@optique/core 1.0.0-dev.1458 → 1.0.0-dev.1461

package/dist/valueparser.cjs

@@ -2636,6 +2636,90 @@ function compressIpv6(groups) {
 	else return before.join(":") + "::" + after.join(":");
 }
 /**
+* Extracts IPv4 octets from an IPv4-mapped IPv6 address.
+* Returns null if the address is not an IPv4-mapped address
+* (i.e., not in the `::ffff:x.x.x.x` range).
+*/
+function extractIpv4FromMapped(normalizedIpv6) {
+	const groups = expandIpv6(normalizedIpv6);
+	if (groups === null) return null;
+	for (let i = 0; i < 5; i++) if (parseInt(groups[i], 16) !== 0) return null;
+	if (parseInt(groups[5], 16) !== 65535) return null;
+	const high = parseInt(groups[6], 16);
+	const low = parseInt(groups[7], 16);
+	return [
+		high >> 8 & 255,
+		high & 255,
+		low >> 8 & 255,
+		low & 255
+	];
+}
+/**
+* Checks IPv4 restrictions against octets extracted from an IPv4-mapped
+* IPv6 address.  The check uses the base address, consistent with how
+* the `ipv4()` parser validates the address part of a regular IPv4 CIDR.
+*
+* Returns an error result if a restriction is violated, or null if all
+* checks pass.
+*/
+function checkIpv4MappedRestrictions(octets, normalizedIpv6, ipv4Opts, errors) {
+	const allowPrivate = ipv4Opts?.allowPrivate ?? true;
+	const allowLoopback = ipv4Opts?.allowLoopback ?? true;
+	const allowLinkLocal = ipv4Opts?.allowLinkLocal ?? true;
+	const allowMulticast = ipv4Opts?.allowMulticast ?? true;
+	const allowBroadcast = ipv4Opts?.allowBroadcast ?? true;
+	const allowZero = ipv4Opts?.allowZero ?? true;
+	if (!allowPrivate && isPrivateIp(octets)) {
+		const errorMsg = errors?.privateNotAllowed;
+		const msg = typeof errorMsg === "function" ? errorMsg(normalizedIpv6) : errorMsg ?? require_message.message`${normalizedIpv6} is a private IP address.`;
+		return {
+			success: false,
+			error: msg
+		};
+	}
+	if (!allowLoopback && isLoopbackIp(octets)) {
+		const errorMsg = errors?.loopbackNotAllowed;
+		const msg = typeof errorMsg === "function" ? errorMsg(normalizedIpv6) : errorMsg ?? require_message.message`${normalizedIpv6} is a loopback address.`;
+		return {
+			success: false,
+			error: msg
+		};
+	}
+	if (!allowLinkLocal && isLinkLocalIp(octets)) {
+		const errorMsg = errors?.linkLocalNotAllowed;
+		const msg = typeof errorMsg === "function" ? errorMsg(normalizedIpv6) : errorMsg ?? require_message.message`${normalizedIpv6} is a link-local address.`;
+		return {
+			success: false,
+			error: msg
+		};
+	}
+	if (!allowMulticast && isMulticastIp(octets)) {
+		const errorMsg = errors?.multicastNotAllowed;
+		const msg = typeof errorMsg === "function" ? errorMsg(normalizedIpv6) : errorMsg ?? require_message.message`${normalizedIpv6} is a multicast address.`;
+		return {
+			success: false,
+			error: msg
+		};
+	}
+	if (!allowBroadcast && isBroadcastIp(octets)) {
+		const errorMsg = errors?.broadcastNotAllowed;
+		const msg = typeof errorMsg === "function" ? errorMsg(normalizedIpv6) : errorMsg ?? require_message.message`${normalizedIpv6} is the broadcast address.`;
+		return {
+			success: false,
+			error: msg
+		};
+	}
+	if (!allowZero && isZeroIp(octets)) {
+		const errorMsg = errors?.zeroNotAllowed;
+		const msg = typeof errorMsg === "function" ? errorMsg(normalizedIpv6) : errorMsg ?? require_message.message`${normalizedIpv6} is the zero address.`;
+		return {
+			success: false,
+			error: msg
+		};
+	}
+	return null;
+}
+/**
 * Creates a value parser that accepts both IPv4 and IPv6 addresses.
 *
 * By default, accepts both IPv4 and IPv6 addresses. Use the `version` option
@@ -2688,6 +2772,22 @@ function ip(options) {
 			zeroNotAllowed: errors?.zeroNotAllowed
 		}
 	}) : null;
+	const mappedIpv4Opts = version === "both" ? {
+		allowPrivate: options?.ipv4?.allowPrivate,
+		allowLoopback: options?.ipv4?.allowLoopback,
+		allowLinkLocal: options?.ipv4?.allowLinkLocal,
+		allowMulticast: options?.ipv4?.allowMulticast,
+		allowBroadcast: options?.ipv4?.allowBroadcast,
+		allowZero: options?.ipv4?.allowZero
+	} : void 0;
+	const mappedIpv4Errors = version === "both" ? {
+		privateNotAllowed: errors?.privateNotAllowed,
+		loopbackNotAllowed: errors?.loopbackNotAllowed,
+		linkLocalNotAllowed: errors?.linkLocalNotAllowed,
+		multicastNotAllowed: errors?.multicastNotAllowed,
+		broadcastNotAllowed: errors?.broadcastNotAllowed,
+		zeroNotAllowed: errors?.zeroNotAllowed
+	} : void 0;
 	return {
 		$mode: "sync",
 		metavar,
@@ -2702,7 +2802,16 @@ function ip(options) {
 			}
 			if (ipv6Parser !== null) {
 				const result = ipv6Parser.parse(input);
-				if (result.success) return result;
+				if (result.success) {
+					if (version === "both") {
+						const mappedOctets = extractIpv4FromMapped(result.value);
+						if (mappedOctets !== null) {
+							const restrictionError = checkIpv4MappedRestrictions(mappedOctets, result.value, mappedIpv4Opts, mappedIpv4Errors);
+							if (restrictionError !== null) return restrictionError;
+						}
+					}
+					return result;
+				}
 				ipv6Error = result;
 				if (version === 6) return result;
 			}
@@ -2804,6 +2913,22 @@ function cidr(options) {
 			uniqueLocalNotAllowed: errors?.uniqueLocalNotAllowed
 		}
 	}) : null;
+	const mappedIpv4Opts = version === "both" ? {
+		allowPrivate: options?.ipv4?.allowPrivate,
+		allowLoopback: options?.ipv4?.allowLoopback,
+		allowLinkLocal: options?.ipv4?.allowLinkLocal,
+		allowMulticast: options?.ipv4?.allowMulticast,
+		allowBroadcast: options?.ipv4?.allowBroadcast,
+		allowZero: options?.ipv4?.allowZero
+	} : void 0;
+	const mappedIpv4Errors = version === "both" ? {
+		privateNotAllowed: errors?.privateNotAllowed,
+		loopbackNotAllowed: errors?.loopbackNotAllowed,
+		linkLocalNotAllowed: errors?.linkLocalNotAllowed,
+		multicastNotAllowed: errors?.multicastNotAllowed,
+		broadcastNotAllowed: errors?.broadcastNotAllowed,
+		zeroNotAllowed: errors?.zeroNotAllowed
+	} : void 0;
 	return {
 		$mode: "sync",
 		metavar,
@@ -3148,6 +3273,13 @@ function cidr(options) {
 					error: msg
 				};
 			}
+			if (version === "both" && ipVersion === 6 && normalizedIp !== null) {
+				const mappedOctets = extractIpv4FromMapped(normalizedIp);
+				if (mappedOctets !== null) {
+					const restrictionError = checkIpv4MappedRestrictions(mappedOctets, normalizedIp, mappedIpv4Opts, mappedIpv4Errors);
+					if (restrictionError !== null) return restrictionError;
+				}
+			}
 			return {
 				success: true,
 				value: {

package/dist/valueparser.js

@@ -2636,6 +2636,90 @@ function compressIpv6(groups) {
 	else return before.join(":") + "::" + after.join(":");
 }
 /**
+* Extracts IPv4 octets from an IPv4-mapped IPv6 address.
+* Returns null if the address is not an IPv4-mapped address
+* (i.e., not in the `::ffff:x.x.x.x` range).
+*/
+function extractIpv4FromMapped(normalizedIpv6) {
+	const groups = expandIpv6(normalizedIpv6);
+	if (groups === null) return null;
+	for (let i = 0; i < 5; i++) if (parseInt(groups[i], 16) !== 0) return null;
+	if (parseInt(groups[5], 16) !== 65535) return null;
+	const high = parseInt(groups[6], 16);
+	const low = parseInt(groups[7], 16);
+	return [
+		high >> 8 & 255,
+		high & 255,
+		low >> 8 & 255,
+		low & 255
+	];
+}
+/**
+* Checks IPv4 restrictions against octets extracted from an IPv4-mapped
+* IPv6 address.  The check uses the base address, consistent with how
+* the `ipv4()` parser validates the address part of a regular IPv4 CIDR.
+*
+* Returns an error result if a restriction is violated, or null if all
+* checks pass.
+*/
+function checkIpv4MappedRestrictions(octets, normalizedIpv6, ipv4Opts, errors) {
+	const allowPrivate = ipv4Opts?.allowPrivate ?? true;
+	const allowLoopback = ipv4Opts?.allowLoopback ?? true;
+	const allowLinkLocal = ipv4Opts?.allowLinkLocal ?? true;
+	const allowMulticast = ipv4Opts?.allowMulticast ?? true;
+	const allowBroadcast = ipv4Opts?.allowBroadcast ?? true;
+	const allowZero = ipv4Opts?.allowZero ?? true;
+	if (!allowPrivate && isPrivateIp(octets)) {
+		const errorMsg = errors?.privateNotAllowed;
+		const msg = typeof errorMsg === "function" ? errorMsg(normalizedIpv6) : errorMsg ?? message`${normalizedIpv6} is a private IP address.`;
+		return {
+			success: false,
+			error: msg
+		};
+	}
+	if (!allowLoopback && isLoopbackIp(octets)) {
+		const errorMsg = errors?.loopbackNotAllowed;
+		const msg = typeof errorMsg === "function" ? errorMsg(normalizedIpv6) : errorMsg ?? message`${normalizedIpv6} is a loopback address.`;
+		return {
+			success: false,
+			error: msg
+		};
+	}
+	if (!allowLinkLocal && isLinkLocalIp(octets)) {
+		const errorMsg = errors?.linkLocalNotAllowed;
+		const msg = typeof errorMsg === "function" ? errorMsg(normalizedIpv6) : errorMsg ?? message`${normalizedIpv6} is a link-local address.`;
+		return {
+			success: false,
+			error: msg
+		};
+	}
+	if (!allowMulticast && isMulticastIp(octets)) {
+		const errorMsg = errors?.multicastNotAllowed;
+		const msg = typeof errorMsg === "function" ? errorMsg(normalizedIpv6) : errorMsg ?? message`${normalizedIpv6} is a multicast address.`;
+		return {
+			success: false,
+			error: msg
+		};
+	}
+	if (!allowBroadcast && isBroadcastIp(octets)) {
+		const errorMsg = errors?.broadcastNotAllowed;
+		const msg = typeof errorMsg === "function" ? errorMsg(normalizedIpv6) : errorMsg ?? message`${normalizedIpv6} is the broadcast address.`;
+		return {
+			success: false,
+			error: msg
+		};
+	}
+	if (!allowZero && isZeroIp(octets)) {
+		const errorMsg = errors?.zeroNotAllowed;
+		const msg = typeof errorMsg === "function" ? errorMsg(normalizedIpv6) : errorMsg ?? message`${normalizedIpv6} is the zero address.`;
+		return {
+			success: false,
+			error: msg
+		};
+	}
+	return null;
+}
+/**
 * Creates a value parser that accepts both IPv4 and IPv6 addresses.
 *
 * By default, accepts both IPv4 and IPv6 addresses. Use the `version` option
@@ -2688,6 +2772,22 @@ function ip(options) {
 			zeroNotAllowed: errors?.zeroNotAllowed
 		}
 	}) : null;
+	const mappedIpv4Opts = version === "both" ? {
+		allowPrivate: options?.ipv4?.allowPrivate,
+		allowLoopback: options?.ipv4?.allowLoopback,
+		allowLinkLocal: options?.ipv4?.allowLinkLocal,
+		allowMulticast: options?.ipv4?.allowMulticast,
+		allowBroadcast: options?.ipv4?.allowBroadcast,
+		allowZero: options?.ipv4?.allowZero
+	} : void 0;
+	const mappedIpv4Errors = version === "both" ? {
+		privateNotAllowed: errors?.privateNotAllowed,
+		loopbackNotAllowed: errors?.loopbackNotAllowed,
+		linkLocalNotAllowed: errors?.linkLocalNotAllowed,
+		multicastNotAllowed: errors?.multicastNotAllowed,
+		broadcastNotAllowed: errors?.broadcastNotAllowed,
+		zeroNotAllowed: errors?.zeroNotAllowed
+	} : void 0;
 	return {
 		$mode: "sync",
 		metavar,
@@ -2702,7 +2802,16 @@ function ip(options) {
 			}
 			if (ipv6Parser !== null) {
 				const result = ipv6Parser.parse(input);
-				if (result.success) return result;
+				if (result.success) {
+					if (version === "both") {
+						const mappedOctets = extractIpv4FromMapped(result.value);
+						if (mappedOctets !== null) {
+							const restrictionError = checkIpv4MappedRestrictions(mappedOctets, result.value, mappedIpv4Opts, mappedIpv4Errors);
+							if (restrictionError !== null) return restrictionError;
+						}
+					}
+					return result;
+				}
 				ipv6Error = result;
 				if (version === 6) return result;
 			}
@@ -2804,6 +2913,22 @@ function cidr(options) {
 			uniqueLocalNotAllowed: errors?.uniqueLocalNotAllowed
 		}
 	}) : null;
+	const mappedIpv4Opts = version === "both" ? {
+		allowPrivate: options?.ipv4?.allowPrivate,
+		allowLoopback: options?.ipv4?.allowLoopback,
+		allowLinkLocal: options?.ipv4?.allowLinkLocal,
+		allowMulticast: options?.ipv4?.allowMulticast,
+		allowBroadcast: options?.ipv4?.allowBroadcast,
+		allowZero: options?.ipv4?.allowZero
+	} : void 0;
+	const mappedIpv4Errors = version === "both" ? {
+		privateNotAllowed: errors?.privateNotAllowed,
+		loopbackNotAllowed: errors?.loopbackNotAllowed,
+		linkLocalNotAllowed: errors?.linkLocalNotAllowed,
+		multicastNotAllowed: errors?.multicastNotAllowed,
+		broadcastNotAllowed: errors?.broadcastNotAllowed,
+		zeroNotAllowed: errors?.zeroNotAllowed
+	} : void 0;
 	return {
 		$mode: "sync",
 		metavar,
@@ -3148,6 +3273,13 @@ function cidr(options) {
 					error: msg
 				};
 			}
+			if (version === "both" && ipVersion === 6 && normalizedIp !== null) {
+				const mappedOctets = extractIpv4FromMapped(normalizedIp);
+				if (mappedOctets !== null) {
+					const restrictionError = checkIpv4MappedRestrictions(mappedOctets, normalizedIp, mappedIpv4Opts, mappedIpv4Errors);
+					if (restrictionError !== null) return restrictionError;
+				}
+			}
 			return {
 				success: true,
 				value: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optique/core",
-  "version": "1.0.0-dev.1458+3f4a79f6",
+  "version": "1.0.0-dev.1461+fd58e837",
   "description": "Type-safe combinatorial command-line interface parser",
   "keywords": [
     "CLI",