@fedify/vocab-runtime 2.5.0-dev.2448 → 2.5.0-dev.2494

package/dist/tests/internal/portable-dereference.test.cjs

@@ -1,6 +1,6 @@
-const require_url = require("../url-BNakuZ8k.cjs");
-const require_jsonld_cache = require("../jsonld-cache-BEXiiM-V.cjs");
-const require_portable_dereference = require("../portable-dereference-DaTBBvCj.cjs");
+const require_url = require("../url-Bdj-rTcC.cjs");
+const require_jsonld_cache = require("../jsonld-cache-DKIWKxEX.cjs");
+const require_portable_dereference = require("../portable-dereference-BUoDzMxk.cjs");
 let node_assert_strict = require("node:assert/strict");
 let node_test = require("node:test");
 //#region src/internal/portable-dereference.test.ts

package/dist/tests/internal/portable-dereference.test.mjs

@@ -1,6 +1,6 @@
-import { S as withGatewayHints, _ as parseIri } from "../url-DMxmp7ZG.mjs";
-import { n as createScopedContextLoader } from "../jsonld-cache-DFnWsLuZ.mjs";
-import { a as recordPortableReferrer, i as isPortableIri, n as getPortableGatewayCandidates, r as getReferrerGateways, t as createSnapshotContextLoader } from "../portable-dereference-sGRs_qdT.mjs";
+import { E as withGatewayHints, b as parseIri } from "../url-COj5Q8mb.mjs";
+import { n as createScopedContextLoader } from "../jsonld-cache-KH40z9_7.mjs";
+import { a as recordPortableReferrer, i as isPortableIri, n as getPortableGatewayCandidates, r as getReferrerGateways, t as createSnapshotContextLoader } from "../portable-dereference-Du2k3ngE.mjs";
 import { deepStrictEqual, ok, throws } from "node:assert/strict";
 import { test } from "node:test";
 //#region src/internal/portable-dereference.test.ts

package/dist/tests/{jsonld-cache-BEXiiM-V.cjs → jsonld-cache-DKIWKxEX.cjs}

@@ -1,4 +1,4 @@
-const require_url = require("./url-BNakuZ8k.cjs");
+const require_url = require("./url-Bdj-rTcC.cjs");
 const require_jsonld = require("./jsonld-CmDhHNTx.cjs");
 //#region src/internal/jsonld-cache.ts
 /**

package/dist/tests/{jsonld-cache-DFnWsLuZ.mjs → jsonld-cache-KH40z9_7.mjs}

@@ -1,4 +1,4 @@
-import { _ as parseIri, c as getFe34Origin, d as haveSameIriOrigin, o as formatIri, s as fromCompatibleEf61Id, u as haveSameFe34Origin } from "./url-DMxmp7ZG.mjs";
+import { b as parseIri, c as fromCompatibleEf61Id, d as haveSameFe34Origin, f as haveSameIriOrigin, l as getFe34Origin, s as formatIri } from "./url-COj5Q8mb.mjs";
 import { t as jsonld_default } from "./jsonld-DweIJ07b.mjs";
 //#region src/internal/jsonld-cache.ts
 /**

package/dist/tests/jsonld-cache.test.cjs

@@ -1,6 +1,6 @@
-const require_url = require("./url-BNakuZ8k.cjs");
+const require_url = require("./url-Bdj-rTcC.cjs");
 const require_jsonld = require("./jsonld-CmDhHNTx.cjs");
-const require_jsonld_cache = require("./jsonld-cache-BEXiiM-V.cjs");
+const require_jsonld_cache = require("./jsonld-cache-DKIWKxEX.cjs");
 let node_test = require("node:test");
 let node_assert = require("node:assert");
 //#region src/jsonld-cache.test.ts

package/dist/tests/jsonld-cache.test.mjs

@@ -1,6 +1,6 @@
-import { _ as parseIri } from "./url-DMxmp7ZG.mjs";
+import { b as parseIri } from "./url-COj5Q8mb.mjs";
 import { t as jsonld_default } from "./jsonld-DweIJ07b.mjs";
-import { a as isTrustedIriOrigin, i as getPortableActorGateways, o as normalizeJsonLdIris, r as getJsonLdContext, t as compactJsonLdCache } from "./jsonld-cache-DFnWsLuZ.mjs";
+import { a as isTrustedIriOrigin, i as getPortableActorGateways, o as normalizeJsonLdIris, r as getJsonLdContext, t as compactJsonLdCache } from "./jsonld-cache-KH40z9_7.mjs";
 import { test } from "node:test";
 import { deepStrictEqual, ok, strictEqual } from "node:assert";
 //#region src/jsonld-cache.test.ts

package/dist/tests/node-CbBR-th-.mjs

@@ -0,0 +1,84 @@
+import { n as UrlError } from "./url-COj5Q8mb.mjs";
+import { n as redeemPinGrant } from "./pin-grant-H5XhM1Xs.mjs";
+import { isIP } from "node:net";
+//#region src/pinners/node.ts
+/**
+* Creates a pinner for Node.js.  Every request is sent through the global
+* `fetch()` with an undici `Agent` as the `dispatcher`.  The agent's
+* `connect.lookup` answers only with the addresses of live grants for
+* the hostname, checking each of them again right before connecting, and
+* fails when there are none, so a connection can never be made to an address
+* that was not validated.
+*
+* The agent is shared by the requests of all grants, so keep-alive
+* connections are reused.  A pooled connection was made to an address of
+* a grant that was valid when it was connected, so reusing it from another
+* session of the same origin still reaches a validated address.  Response
+* bodies have to be consumed or cancelled for their connections to return to
+* the pool, which sessions do when they are closed.
+*
+* Since the dispatcher is passed explicitly, neither proxy environment
+* variables nor the global dispatcher (e.g., `NODE_USE_ENV_PROXY=1`) apply.
+* @param options The pinner options.
+* @returns The pinner.
+*/
+function createNodePinner({ verifyAddress, undici }) {
+	const grants = /* @__PURE__ */ new Map();
+	function lookup(hostname, options, callback) {
+		let addresses;
+		try {
+			addresses = getGrantedAddresses(hostname, options.family);
+		} catch (error) {
+			callback(error, []);
+			return;
+		}
+		if (options.all) callback(null, addresses);
+		else callback(null, addresses[0].address, addresses[0].family);
+	}
+	function getGrantedAddresses(hostname, family) {
+		const addresses = /* @__PURE__ */ new Map();
+		for (const [grant, record] of grants.get(hostname) ?? []) {
+			try {
+				redeemPinGrant(grant, new URL(record.origin));
+			} catch {
+				continue;
+			}
+			for (const address of record.addresses) addresses.set(address.address, address);
+		}
+		const familyNumber = family === "IPv4" ? 4 : family === "IPv6" ? 6 : typeof family === "number" ? family : 0;
+		const result = [...addresses.values()].filter((address) => familyNumber === 0 || address.family === familyNumber);
+		if (result.length < 1) throw new UrlError(`No validated address to connect to: ${hostname}`);
+		for (const address of result) verifyAddress(address);
+		return result;
+	}
+	const agent = new undici.Agent({ connect: { lookup } });
+	return {
+		supports(url) {
+			return url.protocol === "http:" || url.protocol === "https:";
+		},
+		async fetch(grant, request, signal) {
+			const record = redeemPinGrant(grant, new URL(request.url));
+			if (isIP(record.hostname) !== 0) for (const address of record.addresses) verifyAddress(address);
+			let registered = grants.get(record.hostname);
+			if (registered == null) {
+				registered = /* @__PURE__ */ new Map();
+				grants.set(record.hostname, registered);
+			}
+			registered.set(grant, record);
+			return await fetch(request, {
+				redirect: "manual",
+				signal: signal == null || signal === request.signal ? request.signal : AbortSignal.any([signal, request.signal]),
+				dispatcher: agent
+			});
+		},
+		release(grant) {
+			for (const [hostname, registered] of grants) {
+				if (!registered.delete(grant)) continue;
+				if (registered.size < 1) grants.delete(hostname);
+				break;
+			}
+		}
+	};
+}
+//#endregion
+export { createNodePinner as t };

package/dist/tests/node-Ch29PDXR.cjs

@@ -0,0 +1,89 @@
+const require_url = require("./url-Bdj-rTcC.cjs");
+const require_pin_grant = require("./pin-grant-CPrpk1l4.cjs");
+let node_net = require("node:net");
+//#region src/pinners/node.ts
+/**
+* Creates a pinner for Node.js.  Every request is sent through the global
+* `fetch()` with an undici `Agent` as the `dispatcher`.  The agent's
+* `connect.lookup` answers only with the addresses of live grants for
+* the hostname, checking each of them again right before connecting, and
+* fails when there are none, so a connection can never be made to an address
+* that was not validated.
+*
+* The agent is shared by the requests of all grants, so keep-alive
+* connections are reused.  A pooled connection was made to an address of
+* a grant that was valid when it was connected, so reusing it from another
+* session of the same origin still reaches a validated address.  Response
+* bodies have to be consumed or cancelled for their connections to return to
+* the pool, which sessions do when they are closed.
+*
+* Since the dispatcher is passed explicitly, neither proxy environment
+* variables nor the global dispatcher (e.g., `NODE_USE_ENV_PROXY=1`) apply.
+* @param options The pinner options.
+* @returns The pinner.
+*/
+function createNodePinner({ verifyAddress, undici }) {
+	const grants = /* @__PURE__ */ new Map();
+	function lookup(hostname, options, callback) {
+		let addresses;
+		try {
+			addresses = getGrantedAddresses(hostname, options.family);
+		} catch (error) {
+			callback(error, []);
+			return;
+		}
+		if (options.all) callback(null, addresses);
+		else callback(null, addresses[0].address, addresses[0].family);
+	}
+	function getGrantedAddresses(hostname, family) {
+		const addresses = /* @__PURE__ */ new Map();
+		for (const [grant, record] of grants.get(hostname) ?? []) {
+			try {
+				require_pin_grant.redeemPinGrant(grant, new URL(record.origin));
+			} catch {
+				continue;
+			}
+			for (const address of record.addresses) addresses.set(address.address, address);
+		}
+		const familyNumber = family === "IPv4" ? 4 : family === "IPv6" ? 6 : typeof family === "number" ? family : 0;
+		const result = [...addresses.values()].filter((address) => familyNumber === 0 || address.family === familyNumber);
+		if (result.length < 1) throw new require_url.UrlError(`No validated address to connect to: ${hostname}`);
+		for (const address of result) verifyAddress(address);
+		return result;
+	}
+	const agent = new undici.Agent({ connect: { lookup } });
+	return {
+		supports(url) {
+			return url.protocol === "http:" || url.protocol === "https:";
+		},
+		async fetch(grant, request, signal) {
+			const record = require_pin_grant.redeemPinGrant(grant, new URL(request.url));
+			if ((0, node_net.isIP)(record.hostname) !== 0) for (const address of record.addresses) verifyAddress(address);
+			let registered = grants.get(record.hostname);
+			if (registered == null) {
+				registered = /* @__PURE__ */ new Map();
+				grants.set(record.hostname, registered);
+			}
+			registered.set(grant, record);
+			return await fetch(request, {
+				redirect: "manual",
+				signal: signal == null || signal === request.signal ? request.signal : AbortSignal.any([signal, request.signal]),
+				dispatcher: agent
+			});
+		},
+		release(grant) {
+			for (const [hostname, registered] of grants) {
+				if (!registered.delete(grant)) continue;
+				if (registered.size < 1) grants.delete(hostname);
+				break;
+			}
+		}
+	};
+}
+//#endregion
+Object.defineProperty(exports, "createNodePinner", {
+	enumerable: true,
+	get: function() {
+		return createNodePinner;
+	}
+});

package/dist/tests/pin-grant-CPrpk1l4.cjs

@@ -0,0 +1,70 @@
+//#region src/pin-grant.ts
+const grants = /* @__PURE__ */ new WeakMap();
+/**
+* Issues a grant for the given URL's origin and addresses.  This does not
+* validate the addresses; callers validate them before issuing, and pinners
+* validate them again right before connecting.
+* @param url The URL whose origin the grant is bound to.
+* @param addresses The addresses to connect to.
+* @returns A new grant.
+*/
+function issuePinGrant(url, addresses) {
+	const grant = Object.freeze(Object.create(null));
+	let hostname = url.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	const record = Object.freeze({
+		origin: url.origin,
+		hostname,
+		addresses: Object.freeze(addresses.map(({ address, family }) => Object.freeze({
+			address,
+			family
+		})))
+	});
+	grants.set(grant, {
+		record,
+		revoked: false
+	});
+	return grant;
+}
+/**
+* Checks that the given grant was issued by {@link issuePinGrant}, has not
+* been revoked, and was issued for the origin of the given URL.
+* @param grant The grant to redeem.
+* @param url The URL to connect to.
+* @returns What the grant stands for.
+* @throws {TypeError} If the grant cannot be used for the URL.
+*/
+function redeemPinGrant(grant, url) {
+	const state = typeof grant === "object" && grant !== null ? grants.get(grant) : void 0;
+	if (state == null) throw new TypeError("Invalid pin grant.");
+	if (state.revoked) throw new TypeError("The pin grant has been revoked.");
+	if (url.origin !== state.record.origin) throw new TypeError(`The pin grant for ${state.record.origin} cannot be used for ${url.origin}.`);
+	return state.record;
+}
+/**
+* Revokes the given grant so that it can no longer be redeemed.
+* @param grant The grant to revoke.
+*/
+function revokePinGrant(grant) {
+	const state = grants.get(grant);
+	if (state != null) state.revoked = true;
+}
+//#endregion
+Object.defineProperty(exports, "issuePinGrant", {
+	enumerable: true,
+	get: function() {
+		return issuePinGrant;
+	}
+});
+Object.defineProperty(exports, "redeemPinGrant", {
+	enumerable: true,
+	get: function() {
+		return redeemPinGrant;
+	}
+});
+Object.defineProperty(exports, "revokePinGrant", {
+	enumerable: true,
+	get: function() {
+		return revokePinGrant;
+	}
+});

package/dist/tests/pin-grant-H5XhM1Xs.mjs

@@ -0,0 +1,53 @@
+//#region src/pin-grant.ts
+const grants = /* @__PURE__ */ new WeakMap();
+/**
+* Issues a grant for the given URL's origin and addresses.  This does not
+* validate the addresses; callers validate them before issuing, and pinners
+* validate them again right before connecting.
+* @param url The URL whose origin the grant is bound to.
+* @param addresses The addresses to connect to.
+* @returns A new grant.
+*/
+function issuePinGrant(url, addresses) {
+	const grant = Object.freeze(Object.create(null));
+	let hostname = url.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	const record = Object.freeze({
+		origin: url.origin,
+		hostname,
+		addresses: Object.freeze(addresses.map(({ address, family }) => Object.freeze({
+			address,
+			family
+		})))
+	});
+	grants.set(grant, {
+		record,
+		revoked: false
+	});
+	return grant;
+}
+/**
+* Checks that the given grant was issued by {@link issuePinGrant}, has not
+* been revoked, and was issued for the origin of the given URL.
+* @param grant The grant to redeem.
+* @param url The URL to connect to.
+* @returns What the grant stands for.
+* @throws {TypeError} If the grant cannot be used for the URL.
+*/
+function redeemPinGrant(grant, url) {
+	const state = typeof grant === "object" && grant !== null ? grants.get(grant) : void 0;
+	if (state == null) throw new TypeError("Invalid pin grant.");
+	if (state.revoked) throw new TypeError("The pin grant has been revoked.");
+	if (url.origin !== state.record.origin) throw new TypeError(`The pin grant for ${state.record.origin} cannot be used for ${url.origin}.`);
+	return state.record;
+}
+/**
+* Revokes the given grant so that it can no longer be redeemed.
+* @param grant The grant to revoke.
+*/
+function revokePinGrant(grant) {
+	const state = grants.get(grant);
+	if (state != null) state.revoked = true;
+}
+//#endregion
+export { redeemPinGrant as n, revokePinGrant as r, issuePinGrant as t };

package/dist/tests/pin-grant.test.cjs

@@ -0,0 +1,87 @@
+const require_pin_grant = require("./pin-grant-CPrpk1l4.cjs");
+let node_assert = require("node:assert");
+let _fedify_fixture = require("@fedify/fixture");
+//#region src/pin-grant.test.ts
+const addresses = [{
+	address: "8.8.8.8",
+	family: 4
+}, {
+	address: "2001:4860:4860::8888",
+	family: 6
+}];
+(0, _fedify_fixture.test)("redeemPinGrant() returns what the grant was issued for", () => {
+	const url = new URL("https://pinned-host.invalid:8443/path?query");
+	const input = addresses.map((address) => ({ ...address }));
+	const grant = require_pin_grant.issuePinGrant(url, input);
+	const record = require_pin_grant.redeemPinGrant(grant, url);
+	(0, node_assert.deepStrictEqual)(record.origin, "https://pinned-host.invalid:8443");
+	(0, node_assert.deepStrictEqual)(record.hostname, "pinned-host.invalid");
+	(0, node_assert.deepStrictEqual)(record.addresses, addresses);
+	input[0].address = "127.0.0.1";
+	input.push({
+		address: "10.0.0.1",
+		family: 4
+	});
+	(0, node_assert.deepStrictEqual)(require_pin_grant.redeemPinGrant(grant, url).addresses, addresses);
+	(0, node_assert.ok)(Object.isFrozen(record));
+	(0, node_assert.ok)(Object.isFrozen(record.addresses));
+	(0, node_assert.ok)(Object.isFrozen(record.addresses[0]));
+	(0, node_assert.strictEqual)(require_pin_grant.redeemPinGrant(grant, new URL("https://pinned-host.invalid:8443/other")), record);
+});
+(0, _fedify_fixture.test)("redeemPinGrant() strips brackets from IPv6 hostnames", () => {
+	const url = new URL("http://[2001:4860:4860::8888]/");
+	const record = require_pin_grant.redeemPinGrant(require_pin_grant.issuePinGrant(url, [addresses[1]]), url);
+	(0, node_assert.deepStrictEqual)(record.hostname, "2001:4860:4860::8888");
+	(0, node_assert.deepStrictEqual)(record.origin, "http://[2001:4860:4860::8888]");
+});
+(0, _fedify_fixture.test)("redeemPinGrant() rejects grants not issued by issuePinGrant()", () => {
+	const url = new URL("https://pinned-host.invalid/");
+	const issued = require_pin_grant.issuePinGrant(url, addresses);
+	const forgeries = {
+		"object literal": {},
+		"null-prototype object": Object.create(null),
+		"frozen null-prototype object": Object.freeze(Object.create(null)),
+		"copy of a grant": { ...issued },
+		"structured clone of a grant": structuredClone(issued),
+		"object inheriting from a grant": Object.create(issued),
+		"null": null,
+		"undefined": void 0,
+		"string": "grant"
+	};
+	for (const [name, forgery] of Object.entries(forgeries)) (0, node_assert.throws)(() => require_pin_grant.redeemPinGrant(forgery, url), TypeError, name);
+	(0, node_assert.ok)(require_pin_grant.redeemPinGrant(issued, url));
+});
+(0, _fedify_fixture.test)("redeemPinGrant() rejects URLs of other origins", () => {
+	const grant = require_pin_grant.issuePinGrant(new URL("https://pinned-host.invalid/"), addresses);
+	for (const url of [
+		"http://pinned-host.invalid/",
+		"https://other-host.invalid/",
+		"https://sub.pinned-host.invalid/",
+		"https://pinned-host.invalid:8443/",
+		"https://8.8.8.8/"
+	]) (0, node_assert.throws)(() => require_pin_grant.redeemPinGrant(grant, new URL(url)), TypeError, url);
+	(0, node_assert.ok)(require_pin_grant.redeemPinGrant(grant, new URL("https://pinned-host.invalid:443/")));
+});
+(0, _fedify_fixture.test)("redeemPinGrant() rejects revoked grants", () => {
+	const url = new URL("https://pinned-host.invalid/");
+	const grant = require_pin_grant.issuePinGrant(url, addresses);
+	const other = require_pin_grant.issuePinGrant(url, addresses);
+	require_pin_grant.revokePinGrant(grant);
+	(0, node_assert.throws)(() => require_pin_grant.redeemPinGrant(grant, url), TypeError);
+	require_pin_grant.revokePinGrant(grant);
+	(0, node_assert.throws)(() => require_pin_grant.redeemPinGrant(grant, url), TypeError);
+	(0, node_assert.ok)(require_pin_grant.redeemPinGrant(other, url));
+});
+(0, _fedify_fixture.test)("revokePinGrant() ignores unknown objects", () => {
+	require_pin_grant.revokePinGrant({});
+	require_pin_grant.revokePinGrant(Object.create(null));
+});
+(0, _fedify_fixture.test)("issuePinGrant() returns a distinct frozen object every time", () => {
+	const url = new URL("https://pinned-host.invalid/");
+	const a = require_pin_grant.issuePinGrant(url, addresses);
+	(0, node_assert.ok)(a !== require_pin_grant.issuePinGrant(url, addresses));
+	(0, node_assert.ok)(Object.isFrozen(a));
+	(0, node_assert.strictEqual)(Object.getPrototypeOf(a), null);
+	(0, node_assert.deepStrictEqual)(Reflect.ownKeys(a), []);
+});
+//#endregion

package/dist/tests/pin-grant.test.d.cts

@@ -0,0 +1 @@
+export { };

package/dist/tests/pin-grant.test.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/tests/pin-grant.test.mjs

@@ -0,0 +1,88 @@
+import { n as redeemPinGrant, r as revokePinGrant, t as issuePinGrant } from "./pin-grant-H5XhM1Xs.mjs";
+import { deepStrictEqual, ok, strictEqual, throws } from "node:assert";
+import { test } from "@fedify/fixture";
+//#region src/pin-grant.test.ts
+const addresses = [{
+	address: "8.8.8.8",
+	family: 4
+}, {
+	address: "2001:4860:4860::8888",
+	family: 6
+}];
+test("redeemPinGrant() returns what the grant was issued for", () => {
+	const url = new URL("https://pinned-host.invalid:8443/path?query");
+	const input = addresses.map((address) => ({ ...address }));
+	const grant = issuePinGrant(url, input);
+	const record = redeemPinGrant(grant, url);
+	deepStrictEqual(record.origin, "https://pinned-host.invalid:8443");
+	deepStrictEqual(record.hostname, "pinned-host.invalid");
+	deepStrictEqual(record.addresses, addresses);
+	input[0].address = "127.0.0.1";
+	input.push({
+		address: "10.0.0.1",
+		family: 4
+	});
+	deepStrictEqual(redeemPinGrant(grant, url).addresses, addresses);
+	ok(Object.isFrozen(record));
+	ok(Object.isFrozen(record.addresses));
+	ok(Object.isFrozen(record.addresses[0]));
+	strictEqual(redeemPinGrant(grant, new URL("https://pinned-host.invalid:8443/other")), record);
+});
+test("redeemPinGrant() strips brackets from IPv6 hostnames", () => {
+	const url = new URL("http://[2001:4860:4860::8888]/");
+	const record = redeemPinGrant(issuePinGrant(url, [addresses[1]]), url);
+	deepStrictEqual(record.hostname, "2001:4860:4860::8888");
+	deepStrictEqual(record.origin, "http://[2001:4860:4860::8888]");
+});
+test("redeemPinGrant() rejects grants not issued by issuePinGrant()", () => {
+	const url = new URL("https://pinned-host.invalid/");
+	const issued = issuePinGrant(url, addresses);
+	const forgeries = {
+		"object literal": {},
+		"null-prototype object": Object.create(null),
+		"frozen null-prototype object": Object.freeze(Object.create(null)),
+		"copy of a grant": { ...issued },
+		"structured clone of a grant": structuredClone(issued),
+		"object inheriting from a grant": Object.create(issued),
+		"null": null,
+		"undefined": void 0,
+		"string": "grant"
+	};
+	for (const [name, forgery] of Object.entries(forgeries)) throws(() => redeemPinGrant(forgery, url), TypeError, name);
+	ok(redeemPinGrant(issued, url));
+});
+test("redeemPinGrant() rejects URLs of other origins", () => {
+	const grant = issuePinGrant(new URL("https://pinned-host.invalid/"), addresses);
+	for (const url of [
+		"http://pinned-host.invalid/",
+		"https://other-host.invalid/",
+		"https://sub.pinned-host.invalid/",
+		"https://pinned-host.invalid:8443/",
+		"https://8.8.8.8/"
+	]) throws(() => redeemPinGrant(grant, new URL(url)), TypeError, url);
+	ok(redeemPinGrant(grant, new URL("https://pinned-host.invalid:443/")));
+});
+test("redeemPinGrant() rejects revoked grants", () => {
+	const url = new URL("https://pinned-host.invalid/");
+	const grant = issuePinGrant(url, addresses);
+	const other = issuePinGrant(url, addresses);
+	revokePinGrant(grant);
+	throws(() => redeemPinGrant(grant, url), TypeError);
+	revokePinGrant(grant);
+	throws(() => redeemPinGrant(grant, url), TypeError);
+	ok(redeemPinGrant(other, url));
+});
+test("revokePinGrant() ignores unknown objects", () => {
+	revokePinGrant({});
+	revokePinGrant(Object.create(null));
+});
+test("issuePinGrant() returns a distinct frozen object every time", () => {
+	const url = new URL("https://pinned-host.invalid/");
+	const a = issuePinGrant(url, addresses);
+	ok(a !== issuePinGrant(url, addresses));
+	ok(Object.isFrozen(a));
+	strictEqual(Object.getPrototypeOf(a), null);
+	deepStrictEqual(Reflect.ownKeys(a), []);
+});
+//#endregion
+export {};