@fedify/vocab-runtime 2.5.0-dev.2448 → 2.5.0-dev.2494

package/deno.json

@@ -1,12 +1,13 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.5.0-dev.2448+756933d0",
+  "version": "2.5.0-dev.2494+f2e9b5d3",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",
     "./internal/jsonld-cache": "./src/internal/jsonld-cache.ts",
     "./internal/portable-dereference": "./src/internal/portable-dereference.ts",
     "./internal/signed-representation": "./src/internal/signed-representation.ts",
+    "./internal": "./src/internal.ts",
     "./jsonld": "./src/jsonld.ts",
     "./temporal": "./src/temporal.ts"
   },
@@ -22,7 +23,8 @@
     "byte-encodings": "npm:byte-encodings@^1.0.11",
     "fetch-mock": "npm:fetch-mock@^12.5.4",
     "jsonld": "npm:jsonld@^9.0.0",
-    "pkijs": "npm:pkijs@^3.2.5"
+    "pkijs": "npm:pkijs@^3.2.5",
+    "undici": "npm:undici@^7.30.1"
   },
   "exclude": [
     "dist",
@@ -31,6 +33,7 @@
   "publish": {
     "exclude": [
       "**/*.test.ts",
+      "src/**/testdata/",
       "tsdown.config.ts"
     ]
   },

package/dist/{docloader-BBnBpbsG.d.cts → docloader-DD6binpN.d.cts}

@@ -221,7 +221,9 @@ type AuthenticatedDocumentLoaderFactory = (identity: {
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
 * @param response The response to get the document from.
-* @param fetch The function to fetch the document.
+* @param fetch The function to fetch the document.  It is called with the URL
+*              of an alternate document, if any, after the response body has
+*              been either read or its cancellation has been started.
 * @param options The options for loading the document.
 * @returns The loaded remote document.
 * @throws {FetchError} If the response is not OK.
@@ -292,12 +294,6 @@ interface GetDocumentLoaderOptions extends DocumentLoaderFactoryOptions {
 * @returns The document loader.
 * @since 1.3.0
 */
-declare function getDocumentLoader({
-  allowPrivateAddress,
-  maxRedirection,
-  skipPreloadedContexts,
-  timeout,
-  userAgent
-}?: GetDocumentLoaderOptions): DocumentLoader;
+declare function getDocumentLoader(options?: GetDocumentLoaderOptions): DocumentLoader;
 //#endregion
 export { isTransientFetchError as _, DocumentLoaderOptions as a, getDocumentLoader as c, withDocumentLoaderTimeout as d, CreateRequestOptions as f, getUserAgent as g, createActivityPubRequest as h, DocumentLoaderFactoryOptions as i, getRemoteDocument as l, GetUserAgentOptions as m, DocumentLoader as n, GetDocumentLoaderOptions as o, FetchError as p, DocumentLoaderFactory as r, RemoteDocument as s, AuthenticatedDocumentLoaderFactory as t, resolveDocumentLoaderTimeout as u, logRequest as v };

package/dist/{docloader-BBnBpbsG.d.ts → docloader-DD6binpN.d.ts}

@@ -221,7 +221,9 @@ type AuthenticatedDocumentLoaderFactory = (identity: {
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
 * @param response The response to get the document from.
-* @param fetch The function to fetch the document.
+* @param fetch The function to fetch the document.  It is called with the URL
+*              of an alternate document, if any, after the response body has
+*              been either read or its cancellation has been started.
 * @param options The options for loading the document.
 * @returns The loaded remote document.
 * @throws {FetchError} If the response is not OK.
@@ -292,12 +294,6 @@ interface GetDocumentLoaderOptions extends DocumentLoaderFactoryOptions {
 * @returns The document loader.
 * @since 1.3.0
 */
-declare function getDocumentLoader({
-  allowPrivateAddress,
-  maxRedirection,
-  skipPreloadedContexts,
-  timeout,
-  userAgent
-}?: GetDocumentLoaderOptions): DocumentLoader;
+declare function getDocumentLoader(options?: GetDocumentLoaderOptions): DocumentLoader;
 //#endregion
 export { isTransientFetchError as _, DocumentLoaderOptions as a, getDocumentLoader as c, withDocumentLoaderTimeout as d, CreateRequestOptions as f, getUserAgent as g, createActivityPubRequest as h, DocumentLoaderFactoryOptions as i, getRemoteDocument as l, GetUserAgentOptions as m, DocumentLoader as n, GetDocumentLoaderOptions as o, FetchError as p, DocumentLoaderFactory as r, RemoteDocument as s, AuthenticatedDocumentLoaderFactory as t, resolveDocumentLoaderTimeout as u, logRequest as v };

package/dist/internal/jsonld-cache.cjs

@@ -1,6 +1,6 @@
 
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_url = require("../url-DrGTR8yv.cjs");
+const require_url = require("../url-DIKZnaJv.cjs");
 const require_jsonld = require("../jsonld.cjs");
 //#region src/internal/jsonld-cache.ts
 /**

package/dist/internal/jsonld-cache.d.cts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { n as DocumentLoader } from "../docloader-BBnBpbsG.cjs";
+import { n as DocumentLoader } from "../docloader-DD6binpN.cjs";
 
 //#region src/internal/jsonld-cache.d.ts
 /**

package/dist/internal/jsonld-cache.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { n as DocumentLoader } from "../docloader-BBnBpbsG.js";
+import { n as DocumentLoader } from "../docloader-DD6binpN.js";
 
 //#region src/internal/jsonld-cache.d.ts
 /**

package/dist/internal/jsonld-cache.js

@@ -1,5 +1,5 @@
 
-import { _ as parseIri, c as getFe34Origin, d as haveSameIriOrigin, o as formatIri, s as fromCompatibleEf61Id, u as haveSameFe34Origin } from "../url-Dzyp-NsC.js";
+import { b as parseIri, c as fromCompatibleEf61Id, d as haveSameFe34Origin, f as haveSameIriOrigin, l as getFe34Origin, s as formatIri } from "../url-mWveR5GA.js";
 import jsonld_default from "../jsonld.js";
 //#region src/internal/jsonld-cache.ts
 /**

package/dist/internal/portable-dereference.cjs

@@ -1,7 +1,7 @@
 
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_contexts = require("../contexts-B09jb9Pi.cjs");
-const require_url = require("../url-DrGTR8yv.cjs");
+const require_url = require("../url-DIKZnaJv.cjs");
 const require_jsonld = require("../jsonld.cjs");
 const require_internal_jsonld_cache = require("./jsonld-cache.cjs");
 let _logtape_logtape = require("@logtape/logtape");

package/dist/internal/portable-dereference.d.cts

@@ -1,6 +1,6 @@
 /// <reference lib="esnext.temporal" />
-import { n as DocumentLoader, s as RemoteDocument } from "../docloader-BBnBpbsG.cjs";
-import { r as PortableObjectVerifier } from "../portable-Dfvcg_Wy.cjs";
+import { n as DocumentLoader, s as RemoteDocument } from "../docloader-DD6binpN.cjs";
+import { r as PortableObjectVerifier } from "../portable-Cr7NwZwb.cjs";
 import { Span, TracerProvider } from "@opentelemetry/api";
 
 //#region src/internal/portable-dereference.d.ts

package/dist/internal/portable-dereference.d.ts

@@ -1,6 +1,6 @@
 /// <reference lib="esnext.temporal" />
-import { n as DocumentLoader, s as RemoteDocument } from "../docloader-BBnBpbsG.js";
-import { r as PortableObjectVerifier } from "../portable-BDydjp5H.js";
+import { n as DocumentLoader, s as RemoteDocument } from "../docloader-DD6binpN.js";
+import { r as PortableObjectVerifier } from "../portable-1VSnSJFj.js";
 import { Span, TracerProvider } from "@opentelemetry/api";
 
 //#region src/internal/portable-dereference.d.ts

package/dist/internal/portable-dereference.js

@@ -1,6 +1,6 @@
 
 import { t as preloadedContexts } from "../contexts-DWrj4AGR.js";
-import { _ as parseIri, h as parseGatewayOrigin, i as canonicalizePortableUri, o as formatIri, s as fromCompatibleEf61Id, t as GATEWAY_HINT_PARAMETER, u as haveSameFe34Origin, y as toCompatibleEf61Id } from "../url-Dzyp-NsC.js";
+import { C as toCompatibleEf61Id, a as canonicalizePortableUri, b as parseIri, c as fromCompatibleEf61Id, d as haveSameFe34Origin, s as formatIri, t as GATEWAY_HINT_PARAMETER, v as parseGatewayOrigin } from "../url-mWveR5GA.js";
 import jsonld_default from "../jsonld.js";
 import { createScopedContextLoader, registerDocumentLoaderWrapper, unwrapReleasedDocumentLoader } from "./jsonld-cache.js";
 import { getLogger } from "@logtape/logtape";

package/dist/internal.cjs

@@ -0,0 +1,6 @@
+
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_public_fetch = require("./public-fetch-Dvfvawei.cjs");
+exports.openDirectFetch = require_public_fetch.openDirectFetch;
+exports.openPublicFetch = require_public_fetch.openPublicFetch;
+exports.withPublicFetch = require_public_fetch.withPublicFetch;

package/dist/internal.d.cts

@@ -0,0 +1,108 @@
+/// <reference lib="esnext.temporal" />
+import { t as ResolvedAddress } from "./url-4EE56sNP.cjs";
+
+//#region src/public-fetch.d.ts
+/**
+* Options for {@link openPublicFetch} and {@link withPublicFetch}.
+*/
+interface PublicFetchOptions {
+  /**
+  * An `AbortSignal` for cancelling the DNS lookup.
+  */
+  readonly signal?: AbortSignal;
+  /**
+  * A function that resolves all addresses of a hostname, used instead of
+  * `node:dns.lookup()`.  The addresses it returns are validated in the same
+  * way as the default lookup's.
+  */
+  readonly lookup?: (hostname: string) => Promise<readonly ResolvedAddress[]>;
+}
+/**
+* A session for fetching resources from a single origin.  Its `fetch()`
+* connects only to the addresses validated when the session was opened, on
+* runtimes that support it.
+*/
+interface PublicFetchSession {
+  /**
+  * A copy of the URL the session was opened for.
+  */
+  readonly url: URL;
+  /**
+  * Fetches a resource from the session's origin.  Redirects are never
+  * followed; the redirect mode is always `"manual"`.
+  * @throws {TypeError} If the input's origin differs from the session's, or
+  *                     if the session is closed.
+  */
+  fetch(input: Request | URL | string, init?: RequestInit): Promise<Response>;
+  /**
+  * Closes the session.  The cancellation of response bodies that have been
+  * neither consumed nor cancelled is started (without waiting for it), and
+  * the session can no longer fetch.  Calling this more than once has no
+  * effect.
+  */
+  close(): Promise<void>;
+}
+/**
+* The functions created by {@link createPublicFetch}.
+*/
+interface PublicFetch {
+  /**
+  * Validates the URL, resolves its hostname, checks that every resolved
+  * address is public, and opens a session that connects only to those
+  * addresses.
+  * @param url The URL to open a session for.
+  * @param options The options.
+  * @returns The session.  It must be closed.
+  * @throws {UrlError} If the URL is not allowed, or its hostname cannot be
+  *                    resolved (with `reason: "dns"`).
+  */
+  openPublicFetch(url: URL | string, options?: PublicFetchOptions): Promise<PublicFetchSession>;
+  /**
+  * Opens a session with {@link PublicFetch.openPublicFetch}, runs the given
+  * function with its `fetch()`, and closes the session afterwards.
+  * @param url The URL to open a session for.
+  * @param fn The function to run.  It must not return a `Response`, since
+  *           the response bodies are cancelled when the session is closed.
+  * @param options The options.
+  * @returns The value returned by `fn`.
+  * @throws {UrlError} If the URL is not allowed.
+  * @throws {TypeError} If `fn` returns a `Response`.
+  */
+  withPublicFetch<T>(url: URL | string, fn: (fetch: PublicFetchSession["fetch"]) => Promise<T>, options?: PublicFetchOptions): Promise<T>;
+}
+/**
+* Validates the URL, resolves its hostname, checks that every resolved
+* address is public, and opens a session that connects only to those
+* addresses.  Connections are pinned on Node.js and Bun.  On other runtimes,
+* the session uses the global `fetch()` after the check.
+* @param url The URL to open a session for.
+* @param options The options.
+* @returns The session.  It must be closed.
+* @throws {UrlError} If the URL is not allowed, or its hostname cannot be
+*                    resolved (with `reason: "dns"`).
+*/
+declare const openPublicFetch: PublicFetch["openPublicFetch"];
+/**
+* Opens a session with {@link openPublicFetch}, runs the given function with
+* its `fetch()`, and closes the session afterwards.
+* @param url The URL to open a session for.
+* @param fn The function to run.  It must not return a `Response`, since
+*           the response bodies are cancelled when the session is closed.
+* @param options The options.
+* @returns The value returned by `fn`.
+* @throws {UrlError} If the URL is not allowed.
+* @throws {TypeError} If `fn` returns a `Response`.
+*/
+declare const withPublicFetch: PublicFetch["withPublicFetch"];
+/**
+* Opens a session that neither validates nor pins addresses, for callers that
+* allow private addresses.  It has the same rules as {@link openPublicFetch}
+* sessions otherwise: requests are limited to the URL's origin, redirects are
+* never followed, and unconsumed response bodies are cancelled on close.
+* It grants nothing beyond calling the global `fetch()` directly.
+* @param url The URL to open a session for.
+* @returns The session.  It must be closed.
+*/
+declare function openDirectFetch(url: URL | string): Promise<PublicFetchSession>;
+//#endregion
+export { type PublicFetchOptions, type PublicFetchSession, openDirectFetch, openPublicFetch, withPublicFetch };

package/dist/internal.d.ts

@@ -0,0 +1,108 @@
+/// <reference lib="esnext.temporal" />
+import { t as ResolvedAddress } from "./url-4EE56sNP.js";
+
+//#region src/public-fetch.d.ts
+/**
+* Options for {@link openPublicFetch} and {@link withPublicFetch}.
+*/
+interface PublicFetchOptions {
+  /**
+  * An `AbortSignal` for cancelling the DNS lookup.
+  */
+  readonly signal?: AbortSignal;
+  /**
+  * A function that resolves all addresses of a hostname, used instead of
+  * `node:dns.lookup()`.  The addresses it returns are validated in the same
+  * way as the default lookup's.
+  */
+  readonly lookup?: (hostname: string) => Promise<readonly ResolvedAddress[]>;
+}
+/**
+* A session for fetching resources from a single origin.  Its `fetch()`
+* connects only to the addresses validated when the session was opened, on
+* runtimes that support it.
+*/
+interface PublicFetchSession {
+  /**
+  * A copy of the URL the session was opened for.
+  */
+  readonly url: URL;
+  /**
+  * Fetches a resource from the session's origin.  Redirects are never
+  * followed; the redirect mode is always `"manual"`.
+  * @throws {TypeError} If the input's origin differs from the session's, or
+  *                     if the session is closed.
+  */
+  fetch(input: Request | URL | string, init?: RequestInit): Promise<Response>;
+  /**
+  * Closes the session.  The cancellation of response bodies that have been
+  * neither consumed nor cancelled is started (without waiting for it), and
+  * the session can no longer fetch.  Calling this more than once has no
+  * effect.
+  */
+  close(): Promise<void>;
+}
+/**
+* The functions created by {@link createPublicFetch}.
+*/
+interface PublicFetch {
+  /**
+  * Validates the URL, resolves its hostname, checks that every resolved
+  * address is public, and opens a session that connects only to those
+  * addresses.
+  * @param url The URL to open a session for.
+  * @param options The options.
+  * @returns The session.  It must be closed.
+  * @throws {UrlError} If the URL is not allowed, or its hostname cannot be
+  *                    resolved (with `reason: "dns"`).
+  */
+  openPublicFetch(url: URL | string, options?: PublicFetchOptions): Promise<PublicFetchSession>;
+  /**
+  * Opens a session with {@link PublicFetch.openPublicFetch}, runs the given
+  * function with its `fetch()`, and closes the session afterwards.
+  * @param url The URL to open a session for.
+  * @param fn The function to run.  It must not return a `Response`, since
+  *           the response bodies are cancelled when the session is closed.
+  * @param options The options.
+  * @returns The value returned by `fn`.
+  * @throws {UrlError} If the URL is not allowed.
+  * @throws {TypeError} If `fn` returns a `Response`.
+  */
+  withPublicFetch<T>(url: URL | string, fn: (fetch: PublicFetchSession["fetch"]) => Promise<T>, options?: PublicFetchOptions): Promise<T>;
+}
+/**
+* Validates the URL, resolves its hostname, checks that every resolved
+* address is public, and opens a session that connects only to those
+* addresses.  Connections are pinned on Node.js and Bun.  On other runtimes,
+* the session uses the global `fetch()` after the check.
+* @param url The URL to open a session for.
+* @param options The options.
+* @returns The session.  It must be closed.
+* @throws {UrlError} If the URL is not allowed, or its hostname cannot be
+*                    resolved (with `reason: "dns"`).
+*/
+declare const openPublicFetch: PublicFetch["openPublicFetch"];
+/**
+* Opens a session with {@link openPublicFetch}, runs the given function with
+* its `fetch()`, and closes the session afterwards.
+* @param url The URL to open a session for.
+* @param fn The function to run.  It must not return a `Response`, since
+*           the response bodies are cancelled when the session is closed.
+* @param options The options.
+* @returns The value returned by `fn`.
+* @throws {UrlError} If the URL is not allowed.
+* @throws {TypeError} If `fn` returns a `Response`.
+*/
+declare const withPublicFetch: PublicFetch["withPublicFetch"];
+/**
+* Opens a session that neither validates nor pins addresses, for callers that
+* allow private addresses.  It has the same rules as {@link openPublicFetch}
+* sessions otherwise: requests are limited to the URL's origin, redirects are
+* never followed, and unconsumed response bodies are cancelled on close.
+* It grants nothing beyond calling the global `fetch()` directly.
+* @param url The URL to open a session for.
+* @returns The session.  It must be closed.
+*/
+declare function openDirectFetch(url: URL | string): Promise<PublicFetchSession>;
+//#endregion
+export { type PublicFetchOptions, type PublicFetchSession, openDirectFetch, openPublicFetch, withPublicFetch };

package/dist/internal.js

@@ -0,0 +1,3 @@
+
+import { n as openPublicFetch, r as withPublicFetch, t as openDirectFetch } from "./public-fetch-ziZ39L5I.js";
+export { openDirectFetch, openPublicFetch, withPublicFetch };

package/dist/mod.cjs

@@ -2,7 +2,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-B7lfambq.cjs");
 const require_contexts = require("./contexts-B09jb9Pi.cjs");
-const require_url = require("./url-DrGTR8yv.cjs");
+const require_url = require("./url-DIKZnaJv.cjs");
+const require_public_fetch = require("./public-fetch-Dvfvawei.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 let node_process = require("node:process");
@@ -16,7 +17,7 @@ let _multiformats_base_x = require("@multiformats/base-x");
 _multiformats_base_x = require_rolldown_runtime.__toESM(_multiformats_base_x, 1);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.5.0-dev.2448+756933d0";
+var version = "2.5.0-dev.2494+f2e9b5d3";
 //#endregion
 //#region src/request.ts
 /**
@@ -525,7 +526,7 @@ async function bufferErrorResponse(response, url, signal) {
 		try {
 			await readBoundedBytes(response, MAX_ERROR_BODY_SIZE, url);
 		} catch (error) {
-			await clone.body?.cancel().catch(() => {});
+			clone.body?.cancel().catch(() => {});
 			if (signal?.aborted) throw error;
 			logger.debug("Failed to read the error response body from {url}: {error}", {
 				url,
@@ -557,14 +558,48 @@ async function bufferErrorResponse(response, url, signal) {
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
 * @param response The response to get the document from.
-* @param fetch The function to fetch the document.
+* @param fetch The function to fetch the document.  It is called with the URL
+*              of an alternate document, if any, after the response body has
+*              been either read or its cancellation has been started.
 * @param options The options for loading the document.
 * @returns The loaded remote document.
 * @throws {FetchError} If the response is not OK.
 * @internal
 */
 async function getRemoteDocument(url, response, fetch, options) {
-	const documentUrl = response.url === "" ? url : response.url;
+	const result = await parseRemoteDocument(url, response, options);
+	if ("alternate" in result) return await fetch(result.alternate, options);
+	return result.document;
+}
+/**
+* Starts cancelling the body of a response without waiting for it to settle.
+* The cancellation of a branch of a tee (e.g., a body cloned by a fetch mock)
+* settles only after the other branch is cancelled too, per the Streams
+* standard, so awaiting it could block forever.  Failures are only logged.
+* @param response The response whose body is cancelled.
+* @param url The URL of the response, for logging.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
+		});
+	});
+}
+/**
+* Gets a {@link RemoteDocument} from the given response, or the URL of an
+* alternate document to load instead.  When an alternate document is found,
+* the response body has been either read or its cancellation has been started
+* (without waiting for it), so that the alternate document can be loaded after
+* the response's session is closed.
+* @param url The URL of the document to load.
+* @param response The response to get the document from.
+* @returns The loaded remote document, or the alternate document URL.
+* @throws {FetchError} If the response is not OK.
+*/
+async function parseRemoteDocument(url, response, options) {
+	const documentUrl = url;
 	const docUrl = new URL(documentUrl);
 	if (!response.ok) {
 		if (options?.suppressError) logger.warn("Failed to fetch document: {status} {url} {headers}", {
@@ -606,7 +641,8 @@ async function getRemoteDocument(url, response, fetch, options) {
 						alternateUrl: altUri.href,
 						url: documentUrl
 					});
-					return await fetch(altUri.href, options);
+					cancelResponseBody(response, documentUrl);
+					return { alternate: altUri.href };
 				}
 			}
 		}
@@ -642,7 +678,7 @@ async function getRemoteDocument(url, response, fetch, options) {
 					alternateUrl: attribs.href,
 					url: documentUrl
 				});
-				return await fetch(new URL(attribs.href, docUrl).href, options);
+				return { alternate: new URL(attribs.href, docUrl).href };
 			}
 		}
 		try {
@@ -657,11 +693,11 @@ async function getRemoteDocument(url, response, fetch, options) {
 		url: documentUrl,
 		headers: Object.fromEntries(response.headers.entries())
 	});
-	return {
+	return { document: {
 		contextUrl,
 		document,
 		documentUrl
-	};
+	} };
 }
 /**
 * Resolves {@link DocumentLoaderFactoryOptions.timeout} into milliseconds.
@@ -766,10 +802,59 @@ function withDocumentLoaderTimeout(loader, timeout) {
 * @returns The document loader.
 * @since 1.3.0
 */
-function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedContexts, timeout, userAgent } = {}) {
+function getDocumentLoader(options = {}) {
+	return createDocumentLoader(options);
+}
+/**
+* The implementation of {@link getDocumentLoader}, with injectable
+* dependencies.  This is not exported from any entry point.
+* @param options Options for the document loader.
+* @param deps The dependencies.
+* @returns The document loader.
+*/
+function createDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedContexts, timeout, userAgent } = {}, deps = {}) {
 	const resolvedTimeout = resolveDocumentLoaderTimeout(timeout);
 	const tracer = _opentelemetry_api.trace.getTracerProvider().getTracer(name, version);
 	const maximumRedirection = maxRedirection ?? DEFAULT_MAX_REDIRECTION;
+	async function openHop(url, options) {
+		try {
+			const session = deps.openHop != null ? await deps.openHop(url) : allowPrivateAddress ? await require_public_fetch.openDirectFetch(url) : await require_public_fetch.openPublicFetch(url, { signal: options?.signal });
+			if (options?.signal?.aborted) {
+				await session.close();
+				options.signal.throwIfAborted();
+			}
+			return session;
+		} catch (error) {
+			if (error instanceof require_url.UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+				url,
+				error
+			});
+			else logger[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	async function fetchHop(session, url, span, options) {
+		try {
+			const request = createActivityPubRequest(url, { userAgent });
+			logRequest(logger, request);
+			const response = await session.fetch(request, {
+				redirect: "manual",
+				signal: options?.signal
+			});
+			span.setAttribute("http.response.status_code", response.status);
+			if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+				const location = response.headers.get("Location");
+				cancelResponseBody(response, url);
+				return { location };
+			}
+			return await parseRemoteDocument(url, response, options);
+		} finally {
+			await session.close();
+		}
+	}
 	async function load(url, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
 		options?.signal?.throwIfAborted();
 		const parsedUrl = new URL(url);
@@ -784,36 +869,15 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 				documentUrl: currentUrl
 			};
 		}
-		if (!allowPrivateAddress) {
-			try {
-				await require_url.validatePublicUrl(currentUrl);
-			} catch (error) {
-				if (error instanceof require_url.UrlError) if (error.reason === "dns") logger.debug("DNS lookup failed for {url}", {
-					url: currentUrl,
-					error
-				});
-				else logger[options?.suppressError ? "warn" : "error"]("Disallowed private URL: {url}", {
-					url: currentUrl,
-					error
-				});
-				throw error;
-			}
-			options?.signal?.throwIfAborted();
-		}
+		const session = await openHop(currentUrl, options);
 		visited.add(currentUrl);
 		return await tracer.startActiveSpan("activitypub.fetch_document", {
 			kind: _opentelemetry_api.SpanKind.CLIENT,
 			attributes: { "url.full": currentUrl }
 		}, async (span) => {
 			try {
-				const request = createActivityPubRequest(currentUrl, { userAgent });
-				logRequest(logger, request);
-				const response = await fetch(request, {
-					redirect: "manual",
-					signal: options?.signal
-				});
-				span.setAttribute("http.response.status_code", response.status);
-				if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+				const outcome = await fetchHop(session, currentUrl, span, options);
+				if ("location" in outcome) {
 					if (redirected >= maximumRedirection) {
 						logger[options?.suppressError ? "warn" : "error"]("Too many redirections ({redirections}) while fetching document.", {
 							redirections: redirected + 1,
@@ -821,7 +885,7 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 						});
 						throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
 					}
-					const redirectUrl = new URL(response.headers.get("Location"), response.url === "" ? currentUrl : response.url).href;
+					const redirectUrl = new URL(outcome.location, currentUrl).href;
 					span.setAttribute("http.redirect.url", redirectUrl);
 					if (visited.has(redirectUrl)) {
 						logger[options?.suppressError ? "warn" : "error"]("Detected a redirect loop while fetching document: {url} -> {redirectUrl}", {
@@ -832,12 +896,14 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 					}
 					return await load(redirectUrl, options, redirected + 1, visited);
 				}
-				const result = await getRemoteDocument(currentUrl, response, async (alternateUrl) => {
+				let result;
+				if ("alternate" in outcome) {
+					const alternateUrl = outcome.alternate;
 					options?.signal?.throwIfAborted();
 					if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(currentUrl, `Too many redirections (${redirected + 1})`);
 					if (visited.has(alternateUrl)) throw new FetchError(currentUrl, `Redirect loop detected: ${alternateUrl}`);
-					return await load(alternateUrl, options, redirected + 1, visited);
-				}, options);
+					result = await load(alternateUrl, options, redirected + 1, visited);
+				} else result = outcome.document;
 				span.setAttribute("docloader.document_url", result.documentUrl);
 				if (result.contextUrl != null) span.setAttribute("docloader.context_url", result.contextUrl);
 				return result;