, [ipv4("127.0.0.1")]);
+			const response = await pinner.fetch(grant, new Request(url, { headers: { "X-Test": "header" } }));
+			deepStrictEqual(response.status, 200);
+			deepStrictEqual(await response.text(), "pinned");
+			deepStrictEqual(await (await pinner.fetch(grant, new Request(url, {
+				method: "POST",
+				body: "payload"
+			}))).text(), "pinned");
+			deepStrictEqual(requests.map(({ method, url, host, body }) => ({
+				method,
+				url,
+				host,
+				body
+			})), [{
+				method: "GET",
+				url: "/path?query",
+				host: `pinned-host.invalid:${port}`,
+				body: ""
+			}, {
+				method: "POST",
+				url: "/path?query",
+				host: `pinned-host.invalid:${port}`,
+				body: "payload"
+			}]);
+		} finally {
+			await closeServer(server);
+		}
+	});
+	test(`${name} does not follow redirects`, { ignore: !connects }, async () => {
+		const { server, port, requests } = await startRecordingServer("127.0.0.1", (_, res) => {
+			res.writeHead(302, { Location: "/target" });
+			res.end();
+		});
+		try {
+			const pinner = await create(allowAll);
+			const url = new URL(`http://pinned-host.invalid:${port}/`);
+			const grant = issuePinGrant(url, [ipv4("127.0.0.1")]);
+			const response = await pinner.fetch(grant, new Request(url, { redirect: "follow" }));
+			deepStrictEqual(response.status, 302);
+			deepStrictEqual(response.headers.get("Location"), "/target");
+			deepStrictEqual(requests.length, 1);
+		} finally {
+			await closeServer(server);
+		}
+	});
+	test(`${name} aborts requests on either signal`, { ignore: !connects }, async () => {
+		let notifyReceived = () => {};
+		const server = createServer$1(() => notifyReceived());
+		const port = await listen(server);
+		try {
+			const pinner = await create(allowAll);
+			const url = new URL(`http://pinned-host.invalid:${port}/`);
+			const grant = issuePinGrant(url, [ipv4("127.0.0.1")]);
+			for (const which of ["request", "separate"]) {
+				const requestController = new AbortController();
+				const separateController = new AbortController();
+				const received = new Promise((resolve) => notifyReceived = resolve);
+				const response = pinner.fetch(grant, new Request(url, { signal: requestController.signal }), separateController.signal);
+				await received;
+				(which === "request" ? requestController : separateController).abort();
+				await rejects(response, { name: "AbortError" }, which);
+			}
+		} finally {
+			await closeServer(server);
+		}
+	});
+	test(`${name} does not deliver a POST request twice`, { ignore: !connects }, async () => {
+		if (!(await getLoopbackSupport()).dualStack) return;
+		let received = 0;
+		const server = createServer((socket) => {
+			let data = "";
+			socket.setEncoding("latin1");
+			socket.on("error", () => {});
+			socket.on("data", (chunk) => {
+				data += chunk;
+				const headEnd = data.indexOf("\r\n\r\n");
+				if (headEnd < 0) return;
+				const length = /^content-length:\s*(\d+)/im.exec(data.slice(0, headEnd))?.[1];
+				if (!(length == null ? data.endsWith("\r\n0\r\n\r\n") : data.length - headEnd - 4 >= Number(length))) return;
+				received++;
+				socket.destroy();
+			});
+		});
+		const port = await listen(server, "::");
+		try {
+			const pinner = await create(allowAll);
+			const url = new URL(`http://pinned-host.invalid:${port}/inbox`);
+			const grant = issuePinGrant(url, [ipv4("127.0.0.1"), ipv6("::1")]);
+			await rejects(() => pinner.fetch(grant, new Request(url, {
+				method: "POST",
+				body: "activity"
+			})));
+			deepStrictEqual(received, 1);
+			revokePinGrant(grant);
+			await pinner.release(grant);
+			const second = issuePinGrant(url, [ipv6("::1")]);
+			await rejects(() => pinner.fetch(second, new Request(url, {
+				method: "POST",
+				body: "activity"
+			})));
+			deepStrictEqual(received, 2);
+		} finally {
+			await closeServer(server);
+		}
+	});
+}
+//#endregion
+export {};