@uncefact/untp-utils 0.1.0 → 0.2.0

package/build/http-headers/parse-entity-tag.test.js

@@ -0,0 +1,41 @@
+import { parseEntityTag } from './parse-entity-tag.js';
+describe('parseEntityTag', () => {
+    describe('accepts valid entity-tags', () => {
+        it.each([
+            '""',
+            '"abc"',
+            '"33a64df551425fcc55e4d42a148795d9f25f89d4"',
+            'W/"abc"',
+            'W/""',
+            '"a-b-c.d"',
+            '"!@#$%^&*()"',
+        ])('%s', (value) => {
+            expect(parseEntityTag(value)).toBe(value);
+        });
+    });
+    describe('rejects malformed entity-tags', () => {
+        it.each([
+            ['unquoted value', 'abc'],
+            ['single-quoted value', "'abc'"],
+            ['missing closing quote', '"abc'],
+            ['missing opening quote', 'abc"'],
+            ['embedded double quote', '"a"b"'],
+            ['lower-case w prefix', 'w/"abc"'],
+            ['w prefix without slash', 'W"abc"'],
+            ['empty string', ''],
+            ['trailing whitespace', '"abc" '],
+            ['multiple etags (not supported)', '"abc", "def"'],
+        ])('%s', (_label, value) => {
+            expect(parseEntityTag(value)).toBeUndefined();
+        });
+    });
+    describe('rejects header-injection vectors', () => {
+        it('rejects CRLF in the value', () => {
+            expect(parseEntityTag('"abc"\r\nX-Evil: pwn')).toBeUndefined();
+        });
+        it('rejects embedded null byte', () => {
+            expect(parseEntityTag('"a\x00b"')).toBeUndefined();
+        });
+    });
+});
+//# sourceMappingURL=parse-entity-tag.test.js.map

package/build/http-headers/parse-entity-tag.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-entity-tag.test.js","sourceRoot":"","sources":["../../src/http-headers/parse-entity-tag.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,IAAI,CAAC;YACN,IAAI;YACJ,OAAO;YACP,4CAA4C;YAC5C,SAAS;YACT,MAAM;YACN,WAAW;YACX,cAAc;SACf,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;QAC7C,EAAE,CAAC,IAAI,CAAC;YACN,CAAC,gBAAgB,EAAE,KAAK,CAAC;YACzB,CAAC,qBAAqB,EAAE,OAAO,CAAC;YAChC,CAAC,uBAAuB,EAAE,MAAM,CAAC;YACjC,CAAC,uBAAuB,EAAE,MAAM,CAAC;YACjC,CAAC,uBAAuB,EAAE,OAAO,CAAC;YAClC,CAAC,qBAAqB,EAAE,SAAS,CAAC;YAClC,CAAC,wBAAwB,EAAE,QAAQ,CAAC;YACpC,CAAC,cAAc,EAAE,EAAE,CAAC;YACpB,CAAC,qBAAqB,EAAE,QAAQ,CAAC;YACjC,CAAC,gCAAgC,EAAE,cAAc,CAAC;SACnD,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/build/http-headers/parse-imf-date.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Validates an HTTP `Last-Modified` / `If-Modified-Since` / `Date` value
+ * per RFC 7231 §7.1.1.1 IMF-fixdate. Returns the value verbatim if it
+ * matches the strict IMF-fixdate grammar; otherwise returns `undefined`.
+ *
+ * Strict by design: only IMF-fixdate is accepted. Servers that send
+ * RFC 850 or asctime() format produce `undefined` here. If you hit a
+ * real upstream sending a legacy format, broaden this validator with a
+ * deliberate test case rather than relaxing it ad hoc.
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc7231#section-7.1.1.1
+ */
+export declare function parseImfDate(value: string): string | undefined;

package/build/http-headers/parse-imf-date.js

@@ -0,0 +1,23 @@
+import { isSafeHeaderValue } from './is-safe-header-value.js';
+// RFC 7231 §7.1.1.1 IMF-fixdate: the only timestamp format servers SHOULD
+// generate. RFC 850 and asctime() are receivable per the RFC but
+// effectively dead in modern HTTP; this validator rejects them.
+const IMF_FIXDATE_RE = /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT$/;
+/**
+ * Validates an HTTP `Last-Modified` / `If-Modified-Since` / `Date` value
+ * per RFC 7231 §7.1.1.1 IMF-fixdate. Returns the value verbatim if it
+ * matches the strict IMF-fixdate grammar; otherwise returns `undefined`.
+ *
+ * Strict by design: only IMF-fixdate is accepted. Servers that send
+ * RFC 850 or asctime() format produce `undefined` here. If you hit a
+ * real upstream sending a legacy format, broaden this validator with a
+ * deliberate test case rather than relaxing it ad hoc.
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc7231#section-7.1.1.1
+ */
+export function parseImfDate(value) {
+    if (!isSafeHeaderValue(value))
+        return undefined;
+    return IMF_FIXDATE_RE.test(value) ? value : undefined;
+}
+//# sourceMappingURL=parse-imf-date.js.map

package/build/http-headers/parse-imf-date.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-imf-date.js","sourceRoot":"","sources":["../../src/http-headers/parse-imf-date.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,0EAA0E;AAC1E,iEAAiE;AACjE,gEAAgE;AAChE,MAAM,cAAc,GAClB,sHAAsH,CAAC;AAEzH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC"}

package/build/http-headers/parse-imf-date.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/http-headers/parse-imf-date.test.js

@@ -0,0 +1,31 @@
+import { parseImfDate } from './parse-imf-date.js';
+describe('parseImfDate', () => {
+    describe('accepts valid IMF-fixdate', () => {
+        it.each(['Sun, 06 Nov 1994 08:49:37 GMT', 'Wed, 21 May 2026 12:00:00 GMT', 'Mon, 01 Jan 2024 00:00:00 GMT'])('%s', (value) => {
+            expect(parseImfDate(value)).toBe(value);
+        });
+    });
+    describe('rejects malformed dates', () => {
+        it.each([
+            ['lowercase day name', 'sun, 06 Nov 1994 08:49:37 GMT'],
+            ['missing comma', 'Sun 06 Nov 1994 08:49:37 GMT'],
+            ['1-digit day', 'Sun, 6 Nov 1994 08:49:37 GMT'],
+            ['2-digit year', 'Sun, 06 Nov 94 08:49:37 GMT'],
+            ['no GMT suffix', 'Sun, 06 Nov 1994 08:49:37'],
+            ['UTC instead of GMT', 'Sun, 06 Nov 1994 08:49:37 UTC'],
+            ['ISO-8601', '2026-05-21T12:00:00Z'],
+            ['RFC 850 format', 'Sunday, 06-Nov-94 08:49:37 GMT'],
+            ['asctime format', 'Sun Nov  6 08:49:37 1994'],
+            ['empty string', ''],
+            ['gibberish', 'not a date'],
+        ])('%s', (_label, value) => {
+            expect(parseImfDate(value)).toBeUndefined();
+        });
+    });
+    describe('rejects header-injection vectors', () => {
+        it('rejects CRLF in the value', () => {
+            expect(parseImfDate('Sun, 06 Nov 1994 08:49:37 GMT\r\nX-Evil: pwn')).toBeUndefined();
+        });
+    });
+});
+//# sourceMappingURL=parse-imf-date.test.js.map

package/build/http-headers/parse-imf-date.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-imf-date.test.js","sourceRoot":"","sources":["../../src/http-headers/parse-imf-date.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,IAAI,CAAC,CAAC,+BAA+B,EAAE,+BAA+B,EAAE,+BAA+B,CAAC,CAAC,CAC1G,IAAI,EACJ,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,IAAI,CAAC;YACN,CAAC,oBAAoB,EAAE,+BAA+B,CAAC;YACvD,CAAC,eAAe,EAAE,8BAA8B,CAAC;YACjD,CAAC,aAAa,EAAE,8BAA8B,CAAC;YAC/C,CAAC,cAAc,EAAE,6BAA6B,CAAC;YAC/C,CAAC,eAAe,EAAE,2BAA2B,CAAC;YAC9C,CAAC,oBAAoB,EAAE,+BAA+B,CAAC;YACvD,CAAC,UAAU,EAAE,sBAAsB,CAAC;YACpC,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;YACpD,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;YAC9C,CAAC,cAAc,EAAE,EAAE,CAAC;YACpB,CAAC,WAAW,EAAE,YAAY,CAAC;SAC5B,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,CAAC,YAAY,CAAC,8CAA8C,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACvF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/build/http-headers/parse-media-type.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Validates an HTTP `Content-Type` value per RFC 7231 §3.1.1.1. Returns
+ * the value verbatim if it matches the media-type grammar (`type/subtype`
+ * with optional `; name=value` parameters); otherwise returns `undefined`.
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1
+ */
+export declare function parseMediaType(value: string): string | undefined;

package/build/http-headers/parse-media-type.js

@@ -0,0 +1,21 @@
+import { isSafeHeaderValue } from './is-safe-header-value.js';
+// RFC 7231 §3.1.1.1: media-type = type "/" subtype *( OWS ";" OWS parameter )
+// tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "."
+//       / "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA
+const TOKEN = "[!#$%&'*+\\-.^_`|~0-9A-Za-z]+";
+const QUOTED = '"[^"]*"';
+const PARAM = `\\s*;\\s*${TOKEN}=(?:${TOKEN}|${QUOTED})`;
+const MEDIA_TYPE_RE = new RegExp(`^${TOKEN}\\/${TOKEN}(?:${PARAM})*$`);
+/**
+ * Validates an HTTP `Content-Type` value per RFC 7231 §3.1.1.1. Returns
+ * the value verbatim if it matches the media-type grammar (`type/subtype`
+ * with optional `; name=value` parameters); otherwise returns `undefined`.
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1
+ */
+export function parseMediaType(value) {
+    if (!isSafeHeaderValue(value))
+        return undefined;
+    return MEDIA_TYPE_RE.test(value) ? value : undefined;
+}
+//# sourceMappingURL=parse-media-type.js.map

package/build/http-headers/parse-media-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-media-type.js","sourceRoot":"","sources":["../../src/http-headers/parse-media-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,8EAA8E;AAC9E,oEAAoE;AACpE,sDAAsD;AACtD,MAAM,KAAK,GAAG,+BAA+B,CAAC;AAC9C,MAAM,MAAM,GAAG,SAAS,CAAC;AACzB,MAAM,KAAK,GAAG,YAAY,KAAK,OAAO,KAAK,IAAI,MAAM,GAAG,CAAC;AACzD,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,KAAK,MAAM,KAAK,KAAK,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/build/http-headers/parse-media-type.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/http-headers/parse-media-type.test.js

@@ -0,0 +1,39 @@
+import { parseMediaType } from './parse-media-type.js';
+describe('parseMediaType', () => {
+    describe('accepts valid media types', () => {
+        it.each([
+            'application/json',
+            'text/plain',
+            'application/vnd.api+json',
+            'application/x-www-form-urlencoded',
+            'image/svg+xml',
+            'text/plain; charset=utf-8',
+            'text/plain;charset=utf-8',
+            'application/json; charset=utf-8; profile=foo',
+            'text/plain; charset="utf-8"',
+            'multipart/form-data; boundary="----WebKitFormBoundary"',
+        ])('%s', (value) => {
+            expect(parseMediaType(value)).toBe(value);
+        });
+    });
+    describe('rejects malformed media types', () => {
+        it.each([
+            ['missing slash', 'application'],
+            ['empty type', '/json'],
+            ['empty subtype', 'application/'],
+            ['whitespace in type', 'app lication/json'],
+            ['whitespace in subtype', 'application/js on'],
+            ['comma-separated list (not supported by this validator)', 'application/json, text/plain'],
+            ['empty string', ''],
+            ['unquoted parameter value with whitespace', 'text/plain; charset=ut f-8'],
+        ])('%s', (_label, value) => {
+            expect(parseMediaType(value)).toBeUndefined();
+        });
+    });
+    describe('rejects header-injection vectors', () => {
+        it('rejects CRLF in the value', () => {
+            expect(parseMediaType('application/json\r\nX-Evil: pwn')).toBeUndefined();
+        });
+    });
+});
+//# sourceMappingURL=parse-media-type.test.js.map

package/build/http-headers/parse-media-type.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-media-type.test.js","sourceRoot":"","sources":["../../src/http-headers/parse-media-type.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,IAAI,CAAC;YACN,kBAAkB;YAClB,YAAY;YACZ,0BAA0B;YAC1B,mCAAmC;YACnC,eAAe;YACf,2BAA2B;YAC3B,0BAA0B;YAC1B,8CAA8C;YAC9C,6BAA6B;YAC7B,wDAAwD;SACzD,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;QAC7C,EAAE,CAAC,IAAI,CAAC;YACN,CAAC,eAAe,EAAE,aAAa,CAAC;YAChC,CAAC,YAAY,EAAE,OAAO,CAAC;YACvB,CAAC,eAAe,EAAE,cAAc,CAAC;YACjC,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;YAC3C,CAAC,uBAAuB,EAAE,mBAAmB,CAAC;YAC9C,CAAC,wDAAwD,EAAE,8BAA8B,CAAC;YAC1F,CAAC,cAAc,EAAE,EAAE,CAAC;YACpB,CAAC,0CAA0C,EAAE,4BAA4B,CAAC;SAC3E,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,CAAC,cAAc,CAAC,iCAAiC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/build/http-headers/user-agent.d.ts

@@ -0,0 +1,35 @@
+/**
+ * `User-Agent` sent on every guarded fetch (`resolveDocument` and
+ * everything composed on it) unless overridden.
+ *
+ * Anonymous (UA-less) automated fetches risk being challenged by bot
+ * protection on well-known context hosts (observed 2026-08-12 on a
+ * production RI: w3.org returned 429 challenge pages to UA-less fetches
+ * while identified requests from the same host passed), so every request
+ * identifies itself. See uncefact/tests-untp#886 for the fetch-per-issuance
+ * pattern that provoked it. Operators override via the `RI_HTTP_USER_AGENT`
+ * environment variable (read per request, so it applies without a rebuild),
+ * and a caller-supplied `user-agent` header takes precedence over both.
+ *
+ * These live in `http-headers` (not `resolvers`) so boot-time validation can
+ * import them in environments that cannot load the resolver stack's undici
+ * dependency (e.g. jsdom test environments).
+ */
+export declare const DEFAULT_USER_AGENT = "uncefact-untp-utils (+https://github.com/uncefact/tests-untp)";
+/** Environment variable that overrides {@link DEFAULT_USER_AGENT}. */
+export declare const USER_AGENT_ENV_VAR = "RI_HTTP_USER_AGENT";
+/**
+ * Whether `value` can be sent as an HTTP `User-Agent` field value: non-blank,
+ * free of control characters (notably CR/LF, which would corrupt or split
+ * the request's header block; HTAB is also rejected, deliberately stricter
+ * than the wire grammar), and within the fetch ByteString range. undici
+ * converts header values to ByteString and throws on any UTF-16 code unit
+ * above U+00FF (undici@6.25.0 `lib/web/fetch/webidl.js`), so a value the
+ * ByteString check fails here would otherwise pass boot validation and then
+ * break every guarded fetch at request time. Latin-1 text (e.g. `café`)
+ * remains sendable and accepted.
+ *
+ * Exported so deployments can validate their configured override at boot
+ * (fail-fast) instead of meeting the guarded fetch's request-time failure.
+ */
+export declare function isValidHttpUserAgent(value: string): boolean;

package/build/http-headers/user-agent.js

@@ -0,0 +1,45 @@
+import { isSafeHeaderValue } from './is-safe-header-value.js';
+/**
+ * `User-Agent` sent on every guarded fetch (`resolveDocument` and
+ * everything composed on it) unless overridden.
+ *
+ * Anonymous (UA-less) automated fetches risk being challenged by bot
+ * protection on well-known context hosts (observed 2026-08-12 on a
+ * production RI: w3.org returned 429 challenge pages to UA-less fetches
+ * while identified requests from the same host passed), so every request
+ * identifies itself. See uncefact/tests-untp#886 for the fetch-per-issuance
+ * pattern that provoked it. Operators override via the `RI_HTTP_USER_AGENT`
+ * environment variable (read per request, so it applies without a rebuild),
+ * and a caller-supplied `user-agent` header takes precedence over both.
+ *
+ * These live in `http-headers` (not `resolvers`) so boot-time validation can
+ * import them in environments that cannot load the resolver stack's undici
+ * dependency (e.g. jsdom test environments).
+ */
+export const DEFAULT_USER_AGENT = 'uncefact-untp-utils (+https://github.com/uncefact/tests-untp)';
+/** Environment variable that overrides {@link DEFAULT_USER_AGENT}. */
+export const USER_AGENT_ENV_VAR = 'RI_HTTP_USER_AGENT';
+/**
+ * Whether `value` can be sent as an HTTP `User-Agent` field value: non-blank,
+ * free of control characters (notably CR/LF, which would corrupt or split
+ * the request's header block; HTAB is also rejected, deliberately stricter
+ * than the wire grammar), and within the fetch ByteString range. undici
+ * converts header values to ByteString and throws on any UTF-16 code unit
+ * above U+00FF (undici@6.25.0 `lib/web/fetch/webidl.js`), so a value the
+ * ByteString check fails here would otherwise pass boot validation and then
+ * break every guarded fetch at request time. Latin-1 text (e.g. `café`)
+ * remains sendable and accepted.
+ *
+ * Exported so deployments can validate their configured override at boot
+ * (fail-fast) instead of meeting the guarded fetch's request-time failure.
+ */
+export function isValidHttpUserAgent(value) {
+    if (value.trim() === '' || !isSafeHeaderValue(value))
+        return false;
+    for (let i = 0; i < value.length; i += 1) {
+        if (value.charCodeAt(i) > 0xff)
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=user-agent.js.map

package/build/http-headers/user-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent.js","sourceRoot":"","sources":["../../src/http-headers/user-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,+DAA+D,CAAC;AAElG,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/build/http-headers/user-agent.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/http-headers/user-agent.test.js

@@ -0,0 +1,27 @@
+import { DEFAULT_USER_AGENT, isValidHttpUserAgent } from './user-agent.js';
+describe('isValidHttpUserAgent', () => {
+    it('accepts an ordinary product token', () => {
+        expect(isValidHttpUserAgent('acme-ri/1.2 (+https://ri.acme.example)')).toBe(true);
+    });
+    it('accepts the library default', () => {
+        expect(isValidHttpUserAgent(DEFAULT_USER_AGENT)).toBe(true);
+    });
+    it('accepts Latin-1 text, which undici can send', () => {
+        expect(isValidHttpUserAgent('café-agent')).toBe(true);
+        expect(isValidHttpUserAgent('agentÿ')).toBe(true);
+    });
+    it('rejects blank and whitespace-only values', () => {
+        expect(isValidHttpUserAgent('')).toBe(false);
+        expect(isValidHttpUserAgent('   ')).toBe(false);
+    });
+    it('rejects control characters, including CR/LF and tab', () => {
+        expect(isValidHttpUserAgent('evil\r\nX-Injected: 1')).toBe(false);
+        expect(isValidHttpUserAgent('a\tb')).toBe(false);
+        expect(isValidHttpUserAgent('a\u0000b')).toBe(false);
+    });
+    it('rejects code units above U+00FF, which undici refuses as ByteString', () => {
+        expect(isValidHttpUserAgent('agentĀ')).toBe(false);
+        expect(isValidHttpUserAgent('agent\u{1f642}')).toBe(false);
+    });
+});
+//# sourceMappingURL=user-agent.test.js.map

package/build/http-headers/user-agent.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent.test.js","sourceRoot":"","sources":["../../src/http-headers/user-agent.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE3E,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,oBAAoB,CAAC,wCAAwC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/build/index.d.ts

@@ -1 +1 @@
-export * from './multibase-digest/index.js';
+export * from './structured-error.js';

package/build/index.js

@@ -1,2 +1,2 @@
-export * from './multibase-digest/index.js';
+export * from './structured-error.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC"}

package/build/loaders/errors.d.ts

@@ -0,0 +1,21 @@
+import { StructuredError } from '../structured-error.js';
+/**
+ * Base for every diagnostic from `@uncefact/untp-utils/loaders`.
+ * Catch to handle any schema-loader failure generically; catch a concrete
+ * subclass for specific handling.
+ */
+export declare class SchemaLoaderError extends StructuredError {
+}
+/** The network request to the schema URL rejected (DNS failure, connection refused, etc.). */
+export declare class SchemaLoaderNetworkError extends SchemaLoaderError {
+    constructor(url: string, cause: unknown);
+}
+/** The schema URL responded with a non-2xx HTTP status. */
+export declare class SchemaLoaderHttpError extends SchemaLoaderError {
+    readonly status: number;
+    constructor(url: string, status: number);
+}
+/** The schema URL responded with a body that is not parseable as JSON. */
+export declare class SchemaLoaderInvalidJsonError extends SchemaLoaderError {
+    constructor(url: string, cause: unknown);
+}

package/build/loaders/errors.js

@@ -0,0 +1,45 @@
+import { StructuredError } from '../structured-error.js';
+/**
+ * Base for every diagnostic from `@uncefact/untp-utils/loaders`.
+ * Catch to handle any schema-loader failure generically; catch a concrete
+ * subclass for specific handling.
+ */
+export class SchemaLoaderError extends StructuredError {
+}
+/** The network request to the schema URL rejected (DNS failure, connection refused, etc.). */
+export class SchemaLoaderNetworkError extends SchemaLoaderError {
+    constructor(url, cause) {
+        super({
+            code: 'schema-loader.network-error',
+            message: `Could not reach ${url}.`,
+            received: cause instanceof Error ? cause.message : String(cause),
+            expected: `a 2xx response from ${url}`,
+            cause,
+        });
+    }
+}
+/** The schema URL responded with a non-2xx HTTP status. */
+export class SchemaLoaderHttpError extends SchemaLoaderError {
+    status;
+    constructor(url, status) {
+        super({
+            code: 'schema-loader.http-error',
+            message: `${url} returned status ${status}.`,
+            received: status,
+            expected: '2xx',
+        });
+        this.status = status;
+    }
+}
+/** The schema URL responded with a body that is not parseable as JSON. */
+export class SchemaLoaderInvalidJsonError extends SchemaLoaderError {
+    constructor(url, cause) {
+        super({
+            code: 'schema-loader.invalid-json',
+            message: `${url} returned a body that is not valid JSON.`,
+            received: cause instanceof Error ? cause.message : String(cause),
+            cause,
+        });
+    }
+}
+//# sourceMappingURL=errors.js.map

package/build/loaders/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/loaders/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,eAAe;CAAG;AAEzD,8FAA8F;AAC9F,MAAM,OAAO,wBAAyB,SAAQ,iBAAiB;IAC7D,YAAY,GAAW,EAAE,KAAc;QACrC,KAAK,CAAC;YACJ,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,mBAAmB,GAAG,GAAG;YAClC,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAChE,QAAQ,EAAE,uBAAuB,GAAG,EAAE;YACtC,KAAK;SACN,CAAC,CAAC;IACL,CAAC;CACF;AAED,2DAA2D;AAC3D,MAAM,OAAO,qBAAsB,SAAQ,iBAAiB;IACjD,MAAM,CAAS;IACxB,YAAY,GAAW,EAAE,MAAc;QACrC,KAAK,CAAC;YACJ,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,GAAG,GAAG,oBAAoB,MAAM,GAAG;YAC5C,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,4BAA6B,SAAQ,iBAAiB;IACjE,YAAY,GAAW,EAAE,KAAc;QACrC,KAAK,CAAC;YACJ,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,GAAG,GAAG,0CAA0C;YACzD,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAChE,KAAK;SACN,CAAC,CAAC;IACL,CAAC;CACF"}

package/build/loaders/index.d.ts

@@ -0,0 +1,3 @@
+export { SchemaLoaderError, SchemaLoaderNetworkError, SchemaLoaderHttpError, SchemaLoaderInvalidJsonError, } from './errors.js';
+export { createSchemaLoader, type SchemaLoader } from './schema-loader.js';
+export { createJsonLdDocumentLoader, type JsonLdDocumentLoaderOptions, type LoadedRemoteDocument, } from './jsonld-document-loader.js';

package/build/loaders/index.js

@@ -0,0 +1,4 @@
+export { SchemaLoaderError, SchemaLoaderNetworkError, SchemaLoaderHttpError, SchemaLoaderInvalidJsonError, } from './errors.js';
+export { createSchemaLoader } from './schema-loader.js';
+export { createJsonLdDocumentLoader, } from './jsonld-document-loader.js';
+//# sourceMappingURL=index.js.map

package/build/loaders/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/loaders/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,0BAA0B,GAG3B,MAAM,6BAA6B,CAAC"}

package/build/loaders/jsonld-document-loader.d.ts

@@ -0,0 +1,46 @@
+import type { ResolveDocumentOptions } from '../resolvers/index.js';
+import type { TtlCache } from '../cache/ttl-cache.js';
+/**
+ * The subset of jsonld's `RemoteDocument` shape this loader returns. Carries
+ * the fields jsonld.js reads at runtime; it is deliberately not assignable to
+ * `@types/jsonld`'s `RemoteDocument` (whose `document: JsonLd` is narrower
+ * than the `unknown` a fetched body can be), which is one reason the `toRDF`
+ * call site casts its options (see `validateJsonLd`).
+ */
+export interface LoadedRemoteDocument {
+    contextUrl?: string;
+    documentUrl: string;
+    document: unknown;
+}
+/** Options for {@link createJsonLdDocumentLoader}. */
+export interface JsonLdDocumentLoaderOptions extends ResolveDocumentOptions {
+    /** `Accept` header for `@context` fetches. Defaults to JSON-LD then JSON. */
+    accept?: string;
+    /**
+     * Optional cache, keyed by URL, for resolved `@context` documents. When
+     * supplied, a document fetched once is reused for the cache's TTL rather
+     * than re-fetched on every expansion. Only successful fetches are cached
+     * (the {@link TtlCache} contract does not cache rejected fetches), so a
+     * URL the guard rejects is re-checked every time. A successfully fetched
+     * and parsed document is cached even if downstream JSON-LD processing
+     * later rejects it.
+     */
+    cache?: TtlCache<LoadedRemoteDocument>;
+}
+/**
+ * Builds a jsonld document loader that fetches every remote `@context`
+ * document through {@link resolveJsonDocument}, so each URL (and every
+ * redirect hop) passes `validatePublicUrl` and is pinned to the validated IP
+ * before any connection is made, with the resolver's size, timeout, and
+ * redirect bounds applied.
+ *
+ * Without this loader, `jsonld.toRDF` falls back to jsonld.js's default Node
+ * document loader, which fetches `@context` URLs with no SSRF protection: a
+ * crafted `@context` could drive requests to internal or cloud-metadata
+ * addresses during expansion. Wiring this loader in is the JSON-LD
+ * document-loader guard committed to in ADR-033 §7.
+ *
+ * @see ../../../../docs/adrs/033-cvc-architecture.md ADR-033 §7 (Security considerations).
+ * @see https://github.com/uncefact/tests-untp/issues/707
+ */
+export declare function createJsonLdDocumentLoader(options?: JsonLdDocumentLoaderOptions): (url: string) => Promise<LoadedRemoteDocument>;

package/build/loaders/jsonld-document-loader.js

@@ -0,0 +1,34 @@
+/** Default `Accept` for `@context` documents: JSON-LD, falling back to JSON. */
+const CONTEXT_ACCEPT_HEADER = 'application/ld+json, application/json;q=0.9';
+/**
+ * Builds a jsonld document loader that fetches every remote `@context`
+ * document through {@link resolveJsonDocument}, so each URL (and every
+ * redirect hop) passes `validatePublicUrl` and is pinned to the validated IP
+ * before any connection is made, with the resolver's size, timeout, and
+ * redirect bounds applied.
+ *
+ * Without this loader, `jsonld.toRDF` falls back to jsonld.js's default Node
+ * document loader, which fetches `@context` URLs with no SSRF protection: a
+ * crafted `@context` could drive requests to internal or cloud-metadata
+ * addresses during expansion. Wiring this loader in is the JSON-LD
+ * document-loader guard committed to in ADR-033 §7.
+ *
+ * @see ../../../../docs/adrs/033-cvc-architecture.md ADR-033 §7 (Security considerations).
+ * @see https://github.com/uncefact/tests-untp/issues/707
+ */
+export function createJsonLdDocumentLoader(options) {
+    const { cache, accept, ...resolverOptions } = options ?? {};
+    const load = async (url) => {
+        // Lazy import: the resolver stack pulls in undici, which jsdom test
+        // environments cannot evaluate, so it loads at fetch time to keep this
+        // module importable there.
+        const { resolveJsonDocument } = await import('../resolvers/index.js');
+        const { json, finalUrl } = await resolveJsonDocument(url, {
+            ...resolverOptions,
+            accept: accept ?? CONTEXT_ACCEPT_HEADER,
+        });
+        return { documentUrl: finalUrl, document: json };
+    };
+    return cache ? (url) => cache.get(url, () => load(url)) : load;
+}
+//# sourceMappingURL=jsonld-document-loader.js.map

package/build/loaders/jsonld-document-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonld-document-loader.js","sourceRoot":"","sources":["../../src/loaders/jsonld-document-loader.ts"],"names":[],"mappings":"AAgCA,gFAAgF;AAChF,MAAM,qBAAqB,GAAG,6CAA6C,CAAC;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAqC;IAErC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAE5D,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAiC,EAAE;QAChE,oEAAoE;QACpE,uEAAuE;QACvE,2BAA2B;QAC3B,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACtE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE;YACxD,GAAG,eAAe;YAClB,MAAM,EAAE,MAAM,IAAI,qBAAqB;SACxC,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACnD,CAAC,CAAC;IAEF,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC"}

package/build/loaders/jsonld-document-loader.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/loaders/jsonld-document-loader.test.js

@@ -0,0 +1,71 @@
+import { jest } from '@jest/globals';
+import { createInMemoryTtlCache } from '../cache/in-memory-ttl-cache.js';
+const resolveJsonDocument = jest.fn();
+jest.unstable_mockModule('../resolvers/index.js', () => ({
+    resolveJsonDocument,
+}));
+const { createJsonLdDocumentLoader } = await import('./jsonld-document-loader.js');
+describe('createJsonLdDocumentLoader', () => {
+    beforeEach(() => {
+        resolveJsonDocument.mockReset();
+    });
+    it('resolves the URL through resolveJsonDocument and returns the RemoteDocument shape', async () => {
+        resolveJsonDocument.mockResolvedValue({
+            json: { '@context': { name: 'http://schema.org/name' } },
+            finalUrl: 'https://ex.test/ctx',
+        });
+        const result = await createJsonLdDocumentLoader()('https://ex.test/ctx');
+        expect(result).toEqual({
+            documentUrl: 'https://ex.test/ctx',
+            document: { '@context': { name: 'http://schema.org/name' } },
+        });
+    });
+    it('requests JSON-LD via the default Accept', async () => {
+        resolveJsonDocument.mockResolvedValue({ json: {}, finalUrl: 'https://ex.test/ctx' });
+        await createJsonLdDocumentLoader()('https://ex.test/ctx');
+        expect(resolveJsonDocument).toHaveBeenCalledWith('https://ex.test/ctx', expect.objectContaining({ accept: expect.stringContaining('application/ld+json') }));
+    });
+    it('lets the caller override the Accept header', async () => {
+        resolveJsonDocument.mockResolvedValue({ json: {}, finalUrl: 'https://ex.test/ctx' });
+        await createJsonLdDocumentLoader({ accept: 'application/json' })('https://ex.test/ctx');
+        expect(resolveJsonDocument).toHaveBeenCalledWith('https://ex.test/ctx', expect.objectContaining({ accept: 'application/json' }));
+    });
+    it('reports the post-redirect finalUrl as documentUrl', async () => {
+        resolveJsonDocument.mockResolvedValue({ json: {}, finalUrl: 'https://ex.test/final' });
+        const result = await createJsonLdDocumentLoader()('https://ex.test/start');
+        expect(result.documentUrl).toBe('https://ex.test/final');
+    });
+    it('forwards resolver options (e.g. allowedSchemes) to resolveJsonDocument', async () => {
+        resolveJsonDocument.mockResolvedValue({ json: {}, finalUrl: 'https://ex.test/ctx' });
+        await createJsonLdDocumentLoader({ allowedSchemes: ['https'] })('https://ex.test/ctx');
+        expect(resolveJsonDocument).toHaveBeenCalledWith('https://ex.test/ctx', expect.objectContaining({ allowedSchemes: ['https'] }));
+    });
+    it('propagates resolveJsonDocument rejections (SSRF guard, HTTP errors, bad JSON) unchanged', async () => {
+        const guardError = Object.assign(new Error('private address'), { code: 'url.private-address' });
+        resolveJsonDocument.mockRejectedValue(guardError);
+        await expect(createJsonLdDocumentLoader()('http://127.0.0.1/ctx')).rejects.toBe(guardError);
+    });
+    describe('with a cache', () => {
+        it('reuses a resolved context within the TTL instead of re-fetching', async () => {
+            resolveJsonDocument.mockResolvedValue({ json: { '@context': {} }, finalUrl: 'https://ex.test/ctx' });
+            const cache = createInMemoryTtlCache({ ttlMs: 60_000 });
+            const load = createJsonLdDocumentLoader({ cache });
+            await load('https://ex.test/ctx');
+            await load('https://ex.test/ctx');
+            expect(resolveJsonDocument).toHaveBeenCalledTimes(1);
+        });
+        it('does not cache a rejected resolution (re-checks next time)', async () => {
+            const cache = createInMemoryTtlCache({ ttlMs: 60_000 });
+            const load = createJsonLdDocumentLoader({ cache });
+            resolveJsonDocument.mockRejectedValueOnce(new Error('blocked'));
+            await expect(load('https://ex.test/ctx')).rejects.toThrow('blocked');
+            resolveJsonDocument.mockResolvedValueOnce({ json: {}, finalUrl: 'https://ex.test/ctx' });
+            await expect(load('https://ex.test/ctx')).resolves.toEqual({
+                documentUrl: 'https://ex.test/ctx',
+                document: {},
+            });
+            expect(resolveJsonDocument).toHaveBeenCalledTimes(2);
+        });
+    });
+});
+//# sourceMappingURL=jsonld-document-loader.test.js.map

package/build/loaders/jsonld-document-loader.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonld-document-loader.test.js","sourceRoot":"","sources":["../../src/loaders/jsonld-document-loader.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAGzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;AAEtC,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;IACvD,mBAAmB;CACpB,CAAC,CAAC,CAAC;AAEJ,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAEnF,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,UAAU,CAAC,GAAG,EAAE;QACd,mBAAmB,CAAC,SAAS,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,mBAAmB,CAAC,iBAAiB,CAAC;YACpC,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,EAAE;YACxD,QAAQ,EAAE,qBAAqB;SACvB,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG,MAAM,0BAA0B,EAAE,CAAC,qBAAqB,CAAC,CAAC;QAEzE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,WAAW,EAAE,qBAAqB;YAClC,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAW,CAAC,CAAC;QAE9F,MAAM,0BAA0B,EAAE,CAAC,qBAAqB,CAAC,CAAC;QAE1D,MAAM,CAAC,mBAAmB,CAAC,CAAC,oBAAoB,CAC9C,qBAAqB,EACrB,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,CAAC,CACpF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAW,CAAC,CAAC;QAE9F,MAAM,0BAA0B,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAExF,MAAM,CAAC,mBAAmB,CAAC,CAAC,oBAAoB,CAC9C,qBAAqB,EACrB,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CACxD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAW,CAAC,CAAC;QAEhG,MAAM,MAAM,GAAG,MAAM,0BAA0B,EAAE,CAAC,uBAAuB,CAAC,CAAC;QAE3E,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAW,CAAC,CAAC;QAE9F,MAAM,0BAA0B,CAAC,EAAE,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAEvF,MAAM,CAAC,mBAAmB,CAAC,CAAC,oBAAoB,CAC9C,qBAAqB,EACrB,MAAM,CAAC,gBAAgB,CAAC,EAAE,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CACvD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChG,mBAAmB,CAAC,iBAAiB,CAAC,UAAmB,CAAC,CAAC;QAE3D,MAAM,MAAM,CAAC,0BAA0B,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;YAC/E,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAW,CAAC,CAAC;YAC9G,MAAM,KAAK,GAAG,sBAAsB,CAAuB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAEnD,MAAM,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAClC,MAAM,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAElC,MAAM,CAAC,mBAAmB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;YAC1E,MAAM,KAAK,GAAG,sBAAsB,CAAuB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,mBAAmB,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,SAAS,CAAU,CAAC,CAAC;YAEzE,MAAM,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrE,mBAAmB,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAW,CAAC,CAAC;YAClG,MAAM,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACzD,WAAW,EAAE,qBAAqB;gBAClC,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;YACH,MAAM,CAAC,mBAAmB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}