@fedify/vocab-runtime 2.3.0-dev.994 → 2.3.0-pr.809.36

package/dist/tests/url-C20FhC7p.cjs

@@ -0,0 +1,206 @@
+require("./chunk-C2EiDwsr.cjs");
+let node_dns_promises = require("node:dns/promises");
+let node_net = require("node:net");
+//#region src/url.ts
+var UrlError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "UrlError";
+	}
+};
+/**
+* Validates a URL to prevent SSRF attacks.
+*/
+async function validatePublicUrl(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
+	let hostname = parsed.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const hostnameFamily = (0, node_net.isIP)(hostname);
+	if (hostnameFamily !== 0) {
+		validatePublicIpAddress(hostname, hostnameFamily);
+		return;
+	}
+	if ("Deno" in globalThis && !(0, node_net.isIP)(hostname)) {
+		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
+	}
+	if ("Bun" in globalThis) {
+		if (hostname === "example.com" || hostname.endsWith(".example.com")) return;
+		else if (hostname === "fedify-test.internal") throw new UrlError("Invalid or private address: fedify-test.internal");
+	}
+	let addresses;
+	try {
+		addresses = await (0, node_dns_promises.lookup)(hostname, { all: true });
+	} catch {
+		addresses = [];
+	}
+	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
+}
+function isValidPublicIPv4Address(address) {
+	const parts = parseIPv4Address(address);
+	if (parts == null) return false;
+	const value = ipv4PartsToNumber(parts);
+	return !nonPublicIPv4Prefixes.some(({ base, prefix }) => matchesIPv4Prefix(value, base, prefix));
+}
+function isValidPublicIPv6Address(address) {
+	const words = parseIPv6Address(address);
+	if (words == null) return false;
+	if (nonPublicIPv6Prefixes.some(({ words: prefixWords, prefix }) => matchesIPv6Prefix(words, prefixWords, prefix))) return false;
+	for (const { extractIPv4, prefix, words: prefixWords } of ipv6WithIPv4Prefixes) {
+		if (!matchesIPv6Prefix(words, prefixWords, prefix)) continue;
+		const ipv4Address = extractIPv4(words);
+		if (ipv4Address != null && !isValidPublicIPv4Address(ipv4Address)) return false;
+	}
+	return true;
+}
+function expandIPv6Address(address) {
+	address = address.toLowerCase();
+	const ipv4Delimiter = address.lastIndexOf(":");
+	if (address.includes(".") && ipv4Delimiter >= 0) {
+		const ipv4Parts = parseIPv4Address(address.substring(ipv4Delimiter + 1));
+		if (ipv4Parts == null) return address;
+		const high = (ipv4Parts[0] << 8) + ipv4Parts[1];
+		const low = (ipv4Parts[2] << 8) + ipv4Parts[3];
+		address = address.substring(0, ipv4Delimiter + 1) + high.toString(16) + ":" + low.toString(16);
+	}
+	if (address === "::") return "0000:0000:0000:0000:0000:0000:0000:0000";
+	if (address.startsWith("::")) address = "0000" + address;
+	if (address.endsWith("::")) address = address + "0000";
+	address = address.replace("::", ":0000".repeat(8 - (address.match(/:/g) || []).length) + ":");
+	return address.split(":").map((part) => part.padStart(4, "0")).join(":");
+}
+const nonPublicIPv4Prefixes = [
+	ipv4Prefix("0.0.0.0/8", "RFC 6890"),
+	ipv4Prefix("10.0.0.0/8", "RFC 1918"),
+	ipv4Prefix("100.64.0.0/10", "RFC 6598"),
+	ipv4Prefix("127.0.0.0/8", "RFC 1122"),
+	ipv4Prefix("169.254.0.0/16", "RFC 3927"),
+	ipv4Prefix("172.16.0.0/12", "RFC 1918"),
+	ipv4Prefix("192.0.0.0/24", "RFC 6890"),
+	ipv4Prefix("192.0.2.0/24", "RFC 5737"),
+	ipv4Prefix("192.88.99.0/24", "RFC 7526"),
+	ipv4Prefix("192.168.0.0/16", "RFC 1918"),
+	ipv4Prefix("198.18.0.0/15", "RFC 2544"),
+	ipv4Prefix("198.51.100.0/24", "RFC 5737"),
+	ipv4Prefix("203.0.113.0/24", "RFC 5737"),
+	ipv4Prefix("224.0.0.0/4", "RFC 5771"),
+	ipv4Prefix("240.0.0.0/4", "RFC 1112")
+];
+const nonPublicIPv6Prefixes = [
+	ipv6Prefix("::/16", "RFC 4291"),
+	ipv6Prefix("2001::/32", "RFC 4380"),
+	ipv6Prefix("2002::/16", "RFC 3056"),
+	ipv6Prefix("64:ff9b:1::/48", "RFC 8215"),
+	ipv6Prefix("fc00::/7", "RFC 4193"),
+	ipv6Prefix("fe80::/10", "RFC 4291"),
+	ipv6Prefix("ff00::/8", "RFC 4291")
+];
+const ipv6WithIPv4Prefixes = [{
+	...ipv6Prefix("64:ff9b::/96", "RFC 6052"),
+	extractIPv4: (words) => ipv4FromWords(words[6], words[7])
+}];
+function ipv4Prefix(cidr, rfc) {
+	const [address, prefixText] = cidr.split("/");
+	const prefix = parseInt(prefixText, 10);
+	const parts = parseIPv4Address(address);
+	if (parts == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) throw new Error(`Invalid IPv4 prefix: ${cidr}`);
+	return {
+		cidr,
+		base: ipv4PartsToNumber(parts),
+		prefix,
+		rfc
+	};
+}
+function ipv6Prefix(cidr, rfc) {
+	const [address, prefixText] = cidr.split("/");
+	const prefix = parseInt(prefixText, 10);
+	const words = parseIPv6Address(address);
+	if (words == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 128) throw new Error(`Invalid IPv6 prefix: ${cidr}`);
+	return {
+		cidr,
+		words,
+		prefix,
+		rfc
+	};
+}
+function parseIPv4Address(address) {
+	const parts = address.split(".").map((part) => {
+		if (!/^\d+$/.test(part)) return NaN;
+		return parseInt(part, 10);
+	});
+	if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;
+	return parts;
+}
+function parseIPv6Address(address) {
+	const parts = expandIPv6Address(address).split(":");
+	if (parts.length !== 8) return null;
+	const words = parts.map((part) => {
+		if (!/^[0-9a-f]{1,4}$/i.test(part)) return NaN;
+		return parseInt(part, 16);
+	});
+	if (words.some((word) => !Number.isInteger(word) || word < 0 || word > 65535)) return null;
+	return words;
+}
+function ipv4PartsToNumber(parts) {
+	return parts[0] * 2 ** 24 + parts[1] * 2 ** 16 + parts[2] * 2 ** 8 + parts[3];
+}
+function ipv4FromWords(highWord, lowWord) {
+	return [
+		highWord >> 8,
+		highWord & 255,
+		lowWord >> 8,
+		lowWord & 255
+	].join(".");
+}
+function matchesIPv4Prefix(address, prefixBase, prefixLength) {
+	const blockSize = 2 ** (32 - prefixLength);
+	return Math.floor(address / blockSize) === Math.floor(prefixBase / blockSize);
+}
+function matchesIPv6Prefix(address, prefixWords, prefixLength) {
+	let remaining = prefixLength;
+	for (let i = 0; i < 8 && remaining > 0; i++) if (remaining >= 16) {
+		if (address[i] !== prefixWords[i]) return false;
+		remaining -= 16;
+	} else {
+		const mask = 65535 << 16 - remaining & 65535;
+		if ((address[i] & mask) !== (prefixWords[i] & mask)) return false;
+		remaining = 0;
+	}
+	return true;
+}
+//#endregion
+Object.defineProperty(exports, "UrlError", {
+	enumerable: true,
+	get: function() {
+		return UrlError;
+	}
+});
+Object.defineProperty(exports, "expandIPv6Address", {
+	enumerable: true,
+	get: function() {
+		return expandIPv6Address;
+	}
+});
+Object.defineProperty(exports, "isValidPublicIPv4Address", {
+	enumerable: true,
+	get: function() {
+		return isValidPublicIPv4Address;
+	}
+});
+Object.defineProperty(exports, "isValidPublicIPv6Address", {
+	enumerable: true,
+	get: function() {
+		return isValidPublicIPv6Address;
+	}
+});
+Object.defineProperty(exports, "validatePublicUrl", {
+	enumerable: true,
+	get: function() {
+		return validatePublicUrl;
+	}
+});

package/dist/tests/url-m9Qzxy-Y.mjs

@@ -0,0 +1,176 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+//#region src/url.ts
+var UrlError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "UrlError";
+	}
+};
+/**
+* Validates a URL to prevent SSRF attacks.
+*/
+async function validatePublicUrl(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
+	let hostname = parsed.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const hostnameFamily = isIP(hostname);
+	if (hostnameFamily !== 0) {
+		validatePublicIpAddress(hostname, hostnameFamily);
+		return;
+	}
+	if ("Deno" in globalThis && !isIP(hostname)) {
+		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
+	}
+	if ("Bun" in globalThis) {
+		if (hostname === "example.com" || hostname.endsWith(".example.com")) return;
+		else if (hostname === "fedify-test.internal") throw new UrlError("Invalid or private address: fedify-test.internal");
+	}
+	let addresses;
+	try {
+		addresses = await lookup(hostname, { all: true });
+	} catch {
+		addresses = [];
+	}
+	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
+}
+function isValidPublicIPv4Address(address) {
+	const parts = parseIPv4Address(address);
+	if (parts == null) return false;
+	const value = ipv4PartsToNumber(parts);
+	return !nonPublicIPv4Prefixes.some(({ base, prefix }) => matchesIPv4Prefix(value, base, prefix));
+}
+function isValidPublicIPv6Address(address) {
+	const words = parseIPv6Address(address);
+	if (words == null) return false;
+	if (nonPublicIPv6Prefixes.some(({ words: prefixWords, prefix }) => matchesIPv6Prefix(words, prefixWords, prefix))) return false;
+	for (const { extractIPv4, prefix, words: prefixWords } of ipv6WithIPv4Prefixes) {
+		if (!matchesIPv6Prefix(words, prefixWords, prefix)) continue;
+		const ipv4Address = extractIPv4(words);
+		if (ipv4Address != null && !isValidPublicIPv4Address(ipv4Address)) return false;
+	}
+	return true;
+}
+function expandIPv6Address(address) {
+	address = address.toLowerCase();
+	const ipv4Delimiter = address.lastIndexOf(":");
+	if (address.includes(".") && ipv4Delimiter >= 0) {
+		const ipv4Parts = parseIPv4Address(address.substring(ipv4Delimiter + 1));
+		if (ipv4Parts == null) return address;
+		const high = (ipv4Parts[0] << 8) + ipv4Parts[1];
+		const low = (ipv4Parts[2] << 8) + ipv4Parts[3];
+		address = address.substring(0, ipv4Delimiter + 1) + high.toString(16) + ":" + low.toString(16);
+	}
+	if (address === "::") return "0000:0000:0000:0000:0000:0000:0000:0000";
+	if (address.startsWith("::")) address = "0000" + address;
+	if (address.endsWith("::")) address = address + "0000";
+	address = address.replace("::", ":0000".repeat(8 - (address.match(/:/g) || []).length) + ":");
+	return address.split(":").map((part) => part.padStart(4, "0")).join(":");
+}
+const nonPublicIPv4Prefixes = [
+	ipv4Prefix("0.0.0.0/8", "RFC 6890"),
+	ipv4Prefix("10.0.0.0/8", "RFC 1918"),
+	ipv4Prefix("100.64.0.0/10", "RFC 6598"),
+	ipv4Prefix("127.0.0.0/8", "RFC 1122"),
+	ipv4Prefix("169.254.0.0/16", "RFC 3927"),
+	ipv4Prefix("172.16.0.0/12", "RFC 1918"),
+	ipv4Prefix("192.0.0.0/24", "RFC 6890"),
+	ipv4Prefix("192.0.2.0/24", "RFC 5737"),
+	ipv4Prefix("192.88.99.0/24", "RFC 7526"),
+	ipv4Prefix("192.168.0.0/16", "RFC 1918"),
+	ipv4Prefix("198.18.0.0/15", "RFC 2544"),
+	ipv4Prefix("198.51.100.0/24", "RFC 5737"),
+	ipv4Prefix("203.0.113.0/24", "RFC 5737"),
+	ipv4Prefix("224.0.0.0/4", "RFC 5771"),
+	ipv4Prefix("240.0.0.0/4", "RFC 1112")
+];
+const nonPublicIPv6Prefixes = [
+	ipv6Prefix("::/16", "RFC 4291"),
+	ipv6Prefix("2001::/32", "RFC 4380"),
+	ipv6Prefix("2002::/16", "RFC 3056"),
+	ipv6Prefix("64:ff9b:1::/48", "RFC 8215"),
+	ipv6Prefix("fc00::/7", "RFC 4193"),
+	ipv6Prefix("fe80::/10", "RFC 4291"),
+	ipv6Prefix("ff00::/8", "RFC 4291")
+];
+const ipv6WithIPv4Prefixes = [{
+	...ipv6Prefix("64:ff9b::/96", "RFC 6052"),
+	extractIPv4: (words) => ipv4FromWords(words[6], words[7])
+}];
+function ipv4Prefix(cidr, rfc) {
+	const [address, prefixText] = cidr.split("/");
+	const prefix = parseInt(prefixText, 10);
+	const parts = parseIPv4Address(address);
+	if (parts == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) throw new Error(`Invalid IPv4 prefix: ${cidr}`);
+	return {
+		cidr,
+		base: ipv4PartsToNumber(parts),
+		prefix,
+		rfc
+	};
+}
+function ipv6Prefix(cidr, rfc) {
+	const [address, prefixText] = cidr.split("/");
+	const prefix = parseInt(prefixText, 10);
+	const words = parseIPv6Address(address);
+	if (words == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 128) throw new Error(`Invalid IPv6 prefix: ${cidr}`);
+	return {
+		cidr,
+		words,
+		prefix,
+		rfc
+	};
+}
+function parseIPv4Address(address) {
+	const parts = address.split(".").map((part) => {
+		if (!/^\d+$/.test(part)) return NaN;
+		return parseInt(part, 10);
+	});
+	if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;
+	return parts;
+}
+function parseIPv6Address(address) {
+	const parts = expandIPv6Address(address).split(":");
+	if (parts.length !== 8) return null;
+	const words = parts.map((part) => {
+		if (!/^[0-9a-f]{1,4}$/i.test(part)) return NaN;
+		return parseInt(part, 16);
+	});
+	if (words.some((word) => !Number.isInteger(word) || word < 0 || word > 65535)) return null;
+	return words;
+}
+function ipv4PartsToNumber(parts) {
+	return parts[0] * 2 ** 24 + parts[1] * 2 ** 16 + parts[2] * 2 ** 8 + parts[3];
+}
+function ipv4FromWords(highWord, lowWord) {
+	return [
+		highWord >> 8,
+		highWord & 255,
+		lowWord >> 8,
+		lowWord & 255
+	].join(".");
+}
+function matchesIPv4Prefix(address, prefixBase, prefixLength) {
+	const blockSize = 2 ** (32 - prefixLength);
+	return Math.floor(address / blockSize) === Math.floor(prefixBase / blockSize);
+}
+function matchesIPv6Prefix(address, prefixWords, prefixLength) {
+	let remaining = prefixLength;
+	for (let i = 0; i < 8 && remaining > 0; i++) if (remaining >= 16) {
+		if (address[i] !== prefixWords[i]) return false;
+		remaining -= 16;
+	} else {
+		const mask = 65535 << 16 - remaining & 65535;
+		if ((address[i] & mask) !== (prefixWords[i] & mask)) return false;
+		remaining = 0;
+	}
+	return true;
+}
+//#endregion
+export { validatePublicUrl as a, isValidPublicIPv6Address as i, expandIPv6Address as n, isValidPublicIPv4Address as r, UrlError as t };

package/dist/tests/url.test.cjs

@@ -1,5 +1,5 @@
-require("./chunk-Do9eywBl.cjs");
-const require_url = require("./url-pFuSds44.cjs");
+require("./chunk-C2EiDwsr.cjs");
+const require_url = require("./url-C20FhC7p.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 //#region src/url.test.ts
@@ -9,6 +9,25 @@ let node_test = require("node:test");
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://localhost"), require_url.UrlError);
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://127.0.0.1"), require_url.UrlError);
 	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[::1]"), require_url.UrlError);
+	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("http://[::ffff:7f00:1]/"), require_url.UrlError);
+	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[64:ff9b::7f00:1]/"), require_url.UrlError);
+	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[64:ff9b::a00:1]/"), require_url.UrlError);
+	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[64:ff9b:1::a00:1]/"), require_url.UrlError);
+	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[64:ff9b:1::808:808]/"), require_url.UrlError);
+	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[2001::]/"), require_url.UrlError);
+	await (0, node_assert.rejects)(() => require_url.validatePublicUrl("https://[2002:a00:1::]/"), require_url.UrlError);
+	for (const url of [
+		"https://100.64.0.1",
+		"https://198.18.0.1",
+		"https://224.0.0.1",
+		"https://240.0.0.1",
+		"https://192.0.2.1",
+		"https://192.88.99.1",
+		"https://198.51.100.1",
+		"https://203.0.113.1"
+	]) await (0, node_assert.rejects)(() => require_url.validatePublicUrl(url), require_url.UrlError);
+	await require_url.validatePublicUrl("https://[2001:db8::1]");
+	await require_url.validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
 (0, node_test.test)("isValidPublicIPv4Address()", () => {
 	(0, node_assert.ok)(require_url.isValidPublicIPv4Address("8.8.8.8"));
@@ -17,6 +36,24 @@ let node_test = require("node:test");
 	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("10.0.0.1"));
 	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("127.16.0.1"));
 	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("169.254.0.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("100.64.0.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("100.127.255.255"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.0.0.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.0.2.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.88.99.0"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.88.99.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.88.99.2"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("192.88.99.255"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("198.18.0.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("198.19.255.255"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("198.51.100.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("203.0.113.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("224.0.0.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("239.255.255.255"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("240.0.0.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("255.255.255.255"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("1.2.3"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv4Address("999.1.1.1"));
 });
 (0, node_test.test)("isValidPublicIPv6Address()", () => {
 	(0, node_assert.ok)(require_url.isValidPublicIPv6Address("2001:db8::1"));
@@ -25,11 +62,28 @@ let node_test = require("node:test");
 	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("fe80::1"));
 	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("ff00::1"));
 	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("::"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("::ffff:7f00:1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b::7f00:1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b::127.0.0.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b::a00:1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b::10.0.0.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b:1::"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b:1::a00:1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("64:ff9b:1::10.0.0.1"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("2001::"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("2001:0:4136:e378:8000:63bf:3fff:fdd2"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("2002:a00:1::"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("2002:7f00:1::"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("2002:c0a8:1::"));
+	(0, node_assert.ok)(!require_url.isValidPublicIPv6Address("2002:a9fe:1::"));
+	(0, node_assert.ok)(require_url.isValidPublicIPv6Address("64:ff9b::808:808"));
+	(0, node_assert.ok)(require_url.isValidPublicIPv6Address("64:ff9b::8.8.8.8"));
 });
 (0, node_test.test)("expandIPv6Address()", () => {
 	(0, node_assert.deepStrictEqual)(require_url.expandIPv6Address("::"), "0000:0000:0000:0000:0000:0000:0000:0000");
 	(0, node_assert.deepStrictEqual)(require_url.expandIPv6Address("::1"), "0000:0000:0000:0000:0000:0000:0000:0001");
 	(0, node_assert.deepStrictEqual)(require_url.expandIPv6Address("2001:db8::"), "2001:0db8:0000:0000:0000:0000:0000:0000");
 	(0, node_assert.deepStrictEqual)(require_url.expandIPv6Address("2001:db8::1"), "2001:0db8:0000:0000:0000:0000:0000:0001");
+	(0, node_assert.deepStrictEqual)(require_url.expandIPv6Address("64:ff9b::8.8.8.8"), "0064:ff9b:0000:0000:0000:0000:0808:0808");
 });
 //#endregion

package/dist/tests/url.test.mjs

@@ -1,4 +1,4 @@
-import { a as validatePublicUrl, i as isValidPublicIPv6Address, n as expandIPv6Address, r as isValidPublicIPv4Address, t as UrlError } from "./url-BQ_kgmCk.mjs";
+import { a as validatePublicUrl, i as isValidPublicIPv6Address, n as expandIPv6Address, r as isValidPublicIPv4Address, t as UrlError } from "./url-m9Qzxy-Y.mjs";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
 //#region src/url.test.ts
@@ -8,6 +8,25 @@ test("validatePublicUrl()", async () => {
 	await rejects(() => validatePublicUrl("https://localhost"), UrlError);
 	await rejects(() => validatePublicUrl("https://127.0.0.1"), UrlError);
 	await rejects(() => validatePublicUrl("https://[::1]"), UrlError);
+	await rejects(() => validatePublicUrl("http://[::ffff:7f00:1]/"), UrlError);
+	await rejects(() => validatePublicUrl("https://[64:ff9b::7f00:1]/"), UrlError);
+	await rejects(() => validatePublicUrl("https://[64:ff9b::a00:1]/"), UrlError);
+	await rejects(() => validatePublicUrl("https://[64:ff9b:1::a00:1]/"), UrlError);
+	await rejects(() => validatePublicUrl("https://[64:ff9b:1::808:808]/"), UrlError);
+	await rejects(() => validatePublicUrl("https://[2001::]/"), UrlError);
+	await rejects(() => validatePublicUrl("https://[2002:a00:1::]/"), UrlError);
+	for (const url of [
+		"https://100.64.0.1",
+		"https://198.18.0.1",
+		"https://224.0.0.1",
+		"https://240.0.0.1",
+		"https://192.0.2.1",
+		"https://192.88.99.1",
+		"https://198.51.100.1",
+		"https://203.0.113.1"
+	]) await rejects(() => validatePublicUrl(url), UrlError);
+	await validatePublicUrl("https://[2001:db8::1]");
+	await validatePublicUrl("https://[64:ff9b::8.8.8.8]");
 });
 test("isValidPublicIPv4Address()", () => {
 	ok(isValidPublicIPv4Address("8.8.8.8"));
@@ -16,6 +35,24 @@ test("isValidPublicIPv4Address()", () => {
 	ok(!isValidPublicIPv4Address("10.0.0.1"));
 	ok(!isValidPublicIPv4Address("127.16.0.1"));
 	ok(!isValidPublicIPv4Address("169.254.0.1"));
+	ok(!isValidPublicIPv4Address("100.64.0.1"));
+	ok(!isValidPublicIPv4Address("100.127.255.255"));
+	ok(!isValidPublicIPv4Address("192.0.0.1"));
+	ok(!isValidPublicIPv4Address("192.0.2.1"));
+	ok(!isValidPublicIPv4Address("192.88.99.0"));
+	ok(!isValidPublicIPv4Address("192.88.99.1"));
+	ok(!isValidPublicIPv4Address("192.88.99.2"));
+	ok(!isValidPublicIPv4Address("192.88.99.255"));
+	ok(!isValidPublicIPv4Address("198.18.0.1"));
+	ok(!isValidPublicIPv4Address("198.19.255.255"));
+	ok(!isValidPublicIPv4Address("198.51.100.1"));
+	ok(!isValidPublicIPv4Address("203.0.113.1"));
+	ok(!isValidPublicIPv4Address("224.0.0.1"));
+	ok(!isValidPublicIPv4Address("239.255.255.255"));
+	ok(!isValidPublicIPv4Address("240.0.0.1"));
+	ok(!isValidPublicIPv4Address("255.255.255.255"));
+	ok(!isValidPublicIPv4Address("1.2.3"));
+	ok(!isValidPublicIPv4Address("999.1.1.1"));
 });
 test("isValidPublicIPv6Address()", () => {
 	ok(isValidPublicIPv6Address("2001:db8::1"));
@@ -24,12 +61,29 @@ test("isValidPublicIPv6Address()", () => {
 	ok(!isValidPublicIPv6Address("fe80::1"));
 	ok(!isValidPublicIPv6Address("ff00::1"));
 	ok(!isValidPublicIPv6Address("::"));
+	ok(!isValidPublicIPv6Address("::ffff:7f00:1"));
+	ok(!isValidPublicIPv6Address("64:ff9b::7f00:1"));
+	ok(!isValidPublicIPv6Address("64:ff9b::127.0.0.1"));
+	ok(!isValidPublicIPv6Address("64:ff9b::a00:1"));
+	ok(!isValidPublicIPv6Address("64:ff9b::10.0.0.1"));
+	ok(!isValidPublicIPv6Address("64:ff9b:1::"));
+	ok(!isValidPublicIPv6Address("64:ff9b:1::a00:1"));
+	ok(!isValidPublicIPv6Address("64:ff9b:1::10.0.0.1"));
+	ok(!isValidPublicIPv6Address("2001::"));
+	ok(!isValidPublicIPv6Address("2001:0:4136:e378:8000:63bf:3fff:fdd2"));
+	ok(!isValidPublicIPv6Address("2002:a00:1::"));
+	ok(!isValidPublicIPv6Address("2002:7f00:1::"));
+	ok(!isValidPublicIPv6Address("2002:c0a8:1::"));
+	ok(!isValidPublicIPv6Address("2002:a9fe:1::"));
+	ok(isValidPublicIPv6Address("64:ff9b::808:808"));
+	ok(isValidPublicIPv6Address("64:ff9b::8.8.8.8"));
 });
 test("expandIPv6Address()", () => {
 	deepStrictEqual(expandIPv6Address("::"), "0000:0000:0000:0000:0000:0000:0000:0000");
 	deepStrictEqual(expandIPv6Address("::1"), "0000:0000:0000:0000:0000:0000:0000:0001");
 	deepStrictEqual(expandIPv6Address("2001:db8::"), "2001:0db8:0000:0000:0000:0000:0000:0000");
 	deepStrictEqual(expandIPv6Address("2001:db8::1"), "2001:0db8:0000:0000:0000:0000:0000:0001");
+	deepStrictEqual(expandIPv6Address("64:ff9b::8.8.8.8"), "0064:ff9b:0000:0000:0000:0000:0808:0808");
 });
 //#endregion
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.3.0-dev.994+9071ca0a",
+  "version": "2.3.0-pr.809.36+c592d116",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -45,6 +45,16 @@
       "require": "./dist/jsonld.cjs",
       "default": "./dist/jsonld.js"
     },
+    "./temporal": {
+      "types": {
+        "import": "./dist/temporal.d.ts",
+        "require": "./dist/temporal.d.cts",
+        "default": "./dist/temporal.d.ts"
+      },
+      "import": "./dist/temporal.js",
+      "require": "./dist/temporal.cjs",
+      "default": "./dist/temporal.js"
+    },
     "./package.json": "./package.json"
   },
   "keywords": [
@@ -61,14 +71,15 @@
   "devDependencies": {
     "@types/node": "^24.2.1",
     "fetch-mock": "^12.5.4",
-    "tsdown": "^0.21.6",
-    "typescript": "^5.9.2"
+    "tsdown": "^0.22.0",
+    "typescript": "^6.0.0"
   },
   "dependencies": {
-    "@logtape/logtape": "^2.0.5",
+    "@js-temporal/polyfill": "^0.5.1",
+    "@logtape/logtape": "^2.1.0",
     "@multiformats/base-x": "^4.0.1",
-    "@opentelemetry/api": "^1.9.0",
-    "asn1js": "^3.0.6",
+    "@opentelemetry/api": "^1.9.1",
+    "asn1js": "^3.0.10",
     "byte-encodings": "^1.0.11",
     "jsonld": "^9.0.0",
     "pkijs": "^3.3.3"

package/src/mod.ts

@@ -44,6 +44,11 @@ export {
   type GetUserAgentOptions,
   logRequest,
 } from "./request.ts";
+export {
+  type Json,
+  type PropertyPreprocessor,
+  type PropertyPreprocessorContext,
+} from "./preprocessor.ts";
 export {
   expandIPv6Address,
   isValidPublicIPv4Address,

package/src/preprocessor.ts

@@ -0,0 +1,43 @@
+import type { DocumentLoader } from "./docloader.ts";
+import type { TracerProvider } from "@opentelemetry/api";
+
+/**
+ * JSON value shape passed to property preprocessors.
+ * @since 2.3.0
+ */
+export type Json =
+  | string
+  | number
+  | boolean
+  | null
+  | readonly Json[]
+  | { readonly [key: string]: Json };
+
+/**
+ * Runtime context provided to property preprocessors.
+ * @since 2.3.0
+ */
+export interface PropertyPreprocessorContext {
+  /** Loader for remote JSON-LD documents. */
+  documentLoader?: DocumentLoader;
+  /** Loader for remote JSON-LD contexts. */
+  contextLoader?: DocumentLoader;
+  /** OpenTelemetry tracer provider for instrumentation. */
+  tracerProvider?: TracerProvider;
+  /** Base URL for resolving relative references. */
+  baseUrl?: URL;
+}
+
+/**
+ * Function signature for schema-configured property preprocessors.
+ *
+ * Receives an expanded JSON-LD property value and returns a vocabulary
+ * object when the value is handled, `undefined` when the value should
+ * fall through to the normal range decoder, or an `Error` when the value
+ * is recognized but cannot be converted.
+ * @since 2.3.0
+ */
+export type PropertyPreprocessor<T = unknown> = (
+  value: Json,
+  context: PropertyPreprocessorContext,
+) => T | undefined | Error | Promise<T | undefined | Error>;