@uncefact/untp-utils 0.1.0 → 0.2.0

package/build/validation/validate-jsonld.d.ts

@@ -0,0 +1,33 @@
+import type { TtlCache } from '../cache/ttl-cache.js';
+import type { LoadedRemoteDocument } from '../loaders/jsonld-document-loader.js';
+export interface ValidateJsonLdOptions {
+    /** Whether to use safe mode for JSON-LD expansion. Defaults to true. */
+    safe?: boolean;
+    /**
+     * Optional cache, keyed by URL, for resolved remote `@context` documents.
+     * Supplying a shared cache avoids re-fetching the same contexts on every
+     * validation (e.g. the credential context on the issuance/verification
+     * hot path). Only successful fetches are cached, so a URL the SSRF guard
+     * rejects is re-checked every time. A successfully fetched and parsed
+     * document is cached even if expansion later rejects it.
+     */
+    contextCache?: TtlCache<LoadedRemoteDocument>;
+}
+/**
+ * Catches malformed contexts, undefined terms, and structurally invalid
+ * linked data by expanding to RDF in safe mode (unless explicitly disabled).
+ *
+ * Expansion resolves every remote `@context` through a guarded document
+ * loader ({@link createJsonLdDocumentLoader}) so `@context` fetches pass the
+ * `validatePublicUrl` SSRF guard rather than jsonld.js's default unguarded
+ * Node loader. See ADR-033 §7 and issue #707.
+ *
+ * @see https://github.com/digitalbazaar/jsonld.js#safe-mode jsonld.js safe mode (a jsonld.js option, not a W3C-defined term).
+ * @see ../../../../docs/adrs/033-cvc-architecture.md ADR-033 §7 (Security considerations).
+ * @throws {JsonLdInvalidShapeError} if `document` is not a non-null object.
+ * @throws {JsonLdExpansionFailedError} if `jsonld.toRDF` rejects (which
+ *   includes a remote `@context` failing the SSRF guard; the guard's
+ *   rejection is reachable via native `.cause` hops off the thrown error,
+ *   see {@link rehydrateJsonLdCause}).
+ */
+export declare function validateJsonLd(document: unknown, options?: ValidateJsonLdOptions): Promise<void>;

package/build/validation/validate-jsonld.js

@@ -0,0 +1,99 @@
+import { JsonLdExpansionFailedError, JsonLdInvalidShapeError } from './errors.js';
+/**
+ * jsonld.js's own `JsonLdError` wraps a document loader's rejection in the
+ * proprietary `details.cause` and never sets native `Error.cause`
+ * (jsonld@8.3.3 `lib/JsonLdError.js`, loader wrap in
+ * `lib/ContextResolver.js`), so a plain `.cause` walk over a caught
+ * expansion failure dead-ends one hop early: the SSRF guard's rejection
+ * (see `createJsonLdDocumentLoader`) is reachable only via the non-standard
+ * `error.details.cause`, unlike the schema-fetch path (`schema-loader.ts`),
+ * which surfaces the same class of rejection on the native chain.
+ *
+ * A term's own remote `@context` (a JSON-LD 1.1 "scoped context") loses even
+ * that: jsonld.js resolves it through the same loader, but on failure its
+ * scoped-context branch (`lib/context.js`) discards the loader's error
+ * entirely and throws a fresh `JsonLdError` whose `details` carry no `cause`
+ * at all. `fallback` recovers the guard's rejection in that case: `toRDF`'s
+ * `documentLoader` is wrapped ({@link validateJsonLd}) to record the last
+ * error it threw during the call, and that call-scoped record is passed here
+ * as `fallback`. Because jsonld.js resolves `@context` documents one at a
+ * time and any loader throw immediately aborts the whole call (no later,
+ * unrelated loader call can follow one that failed), a recorded loader error
+ * is always the proximate cause of whatever expansion failure this function
+ * is asked to rehydrate, whether or not jsonld.js chose to keep its own
+ * reference to it.
+ *
+ * Rehydrates the recovered error (preferring `details.cause` when jsonld.js
+ * kept it) onto `error.cause` so a plain `.cause` walk reaches it. Mutates
+ * and returns the same object jsonld.js just threw for this call (safe:
+ * nothing else holds a reference to it), and only when there is something to
+ * recover and jsonld.js has not already set a `cause` itself, so a malformed
+ * `@context` that never reached the document loader (and so has nothing
+ * buried and no fallback recorded) does not gain a spurious one.
+ *
+ * @see https://github.com/uncefact/tests-untp/issues/773
+ */
+function rehydrateJsonLdCause(error, fallback) {
+    if (!(error instanceof Error) || error.cause !== undefined) {
+        return error;
+    }
+    const buried = error.details?.cause;
+    const recovered = buried !== undefined ? buried : fallback;
+    if (recovered !== undefined) {
+        error.cause = recovered;
+    }
+    return error;
+}
+/**
+ * Catches malformed contexts, undefined terms, and structurally invalid
+ * linked data by expanding to RDF in safe mode (unless explicitly disabled).
+ *
+ * Expansion resolves every remote `@context` through a guarded document
+ * loader ({@link createJsonLdDocumentLoader}) so `@context` fetches pass the
+ * `validatePublicUrl` SSRF guard rather than jsonld.js's default unguarded
+ * Node loader. See ADR-033 §7 and issue #707.
+ *
+ * @see https://github.com/digitalbazaar/jsonld.js#safe-mode jsonld.js safe mode (a jsonld.js option, not a W3C-defined term).
+ * @see ../../../../docs/adrs/033-cvc-architecture.md ADR-033 §7 (Security considerations).
+ * @throws {JsonLdInvalidShapeError} if `document` is not a non-null object.
+ * @throws {JsonLdExpansionFailedError} if `jsonld.toRDF` rejects (which
+ *   includes a remote `@context` failing the SSRF guard; the guard's
+ *   rejection is reachable via native `.cause` hops off the thrown error,
+ *   see {@link rehydrateJsonLdCause}).
+ */
+export async function validateJsonLd(document, options) {
+    if (typeof document !== 'object' || document === null) {
+        throw new JsonLdInvalidShapeError(document);
+    }
+    // Dynamic import: jsonld pulls in undici/TextDecoder which aren't
+    // available in jsdom, so we load it lazily to allow test mocking. The
+    // guarded document loader is loaded lazily for the same reason (it depends
+    // on the resolvers/node stack, which uses undici and node:dns).
+    const jsonldModule = await import('jsonld');
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const jsonld = ('default' in jsonldModule ? jsonldModule.default : jsonldModule);
+    const { createJsonLdDocumentLoader } = await import('../loaders/jsonld-document-loader.js');
+    const documentLoader = createJsonLdDocumentLoader({ cache: options?.contextCache });
+    // Recorded for rehydrateJsonLdCause's fallback: the last error the loader
+    // threw during this call (undefined if every fetch it made succeeded).
+    let lastLoaderError;
+    const trackedDocumentLoader = async (url) => {
+        try {
+            return await documentLoader(url);
+        }
+        catch (loaderError) {
+            lastLoaderError = loaderError;
+            throw loaderError;
+        }
+    };
+    try {
+        // The options cast bridges @types/jsonld, which types documentLoader with
+        // a legacy callback signature; jsonld.js itself accepts the
+        // single-argument promise-returning loader used here.
+        await jsonld.toRDF(document, { safe: options?.safe ?? true, documentLoader: trackedDocumentLoader });
+    }
+    catch (cause) {
+        throw new JsonLdExpansionFailedError(rehydrateJsonLdCause(cause, lastLoaderError));
+    }
+}
+//# sourceMappingURL=validate-jsonld.js.map

package/build/validation/validate-jsonld.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-jsonld.js","sourceRoot":"","sources":["../../src/validation/validate-jsonld.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAgBlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAS,oBAAoB,CAAC,KAAc,EAAE,QAAkB;IAC9D,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAI,KAAmD,CAAC,OAAO,EAAE,KAAK,CAAC;IACnF,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAiB,EAAE,OAA+B;IACrF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,8DAA8D;IAC9D,MAAM,MAAM,GAAG,CAAC,SAAS,IAAI,YAAY,CAAC,CAAC,CAAE,YAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAA4B,CAAC;IACrH,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,sCAAsC,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,0BAA0B,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAEpF,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,eAAwB,CAAC;IAC7B,MAAM,qBAAqB,GAAG,KAAK,EAAE,GAAW,EAAiC,EAAE;QACjF,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,eAAe,GAAG,WAAW,CAAC;YAC9B,MAAM,WAAW,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,0EAA0E;QAC1E,4DAA4D;QAC5D,sDAAsD;QACtD,MAAM,MAAM,CAAC,KAAK,CAChB,QAA0B,EAC1B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,cAAc,EAAE,qBAAqB,EAAwC,CAC7G,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAAC,oBAAoB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;IACrF,CAAC;AACH,CAAC"}

package/build/validation/validate-jsonld.ssrf.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/validation/validate-jsonld.ssrf.test.js

@@ -0,0 +1,108 @@
+import http from 'node:http';
+import { validateJsonLd } from './validate-jsonld.js';
+import { JsonLdExpansionFailedError } from './errors.js';
+import { UrlValidationError } from '../node/errors.js';
+/**
+ * Walks the native `Error.cause` chain from `error`, collecting every link.
+ * jsonld.js's own `JsonLdError` buries a document loader's rejection at the
+ * non-standard `details.cause` and never sets native `Error.cause`;
+ * `validateJsonLd` rehydrates it onto `error.cause` when wrapping an
+ * expansion failure (see `validate-jsonld.ts`), so a plain `.cause` walk
+ * reaches the SSRF guard's rejection the same way it does on the
+ * schema-fetch path (`schema-loader.ssrf.test.ts`).
+ */
+function nativeCauseChain(error) {
+    const chain = [];
+    let current = error;
+    while (current instanceof Error && current.cause !== undefined) {
+        chain.push(current.cause);
+        current = current.cause;
+    }
+    return chain;
+}
+/**
+ * End-to-end SSRF regression for JSON-LD expansion. Unlike `validate-jsonld.test.ts`,
+ * this suite does NOT mock `jsonld` or the resolver stack: it exercises the real
+ * `jsonld.toRDF` + guarded document loader against a live loopback server standing
+ * in for an internal service.
+ *
+ * The load-bearing assertion is that the canary server is NEVER contacted. A prior
+ * (unguarded) implementation would let jsonld.js's default Node loader fetch a
+ * private `@context` URL, hitting the canary. The guard rejects the URL before any
+ * connection, so `hits` stays 0 regardless of how the expansion ultimately fails.
+ *
+ * @see https://github.com/uncefact/tests-untp/issues/707
+ */
+describe('validateJsonLd SSRF guard (real jsonld + guarded loader)', () => {
+    let server;
+    let baseUrl;
+    let hits = 0;
+    beforeAll(async () => {
+        server = http.createServer((_req, res) => {
+            hits += 1;
+            res.setHeader('content-type', 'application/ld+json');
+            res.end(JSON.stringify({ '@context': {} }));
+        });
+        await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+        const address = server.address();
+        baseUrl = `http://127.0.0.1:${address.port}`;
+    });
+    afterAll(async () => {
+        await new Promise((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())));
+    });
+    beforeEach(() => {
+        hits = 0;
+    });
+    it('never contacts a private @context URL during expansion', async () => {
+        const malicious = { '@context': `${baseUrl}/internal-context`, name: 'value' };
+        const error = await validateJsonLd(malicious).catch((e) => e);
+        expect(error).toBeInstanceOf(JsonLdExpansionFailedError);
+        // The rejection came from the SSRF guard, not an unrelated expansion failure.
+        expect(nativeCauseChain(error)).toContainEqual(expect.any(UrlValidationError));
+        // The security property: the loopback canary was never reached.
+        expect(hits).toBe(0);
+    });
+    it('rejects a metadata-service @context literal before any connection', async () => {
+        const malicious = { '@context': 'http://169.254.169.254/latest/meta-data', name: 'value' };
+        const error = await validateJsonLd(malicious).catch((e) => e);
+        expect(error).toBeInstanceOf(JsonLdExpansionFailedError);
+        expect(nativeCauseChain(error)).toContainEqual(expect.any(UrlValidationError));
+    });
+    it('expands a document with an inline @context without any network fetch', async () => {
+        const document = { '@context': { name: 'http://schema.org/name' }, name: 'Acme' };
+        await expect(validateJsonLd(document)).resolves.toBeUndefined();
+        expect(hits).toBe(0);
+    });
+    it('reaches the UrlValidationError by plain .cause hops, matching the schema-fetch path shape', async () => {
+        const malicious = { '@context': `${baseUrl}/internal-context`, name: 'value' };
+        const error = (await validateJsonLd(malicious).catch((e) => e));
+        // First hop: jsonld.js's own JsonLdError (still carries `.details` for
+        // callers that want the raw jsonld diagnostic).
+        expect(error.cause).toBeInstanceOf(Error);
+        expect(error.cause.name).toBe('jsonld.InvalidUrl');
+        // Second hop: the guard's rejection itself, reachable without digging
+        // into jsonld.js's proprietary `details.cause`.
+        expect(error.cause.cause).toBeInstanceOf(UrlValidationError);
+    });
+    it('never contacts a private scoped (term-level) @context URL during expansion', async () => {
+        // A term can declare its own remote @context (JSON-LD 1.1 scoped contexts).
+        // jsonld.js resolves it through the same guarded loader as a top-level
+        // @context, so it must be rejected the same way.
+        const malicious = {
+            '@context': { myTerm: { '@id': 'http://schema.org/myTerm', '@context': `${baseUrl}/internal-scoped-context` } },
+            myTerm: 'value',
+        };
+        const error = await validateJsonLd(malicious).catch((e) => e);
+        expect(error).toBeInstanceOf(JsonLdExpansionFailedError);
+        // The rejection came from the SSRF guard, reachable by plain .cause hops.
+        // jsonld.js's scoped-context branch (lib/context.js) discards the loader
+        // failure entirely and throws a fresh 'invalid scoped context' JsonLdError
+        // with no `details.cause` of its own, so this can only pass if
+        // validateJsonLd recovers the guard's rejection some other way (tracking
+        // it at the document-loader call, see `validate-jsonld.ts`).
+        expect(nativeCauseChain(error)).toContainEqual(expect.any(UrlValidationError));
+        // The security property: the loopback canary was never reached.
+        expect(hits).toBe(0);
+    });
+});
+//# sourceMappingURL=validate-jsonld.ssrf.test.js.map

package/build/validation/validate-jsonld.ssrf.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-jsonld.ssrf.test.js","sourceRoot":"","sources":["../../src/validation/validate-jsonld.ssrf.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,OAAO,OAAO,YAAY,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,QAAQ,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACxE,IAAI,MAAmB,CAAC;IACxB,IAAI,OAAe,CAAC;IACpB,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACvC,IAAI,IAAI,CAAC,CAAC;YACV,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QAChD,OAAO,GAAG,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,GAAG,EAAE;QACd,IAAI,GAAG,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,GAAG,OAAO,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAE/E,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,0BAA0B,CAAC,CAAC;QACzD,8EAA8E;QAC9E,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/E,gEAAgE;QAChE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,yCAAyC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAE3F,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,0BAA0B,CAAC,CAAC;QACzD,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,QAAQ,GAAG,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAElF,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,GAAG,OAAO,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAE/E,MAAM,KAAK,GAAG,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAA+B,CAAC;QAEvG,uEAAuE;QACvE,gDAAgD;QAChD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAE,KAAK,CAAC,KAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC9D,sEAAsE;QACtE,gDAAgD;QAChD,MAAM,CAAE,KAAK,CAAC,KAAe,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,4EAA4E;QAC5E,uEAAuE;QACvE,iDAAiD;QACjD,MAAM,SAAS,GAAG;YAChB,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,GAAG,OAAO,0BAA0B,EAAE,EAAE;YAC/G,MAAM,EAAE,OAAO;SAChB,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,0BAA0B,CAAC,CAAC;QACzD,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,+DAA+D;QAC/D,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/E,gEAAgE;QAChE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/build/validation/validate-jsonld.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/validation/validate-jsonld.test.js

@@ -0,0 +1,200 @@
+import { jest } from '@jest/globals';
+import { createInMemoryTtlCache } from '../cache/in-memory-ttl-cache.js';
+import { JsonLdValidationError } from './errors.js';
+const toRDF = jest.fn();
+const documentLoader = jest.fn();
+const createJsonLdDocumentLoader = jest.fn(() => documentLoader);
+jest.unstable_mockModule('jsonld', () => ({
+    default: { toRDF },
+    toRDF,
+}));
+// The loader factory is mocked so this suite can assert the option threading
+// (contextCache -> cache) without invoking the real resolver stack; the
+// factory's own behaviour is covered in loaders/jsonld-document-loader.test.ts.
+jest.unstable_mockModule('../loaders/jsonld-document-loader.js', () => ({
+    createJsonLdDocumentLoader,
+}));
+const { validateJsonLd } = await import('./validate-jsonld.js');
+describe('validateJsonLd', () => {
+    beforeEach(() => {
+        toRDF.mockReset();
+        documentLoader.mockReset();
+        createJsonLdDocumentLoader.mockClear();
+    });
+    it('returns void when JSON-LD expansion succeeds', async () => {
+        toRDF.mockResolvedValue([]);
+        await expect(validateJsonLd({ '@context': 'https://example.com' })).resolves.toBeUndefined();
+        expect(toRDF).toHaveBeenCalledWith({ '@context': 'https://example.com' }, expect.objectContaining({ safe: true, documentLoader: expect.any(Function) }));
+    });
+    it('throws JsonLdExpansionFailedError when toRDF rejects', async () => {
+        toRDF.mockRejectedValue(new Error('Invalid JSON-LD'));
+        await expect(validateJsonLd({})).rejects.toMatchObject({
+            name: 'JsonLdExpansionFailedError',
+            code: 'jsonld.expansion-failed',
+            received: 'Invalid JSON-LD',
+        });
+    });
+    it('captures the original error on Error.cause', async () => {
+        const cause = new Error('Missing @context');
+        toRDF.mockRejectedValue(cause);
+        await expect(validateJsonLd({})).rejects.toMatchObject({ cause });
+    });
+    describe('rehydrating a buried jsonld.js loader error', () => {
+        // jsonld.js's own JsonLdError stores a document loader's rejection at
+        // the proprietary `details.cause` and never sets native `Error.cause`
+        // (jsonld@8.3.3 `lib/JsonLdError.js`, loader wrap in
+        // `lib/ContextResolver.js`). `validateJsonLd` rehydrates it onto the
+        // caught error's native `cause` so a plain `.cause` walk reaches it,
+        // matching the schema-fetch path (see `validate-jsonld.ssrf.test.ts`).
+        it('rehydrates the buried loader error onto the native cause chain', async () => {
+            const buried = new Error('SSRF rejected');
+            const jsonldError = Object.assign(new Error('Dereferencing a URL did not result in a valid JSON-LD object.'), {
+                name: 'jsonld.InvalidUrl',
+                details: { code: 'loading remote context failed', url: 'https://internal.example', cause: buried },
+            });
+            toRDF.mockRejectedValue(jsonldError);
+            const error = await validateJsonLd({}).catch((e) => e);
+            expect(error.cause).toBe(jsonldError);
+            // Without the rehydration, jsonldError.cause stays unset (jsonld.js
+            // never sets it), so this hop would be absent.
+            expect(jsonldError.cause).toBe(buried);
+        });
+        it('does not add a spurious cause when the jsonld error has no buried loader error', async () => {
+            // A malformed @context never reaches the document loader, so jsonld.js's
+            // details carry no `cause` to rehydrate.
+            const jsonldError = Object.assign(new Error('Invalid JSON-LD syntax; @context must be an object.'), {
+                name: 'jsonld.SyntaxError',
+                details: { code: 'invalid @context' },
+            });
+            toRDF.mockRejectedValue(jsonldError);
+            await validateJsonLd({}).catch(() => undefined);
+            // Asserts absence, not merely `undefined`: an implementation that sets
+            // `error.cause = undefined` unconditionally would pass a `toBeUndefined()`
+            // check but still fabricate a `cause` property that was never there.
+            expect('cause' in jsonldError).toBe(false);
+        });
+        it('does not clobber an existing native cause on the jsonld error', async () => {
+            const existingCause = new Error('existing, legitimate native cause');
+            const buried = new Error('buried loader error, must not overwrite the existing cause');
+            const jsonldError = Object.assign(new Error('wrapped', { cause: existingCause }), {
+                name: 'jsonld.InvalidUrl',
+                details: { cause: buried },
+            });
+            toRDF.mockRejectedValue(jsonldError);
+            await validateJsonLd({}).catch(() => undefined);
+            expect(jsonldError.cause).toBe(existingCause);
+        });
+        // A term's own remote @context (a JSON-LD 1.1 "scoped context") is
+        // resolved through the same document loader, but on failure jsonld.js's
+        // scoped-context branch (lib/context.js) discards the loader's error
+        // entirely and throws a fresh JsonLdError with no `details.cause` at
+        // all (see validate-jsonld.ssrf.test.ts for the real-jsonld
+        // reproduction). validateJsonLd recovers it by tracking the last error
+        // the document loader threw during the call and using that as a
+        // fallback cause.
+        describe('recovering via the tracked-loader fallback', () => {
+            /** Simulates toRDF calling the documentLoader it was given, then rejecting as jsonld.js would. */
+            function rejectAfterCallingLoader(url, rejection) {
+                toRDF.mockImplementation(async (...args) => {
+                    const opts = args[1];
+                    await opts.documentLoader(url).catch(() => undefined);
+                    throw rejection;
+                });
+            }
+            it('recovers the tracked loader error when the jsonld error has no buried cause of its own', async () => {
+                const loaderError = new Error('SSRF rejected, recorded from the tracked loader');
+                documentLoader.mockRejectedValue(loaderError);
+                const scopedContextError = Object.assign(new Error('Invalid JSON-LD syntax; invalid scoped context.'), {
+                    name: 'jsonld.SyntaxError',
+                    details: { code: 'invalid scoped context', context: 'https://internal.example', term: 'myTerm' },
+                });
+                rejectAfterCallingLoader('https://internal.example', scopedContextError);
+                await validateJsonLd({}).catch(() => undefined);
+                // Without the fallback, this jsonld error's details carry no `cause`
+                // at all, so scopedContextError.cause would stay unset.
+                expect(scopedContextError.cause).toBe(loaderError);
+            });
+            it('prefers the buried details.cause over the fallback when jsonld.js kept both', async () => {
+                const buried = new Error('buried on details.cause, should win');
+                const fallbackLoaderError = new Error('recorded from the tracked loader, should lose');
+                documentLoader.mockRejectedValue(fallbackLoaderError);
+                const jsonldError = Object.assign(new Error('wrapped'), {
+                    name: 'jsonld.InvalidUrl',
+                    details: { cause: buried },
+                });
+                rejectAfterCallingLoader('https://example.com', jsonldError);
+                await validateJsonLd({}).catch(() => undefined);
+                expect(jsonldError.cause).toBe(buried);
+            });
+            it('does not fabricate a cause when the loader never threw during the call', async () => {
+                // The loader succeeds (or is never called); the eventual rejection
+                // is for an unrelated reason, so there is nothing to fall back to.
+                documentLoader.mockResolvedValue({ documentUrl: 'https://example.com', document: {} });
+                const unrelatedError = Object.assign(new Error('Invalid JSON-LD syntax; @context must be an object.'), {
+                    name: 'jsonld.SyntaxError',
+                    details: { code: 'invalid @context' },
+                });
+                rejectAfterCallingLoader('https://example.com', unrelatedError);
+                await validateJsonLd({}).catch(() => undefined);
+                expect('cause' in unrelatedError).toBe(false);
+            });
+        });
+    });
+    it('throws JsonLdInvalidShapeError when the document is not an object', async () => {
+        await expect(validateJsonLd('not-an-object')).rejects.toMatchObject({
+            name: 'JsonLdInvalidShapeError',
+            code: 'jsonld.invalid-shape',
+            received: 'string',
+            expected: 'object',
+        });
+        expect(toRDF).not.toHaveBeenCalled();
+    });
+    it('throws JsonLdInvalidShapeError for null input', async () => {
+        await expect(validateJsonLd(null)).rejects.toMatchObject({
+            name: 'JsonLdInvalidShapeError',
+            received: 'null',
+        });
+    });
+    it('passes safe: false to toRDF when options.safe is false', async () => {
+        toRDF.mockResolvedValue([]);
+        await validateJsonLd({ '@context': 'https://example.com' }, { safe: false });
+        expect(toRDF).toHaveBeenCalledWith({ '@context': 'https://example.com' }, expect.objectContaining({ safe: false, documentLoader: expect.any(Function) }));
+    });
+    it('defaults safe to true when no options provided', async () => {
+        toRDF.mockResolvedValue([]);
+        await validateJsonLd({ '@context': 'https://example.com' });
+        expect(toRDF).toHaveBeenCalledWith({ '@context': 'https://example.com' }, expect.objectContaining({ safe: true, documentLoader: expect.any(Function) }));
+    });
+    it('creates the document loader with the supplied contextCache', async () => {
+        toRDF.mockResolvedValue([]);
+        const contextCache = createInMemoryTtlCache({ ttlMs: 60_000 });
+        await validateJsonLd({ '@context': 'https://example.com' }, { contextCache });
+        expect(createJsonLdDocumentLoader).toHaveBeenCalledWith({ cache: contextCache });
+    });
+    it('passes toRDF a loader that delegates to the one createJsonLdDocumentLoader created', async () => {
+        toRDF.mockResolvedValue([]);
+        const remoteDoc = { documentUrl: 'https://example.com', document: {} };
+        documentLoader.mockResolvedValue(remoteDoc);
+        await validateJsonLd({ '@context': 'https://example.com' });
+        expect(createJsonLdDocumentLoader).toHaveBeenCalledWith({ cache: undefined });
+        // validateJsonLd wraps the created loader (to record failures for
+        // rehydrateJsonLdCause's fallback, see validate-jsonld.ts), so toRDF
+        // receives a different function reference; assert delegation instead.
+        const passedOptions = toRDF.mock.calls[0]?.[1];
+        await expect(passedOptions.documentLoader('https://example.com')).resolves.toBe(remoteDoc);
+        expect(documentLoader).toHaveBeenCalledWith('https://example.com');
+    });
+    it('handles non-Error thrown values', async () => {
+        toRDF.mockRejectedValue('string error');
+        await expect(validateJsonLd({})).rejects.toMatchObject({
+            code: 'jsonld.expansion-failed',
+            received: 'string error',
+        });
+    });
+    it('every concrete error extends JsonLdValidationError', async () => {
+        await expect(validateJsonLd(null)).rejects.toBeInstanceOf(JsonLdValidationError);
+        toRDF.mockRejectedValue(new Error('x'));
+        await expect(validateJsonLd({})).rejects.toBeInstanceOf(JsonLdValidationError);
+    });
+});
+//# sourceMappingURL=validate-jsonld.test.js.map

package/build/validation/validate-jsonld.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-jsonld.test.js","sourceRoot":"","sources":["../../src/validation/validate-jsonld.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,EAAuD,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzG,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;AACxB,MAAM,cAAc,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;AACjC,MAAM,0BAA0B,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;AAEjE,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,OAAO,EAAE,EAAE,KAAK,EAAE;IAClB,KAAK;CACN,CAAC,CAAC,CAAC;AAEJ,6EAA6E;AAC7E,wEAAwE;AACxE,gFAAgF;AAChF,IAAI,CAAC,mBAAmB,CAAC,sCAAsC,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,0BAA0B;CAC3B,CAAC,CAAC,CAAC;AAEJ,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAEhE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,CAAC,SAAS,EAAE,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,CAAC;QAC3B,0BAA0B,CAAC,SAAS,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,KAAK,CAAC,iBAAiB,CAAC,EAAW,CAAC,CAAC;QAErC,MAAM,MAAM,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC7F,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAChC,EAAE,UAAU,EAAE,qBAAqB,EAAE,EACrC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAC9E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAU,CAAC,CAAC;QAE/D,MAAM,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACrD,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC5C,KAAK,CAAC,iBAAiB,CAAC,KAAc,CAAC,CAAC;QAExC,MAAM,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;QAC3D,sEAAsE;QACtE,sEAAsE;QACtE,qDAAqD;QACrD,qEAAqE;QACrE,qEAAqE;QACrE,uEAAuE;QAEvE,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;YAC9E,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+DAA+D,CAAC,EAAE;gBAC5G,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE;aACnG,CAAC,CAAC;YACH,KAAK,CAAC,iBAAiB,CAAC,WAAoB,CAAC,CAAC;YAE9C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAEhE,MAAM,CAAE,KAAoC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtE,oEAAoE;YACpE,+CAA+C;YAC/C,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;YAC9F,yEAAyE;YACzE,yCAAyC;YACzC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAAE;gBAClG,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE;aACtC,CAAC,CAAC;YACH,KAAK,CAAC,iBAAiB,CAAC,WAAoB,CAAC,CAAC;YAE9C,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAEhD,uEAAuE;YACvE,2EAA2E;YAC3E,qEAAqE;YACrE,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YACvF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE;gBAChF,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;aAC3B,CAAC,CAAC;YACH,KAAK,CAAC,iBAAiB,CAAC,WAAoB,CAAC,CAAC;YAE9C,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAEhD,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,mEAAmE;QACnE,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;QACrE,4DAA4D;QAC5D,uEAAuE;QACvE,gEAAgE;QAChE,kBAAkB;QAClB,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;YAC1D,kGAAkG;YAClG,SAAS,wBAAwB,CAAC,GAAW,EAAE,SAAkB;gBAC/D,KAAK,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;oBACpD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAwD,CAAC;oBAC5E,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACtD,MAAM,SAAS,CAAC;gBAClB,CAAC,CAAC,CAAC;YACL,CAAC;YAED,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;gBACtG,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACjF,cAAc,CAAC,iBAAiB,CAAC,WAAoB,CAAC,CAAC;gBACvD,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAAE;oBACrG,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,QAAQ,EAAE;iBACjG,CAAC,CAAC;gBACH,wBAAwB,CAAC,0BAA0B,EAAE,kBAAkB,CAAC,CAAC;gBAEzE,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAEhD,qEAAqE;gBACrE,wDAAwD;gBACxD,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;gBAC3F,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBAChE,MAAM,mBAAmB,GAAG,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBACvF,cAAc,CAAC,iBAAiB,CAAC,mBAA4B,CAAC,CAAC;gBAC/D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE;oBACtD,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;iBAC3B,CAAC,CAAC;gBACH,wBAAwB,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;gBAE7D,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAEhD,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;gBACtF,mEAAmE;gBACnE,mEAAmE;gBACnE,cAAc,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE,QAAQ,EAAE,EAAE,EAAW,CAAC,CAAC;gBAChG,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAAE;oBACrG,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE;iBACtC,CAAC,CAAC;gBACH,wBAAwB,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;gBAEhE,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAEhD,MAAM,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAClE,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACvD,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,KAAK,CAAC,iBAAiB,CAAC,EAAW,CAAC,CAAC;QAErC,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,qBAAqB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAE7E,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAChC,EAAE,UAAU,EAAE,qBAAqB,EAAE,EACrC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAC/E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,KAAK,CAAC,iBAAiB,CAAC,EAAW,CAAC,CAAC;QAErC,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAE5D,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAChC,EAAE,UAAU,EAAE,qBAAqB,EAAE,EACrC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAC9E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,KAAK,CAAC,iBAAiB,CAAC,EAAW,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,sBAAsB,CAAuB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAErF,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,qBAAqB,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QAE9E,MAAM,CAAC,0BAA0B,CAAC,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,KAAK,CAAC,iBAAiB,CAAC,EAAW,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACvE,cAAc,CAAC,iBAAiB,CAAC,SAAkB,CAAC,CAAC;QAErD,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAE5D,MAAM,CAAC,0BAA0B,CAAC,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9E,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAA0D,CAAC;QACxG,MAAM,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3F,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,KAAK,CAAC,iBAAiB,CAAC,cAAuB,CAAC,CAAC;QAEjD,MAAM,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACrD,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;QACjF,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,GAAG,CAAU,CAAC,CAAC;QACjD,MAAM,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uncefact/untp-utils",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Shared utility primitives for UNTP packages and consumers.",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -9,15 +9,68 @@
       "types": "./build/index.d.ts",
       "default": "./build/index.js"
     },
+    "./artefacts": {
+      "types": "./build/artefacts/index.d.ts",
+      "default": "./build/artefacts/index.js"
+    },
     "./multibase-digest": {
       "types": "./build/multibase-digest/index.d.ts",
       "default": "./build/multibase-digest/index.js"
+    },
+    "./conformity-vocabulary": {
+      "types": "./build/conformity-vocabulary/index.d.ts",
+      "default": "./build/conformity-vocabulary/index.js"
+    },
+    "./validation": {
+      "types": "./build/validation/index.d.ts",
+      "default": "./build/validation/index.js"
+    },
+    "./loaders": {
+      "types": "./build/loaders/index.d.ts",
+      "default": "./build/loaders/index.js"
+    },
+    "./node": {
+      "types": "./build/node/index.d.ts",
+      "default": "./build/node/index.js"
+    },
+    "./cache": {
+      "types": "./build/cache/index.d.ts",
+      "default": "./build/cache/index.js"
+    },
+    "./resolvers": {
+      "types": "./build/resolvers/index.d.ts",
+      "default": "./build/resolvers/index.js"
+    },
+    "./http-headers": {
+      "types": "./build/http-headers/index.d.ts",
+      "default": "./build/http-headers/index.js"
     }
   },
   "typesVersions": {
     "*": {
       "multibase-digest": [
         "./build/multibase-digest/index.d.ts"
+      ],
+      "conformity-vocabulary": [
+        "./build/conformity-vocabulary/index.d.ts"
+      ],
+      "validation": [
+        "./build/validation/index.d.ts"
+      ],
+      "loaders": [
+        "./build/loaders/index.d.ts"
+      ],
+      "node": [
+        "./build/node/index.d.ts"
+      ],
+      "cache": [
+        "./build/cache/index.d.ts"
+      ],
+      "resolvers": [
+        "./build/resolvers/index.d.ts"
+      ],
+      "http-headers": [
+        "./build/http-headers/index.d.ts"
       ]
     }
   },
@@ -35,7 +88,8 @@
     "untp",
     "multibase",
     "multihash",
-    "digest"
+    "digest",
+    "conformity-vocabulary"
   ],
   "author": "",
   "license": "Apache-2.0",
@@ -45,10 +99,17 @@
     "directory": "packages/untp-utils"
   },
   "dependencies": {
-    "multiformats": "^13.3.1"
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1",
+    "ipaddr.js": "^2.4.0",
+    "jsonld": "^8.3.3",
+    "multiformats": "^13.3.1",
+    "undici": "^6.25.0"
   },
   "devDependencies": {
+    "@jest/globals": "29.7.0",
     "@types/jest": "29.5.11",
+    "@types/jsonld": "^1.5.15",
     "cross-env": "^7.0.3",
     "jest": "29.7.0",
     "ts-jest": "29.1.1",