@jini-ai/platform 0.5.9 → 0.5.10

package/dist/net/address.d.ts

@@ -1,26 +1,12 @@
-/** Expand an IPv6 literal (with `::` compression and/or an embedded dotted
- *  IPv4 tail) into its eight 16-bit groups, or null if it does not parse.
- *  Node's URL parser normalizes mapped literals to hex (`::ffff:127.0.0.1` →
- *  `::ffff:7f00:1`), so a string regex can't reliably spot the mapped range —
- *  we have to canonicalize.
- *
- *  Exported (previously module-private) so its parse-failure guards are
- *  directly unit-testable: the IP classifier and guarded client gate
- *  calls behind `net.isIP(addr) === 6`, and Node's `isIP` already fully
- *  validates IPv6 syntax (including embedded-IPv4-tail octet ranges) before
- *  returning 6 — empirically re-verified this session by fuzzing ~10k
- *  `isIP`-accepted v6 literals through this function's guards with zero
- *  hits — so none of these guards are reachable through that path. They stay
- *  as real defense-in-depth (fail closed with `null` rather than trust a
- *  platform primitive never changing behavior), matching the asset cache's
- *  exported-for-direct-testing precedent (`readBodyCapped`'s abort parameter). */
-export declare function expandIpv6({ address: addr }: {
-    address: string;
-}): number[] | null;
-/** True for any address an external CDN must never resolve to: loopback,
- *  link-local, private, CGNAT, ULA, multicast, or unspecified. An unparseable
- *  input is treated as unsafe. */
-export declare function isPrivateAddress({ address: addr }: {
+import { type AddressClass } from './endpoint-policy.js';
+export { expandIpv6 } from './endpoint-policy.js';
+export type { AddressClass } from './endpoint-policy.js';
+/** Strict Node peer classification; invalid literals fail closed to reserved. */
+export declare function classifyIpAddress({ ip }: {
+    ip: string;
+}, _options?: Record<string, never>): AddressClass;
+/** True for loopback, link-local, private, CGNAT, ULA, multicast or unspecified; invalid input fails closed. */
+export declare function isPrivateAddress({ address }: {
     address: string;
 }): boolean;
 export { isLoopbackApiHost, isBlockedExternalApiHostname } from './endpoint-policy.js';

package/dist/net/address.js

@@ -1,139 +1,34 @@
 import { isIP } from 'node:net';
+import { classifyAddressLiteral } from './endpoint-policy.js';
 // SSRF peer classification is distinct from core's browser-development LAN origin allow-list.
-/** Expand an IPv6 literal (with `::` compression and/or an embedded dotted
- *  IPv4 tail) into its eight 16-bit groups, or null if it does not parse.
- *  Node's URL parser normalizes mapped literals to hex (`::ffff:127.0.0.1` →
- *  `::ffff:7f00:1`), so a string regex can't reliably spot the mapped range —
- *  we have to canonicalize.
- *
- *  Exported (previously module-private) so its parse-failure guards are
- *  directly unit-testable: the IP classifier and guarded client gate
- *  calls behind `net.isIP(addr) === 6`, and Node's `isIP` already fully
- *  validates IPv6 syntax (including embedded-IPv4-tail octet ranges) before
- *  returning 6 — empirically re-verified this session by fuzzing ~10k
- *  `isIP`-accepted v6 literals through this function's guards with zero
- *  hits — so none of these guards are reachable through that path. They stay
- *  as real defense-in-depth (fail closed with `null` rather than trust a
- *  platform primitive never changing behavior), matching the asset cache's
- *  exported-for-direct-testing precedent (`readBodyCapped`'s abort parameter). */
-export function expandIpv6({ address: addr }) {
-    // `String#split` always returns a non-empty array, so index 0 is never
-    // `undefined` — the `!` narrows a `noUncheckedIndexedAccess` false
-    // positive, not a real fallback path.
-    let s = addr.toLowerCase().split('%')[0];
-    if (!s.includes(':'))
-        return null;
-    // Fold a trailing dotted IPv4 (`…:1.2.3.4`) into two hex groups.
-    const v4 = /^(.*:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(s);
-    if (v4) {
-        // `v4[2]` is the regex's second (mandatory, non-optional) capture group
-        // of a successful match — always defined.
-        const o = v4[2].split('.').map((n) => Number(n));
-        if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
-            return null;
-        // `o` is now a validated 4-element array — indices 0-3 always defined.
-        const hi = (((o[0] << 8) | o[1])).toString(16);
-        const lo = (((o[2] << 8) | o[3])).toString(16);
-        s = `${v4[1]}${hi}:${lo}`;
-    }
-    const halves = s.split('::');
-    if (halves.length > 2)
-        return null;
-    const parse = (p) => p === '' ? [] : p.split(':').map((g) => (/^[0-9a-f]{1,4}$/.test(g) ? parseInt(g, 16) : Number.NaN));
-    // `halves` always has at least one element (split guarantee).
-    const left = parse(halves[0]);
-    let groups;
-    if (halves.length === 1) {
-        groups = left;
-    }
-    else {
-        // `halves.length === 2` here (the `> 2` case already returned above).
-        const right = parse(halves[1]);
-        const fill = 8 - left.length - right.length;
-        if (fill < 1)
-            return null;
-        groups = [...left, ...new Array(fill).fill(0), ...right];
-    }
-    if (groups.length !== 8 || groups.some((g) => Number.isNaN(g) || g < 0 || g > 0xffff))
-        return null;
-    return groups;
+export { expandIpv6 } from './endpoint-policy.js';
+/** Strict Node peer classification; invalid literals fail closed to reserved. */
+export function classifyIpAddress({ ip }, _options = {}) {
+    // `net.isIP(ip) === 4` already guarantees `ip` is a syntactically
+    // valid dotted-quad with four 0-255 decimal octets (no leading-zero
+    // octal ambiguity, no out-of-range component) — empirically verified
+    // in the original extraction by fuzzing 500k+ candidate strings through `isIP` and
+    // this same re-derivation with zero divergences. The shared classifier therefore receives
+    // validated octets.
+    // `net.isIP(ip) === 6` already guarantees `ip` is syntactically valid
+    // IPv6 (Node validates this before classifying the family), and
+    // `expandIpv6` implements the same canonicalization Node's own parser
+    // does, so it never returns `null` for an `isIP`-accepted literal —
+    // empirically verified in the original extraction by fuzzing ~10k `isIP`-accepted
+    // v6 literals through `expandIpv6` with zero `null` results (see
+    // `expandIpv6`'s doc comment and `archived provenance ledger`'s 2026-07-22 entry).
+    // Kept as a real fail-closed guard (defense-in-depth against a future
+    // change to either parser) rather than asserted away, so it stays
+    // provably-unreachable-but-intentional instead of a forced test.
+    // Both rejections (Node's `isIP` and the shared classifier) funnel into one
+    // fail-closed default, so the `reserved` fallback is the single place an
+    // unclassifiable literal lands — exercised by every invalid input.
+    const addressClass = isIP(ip) === 0 ? null : classifyAddressLiteral({ address: ip });
+    return addressClass ?? 'reserved';
 }
-/** True for any address an external CDN must never resolve to: loopback,
- *  link-local, private, CGNAT, ULA, multicast, or unspecified. An unparseable
- *  input is treated as unsafe. */
-export function isPrivateAddress({ address: addr }) {
-    const fam = isIP(addr);
-    if (fam === 4) {
-        // `net.isIP(addr) === 4` already guarantees `addr` is a syntactically
-        // valid dotted-quad with four 0-255 decimal octets (no leading-zero
-        // octal ambiguity, no out-of-range component) — empirically re-verified
-        // this session by fuzzing 500k+ candidate strings through `isIP` and
-        // this same re-derivation with zero divergences. `o` is therefore always
-        // a validated 4-element array.
-        const o = addr.split('.').map((n) => Number(n));
-        const a = o[0];
-        const b = o[1];
-        if (a === 0)
-            return true; // "this" network / unspecified
-        if (a === 10)
-            return true; // private
-        if (a === 127)
-            return true; // loopback
-        if (a === 169 && b === 254)
-            return true; // link-local
-        if (a === 172 && b >= 16 && b <= 31)
-            return true; // private
-        if (a === 192 && b === 168)
-            return true; // private
-        if (a === 100 && b >= 64 && b <= 127)
-            return true; // CGNAT
-        if (a >= 224)
-            return true; // multicast + reserved
-        return false;
-    }
-    if (fam === 6) {
-        const groups = expandIpv6({ address: addr });
-        // `net.isIP(addr) === 6` already guarantees `addr` is syntactically valid
-        // IPv6 (Node validates this before classifying the family), and
-        // `expandIpv6` implements the same canonicalization Node's own parser
-        // does, so it never returns `null` for an `isIP`-accepted literal —
-        // empirically re-verified this session by fuzzing ~10k `isIP`-accepted
-        // v6 literals through `expandIpv6` with zero `null` results (see
-        // `expandIpv6`'s doc comment and `archived provenance ledger`'s 2026-07-22 entry).
-        // Kept as a real fail-closed guard (defense-in-depth against a future
-        // change to either parser) rather than asserted away, so it stays
-        // provably-unreachable-but-intentional instead of a forced test.
-        if (!groups)
-            return true; // can't canonicalize a "valid" v6 → refuse
-        // IPv4-mapped (`::ffff:0:0/96`) and the deprecated IPv4-compatible
-        // (`::0:0/96`, excluding :: / ::1) carry an embedded IPv4 — classify it by
-        // its real v4 range so `::ffff:7f00:1` (== 127.0.0.1) is caught.
-        const topZero = groups.slice(0, 5).every((g) => g === 0);
-        if (topZero && (groups[5] === 0xffff || groups[5] === 0)) {
-            // `groups` is a validated 8-element array once non-null — indices 6-7
-            // always defined.
-            const a = groups[6] >> 8;
-            const b = groups[6] & 0xff;
-            const c = groups[7] >> 8;
-            const d = groups[7] & 0xff;
-            if (groups[5] === 0xffff || a !== 0 || b !== 0) {
-                return isPrivateAddress({ address: `${a}.${b}.${c}.${d}` });
-            }
-        }
-        if (groups.every((g) => g === 0))
-            return true; // ::  (unspecified)
-        if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1)
-            return true; // ::1 loopback
-        const first = groups[0];
-        if ((first & 0xffc0) === 0xfe80)
-            return true; // link-local fe80::/10 (fe80–febf)
-        if ((first & 0xfe00) === 0xfc00)
-            return true; // unique-local fc00::/7
-        if ((first & 0xff00) === 0xff00)
-            return true; // multicast ff00::/8
-        return false;
-    }
-    return true; // not a literal IP — caller must resolve before trusting it
+/** True for loopback, link-local, private, CGNAT, ULA, multicast or unspecified; invalid input fails closed. */
+export function isPrivateAddress({ address }) {
+    return classifyIpAddress({ ip: address }) !== 'public';
 }
 // Preserve the Node entry's published names while sharing the literal-host owner with browser consumers.
 export { isLoopbackApiHost, isBlockedExternalApiHostname } from './endpoint-policy.js';

package/dist/net/endpoint-policy.d.ts

@@ -1,8 +1,32 @@
-/** True for `localhost`, `::1`, `127.0.0.0/8`, and their IPv4-mapped-IPv6 forms. */
+/** Expand an IPv6 literal (with `::` compression and/or an embedded dotted
+ *  IPv4 tail) into its eight 16-bit groups, or null if it does not parse.
+ *  Node's URL parser normalizes mapped literals to hex (`::ffff:127.0.0.1` →
+ *  `::ffff:7f00:1`), so a string regex can't reliably spot the mapped range —
+ *  we have to canonicalize.
+ *
+ *  Exported (previously module-private) so its parse-failure guards are
+ *  directly unit-testable: the IP classifier and guarded client gate
+ *  calls behind `net.isIP(addr) === 6`, and Node's `isIP` already fully
+ *  validates IPv6 syntax (including embedded-IPv4-tail octet ranges) before
+ *  returning 6 — empirically verified in the original extraction by fuzzing ~10k
+ *  `isIP`-accepted v6 literals through this function's guards with zero
+ *  hits — so none of these guards are reachable through that path. They stay
+ *  as real defense-in-depth (fail closed with `null` rather than trust a
+ *  platform primitive never changing behavior), matching the asset cache's
+ *  exported-for-direct-testing precedent (`readBodyCapped`'s abort parameter). */
+export declare function expandIpv6({ address: addr }: {
+    address: string;
+}): number[] | null;
+export type AddressClass = 'public' | 'private' | 'loopback' | 'link-local' | 'reserved';
+/** Pure literal classifier; null means malformed input or a hostname requiring DNS. */
+export declare function classifyAddressLiteral({ address }: {
+    address: string;
+}, _options?: Record<string, never>): AddressClass | null;
+/** True for localhost and literal loopback, including embedded IPv4 forms. */
 export declare function isLoopbackApiHost({ hostname }: {
     hostname: string;
 }): boolean;
-/** True for RFC1918/link-local/CGNAT/multicast/unspecified/unique-local-IPv6 addresses — private network space a public caller should never be steered into. */
+/** Private/reserved literal hosts are blocked; configured local servers keep their loopback exception. */
 export declare function isBlockedExternalApiHostname({ hostname }: {
     hostname: string;
 }): boolean;

package/dist/net/endpoint-policy.js

@@ -12,7 +12,7 @@ function normalizeBracketedIpv6(hostname) {
     // FQDN trailing-dot form (RFC 1034) resolves identically to the dotless
     // form, so `localhost.` must normalize to `localhost` before the equality
     // check below — and `0.0.0.0.`, `10.0.0.1.`, etc. must normalize before
-    // isBlockedIpv4 parses them. Strips one or more trailing dots.
+    // the IPv4 classifier parses them. Strips one or more trailing dots.
     return stripped.toLowerCase().replace(/\.+$/, '');
 }
 function parseIpv4(hostname) {
@@ -29,70 +29,173 @@ function parseIpv4(hostname) {
         return null;
     return [parsed[0], parsed[1], parsed[2], parsed[3]];
 }
-function isLoopbackIpv4(hostname) {
-    const parts = parseIpv4(hostname);
-    return Boolean(parts && parts[0] === 127);
+/** Expand an IPv6 literal (with `::` compression and/or an embedded dotted
+ *  IPv4 tail) into its eight 16-bit groups, or null if it does not parse.
+ *  Node's URL parser normalizes mapped literals to hex (`::ffff:127.0.0.1` →
+ *  `::ffff:7f00:1`), so a string regex can't reliably spot the mapped range —
+ *  we have to canonicalize.
+ *
+ *  Exported (previously module-private) so its parse-failure guards are
+ *  directly unit-testable: the IP classifier and guarded client gate
+ *  calls behind `net.isIP(addr) === 6`, and Node's `isIP` already fully
+ *  validates IPv6 syntax (including embedded-IPv4-tail octet ranges) before
+ *  returning 6 — empirically verified in the original extraction by fuzzing ~10k
+ *  `isIP`-accepted v6 literals through this function's guards with zero
+ *  hits — so none of these guards are reachable through that path. They stay
+ *  as real defense-in-depth (fail closed with `null` rather than trust a
+ *  platform primitive never changing behavior), matching the asset cache's
+ *  exported-for-direct-testing precedent (`readBodyCapped`'s abort parameter). */
+export function expandIpv6({ address: addr }) {
+    // `String#split` always returns a non-empty array, so index 0 is never
+    // `undefined` — the `!` narrows a `noUncheckedIndexedAccess` false
+    // positive, not a real fallback path.
+    const literal = addr.toLowerCase().split('%')[0];
+    if (!literal.includes(':'))
+        return null;
+    const s = foldIpv4Tail(literal);
+    if (s === null)
+        return null;
+    const halves = s.split('::');
+    if (halves.length > 2)
+        return null;
+    const parse = (p) => p === '' ? [] : p.split(':').map((g) => (/^[0-9a-f]{1,4}$/.test(g) ? parseInt(g, 16) : Number.NaN));
+    // `halves` always has at least one element (split guarantee).
+    const left = parse(halves[0]);
+    let groups;
+    if (halves.length === 1) {
+        groups = left;
+    }
+    else {
+        // `halves.length === 2` here (the `> 2` case already returned above).
+        const right = parse(halves[1]);
+        const fill = 8 - left.length - right.length;
+        if (fill < 1)
+            return null;
+        groups = [...left, ...new Array(fill).fill(0), ...right];
+    }
+    if (!validIpv6Groups(groups))
+        return null;
+    return groups;
+}
+/** Fold a dotted tail while retaining the parser's defense-in-depth octet validation. */
+function foldIpv4Tail(s) {
+    // Fold a trailing dotted IPv4 (`…:1.2.3.4`) into two hex groups.
+    const v4 = /^(.*:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(s);
+    if (v4) {
+        // `v4[2]` is the regex's second (mandatory, non-optional) capture group
+        // of a successful match — always defined.
+        const o = v4[2].split('.').map((n) => Number(n));
+        if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
+            return null;
+        // `o` is now a validated 4-element array — indices 0-3 always defined.
+        const hi = (((o[0] << 8) | o[1])).toString(16);
+        const lo = (((o[2] << 8) | o[3])).toString(16);
+        s = `${v4[1]}${hi}:${lo}`;
+    }
+    return s;
 }
-function isBlockedIpv4(hostname) {
-    const parts = parseIpv4(hostname);
-    if (!parts)
-        return false;
-    const [a, b] = parts;
-    return (a === 0 ||
-        (a === 100 && b >= 64 && b <= 127) ||
-        (a === 169 && b === 254) ||
-        a === 10 ||
-        (a === 192 && b === 168) ||
+function validIpv6Groups(groups) {
+    return groups.length === 8 && groups.every(g => Number.isInteger(g) && g >= 0 && g <= 0xffff);
+}
+/** Classifies validated IPv4 bytes; shared by native and embedded-v4 literals. */
+function classifyIpv4Bytes(bytes) {
+    const [a, b] = bytes;
+    if (a === 127)
+        return 'loopback';
+    // This range includes the cloud metadata address 169.254.169.254.
+    if (a === 169 && b === 254)
+        return 'link-local';
+    if (a === 0 || a >= 224)
+        return 'reserved'; // "this" network / unspecified; multicast + reserved
+    // The remaining blocked IPv4 ranges include RFC 6598 shared carrier space (100.64.0.0/10):
+    // it is not globally routable and belongs with RFC 1918 private ranges for egress decisions.
+    if (isPrivateIpv4Bytes(bytes))
+        return 'private';
+    return 'public';
+}
+function isPrivateIpv4Bytes([a, b]) {
+    if (a === 100)
+        return b >= 64 && b <= 127;
+    return a === 10 ||
         (a === 172 && b >= 16 && b <= 31) ||
-        a >= 224);
+        (a === 192 && b === 168);
 }
-/** `::ffff:10.0.0.1` and `::ffff:a00:1` denote the same address; return dotted form so the v4 rules apply. */
-function ipv4MappedToDotted(hostname) {
-    const host = normalizeBracketedIpv6(hostname);
-    const mapped = /^::ffff:(.+)$/i.exec(host)?.[1];
-    if (!mapped)
-        return null;
-    if (parseIpv4(mapped.toLowerCase()))
-        return mapped.toLowerCase();
-    const hexParts = mapped.split(':');
-    if (hexParts.length !== 2 ||
-        !hexParts.every((part) => /^[0-9a-f]{1,4}$/i.test(part))) {
-        return null;
+// Each /96 prefix carries IPv4 in the final four bytes. Matching canonical
+// bytes also handles expanded IPv6 and WHATWG URL's dotted-to-hex normalization.
+const EMBEDDED_IPV4_PREFIXES = [
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], // compatible ::/96 (except native ::/::1)
+    [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255], // mapped ::ffff:0:0/96
+    [0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 0, 0], // translated ::ffff:0:0:0/96
+    [0, 100, 255, 155, 0, 0, 0, 0, 0, 0, 0, 0], // well-known NAT64 64:ff9b::/96
+];
+function hasEmbeddedIpv4(bytes) {
+    return EMBEDDED_IPV4_PREFIXES.some(prefix => hasPrefix(bytes, prefix));
+}
+function hasPrefix(bytes, prefix) {
+    return prefix.every((byte, index) => bytes[index] === byte);
+}
+// Teredo 2001::/32 obfuscates its client IPv4, and local-use NAT64 64:ff9b:1::/48 may embed
+// IPv4 at any prefix length, so neither can be classified by position: both are refused.
+const UNCLASSIFIABLE_TUNNEL_PREFIXES = [
+    [0x20, 0x01, 0, 0], // Teredo 2001::/32
+    [0, 0x64, 0xff, 0x9b, 0, 1], // local-use NAT64 64:ff9b:1::/48
+];
+/** Tunnel prefixes that reach IPv4 without a fixed /96 tail; null means not a tunnel prefix. */
+function classifyTunnelIpv6(bytes) {
+    // 6to4 2002::/16 carries its IPv4 in bytes 2-5; a host with a 6to4 route encapsulates to it.
+    if (hasPrefix(bytes, [0x20, 0x02]))
+        return classifyIpv4Bytes(bytes.slice(2, 6));
+    if (UNCLASSIFIABLE_TUNNEL_PREFIXES.some(prefix => hasPrefix(bytes, prefix)))
+        return 'reserved';
+    return null;
+}
+/** Classifies 16 IPv6 bytes, independent of compression or dotted/hex tail spelling. */
+function classifyIpv6Bytes(bytes) {
+    // Native :: and ::1 retain their own meaning before the deprecated compatible-v4 range.
+    if (bytes.every(n => n === 0))
+        return 'reserved'; // :: (unspecified)
+    if (bytes.slice(0, 15).every(n => n === 0) && bytes[15] === 1)
+        return 'loopback';
+    // IPv4-mapped (::ffff:0:0/96) and deprecated IPv4-compatible (::/96)
+    // carry an embedded IPv4: classify its real range so ::ffff:7f00:1 is caught.
+    if (hasEmbeddedIpv4(bytes))
+        return classifyIpv4Bytes(bytes.slice(12));
+    const tunnel = classifyTunnelIpv6(bytes);
+    if (tunnel)
+        return tunnel;
+    if (bytes[0] === 255)
+        return 'reserved'; // multicast ff00::/8
+    const first = (bytes[0] << 8) | bytes[1];
+    if ((first & 0xffc0) === 0xfe80)
+        return 'link-local'; // fe80::/10 (fe80–febf)
+    if ((first & 0xfe00) === 0xfc00)
+        return 'private'; // unique-local fc00::/7
+    return 'public';
+}
+/** Pure literal classifier; null means malformed input or a hostname requiring DNS. */
+export function classifyAddressLiteral({ address }, _options = {}) {
+    if (!address.includes(':')) {
+        const ipv4 = parseIpv4(address);
+        return ipv4 ? classifyIpv4Bytes(ipv4) : null;
     }
-    // Non-null assertions, not a runtime guard: the length/regex checks above
-    // already guarantee exactly two non-empty hex segments here.
-    const hi = hexParts[0];
-    const lo = hexParts[1];
-    const value = (Number.parseInt(hi, 16) << 16) | Number.parseInt(lo, 16);
-    return [
-        (value >>> 24) & 255,
-        (value >>> 16) & 255,
-        (value >>> 8) & 255,
-        value & 255,
-    ].join('.');
+    const groups = expandIpv6({ address });
+    if (!groups)
+        return null;
+    // The parser's length/regex checks guarantee complete groups and bytes here;
+    // non-null assertions in byte classification narrow index types, not a runtime fallback.
+    // Parse once, then all range decisions operate on the same 16 canonical bytes.
+    const bytes = groups.flatMap(group => [group >> 8, group & 255]);
+    return classifyIpv6Bytes(bytes);
 }
-/** True for `localhost`, `::1`, `127.0.0.0/8`, and their IPv4-mapped-IPv6 forms. */
+/** True for localhost and literal loopback, including embedded IPv4 forms. */
 export function isLoopbackApiHost({ hostname }) {
     const host = normalizeBracketedIpv6(hostname);
-    if (host === 'localhost' || host === '::1')
-        return true;
-    if (isLoopbackIpv4(host))
-        return true;
-    const mapped = ipv4MappedToDotted(host);
-    return Boolean(mapped && isLoopbackIpv4(mapped));
+    return host === 'localhost' || classifyAddressLiteral({ address: host }) === 'loopback';
 }
-/** True for RFC1918/link-local/CGNAT/multicast/unspecified/unique-local-IPv6 addresses — private network space a public caller should never be steered into. */
+/** Private/reserved literal hosts are blocked; configured local servers keep their loopback exception. */
 export function isBlockedExternalApiHostname({ hostname }) {
     const host = normalizeBracketedIpv6(hostname);
-    if (host === '::')
-        return true;
-    if (isBlockedIpv4(host))
-        return true;
-    if (/^f[cd][0-9a-f]{2}:/i.test(host))
-        return true;
-    if (/^fe[89ab][0-9a-f]:/i.test(host))
-        return true;
-    const mapped = ipv4MappedToDotted(host);
-    return Boolean(mapped && isBlockedIpv4(mapped));
+    const addressClass = classifyAddressLiteral({ address: host });
+    return addressClass !== null && addressClass !== 'public' && addressClass !== 'loopback';
 }
 //# sourceMappingURL=endpoint-policy.js.map

package/dist/object-store/index.d.ts

@@ -0,0 +1,2 @@
+export { createLocalFsObjectStore, createLocalFsObjectStoreProvider } from './local-fs.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/object-store/index.js

@@ -0,0 +1,2 @@
+export { createLocalFsObjectStore, createLocalFsObjectStoreProvider } from './local-fs.js';
+//# sourceMappingURL=index.js.map

package/dist/object-store/local-fs.d.ts

@@ -0,0 +1,17 @@
+import type { ObjectStore, ObjectStoreProvider } from '@jini-ai/core/object-store';
+/**
+ * Creates a local-filesystem `ObjectStore` rooted at `rootDir`.
+ * @complexity Each call is O(1) syscalls beyond the read/write itself.
+ */
+export declare function createLocalFsObjectStore(required: {
+    readonly rootDir: string;
+}, _optional?: Record<string, never>): ObjectStore;
+/**
+ * The `local` provider bound to one root directory (the host owns where bytes live; settings and
+ * credentials are ignored — local storage needs neither).
+ * @complexity O(1).
+ */
+export declare function createLocalFsObjectStoreProvider(required: {
+    readonly rootDir: string;
+}, _optional?: Record<string, never>): ObjectStoreProvider;
+//# sourceMappingURL=local-fs.d.ts.map