@fedify/vocab-runtime 2.2.0 → 2.2.2

package/deno.json

@@ -1,10 +1,11 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",
-    "./jsonld": "./src/jsonld.ts"
+    "./jsonld": "./src/jsonld.ts",
+    "./temporal": "./src/temporal.ts"
   },
   "description": "Runtime library for @fedify/vocab",
   "author": {
@@ -13,6 +14,7 @@
     "url": "https://hongminhee.org/"
   },
   "imports": {
+    "@js-temporal/polyfill": "npm:@js-temporal/polyfill@^0.5.1",
     "@multiformats/base-x": "npm:@multiformats/base-x@^4.0.1",
     "asn1js": "npm:asn1js@^3.0.6",
     "byte-encodings": "npm:byte-encodings@^1.0.11",

package/dist/{chunk-CKQMccvm.cjs → chunk-M78iaK0I.cjs}

@@ -1,3 +1,4 @@
+
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;

package/dist/jsonld.cjs

@@ -1,4 +1,5 @@
-const require_chunk = require("./chunk-CKQMccvm.cjs");
+
+const require_chunk = require("./chunk-M78iaK0I.cjs");
 let jsonld_dist_jsonld_esm_js = require("jsonld/dist/jsonld.esm.js");
 jsonld_dist_jsonld_esm_js = require_chunk.__toESM(jsonld_dist_jsonld_esm_js);
 //#region src/jsonld.ts

package/dist/jsonld.d.cts

@@ -1,3 +1,4 @@
+/// <reference lib="esnext.temporal" />
 import * as _$jsonld from "jsonld";
 
 //#region src/jsonld.d.ts

package/dist/jsonld.d.ts

@@ -1,3 +1,4 @@
+/// <reference lib="esnext.temporal" />
 import * as _$jsonld from "jsonld";
 
 //#region src/jsonld.d.ts

package/dist/jsonld.js

@@ -1,3 +1,4 @@
+
 import jsonld from "jsonld/dist/jsonld.esm.js";
 //#region src/jsonld.ts
 var jsonld_default = jsonld;

package/dist/mod.cjs

@@ -1,5 +1,6 @@
+
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_chunk = require("./chunk-CKQMccvm.cjs");
+const require_chunk = require("./chunk-M78iaK0I.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 let node_process = require("node:process");
@@ -4383,7 +4384,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.2.0";
+var version = "2.2.2";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4650,8 +4651,13 @@ async function validatePublicUrl(url) {
 	const parsed = new URL(url);
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
 	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.substring(1, hostname.length - 2);
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
 	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const hostnameFamily = (0, node_net.isIP)(hostname);
+	if (hostnameFamily !== 0) {
+		validatePublicIpAddress(hostname, hostnameFamily);
+		return;
+	}
 	if ("Deno" in globalThis && !(0, node_net.isIP)(hostname)) {
 		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	}
@@ -4665,7 +4671,11 @@ async function validatePublicUrl(url) {
 	} catch {
 		addresses = [];
 	}
-	for (const { address, family } of addresses) if (family === 4 && !isValidPublicIPv4Address(address) || family === 6 && !isValidPublicIPv6Address(address) || family < 4 || family === 5 || family > 6) throw new UrlError(`Invalid or private address: ${address}`);
+	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
 }
 function isValidPublicIPv4Address(address) {
 	const parts = address.split(".");

package/dist/mod.d.cts

@@ -1,3 +1,4 @@
+/// <reference lib="esnext.temporal" />
 import { Logger } from "@logtape/logtape";
 
 //#region src/contexts.d.ts

package/dist/mod.d.ts

@@ -1,3 +1,4 @@
+/// <reference lib="esnext.temporal" />
 import { Logger } from "@logtape/logtape";
 
 //#region src/contexts.d.ts

package/dist/mod.js

@@ -1,3 +1,4 @@
+
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import process from "node:process";
@@ -4379,7 +4380,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.2.0";
+var version = "2.2.2";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4646,8 +4647,13 @@ async function validatePublicUrl(url) {
 	const parsed = new URL(url);
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
 	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.substring(1, hostname.length - 2);
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
 	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const hostnameFamily = isIP(hostname);
+	if (hostnameFamily !== 0) {
+		validatePublicIpAddress(hostname, hostnameFamily);
+		return;
+	}
 	if ("Deno" in globalThis && !isIP(hostname)) {
 		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	}
@@ -4661,7 +4667,11 @@ async function validatePublicUrl(url) {
 	} catch {
 		addresses = [];
 	}
-	for (const { address, family } of addresses) if (family === 4 && !isValidPublicIPv4Address(address) || family === 6 && !isValidPublicIPv6Address(address) || family < 4 || family === 5 || family > 6) throw new UrlError(`Invalid or private address: ${address}`);
+	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
 }
 function isValidPublicIPv4Address(address) {
 	const parts = address.split(".");

package/dist/temporal.cjs

@@ -0,0 +1,60 @@
+
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/temporal.ts
+/**
+* Type guards for `Temporal` namespace objects.
+*
+* Fedify accepts both runtime polyfills (e.g. `@js-temporal/polyfill`,
+* `temporal-polyfill`) and the host's native `Temporal` implementation
+* (Node.js 26+, Bun, Deno). The guards below rely on `Symbol.toStringTag`,
+* which is mandated by the Temporal specification, so they accept any
+* spec-conformant implementation regardless of which class produced the
+* value.
+*
+* @module
+*/
+/**
+* Checks whether the given value is a `Temporal.Instant` object, regardless
+* of whether it came from a polyfill or the host's native implementation.
+*
+* The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+* `epochNanoseconds` accessor exposes a `bigint`, and that `toString` is
+* not the default inherited from `Object.prototype`.  Together they reject
+* bare objects whose tag was set to `"Temporal.Instant"` without exposing
+* the rest of the shape; the `toString` check in particular prevents a
+* spoof from reaching the JSON-LD serializer (which calls `toString()`)
+* and emitting `"[object Temporal.Instant]"` instead of an RFC 3339
+* timestamp.
+*
+* @param value The value to test.
+* @returns `true` if the value reports `Temporal.Instant` via
+*          `Symbol.toStringTag`, exposes a `bigint`-valued
+*          `epochNanoseconds`, and overrides `toString`; `false` otherwise.
+*/
+function isTemporalInstant(value) {
+	return typeof value === "object" && value !== null && Object.prototype.toString.call(value) === "[object Temporal.Instant]" && "epochNanoseconds" in value && typeof value.epochNanoseconds === "bigint" && "toString" in value && typeof value.toString === "function" && value.toString !== Object.prototype.toString;
+}
+/**
+* Checks whether the given value is a `Temporal.Duration` object, regardless
+* of whether it came from a polyfill or the host's native implementation.
+*
+* The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+* `sign` accessor returns one of the three spec-valid values (`-1`, `0`,
+* or `1`), and that `toString` is not the default inherited from
+* `Object.prototype`.  Together they reject bare objects whose tag was set
+* to `"Temporal.Duration"` without exposing the rest of the shape; the
+* `toString` check in particular prevents a spoof from reaching the
+* JSON-LD serializer (which calls `toString()`) and emitting
+* `"[object Temporal.Duration]"` instead of an ISO 8601 duration.
+*
+* @param value The value to test.
+* @returns `true` if the value reports `Temporal.Duration` via
+*          `Symbol.toStringTag`, exposes a `sign` of `-1`, `0`, or `1`,
+*          and overrides `toString`; `false` otherwise.
+*/
+function isTemporalDuration(value) {
+	return typeof value === "object" && value !== null && Object.prototype.toString.call(value) === "[object Temporal.Duration]" && "sign" in value && (value.sign === -1 || value.sign === 0 || value.sign === 1) && "toString" in value && typeof value.toString === "function" && value.toString !== Object.prototype.toString;
+}
+//#endregion
+exports.isTemporalDuration = isTemporalDuration;
+exports.isTemporalInstant = isTemporalInstant;

package/dist/temporal.d.cts

@@ -0,0 +1,54 @@
+/// <reference lib="esnext.temporal" />
+//#region src/temporal.d.ts
+/**
+* Type guards for `Temporal` namespace objects.
+*
+* Fedify accepts both runtime polyfills (e.g. `@js-temporal/polyfill`,
+* `temporal-polyfill`) and the host's native `Temporal` implementation
+* (Node.js 26+, Bun, Deno). The guards below rely on `Symbol.toStringTag`,
+* which is mandated by the Temporal specification, so they accept any
+* spec-conformant implementation regardless of which class produced the
+* value.
+*
+* @module
+*/
+/**
+* Checks whether the given value is a `Temporal.Instant` object, regardless
+* of whether it came from a polyfill or the host's native implementation.
+*
+* The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+* `epochNanoseconds` accessor exposes a `bigint`, and that `toString` is
+* not the default inherited from `Object.prototype`.  Together they reject
+* bare objects whose tag was set to `"Temporal.Instant"` without exposing
+* the rest of the shape; the `toString` check in particular prevents a
+* spoof from reaching the JSON-LD serializer (which calls `toString()`)
+* and emitting `"[object Temporal.Instant]"` instead of an RFC 3339
+* timestamp.
+*
+* @param value The value to test.
+* @returns `true` if the value reports `Temporal.Instant` via
+*          `Symbol.toStringTag`, exposes a `bigint`-valued
+*          `epochNanoseconds`, and overrides `toString`; `false` otherwise.
+*/
+declare function isTemporalInstant(value: unknown): value is Temporal.Instant;
+/**
+* Checks whether the given value is a `Temporal.Duration` object, regardless
+* of whether it came from a polyfill or the host's native implementation.
+*
+* The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+* `sign` accessor returns one of the three spec-valid values (`-1`, `0`,
+* or `1`), and that `toString` is not the default inherited from
+* `Object.prototype`.  Together they reject bare objects whose tag was set
+* to `"Temporal.Duration"` without exposing the rest of the shape; the
+* `toString` check in particular prevents a spoof from reaching the
+* JSON-LD serializer (which calls `toString()`) and emitting
+* `"[object Temporal.Duration]"` instead of an ISO 8601 duration.
+*
+* @param value The value to test.
+* @returns `true` if the value reports `Temporal.Duration` via
+*          `Symbol.toStringTag`, exposes a `sign` of `-1`, `0`, or `1`,
+*          and overrides `toString`; `false` otherwise.
+*/
+declare function isTemporalDuration(value: unknown): value is Temporal.Duration;
+//#endregion
+export { isTemporalDuration, isTemporalInstant };

package/dist/temporal.d.ts

@@ -0,0 +1,54 @@
+/// <reference lib="esnext.temporal" />
+//#region src/temporal.d.ts
+/**
+* Type guards for `Temporal` namespace objects.
+*
+* Fedify accepts both runtime polyfills (e.g. `@js-temporal/polyfill`,
+* `temporal-polyfill`) and the host's native `Temporal` implementation
+* (Node.js 26+, Bun, Deno). The guards below rely on `Symbol.toStringTag`,
+* which is mandated by the Temporal specification, so they accept any
+* spec-conformant implementation regardless of which class produced the
+* value.
+*
+* @module
+*/
+/**
+* Checks whether the given value is a `Temporal.Instant` object, regardless
+* of whether it came from a polyfill or the host's native implementation.
+*
+* The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+* `epochNanoseconds` accessor exposes a `bigint`, and that `toString` is
+* not the default inherited from `Object.prototype`.  Together they reject
+* bare objects whose tag was set to `"Temporal.Instant"` without exposing
+* the rest of the shape; the `toString` check in particular prevents a
+* spoof from reaching the JSON-LD serializer (which calls `toString()`)
+* and emitting `"[object Temporal.Instant]"` instead of an RFC 3339
+* timestamp.
+*
+* @param value The value to test.
+* @returns `true` if the value reports `Temporal.Instant` via
+*          `Symbol.toStringTag`, exposes a `bigint`-valued
+*          `epochNanoseconds`, and overrides `toString`; `false` otherwise.
+*/
+declare function isTemporalInstant(value: unknown): value is Temporal.Instant;
+/**
+* Checks whether the given value is a `Temporal.Duration` object, regardless
+* of whether it came from a polyfill or the host's native implementation.
+*
+* The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+* `sign` accessor returns one of the three spec-valid values (`-1`, `0`,
+* or `1`), and that `toString` is not the default inherited from
+* `Object.prototype`.  Together they reject bare objects whose tag was set
+* to `"Temporal.Duration"` without exposing the rest of the shape; the
+* `toString` check in particular prevents a spoof from reaching the
+* JSON-LD serializer (which calls `toString()`) and emitting
+* `"[object Temporal.Duration]"` instead of an ISO 8601 duration.
+*
+* @param value The value to test.
+* @returns `true` if the value reports `Temporal.Duration` via
+*          `Symbol.toStringTag`, exposes a `sign` of `-1`, `0`, or `1`,
+*          and overrides `toString`; `false` otherwise.
+*/
+declare function isTemporalDuration(value: unknown): value is Temporal.Duration;
+//#endregion
+export { isTemporalDuration, isTemporalInstant };

package/dist/temporal.js

@@ -0,0 +1,58 @@
+
+//#region src/temporal.ts
+/**
+* Type guards for `Temporal` namespace objects.
+*
+* Fedify accepts both runtime polyfills (e.g. `@js-temporal/polyfill`,
+* `temporal-polyfill`) and the host's native `Temporal` implementation
+* (Node.js 26+, Bun, Deno). The guards below rely on `Symbol.toStringTag`,
+* which is mandated by the Temporal specification, so they accept any
+* spec-conformant implementation regardless of which class produced the
+* value.
+*
+* @module
+*/
+/**
+* Checks whether the given value is a `Temporal.Instant` object, regardless
+* of whether it came from a polyfill or the host's native implementation.
+*
+* The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+* `epochNanoseconds` accessor exposes a `bigint`, and that `toString` is
+* not the default inherited from `Object.prototype`.  Together they reject
+* bare objects whose tag was set to `"Temporal.Instant"` without exposing
+* the rest of the shape; the `toString` check in particular prevents a
+* spoof from reaching the JSON-LD serializer (which calls `toString()`)
+* and emitting `"[object Temporal.Instant]"` instead of an RFC 3339
+* timestamp.
+*
+* @param value The value to test.
+* @returns `true` if the value reports `Temporal.Instant` via
+*          `Symbol.toStringTag`, exposes a `bigint`-valued
+*          `epochNanoseconds`, and overrides `toString`; `false` otherwise.
+*/
+function isTemporalInstant(value) {
+	return typeof value === "object" && value !== null && Object.prototype.toString.call(value) === "[object Temporal.Instant]" && "epochNanoseconds" in value && typeof value.epochNanoseconds === "bigint" && "toString" in value && typeof value.toString === "function" && value.toString !== Object.prototype.toString;
+}
+/**
+* Checks whether the given value is a `Temporal.Duration` object, regardless
+* of whether it came from a polyfill or the host's native implementation.
+*
+* The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+* `sign` accessor returns one of the three spec-valid values (`-1`, `0`,
+* or `1`), and that `toString` is not the default inherited from
+* `Object.prototype`.  Together they reject bare objects whose tag was set
+* to `"Temporal.Duration"` without exposing the rest of the shape; the
+* `toString` check in particular prevents a spoof from reaching the
+* JSON-LD serializer (which calls `toString()`) and emitting
+* `"[object Temporal.Duration]"` instead of an ISO 8601 duration.
+*
+* @param value The value to test.
+* @returns `true` if the value reports `Temporal.Duration` via
+*          `Symbol.toStringTag`, exposes a `sign` of `-1`, `0`, or `1`,
+*          and overrides `toString`; `false` otherwise.
+*/
+function isTemporalDuration(value) {
+	return typeof value === "object" && value !== null && Object.prototype.toString.call(value) === "[object Temporal.Duration]" && "sign" in value && (value.sign === -1 || value.sign === 0 || value.sign === 1) && "toString" in value && typeof value.toString === "function" && value.toString !== Object.prototype.toString;
+}
+//#endregion
+export { isTemporalDuration, isTemporalInstant };

package/dist/tests/decimal.test.cjs

@@ -1,5 +1,5 @@
 require("./chunk-Do9eywBl.cjs");
-require("./docloader-Cm8MkfmU.cjs");
+require("./docloader-CNFRvB3y.cjs");
 require("./key-DTTIntwb.cjs");
 require("./multibase-F7LtMMsK.cjs");
 require("./langstr-CbAxaeEZ.cjs");

package/dist/tests/decimal.test.mjs

@@ -1,4 +1,4 @@
-import "./docloader-0xxbBwa9.mjs";
+import "./docloader-bbaLrO6y.mjs";
 import "./key-BeTHFQJK.mjs";
 import "./multibase-BgU9XRf7.mjs";
 import "./langstr-Di5AvKpB.mjs";

package/dist/tests/{docloader-Cm8MkfmU.cjs → docloader-CNFRvB3y.cjs}

@@ -1,7 +1,7 @@
 require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-DLk6MHw1.cjs");
+const require_request = require("./request-BDej45SV.cjs");
 const require_link = require("./link-FguCydMA.cjs");
-const require_url = require("./url-pFuSds44.cjs");
+const require_url = require("./url-Cj9-Ycue.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _opentelemetry_api = require("@opentelemetry/api");
 //#region src/contexts/activitystreams.json

package/dist/tests/{docloader-0xxbBwa9.mjs → docloader-bbaLrO6y.mjs}

@@ -1,6 +1,6 @@
-import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-peBUF_HC.mjs";
+import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-BrFKK0nk.mjs";
 import { t as HttpHeaderLink } from "./link-NUUWCdnK.mjs";
-import { a as validatePublicUrl, t as UrlError } from "./url-BQ_kgmCk.mjs";
+import { a as validatePublicUrl, t as UrlError } from "./url-BzGwIxB4.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#region src/contexts/activitystreams.json

package/dist/tests/docloader.test.cjs

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Do9eywBl.cjs");
-const require_docloader = require("./docloader-Cm8MkfmU.cjs");
-const require_request = require("./request-DLk6MHw1.cjs");
-const require_url = require("./url-pFuSds44.cjs");
+const require_docloader = require("./docloader-CNFRvB3y.cjs");
+const require_request = require("./request-BDej45SV.cjs");
+const require_url = require("./url-Cj9-Ycue.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 //#region ../../node_modules/.pnpm/glob-to-regexp@0.4.1/node_modules/glob-to-regexp/index.js

package/dist/tests/docloader.test.mjs

@@ -1,6 +1,6 @@
-import { n as preloadedContexts, t as getDocumentLoader } from "./docloader-0xxbBwa9.mjs";
-import { t as FetchError } from "./request-peBUF_HC.mjs";
-import { t as UrlError } from "./url-BQ_kgmCk.mjs";
+import { n as preloadedContexts, t as getDocumentLoader } from "./docloader-bbaLrO6y.mjs";
+import { t as FetchError } from "./request-BrFKK0nk.mjs";
+import { t as UrlError } from "./url-BzGwIxB4.mjs";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
 //#region \0rolldown/runtime.js

package/dist/tests/{request-DLk6MHw1.cjs → request-BDej45SV.cjs}

@@ -3,7 +3,7 @@ let node_process = require("node:process");
 node_process = require_chunk.__toESM(node_process);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.2.0";
+var version = "2.2.2";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/{request-peBUF_HC.mjs → request-BrFKK0nk.mjs}

@@ -1,7 +1,7 @@
 import process from "node:process";
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.2.0";
+var version = "2.2.2";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/request.test.cjs

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Do9eywBl.cjs");
-const require_request = require("./request-DLk6MHw1.cjs");
+const require_request = require("./request-BDej45SV.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 let node_process = require("node:process");

package/dist/tests/request.test.mjs

@@ -1,4 +1,4 @@
-import { o as version, r as getUserAgent } from "./request-peBUF_HC.mjs";
+import { o as version, r as getUserAgent } from "./request-BrFKK0nk.mjs";
 import { deepStrictEqual } from "node:assert";
 import { test } from "node:test";
 import process from "node:process";

package/dist/tests/temporal.test.cjs

@@ -0,0 +1,134 @@
+require("./chunk-Do9eywBl.cjs");
+let node_assert = require("node:assert");
+let node_test = require("node:test");
+let _js_temporal_polyfill = require("@js-temporal/polyfill");
+//#region src/temporal.ts
+/**
+* Type guards for `Temporal` namespace objects.
+*
+* Fedify accepts both runtime polyfills (e.g. `@js-temporal/polyfill`,
+* `temporal-polyfill`) and the host's native `Temporal` implementation
+* (Node.js 26+, Bun, Deno). The guards below rely on `Symbol.toStringTag`,
+* which is mandated by the Temporal specification, so they accept any
+* spec-conformant implementation regardless of which class produced the
+* value.
+*
+* @module
+*/
+/**
+* Checks whether the given value is a `Temporal.Instant` object, regardless
+* of whether it came from a polyfill or the host's native implementation.
+*
+* The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+* `epochNanoseconds` accessor exposes a `bigint`, and that `toString` is
+* not the default inherited from `Object.prototype`.  Together they reject
+* bare objects whose tag was set to `"Temporal.Instant"` without exposing
+* the rest of the shape; the `toString` check in particular prevents a
+* spoof from reaching the JSON-LD serializer (which calls `toString()`)
+* and emitting `"[object Temporal.Instant]"` instead of an RFC 3339
+* timestamp.
+*
+* @param value The value to test.
+* @returns `true` if the value reports `Temporal.Instant` via
+*          `Symbol.toStringTag`, exposes a `bigint`-valued
+*          `epochNanoseconds`, and overrides `toString`; `false` otherwise.
+*/
+function isTemporalInstant(value) {
+	return typeof value === "object" && value !== null && Object.prototype.toString.call(value) === "[object Temporal.Instant]" && "epochNanoseconds" in value && typeof value.epochNanoseconds === "bigint" && "toString" in value && typeof value.toString === "function" && value.toString !== Object.prototype.toString;
+}
+/**
+* Checks whether the given value is a `Temporal.Duration` object, regardless
+* of whether it came from a polyfill or the host's native implementation.
+*
+* The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+* `sign` accessor returns one of the three spec-valid values (`-1`, `0`,
+* or `1`), and that `toString` is not the default inherited from
+* `Object.prototype`.  Together they reject bare objects whose tag was set
+* to `"Temporal.Duration"` without exposing the rest of the shape; the
+* `toString` check in particular prevents a spoof from reaching the
+* JSON-LD serializer (which calls `toString()`) and emitting
+* `"[object Temporal.Duration]"` instead of an ISO 8601 duration.
+*
+* @param value The value to test.
+* @returns `true` if the value reports `Temporal.Duration` via
+*          `Symbol.toStringTag`, exposes a `sign` of `-1`, `0`, or `1`,
+*          and overrides `toString`; `false` otherwise.
+*/
+function isTemporalDuration(value) {
+	return typeof value === "object" && value !== null && Object.prototype.toString.call(value) === "[object Temporal.Duration]" && "sign" in value && (value.sign === -1 || value.sign === 0 || value.sign === 1) && "toString" in value && typeof value.toString === "function" && value.toString !== Object.prototype.toString;
+}
+//#endregion
+//#region src/temporal.test.ts
+(0, node_test.test)("isTemporalInstant() accepts polyfill instances", () => {
+	(0, node_assert.strictEqual)(isTemporalInstant(_js_temporal_polyfill.Temporal.Instant.from("2026-05-14T00:00:00Z")), true);
+});
+(0, node_test.test)("isTemporalInstant() accepts spec-compliant non-polyfill objects", () => {
+	(0, node_assert.strictEqual)(isTemporalInstant(Object.create(null, {
+		[Symbol.toStringTag]: { value: "Temporal.Instant" },
+		epochNanoseconds: { value: 0n },
+		toString: { value: () => "1970-01-01T00:00:00Z" }
+	})), true);
+});
+(0, node_test.test)("isTemporalInstant() rejects unrelated values", () => {
+	(0, node_assert.strictEqual)(isTemporalInstant(null), false);
+	(0, node_assert.strictEqual)(isTemporalInstant(void 0), false);
+	(0, node_assert.strictEqual)(isTemporalInstant("2026-05-14T00:00:00Z"), false);
+	(0, node_assert.strictEqual)(isTemporalInstant(/* @__PURE__ */ new Date()), false);
+	(0, node_assert.strictEqual)(isTemporalInstant(_js_temporal_polyfill.Temporal.Duration.from({ seconds: 1 })), false);
+});
+(0, node_test.test)("isTemporalInstant() rejects bare objects tagged but missing shape", () => {
+	(0, node_assert.strictEqual)(isTemporalInstant(Object.create(null, { [Symbol.toStringTag]: { value: "Temporal.Instant" } })), false);
+});
+(0, node_test.test)("isTemporalInstant() rejects non-bigint epochNanoseconds", () => {
+	(0, node_assert.strictEqual)(isTemporalInstant(Object.create(null, {
+		[Symbol.toStringTag]: { value: "Temporal.Instant" },
+		epochNanoseconds: { value: 0 },
+		toString: { value: () => "1970-01-01T00:00:00Z" }
+	})), false);
+});
+(0, node_test.test)("isTemporalInstant() rejects default Object.prototype.toString", () => {
+	(0, node_assert.strictEqual)(isTemporalInstant({
+		[Symbol.toStringTag]: "Temporal.Instant",
+		epochNanoseconds: 0n
+	}), false);
+});
+(0, node_test.test)("isTemporalDuration() accepts polyfill instances", () => {
+	(0, node_assert.strictEqual)(isTemporalDuration(_js_temporal_polyfill.Temporal.Duration.from({ hours: 1 })), true);
+});
+(0, node_test.test)("isTemporalDuration() accepts spec-compliant non-polyfill objects", () => {
+	(0, node_assert.strictEqual)(isTemporalDuration(Object.create(null, {
+		[Symbol.toStringTag]: { value: "Temporal.Duration" },
+		sign: { value: 0 },
+		toString: { value: () => "PT0S" }
+	})), true);
+});
+(0, node_test.test)("isTemporalDuration() rejects unrelated values", () => {
+	(0, node_assert.strictEqual)(isTemporalDuration(null), false);
+	(0, node_assert.strictEqual)(isTemporalDuration(void 0), false);
+	(0, node_assert.strictEqual)(isTemporalDuration("PT1H"), false);
+	(0, node_assert.strictEqual)(isTemporalDuration(_js_temporal_polyfill.Temporal.Instant.from("2026-05-14T00:00:00Z")), false);
+});
+(0, node_test.test)("isTemporalDuration() rejects bare objects tagged but missing shape", () => {
+	(0, node_assert.strictEqual)(isTemporalDuration(Object.create(null, { [Symbol.toStringTag]: { value: "Temporal.Duration" } })), false);
+});
+(0, node_test.test)("isTemporalDuration() rejects non-number sign", () => {
+	(0, node_assert.strictEqual)(isTemporalDuration(Object.create(null, {
+		[Symbol.toStringTag]: { value: "Temporal.Duration" },
+		sign: { value: "0" },
+		toString: { value: () => "PT0S" }
+	})), false);
+});
+(0, node_test.test)("isTemporalDuration() rejects out-of-range sign values", () => {
+	(0, node_assert.strictEqual)(isTemporalDuration(Object.create(null, {
+		[Symbol.toStringTag]: { value: "Temporal.Duration" },
+		sign: { value: 42 },
+		toString: { value: () => "PT42S" }
+	})), false);
+});
+(0, node_test.test)("isTemporalDuration() rejects default Object.prototype.toString", () => {
+	(0, node_assert.strictEqual)(isTemporalDuration({
+		[Symbol.toStringTag]: "Temporal.Duration",
+		sign: 0
+	}), false);
+});
+//#endregion

package/dist/tests/temporal.test.d.cts

@@ -0,0 +1 @@
+export { };

package/dist/tests/temporal.test.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/tests/temporal.test.mjs

@@ -0,0 +1,134 @@
+import { strictEqual } from "node:assert";
+import { test } from "node:test";
+import { Temporal } from "@js-temporal/polyfill";
+//#region src/temporal.ts
+/**
+* Type guards for `Temporal` namespace objects.
+*
+* Fedify accepts both runtime polyfills (e.g. `@js-temporal/polyfill`,
+* `temporal-polyfill`) and the host's native `Temporal` implementation
+* (Node.js 26+, Bun, Deno). The guards below rely on `Symbol.toStringTag`,
+* which is mandated by the Temporal specification, so they accept any
+* spec-conformant implementation regardless of which class produced the
+* value.
+*
+* @module
+*/
+/**
+* Checks whether the given value is a `Temporal.Instant` object, regardless
+* of whether it came from a polyfill or the host's native implementation.
+*
+* The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+* `epochNanoseconds` accessor exposes a `bigint`, and that `toString` is
+* not the default inherited from `Object.prototype`.  Together they reject
+* bare objects whose tag was set to `"Temporal.Instant"` without exposing
+* the rest of the shape; the `toString` check in particular prevents a
+* spoof from reaching the JSON-LD serializer (which calls `toString()`)
+* and emitting `"[object Temporal.Instant]"` instead of an RFC 3339
+* timestamp.
+*
+* @param value The value to test.
+* @returns `true` if the value reports `Temporal.Instant` via
+*          `Symbol.toStringTag`, exposes a `bigint`-valued
+*          `epochNanoseconds`, and overrides `toString`; `false` otherwise.
+*/
+function isTemporalInstant(value) {
+	return typeof value === "object" && value !== null && Object.prototype.toString.call(value) === "[object Temporal.Instant]" && "epochNanoseconds" in value && typeof value.epochNanoseconds === "bigint" && "toString" in value && typeof value.toString === "function" && value.toString !== Object.prototype.toString;
+}
+/**
+* Checks whether the given value is a `Temporal.Duration` object, regardless
+* of whether it came from a polyfill or the host's native implementation.
+*
+* The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+* `sign` accessor returns one of the three spec-valid values (`-1`, `0`,
+* or `1`), and that `toString` is not the default inherited from
+* `Object.prototype`.  Together they reject bare objects whose tag was set
+* to `"Temporal.Duration"` without exposing the rest of the shape; the
+* `toString` check in particular prevents a spoof from reaching the
+* JSON-LD serializer (which calls `toString()`) and emitting
+* `"[object Temporal.Duration]"` instead of an ISO 8601 duration.
+*
+* @param value The value to test.
+* @returns `true` if the value reports `Temporal.Duration` via
+*          `Symbol.toStringTag`, exposes a `sign` of `-1`, `0`, or `1`,
+*          and overrides `toString`; `false` otherwise.
+*/
+function isTemporalDuration(value) {
+	return typeof value === "object" && value !== null && Object.prototype.toString.call(value) === "[object Temporal.Duration]" && "sign" in value && (value.sign === -1 || value.sign === 0 || value.sign === 1) && "toString" in value && typeof value.toString === "function" && value.toString !== Object.prototype.toString;
+}
+//#endregion
+//#region src/temporal.test.ts
+test("isTemporalInstant() accepts polyfill instances", () => {
+	strictEqual(isTemporalInstant(Temporal.Instant.from("2026-05-14T00:00:00Z")), true);
+});
+test("isTemporalInstant() accepts spec-compliant non-polyfill objects", () => {
+	strictEqual(isTemporalInstant(Object.create(null, {
+		[Symbol.toStringTag]: { value: "Temporal.Instant" },
+		epochNanoseconds: { value: 0n },
+		toString: { value: () => "1970-01-01T00:00:00Z" }
+	})), true);
+});
+test("isTemporalInstant() rejects unrelated values", () => {
+	strictEqual(isTemporalInstant(null), false);
+	strictEqual(isTemporalInstant(void 0), false);
+	strictEqual(isTemporalInstant("2026-05-14T00:00:00Z"), false);
+	strictEqual(isTemporalInstant(/* @__PURE__ */ new Date()), false);
+	strictEqual(isTemporalInstant(Temporal.Duration.from({ seconds: 1 })), false);
+});
+test("isTemporalInstant() rejects bare objects tagged but missing shape", () => {
+	strictEqual(isTemporalInstant(Object.create(null, { [Symbol.toStringTag]: { value: "Temporal.Instant" } })), false);
+});
+test("isTemporalInstant() rejects non-bigint epochNanoseconds", () => {
+	strictEqual(isTemporalInstant(Object.create(null, {
+		[Symbol.toStringTag]: { value: "Temporal.Instant" },
+		epochNanoseconds: { value: 0 },
+		toString: { value: () => "1970-01-01T00:00:00Z" }
+	})), false);
+});
+test("isTemporalInstant() rejects default Object.prototype.toString", () => {
+	strictEqual(isTemporalInstant({
+		[Symbol.toStringTag]: "Temporal.Instant",
+		epochNanoseconds: 0n
+	}), false);
+});
+test("isTemporalDuration() accepts polyfill instances", () => {
+	strictEqual(isTemporalDuration(Temporal.Duration.from({ hours: 1 })), true);
+});
+test("isTemporalDuration() accepts spec-compliant non-polyfill objects", () => {
+	strictEqual(isTemporalDuration(Object.create(null, {
+		[Symbol.toStringTag]: { value: "Temporal.Duration" },
+		sign: { value: 0 },
+		toString: { value: () => "PT0S" }
+	})), true);
+});
+test("isTemporalDuration() rejects unrelated values", () => {
+	strictEqual(isTemporalDuration(null), false);
+	strictEqual(isTemporalDuration(void 0), false);
+	strictEqual(isTemporalDuration("PT1H"), false);
+	strictEqual(isTemporalDuration(Temporal.Instant.from("2026-05-14T00:00:00Z")), false);
+});
+test("isTemporalDuration() rejects bare objects tagged but missing shape", () => {
+	strictEqual(isTemporalDuration(Object.create(null, { [Symbol.toStringTag]: { value: "Temporal.Duration" } })), false);
+});
+test("isTemporalDuration() rejects non-number sign", () => {
+	strictEqual(isTemporalDuration(Object.create(null, {
+		[Symbol.toStringTag]: { value: "Temporal.Duration" },
+		sign: { value: "0" },
+		toString: { value: () => "PT0S" }
+	})), false);
+});
+test("isTemporalDuration() rejects out-of-range sign values", () => {
+	strictEqual(isTemporalDuration(Object.create(null, {
+		[Symbol.toStringTag]: { value: "Temporal.Duration" },
+		sign: { value: 42 },
+		toString: { value: () => "PT42S" }
+	})), false);
+});
+test("isTemporalDuration() rejects default Object.prototype.toString", () => {
+	strictEqual(isTemporalDuration({
+		[Symbol.toStringTag]: "Temporal.Duration",
+		sign: 0
+	}), false);
+});
+//#endregion
+export {};

package/dist/tests/{url-BQ_kgmCk.mjs → url-BzGwIxB4.mjs}

@@ -14,8 +14,13 @@ async function validatePublicUrl(url) {
 	const parsed = new URL(url);
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
 	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.substring(1, hostname.length - 2);
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
 	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const hostnameFamily = isIP(hostname);
+	if (hostnameFamily !== 0) {
+		validatePublicIpAddress(hostname, hostnameFamily);
+		return;
+	}
 	if ("Deno" in globalThis && !isIP(hostname)) {
 		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	}
@@ -29,7 +34,11 @@ async function validatePublicUrl(url) {
 	} catch {
 		addresses = [];
 	}
-	for (const { address, family } of addresses) if (family === 4 && !isValidPublicIPv4Address(address) || family === 6 && !isValidPublicIPv6Address(address) || family < 4 || family === 5 || family > 6) throw new UrlError(`Invalid or private address: ${address}`);
+	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
 }
 function isValidPublicIPv4Address(address) {
 	const parts = address.split(".");

package/dist/tests/{url-pFuSds44.cjs → url-Cj9-Ycue.cjs}

@@ -15,8 +15,13 @@ async function validatePublicUrl(url) {
 	const parsed = new URL(url);
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
 	let hostname = parsed.hostname;
-	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.substring(1, hostname.length - 2);
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
 	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const hostnameFamily = (0, node_net.isIP)(hostname);
+	if (hostnameFamily !== 0) {
+		validatePublicIpAddress(hostname, hostnameFamily);
+		return;
+	}
 	if ("Deno" in globalThis && !(0, node_net.isIP)(hostname)) {
 		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	}
@@ -30,7 +35,11 @@ async function validatePublicUrl(url) {
 	} catch {
 		addresses = [];
 	}
-	for (const { address, family } of addresses) if (family === 4 && !isValidPublicIPv4Address(address) || family === 6 && !isValidPublicIPv6Address(address) || family < 4 || family === 5 || family > 6) throw new UrlError(`Invalid or private address: ${address}`);
+	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
 }
 function isValidPublicIPv4Address(address) {
 	const parts = address.split(".");

package/dist/tests/url.test.cjs

@@ -1,5 +1,5 @@
 require("./chunk-Do9eywBl.cjs");
-const require_url = require("./url-pFuSds44.cjs");
+const require_url = require("./url-Cj9-Ycue.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 //#region src/url.test.ts
@@ -9,6 +9,8 @@ let node_test = require("node:test");
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://localhost"), require_url.UrlError);
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://127.0.0.1"), require_url.UrlError);
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[::1]"), require_url.UrlError);
+	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("http://[::ffff:7f00:1]/"), require_url.UrlError);
+	await require_url.validatePublicUrl("https://[2001:db8::1]");
 });
 (0, node_test.test)("isValidPublicIPv4Address()", () => {
 	(0, node_assert.ok)(require_url.isValidPublicIPv4Address("8.8.8.8"));
@@ -25,6 +27,7 @@ let node_test = require("node:test");
 	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("fe80::1"));
 	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("ff00::1"));
 	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("::"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("::ffff:7f00:1"));
 });
 (0, node_test.test)("expandIPv6Address()", () => {
 	(0, node_assert.deepStrictEqual)(require_url.expandIPv6Address("::"), "0000:0000:0000:0000:0000:0000:0000:0000");

package/dist/tests/url.test.mjs

@@ -1,4 +1,4 @@
-import { a as validatePublicUrl, i as isValidPublicIPv6Address, n as expandIPv6Address, r as isValidPublicIPv4Address, t as UrlError } from "./url-BQ_kgmCk.mjs";
+import { a as validatePublicUrl, i as isValidPublicIPv6Address, n as expandIPv6Address, r as isValidPublicIPv4Address, t as UrlError } from "./url-BzGwIxB4.mjs";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
 //#region src/url.test.ts
@@ -8,6 +8,8 @@ test("validatePublicUrl()", async () => {
 	await rejects(() => validatePublicUrl("https://localhost"), UrlError);
 	await rejects(() => validatePublicUrl("https://127.0.0.1"), UrlError);
 	await rejects(() => validatePublicUrl("https://[::1]"), UrlError);
+	await rejects(() => validatePublicUrl("http://[::ffff:7f00:1]/"), UrlError);
+	await validatePublicUrl("https://[2001:db8::1]");
 });
 test("isValidPublicIPv4Address()", () => {
 	ok(isValidPublicIPv4Address("8.8.8.8"));
@@ -24,6 +26,7 @@ test("isValidPublicIPv6Address()", () => {
 	ok(!isValidPublicIPv6Address("fe80::1"));
 	ok(!isValidPublicIPv6Address("ff00::1"));
 	ok(!isValidPublicIPv6Address("::"));
+	ok(!isValidPublicIPv6Address("::ffff:7f00:1"));
 });
 test("expandIPv6Address()", () => {
 	deepStrictEqual(expandIPv6Address("::"), "0000:0000:0000:0000:0000:0000:0000:0000");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -45,6 +45,16 @@
       "require": "./dist/jsonld.cjs",
       "default": "./dist/jsonld.js"
     },
+    "./temporal": {
+      "types": {
+        "import": "./dist/temporal.d.ts",
+        "require": "./dist/temporal.d.cts",
+        "default": "./dist/temporal.d.ts"
+      },
+      "import": "./dist/temporal.js",
+      "require": "./dist/temporal.cjs",
+      "default": "./dist/temporal.js"
+    },
     "./package.json": "./package.json"
   },
   "keywords": [
@@ -62,9 +72,10 @@
     "@types/node": "^24.2.1",
     "fetch-mock": "^12.5.4",
     "tsdown": "^0.21.6",
-    "typescript": "^5.9.2"
+    "typescript": "^6.0.0"
   },
   "dependencies": {
+    "@js-temporal/polyfill": "^0.5.1",
     "@logtape/logtape": "^2.0.5",
     "@multiformats/base-x": "^4.0.1",
     "@opentelemetry/api": "^1.9.0",

package/src/temporal.test.ts

@@ -0,0 +1,121 @@
+import { Temporal } from "@js-temporal/polyfill";
+import { strictEqual } from "node:assert";
+import { test } from "node:test";
+import { isTemporalDuration, isTemporalInstant } from "./temporal.ts";
+
+test("isTemporalInstant() accepts polyfill instances", () => {
+  strictEqual(
+    isTemporalInstant(Temporal.Instant.from("2026-05-14T00:00:00Z")),
+    true,
+  );
+});
+
+test("isTemporalInstant() accepts spec-compliant non-polyfill objects", () => {
+  // Mimics the shape of a native `Temporal.Instant` from a host that does
+  // not share class identity with the bundled polyfill.
+  const nativeLike = Object.create(null, {
+    [Symbol.toStringTag]: { value: "Temporal.Instant" },
+    epochNanoseconds: { value: 0n },
+    toString: { value: () => "1970-01-01T00:00:00Z" },
+  });
+  strictEqual(isTemporalInstant(nativeLike), true);
+});
+
+test("isTemporalInstant() rejects unrelated values", () => {
+  strictEqual(isTemporalInstant(null), false);
+  strictEqual(isTemporalInstant(undefined), false);
+  strictEqual(isTemporalInstant("2026-05-14T00:00:00Z"), false);
+  strictEqual(isTemporalInstant(new Date()), false);
+  strictEqual(
+    isTemporalInstant(Temporal.Duration.from({ seconds: 1 })),
+    false,
+  );
+});
+
+test("isTemporalInstant() rejects bare objects tagged but missing shape", () => {
+  const decoy = Object.create(null, {
+    [Symbol.toStringTag]: { value: "Temporal.Instant" },
+  });
+  strictEqual(isTemporalInstant(decoy), false);
+});
+
+test("isTemporalInstant() rejects non-bigint epochNanoseconds", () => {
+  const decoy = Object.create(null, {
+    [Symbol.toStringTag]: { value: "Temporal.Instant" },
+    epochNanoseconds: { value: 0 },
+    toString: { value: () => "1970-01-01T00:00:00Z" },
+  });
+  strictEqual(isTemporalInstant(decoy), false);
+});
+
+test("isTemporalInstant() rejects default Object.prototype.toString", () => {
+  // A plain object inherits `toString` from `Object.prototype`, so calling
+  // it would produce `"[object Temporal.Instant]"` instead of an RFC 3339
+  // timestamp.  The guard must reject these to keep the serializer honest.
+  const decoy = {
+    [Symbol.toStringTag]: "Temporal.Instant",
+    epochNanoseconds: 0n,
+  };
+  strictEqual(isTemporalInstant(decoy), false);
+});
+
+test("isTemporalDuration() accepts polyfill instances", () => {
+  strictEqual(
+    isTemporalDuration(Temporal.Duration.from({ hours: 1 })),
+    true,
+  );
+});
+
+test("isTemporalDuration() accepts spec-compliant non-polyfill objects", () => {
+  const nativeLike = Object.create(null, {
+    [Symbol.toStringTag]: { value: "Temporal.Duration" },
+    sign: { value: 0 },
+    toString: { value: () => "PT0S" },
+  });
+  strictEqual(isTemporalDuration(nativeLike), true);
+});
+
+test("isTemporalDuration() rejects unrelated values", () => {
+  strictEqual(isTemporalDuration(null), false);
+  strictEqual(isTemporalDuration(undefined), false);
+  strictEqual(isTemporalDuration("PT1H"), false);
+  strictEqual(
+    isTemporalDuration(Temporal.Instant.from("2026-05-14T00:00:00Z")),
+    false,
+  );
+});
+
+test("isTemporalDuration() rejects bare objects tagged but missing shape", () => {
+  const decoy = Object.create(null, {
+    [Symbol.toStringTag]: { value: "Temporal.Duration" },
+  });
+  strictEqual(isTemporalDuration(decoy), false);
+});
+
+test("isTemporalDuration() rejects non-number sign", () => {
+  const decoy = Object.create(null, {
+    [Symbol.toStringTag]: { value: "Temporal.Duration" },
+    sign: { value: "0" },
+    toString: { value: () => "PT0S" },
+  });
+  strictEqual(isTemporalDuration(decoy), false);
+});
+
+test("isTemporalDuration() rejects out-of-range sign values", () => {
+  // Real Temporal.Duration#sign is `-1 | 0 | 1` per spec, so anything else
+  // (here, 42) must be rejected even though it is a number.
+  const decoy = Object.create(null, {
+    [Symbol.toStringTag]: { value: "Temporal.Duration" },
+    sign: { value: 42 },
+    toString: { value: () => "PT42S" },
+  });
+  strictEqual(isTemporalDuration(decoy), false);
+});
+
+test("isTemporalDuration() rejects default Object.prototype.toString", () => {
+  const decoy = {
+    [Symbol.toStringTag]: "Temporal.Duration",
+    sign: 0,
+  };
+  strictEqual(isTemporalDuration(decoy), false);
+});

package/src/temporal.ts

@@ -0,0 +1,74 @@
+/**
+ * Type guards for `Temporal` namespace objects.
+ *
+ * Fedify accepts both runtime polyfills (e.g. `@js-temporal/polyfill`,
+ * `temporal-polyfill`) and the host's native `Temporal` implementation
+ * (Node.js 26+, Bun, Deno). The guards below rely on `Symbol.toStringTag`,
+ * which is mandated by the Temporal specification, so they accept any
+ * spec-conformant implementation regardless of which class produced the
+ * value.
+ *
+ * @module
+ */
+
+/**
+ * Checks whether the given value is a `Temporal.Instant` object, regardless
+ * of whether it came from a polyfill or the host's native implementation.
+ *
+ * The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+ * `epochNanoseconds` accessor exposes a `bigint`, and that `toString` is
+ * not the default inherited from `Object.prototype`.  Together they reject
+ * bare objects whose tag was set to `"Temporal.Instant"` without exposing
+ * the rest of the shape; the `toString` check in particular prevents a
+ * spoof from reaching the JSON-LD serializer (which calls `toString()`)
+ * and emitting `"[object Temporal.Instant]"` instead of an RFC 3339
+ * timestamp.
+ *
+ * @param value The value to test.
+ * @returns `true` if the value reports `Temporal.Instant` via
+ *          `Symbol.toStringTag`, exposes a `bigint`-valued
+ *          `epochNanoseconds`, and overrides `toString`; `false` otherwise.
+ */
+export function isTemporalInstant(value: unknown): value is Temporal.Instant {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    Object.prototype.toString.call(value) === "[object Temporal.Instant]" &&
+    "epochNanoseconds" in value &&
+    typeof value.epochNanoseconds === "bigint" &&
+    "toString" in value &&
+    typeof value.toString === "function" &&
+    value.toString !== Object.prototype.toString
+  );
+}
+
+/**
+ * Checks whether the given value is a `Temporal.Duration` object, regardless
+ * of whether it came from a polyfill or the host's native implementation.
+ *
+ * The guard verifies the spec-mandated `Symbol.toStringTag`, that the
+ * `sign` accessor returns one of the three spec-valid values (`-1`, `0`,
+ * or `1`), and that `toString` is not the default inherited from
+ * `Object.prototype`.  Together they reject bare objects whose tag was set
+ * to `"Temporal.Duration"` without exposing the rest of the shape; the
+ * `toString` check in particular prevents a spoof from reaching the
+ * JSON-LD serializer (which calls `toString()`) and emitting
+ * `"[object Temporal.Duration]"` instead of an ISO 8601 duration.
+ *
+ * @param value The value to test.
+ * @returns `true` if the value reports `Temporal.Duration` via
+ *          `Symbol.toStringTag`, exposes a `sign` of `-1`, `0`, or `1`,
+ *          and overrides `toString`; `false` otherwise.
+ */
+export function isTemporalDuration(value: unknown): value is Temporal.Duration {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    Object.prototype.toString.call(value) === "[object Temporal.Duration]" &&
+    "sign" in value &&
+    (value.sign === -1 || value.sign === 0 || value.sign === 1) &&
+    "toString" in value &&
+    typeof value.toString === "function" &&
+    value.toString !== Object.prototype.toString
+  );
+}

package/src/url.test.ts

@@ -19,6 +19,11 @@ test("validatePublicUrl()", async () => {
   await rejects(() => validatePublicUrl("https://localhost"), UrlError);
   await rejects(() => validatePublicUrl("https://127.0.0.1"), UrlError);
   await rejects(() => validatePublicUrl("https://[::1]"), UrlError);
+  await rejects(
+    () => validatePublicUrl("http://[::ffff:7f00:1]/"),
+    UrlError,
+  );
+  await validatePublicUrl("https://[2001:db8::1]");
 });
 
 test("isValidPublicIPv4Address()", () => {
@@ -37,6 +42,7 @@ test("isValidPublicIPv6Address()", () => {
   ok(!isValidPublicIPv6Address("fe80::1")); // link-local
   ok(!isValidPublicIPv6Address("ff00::1")); // multicast
   ok(!isValidPublicIPv6Address("::")); // unspecified
+  ok(!isValidPublicIPv6Address("::ffff:7f00:1")); // IPv4-mapped
 });
 
 test("expandIPv6Address()", () => {

package/src/url.ts

@@ -19,11 +19,16 @@ export async function validatePublicUrl(url: string): Promise<void> {
   }
   let hostname = parsed.hostname;
   if (hostname.startsWith("[") && hostname.endsWith("]")) {
-    hostname = hostname.substring(1, hostname.length - 2);
+    hostname = hostname.slice(1, -1);
   }
   if (hostname === "localhost") {
     throw new UrlError("Localhost is not allowed");
   }
+  const hostnameFamily = isIP(hostname);
+  if (hostnameFamily !== 0) {
+    validatePublicIpAddress(hostname, hostnameFamily);
+    return;
+  }
   if ("Deno" in globalThis && !isIP(hostname)) {
     // If the `net` permission is not granted, we can't resolve the hostname.
     // However, we can safely assume that it cannot gain access to private
@@ -50,14 +55,18 @@ export async function validatePublicUrl(url: string): Promise<void> {
     addresses = [];
   }
   for (const { address, family } of addresses) {
-    if (
-      family === 4 && !isValidPublicIPv4Address(address) ||
-      family === 6 && !isValidPublicIPv6Address(address) ||
-      family < 4 || family === 5 || family > 6
-    ) {
-      throw new UrlError(`Invalid or private address: ${address}`);
-    }
+    validatePublicIpAddress(address, family);
+  }
+}
+
+function validatePublicIpAddress(address: string, family: number): void {
+  if (
+    family === 4 && isValidPublicIPv4Address(address) ||
+    family === 6 && isValidPublicIPv6Address(address)
+  ) {
+    return;
   }
+  throw new UrlError(`Invalid or private address: ${address}`);
 }
 
 export function isValidPublicIPv4Address(address: string): boolean {

package/tsdown.config.ts

@@ -4,11 +4,14 @@ import { defineConfig } from "tsdown";
 
 export default [
   defineConfig({
-    entry: ["src/mod.ts", "src/jsonld.ts"],
+    entry: ["src/mod.ts", "src/jsonld.ts", "src/temporal.ts"],
     dts: { compilerOptions: { isolatedDeclarations: true, declaration: true } },
     format: ["esm", "cjs"],
     platform: "neutral",
     external: [/^node:/],
+    banner: {
+      dts: `/// <reference lib="esnext.temporal" />`,
+    },
   }),
   defineConfig({
     outDir: "dist/tests",