@pikku/core 0.12.78 → 0.12.79

package/dist/wirings/workflow/pikku-workflow-service.js

@@ -146,6 +146,20 @@ const WORKFLOW_TERMINAL_STATES = new Set([
 const DEFAULT_STALLED_RUN_MS = 5 * 60_000;
 /** Runs re-driven per `recoverStalledRuns` call, so one sweep is bounded. */
 const DEFAULT_STALLED_RUN_LIMIT = 100;
+/**
+ * How long a step may sit `pending` before the relay assumes its dispatch was
+ * lost. This is a bet that no healthy queue takes this long to move a job from
+ * `pending` to `running`; set it above the observed p99 of that latency.
+ */
+const DEFAULT_UNDISPATCHED_STEP_MS = 30_000;
+/** Steps re-driven per `relayUndispatchedSteps` call, so one tick is bounded. */
+const DEFAULT_UNDISPATCHED_STEP_LIMIT = 100;
+/** First wait before a step already re-dispatched once is re-dispatched again. */
+const REDISPATCH_BACKOFF_MS = 30_000;
+/** Ceiling on the doubling backoff, so a permanently stuck step still gets swept. */
+const REDISPATCH_BACKOFF_MAX_MS = 10 * 60_000;
+/** Bound on the in-process backoff map, so a long-lived process cannot grow it without bound. */
+const REDISPATCH_BACKOFF_MAX_ENTRIES = 10_000;
 const WORKFLOW_POLL_MIN_MS = 10;
 const WORKFLOW_POLL_FACTOR = 1.6;
 const WORKFLOW_CHILD_POLL_MAX_MS = 500;
@@ -486,6 +500,96 @@ export class PikkuWorkflowService {
         }
         return { resumed };
     }
+    /**
+     * Runs holding a step that has sat `pending` since before `before`, paired
+     * with the step that flagged them.
+     *
+     * Returns nothing by default so a store that cannot express the query keeps
+     * working unchanged — and, because it does not opt in, gains no re-dispatches
+     * either. A store must have an atomic `withStepLock` before overriding this,
+     * or no concurrency for one to exclude: the relay makes duplicate dispatch
+     * routine, and the claim in `executeWorkflowStepInner` is what keeps a
+     * duplicate from becoming a second execution. `kysely-postgres` and
+     * `kysely-mysql` qualify on the lock, `in-memory` on being inline and
+     * single-process; `mongodb` and `kysely-sqlite` qualify on neither.
+     */
+    async findUndispatchedSteps(_before, _limit) {
+        return [];
+    }
+    /**
+     * Re-drive steps whose dispatch was lost, and report which runs were nudged.
+     *
+     * Arming a step is two writes to two systems: the step row lands `pending`,
+     * then a queue or scheduler job is published. Nothing spans both, so a crash
+     * in between leaves a durable row that nothing will ever pick up — the run
+     * neither finishes nor fails. (Seen on a `workflow.sleep()`: a deploy restart
+     * landed between the sleep step's insert and its timer.)
+     *
+     * The row is the outbox record and this is the relay. Age is the only signal
+     * available — a step `pending` because its dispatch was lost is
+     * indistinguishable from one whose job is merely still queued — so a step
+     * past `undispatchedAfterMs` is re-dispatched regardless, and correctness
+     * rests on the claim rather than on the guess being right. A redundant
+     * dispatch costs one queue message: the loser reads `running` and returns
+     * without invoking anything.
+     *
+     * Re-dispatches back off per step (doubling from 30s, capped at 10m) so a
+     * genuine queue backlog is not amplified by a tick that keeps firing at the
+     * steps the backlog is already delaying. The backoff is per process and
+     * advisory — losing it on restart costs extra dispatches, never correctness.
+     *
+     * This is not self-starting. Call it from a scheduled task; ~30s suits a
+     * queue whose `pending`→`running` latency is well under that.
+     */
+    async relayUndispatchedSteps(options) {
+        const before = new Date(Date.now() -
+            (options?.undispatchedAfterMs ?? DEFAULT_UNDISPATCHED_STEP_MS));
+        const steps = await this.findUndispatchedSteps(before, options?.limit ?? DEFAULT_UNDISPATCHED_STEP_LIMIT);
+        // Backoff is keyed by run, not step, because the run is the unit of
+        // re-drive: `resumeWorkflow` replays the whole run and re-dispatches every
+        // step still owed a job. Holding off a single step while resuming its run
+        // would not suppress anything.
+        const now = Date.now();
+        const runIds = new Set();
+        for (const { runId } of steps) {
+            const eligibleAt = this.redispatchBackoff.get(runId);
+            if (eligibleAt !== undefined && eligibleAt > now) {
+                continue;
+            }
+            this.noteRedispatch(runId, now);
+            runIds.add(runId);
+        }
+        const redispatched = [];
+        for (const runId of runIds) {
+            try {
+                await this.resumeWorkflow(runId);
+                redispatched.push(runId);
+            }
+            catch (err) {
+                // One unresumable run must not stop the tick from relaying the rest.
+                getSingletonServices()?.logger?.error(`Failed to re-dispatch workflow run ${runId}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        return { redispatched };
+    }
+    /** Advisory, per-process record of when a run may next be re-dispatched. */
+    redispatchBackoff = new Map();
+    redispatchDelays = new Map();
+    noteRedispatch(runId, now) {
+        const previous = this.redispatchDelays.get(runId);
+        const delay = Math.min(previous === undefined ? REDISPATCH_BACKOFF_MS : previous * 2, REDISPATCH_BACKOFF_MAX_MS);
+        // A run that settles is never returned again, so entries are only evicted by
+        // this bound — oldest first, which is also least recently re-dispatched.
+        if (this.redispatchBackoff.size >= REDISPATCH_BACKOFF_MAX_ENTRIES) {
+            const oldest = this.redispatchBackoff.keys().next();
+            if (!oldest.done) {
+                this.redispatchBackoff.delete(oldest.value);
+                this.redispatchDelays.delete(oldest.value);
+            }
+        }
+        this.redispatchDelays.set(runId, delay);
+        this.redispatchBackoff.set(runId, now + delay);
+    }
     resolveStepJobOptions(stepOptions) {
         const retries = stepOptions?.retries ?? DEFAULT_STEP_RETRIES;
         const retryDelay = stepOptions?.retryDelay;

package/knowledge/decisions/security/gateway-handlers-run-through-the-function-runner-gate.md

@@ -17,7 +17,16 @@ runner's gate is the only thing that evaluates a function's declared `auth`,
 `scopes` and `permissions`; a direct call runs the handler with none of them
 checked.
 
-The handler is registered with `sessionless: true`. Gateway inbound traffic is
+The synthetic registration **inherits the wired function's own metadata** —
+`sessionless`, input and output schema names, `scopes`, tag middleware — read
+back from `pikkuState(null, 'gateway', 'meta')[name].pikkuFuncId`, which the
+inspector already records. The synthetic id exists so the gate runs; it is not a
+licence to run the handler under metadata its author never wrote. A handler
+declared with `pikkuFunc` says session-required in meta rather than through an
+`auth` property, and that declaration is honoured.
+
+When nothing was declared — no inspector entry, as when a gateway is wired by
+hand — the handler falls back to `sessionless: true`. Gateway inbound traffic is
 authenticated by the platform adapter (webhook signature verification, platform
 tokens), not by a user session, so defaulting to session-required would reject
 every legitimate webhook. `CoreGateway.auth` and the handler's own `auth: true`
@@ -26,6 +35,7 @@ whenever declared, session or not.
 
 **What this rules out:** invoking `config.func` directly from any gateway
 transport as an optimisation, and "simplifying" the synthetic function
-registration away. It also rules out flipping the sessionless default to
-session-required as a hardening measure — that breaks every webhook rather than
+registration away. It also rules out fabricating the handler's metadata rather
+than inheriting it, and flipping the _fallback_ to session-required as a
+hardening measure — that breaks every webhook that declared nothing, rather than
 securing it; require auth per gateway via `CoreGateway.auth` instead.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.78",
+  "version": "0.12.79",
   "description": "The Pikku runtime — functions, wirings, services, middleware and types",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -37,6 +37,7 @@
     "./trigger": "./dist/wirings/trigger/index.js",
     "./rpc": "./dist/wirings/rpc/index.js",
     "./safe-fetch": "./dist/utils/safe-fetch.js",
+    "./node-host-resolver": "./dist/utils/node-host-resolver.js",
     "./mcp": "./dist/wirings/mcp/index.js",
     "./ai-agent": "./dist/wirings/ai-agent/index.js",
     "./gateway": "./dist/wirings/gateway/index.js",

package/src/services/in-memory-workflow-service.ts

@@ -301,6 +301,29 @@ export class InMemoryWorkflowService
     return newStep
   }
 
+  /**
+   * Safe to opt in despite the pass-through `withStepLock`: this service wires
+   * no queues and runs every step inline in one process, so the relay's
+   * redundant dispatch has no second holder to race with. See
+   * knowledge: decisions/internals/the-in-memory-workflow-service-is-inline-only-and-single-process.md
+   */
+  protected async findUndispatchedSteps(
+    before: Date,
+    limit: number
+  ): Promise<Array<{ runId: string; stepId: string }>> {
+    const undispatched: Array<{ runId: string; stepId: string }> = []
+    for (const [runId, run] of this.runs) {
+      if (run.status !== 'running') continue
+      for (const step of this.stepHistory.get(runId) ?? []) {
+        if (step.status !== 'pending') continue
+        if (step.updatedAt >= before) continue
+        undispatched.push({ runId, stepId: step.stepId })
+        if (undispatched.length >= limit) return undispatched
+      }
+    }
+    return undispatched
+  }
+
   protected async findStalledRunIds(
     before: Date,
     limit: number

package/src/utils/node-host-resolver.ts

@@ -0,0 +1,20 @@
+import { lookup } from 'node:dns/promises'
+
+import { setDefaultHostResolver, type HostResolver } from './safe-fetch.js'
+
+/**
+ * Resolves a hostname through the platform resolver, returning every address it
+ * points at so `safeFetch` can reject a public name aimed at an internal one.
+ *
+ * This module is Node-only and is never imported by core itself — Workers has no
+ * DNS API, and a static `node:dns` import in the shared path would break that
+ * build.
+ */
+export const nodeHostResolver: HostResolver = async (hostname) => {
+  const results = await lookup(hostname, { all: true, verbatim: true })
+  return results.map(({ address }) => address)
+}
+
+/** Installs {@link nodeHostResolver} as the default for every `safeFetch`. */
+export const installNodeHostResolver = () =>
+  setDefaultHostResolver(nodeHostResolver)

package/src/utils/safe-fetch.test.ts

@@ -41,15 +41,54 @@ describe('isPrivateHost', () => {
     }
   })
 
+  test('flags reserved IPv4 blocks that are not routable public space', () => {
+    for (const host of [
+      '100.64.0.1', // carrier-grade NAT
+      '100.100.100.200', // Alibaba Cloud metadata endpoint
+      '100.127.255.255', // top of 100.64.0.0/10
+      '192.0.0.192', // IETF protocol assignments
+      '198.18.0.1', // benchmarking
+      '198.19.255.255', // top of 198.18.0.0/15
+      '192.88.99.1', // 6to4 anycast
+      '192.0.2.1', // TEST-NET-1
+      '198.51.100.1', // TEST-NET-2
+      '203.0.113.1', // TEST-NET-3
+      '224.0.0.1', // multicast
+      '240.0.0.1', // reserved
+      '255.255.255.255', // broadcast
+    ]) {
+      assert.equal(isPrivateHost(host), true, `${host} should be private`)
+    }
+  })
+
+  test('flags IPv6 forms that tunnel to an internal IPv4 address', () => {
+    for (const host of [
+      '64:ff9b::a9fe:a9fe', // NAT64 wrapping 169.254.169.254
+      '[64:ff9b::169.254.169.254]', // same, dotted-quad tail
+      '2002:a9fe:a9fe::', // 6to4 wrapping 169.254.169.254
+      '2002:6464:64c8::', // 6to4 wrapping 100.100.100.200
+      'fec0::1', // deprecated site-local
+      'ff02::1', // multicast
+      '100::1', // discard-only
+    ]) {
+      assert.equal(isPrivateHost(host), true, `${host} should be private`)
+    }
+  })
+
   test('allows public hosts', () => {
     for (const host of [
       'example.com',
       '8.8.8.8',
       '172.32.0.1',
       '11.0.0.1',
+      '100.63.255.255', // just below the CGNAT block
+      '100.128.0.0', // just above the CGNAT block
+      '198.17.255.255', // just below the benchmarking block
+      '198.20.0.0', // just above the benchmarking block
       '134744072', // decimal-encoded 8.8.8.8 — public
       '2001:db8::1', // documentation range — public
-      'fec0::1', // deprecated site-local, outside fe80::/10 — treated public
+      '2002:808:808::', // 6to4 wrapping public 8.8.8.8
+      '64:ff9b::808:808', // NAT64 wrapping public 8.8.8.8
     ]) {
       assert.equal(isPrivateHost(host), false, `${host} should be public`)
     }
@@ -138,6 +177,109 @@ describe('safeFetch', () => {
     )
   })
 
+  test('refuses a public hostname that resolves to a private address', async () => {
+    await withStubbedFetch(
+      () => new Response('ok', { status: 200 }),
+      async (calls) => {
+        // The shape the literal-only check misses: a name that parses as public
+        // but whose A record points at the cloud metadata endpoint.
+        await assert.rejects(
+          safeFetch(
+            'https://169-254-169-254.nip.io/latest/meta-data/',
+            {},
+            {
+              resolveHost: async () => ['169.254.169.254'],
+            }
+          ),
+          /resolves to 169\.254\.169\.254/
+        )
+        assert.equal(calls.length, 0)
+      }
+    )
+  })
+
+  test('refuses when any one resolved address is private', async () => {
+    await withStubbedFetch(
+      () => new Response('ok', { status: 200 }),
+      async (calls) => {
+        await assert.rejects(
+          safeFetch(
+            'https://split-horizon.example.com/',
+            {},
+            {
+              resolveHost: async () => ['93.184.216.34', '10.0.0.5'],
+            }
+          ),
+          /resolves to 10\.0\.0\.5/
+        )
+        assert.equal(calls.length, 0)
+      }
+    )
+  })
+
+  test('re-resolves the host of a redirect hop', async () => {
+    await withStubbedFetch(
+      (url) =>
+        url.includes('start.com')
+          ? new Response(null, {
+              status: 302,
+              headers: { location: 'https://rebound.example.com/next' },
+            })
+          : new Response('ok', { status: 200 }),
+      async (calls) => {
+        await assert.rejects(
+          safeFetch(
+            'https://start.com',
+            {},
+            {
+              resolveHost: async (hostname) =>
+                hostname === 'start.com' ? ['93.184.216.34'] : ['127.0.0.1'],
+            }
+          ),
+          /resolves to 127\.0\.0\.1/
+        )
+        assert.equal(calls.length, 1)
+      }
+    )
+  })
+
+  test('allows a public hostname that resolves to public addresses', async () => {
+    await withStubbedFetch(
+      () => new Response('ok', { status: 200 }),
+      async (calls) => {
+        const res = await safeFetch(
+          'https://example.com/',
+          {},
+          {
+            resolveHost: async () => ['93.184.216.34'],
+          }
+        )
+        assert.equal(res.status, 200)
+        assert.equal(calls.length, 1)
+      }
+    )
+  })
+
+  test('does not resolve an IP literal or an allowlisted host', async () => {
+    await withStubbedFetch(
+      () => new Response('ok', { status: 200 }),
+      async () => {
+        let resolverCalls = 0
+        const resolveHost = async () => {
+          resolverCalls++
+          return ['10.0.0.1']
+        }
+        await safeFetch('https://93.184.216.34/', {}, { resolveHost })
+        await safeFetch(
+          'https://internal.example.com/',
+          {},
+          { resolveHost, allowedHosts: ['internal.example.com'] }
+        )
+        assert.equal(resolverCalls, 0)
+      }
+    )
+  })
+
   test('follows a redirect to another public host', async () => {
     await withStubbedFetch(
       (url) =>

package/src/utils/safe-fetch.ts

@@ -32,6 +32,134 @@ function parseIPv4Octets(
   return octets as [number, number, number, number]
 }
 
+/**
+ * IPv4 blocks that must never be reachable from user-supplied URLs: private,
+ * loopback, link-local (cloud metadata), carrier-grade NAT (Alibaba's
+ * `100.100.100.200` metadata endpoint), IETF protocol assignments, benchmarking,
+ * 6to4 anycast, the documentation TEST-NETs, multicast and reserved space.
+ */
+const PRIVATE_IPV4_BLOCKS: ReadonlyArray<readonly [string, number]> = [
+  ['0.0.0.0', 8],
+  ['10.0.0.0', 8],
+  ['100.64.0.0', 10],
+  ['127.0.0.0', 8],
+  ['169.254.0.0', 16],
+  ['172.16.0.0', 12],
+  ['192.0.0.0', 24],
+  ['192.0.2.0', 24],
+  ['192.88.99.0', 24],
+  ['192.168.0.0', 16],
+  ['198.18.0.0', 15],
+  ['198.51.100.0', 24],
+  ['203.0.113.0', 24],
+  ['224.0.0.0', 4],
+  ['240.0.0.0', 4],
+]
+
+const toUint32 = (octets: [number, number, number, number]): number =>
+  ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0
+
+const PRIVATE_IPV4_RANGES = PRIVATE_IPV4_BLOCKS.map(([base, prefix]) => {
+  const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0
+  return [(toUint32(parseIPv4Octets(base)!) & mask) >>> 0, mask] as const
+})
+
+const isPrivateIPv4 = (octets: [number, number, number, number]): boolean => {
+  const addr = toUint32(octets)
+  return PRIVATE_IPV4_RANGES.some(
+    ([base, mask]) => (addr & mask) >>> 0 === base
+  )
+}
+
+/**
+ * Expands an IPv6 literal into its eight 16-bit groups, handling `::` elision
+ * and a trailing dotted-quad. `null` when not a well-formed IPv6 literal.
+ */
+function parseIPv6Groups(host: string): number[] | null {
+  const zoneless = host.split('%')[0]!
+  const halves = zoneless.split('::')
+  if (halves.length > 2) return null
+
+  const parseSide = (side: string): number[] | null => {
+    if (side === '') return []
+    const parts = side.split(':')
+    const groups: number[] = []
+    for (let i = 0; i < parts.length; i++) {
+      const part = parts[i]!
+      if (i === parts.length - 1 && part.includes('.')) {
+        const v4 = parseIPv4Octets(part)
+        if (!v4) return null
+        groups.push((v4[0] << 8) | v4[1], (v4[2] << 8) | v4[3])
+        continue
+      }
+      if (!/^[0-9a-f]{1,4}$/.test(part)) return null
+      groups.push(parseInt(part, 16))
+    }
+    return groups
+  }
+
+  const head = parseSide(halves[0]!)
+  if (head === null) return null
+
+  if (halves.length === 1) {
+    return head.length === 8 ? head : null
+  }
+
+  const tail = parseSide(halves[1]!)
+  if (tail === null) return null
+  if (head.length + tail.length > 7) return null
+  return [...head, ...new Array(8 - head.length - tail.length).fill(0), ...tail]
+}
+
+const embeddedIPv4 = (
+  hi: number,
+  lo: number
+): [number, number, number, number] => [
+  (hi >> 8) & 0xff,
+  hi & 0xff,
+  (lo >> 8) & 0xff,
+  lo & 0xff,
+]
+
+function isPrivateIPv6(groups: number[]): boolean {
+  const [g0, g1, g2, g3, g4, g5, g6, g7] = groups as [
+    number,
+    number,
+    number,
+    number,
+    number,
+    number,
+    number,
+    number,
+  ]
+
+  if (groups.every((g) => g === 0)) return true // :: unspecified
+  if (groups.slice(0, 7).every((g) => g === 0) && g7 === 1) return true // ::1
+
+  // IPv4-mapped ::ffff:0:0/96 and IPv4-compatible ::/96
+  if (g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0) {
+    if (g5 === 0xffff || g5 === 0) return isPrivateIPv4(embeddedIPv4(g6, g7))
+  }
+  // NAT64 well-known prefix 64:ff9b::/96
+  if (
+    g0 === 0x64 &&
+    g1 === 0xff9b &&
+    g2 === 0 &&
+    g3 === 0 &&
+    g4 === 0 &&
+    g5 === 0
+  )
+    return isPrivateIPv4(embeddedIPv4(g6, g7))
+  // 6to4 2002::/16 carries the IPv4 address in the next 32 bits
+  if (g0 === 0x2002) return isPrivateIPv4(embeddedIPv4(g1, g2))
+  if (g0 === 0x100 && g1 === 0 && g2 === 0 && g3 === 0) return true // discard-only 100::/64
+  if ((g0 & 0xffc0) === 0xfe80) return true // link-local fe80::/10
+  if ((g0 & 0xfe00) === 0xfc00) return true // unique-local fc00::/7
+  if ((g0 & 0xffc0) === 0xfec0) return true // deprecated site-local fec0::/10
+  if ((g0 & 0xff00) === 0xff00) return true // multicast ff00::/8
+  return false
+}
+
 /**
  * Whether a hostname is an obvious internal target. Best-effort literal
  * matching only: it cannot catch a public hostname that *resolves* to a
@@ -46,31 +174,30 @@ export function isPrivateHost(hostname: string): boolean {
     return true
 
   if (host.includes(':')) {
-    if (host === '::' || host === '::1') return true
-    const mappedV4 = host.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/)
-    if (mappedV4) return isPrivateHost(mappedV4[1]!)
-    const mappedHex = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/)
-    if (mappedHex) {
-      const hi = parseInt(mappedHex[1]!, 16)
-      const lo = parseInt(mappedHex[2]!, 16)
-      return isPrivateHost(
-        `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`
-      )
-    }
-    if (/^fe[89ab]/.test(host)) return true // link-local fe80::/10
-    if (host.startsWith('fc') || host.startsWith('fd')) return true // unique-local fc00::/7
-    return false
+    const groups = parseIPv6Groups(host)
+    return groups ? isPrivateIPv6(groups) : false
   }
 
   const v4 = parseIPv4Octets(host)
-  if (v4) {
-    const [a, b] = v4
-    if (a === 127 || a === 10 || a === 0) return true
-    if (a === 169 && b === 254) return true // link-local incl. cloud metadata
-    if (a === 172 && b >= 16 && b <= 31) return true
-    if (a === 192 && b === 168) return true
-  }
-  return false
+  return v4 ? isPrivateIPv4(v4) : false
+}
+
+/** Resolves a hostname to the IP addresses it points at. */
+export type HostResolver = (hostname: string) => Promise<string[]>
+
+let defaultHostResolver: HostResolver | undefined
+
+/**
+ * Installs the resolver {@link safeFetch} uses when a call passes no
+ * `resolveHost` of its own.
+ *
+ * Core cannot resolve DNS itself — Workers has no DNS API — so without a
+ * resolver the guard is literal-only and a public name pointing at
+ * `169.254.169.254` passes. Node runtimes install
+ * `nodeHostResolver` from `@pikku/core/node-host-resolver` at startup.
+ */
+export function setDefaultHostResolver(resolver: HostResolver | undefined) {
+  defaultHostResolver = resolver
 }
 
 export interface SafeFetchOptions {
@@ -81,6 +208,50 @@ export interface SafeFetchOptions {
   allowedHosts?: string[]
   /** Maximum redirect hops to follow (each re-validated). Defaults to 3. */
   maxRedirects?: number
+  /**
+   * Resolves a hostname so a *public* name pointing at a private address is
+   * refused. Defaults to whatever {@link setDefaultHostResolver} installed;
+   * pass `null` to opt a call out of resolution entirely.
+   */
+  resolveHost?: HostResolver | null
+}
+
+/** Whether a hostname is already an IP literal, which the sync check covers. */
+function isIpLiteral(hostname: string): boolean {
+  const host = hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '')
+  if (host.includes(':')) return parseIPv6Groups(host.toLowerCase()) !== null
+  return parseIPv4Octets(host) !== null
+}
+
+/**
+ * Rejects a hostname that resolves to an internal address.
+ *
+ * Resolution happens once per hop and the connection is not pinned to the
+ * address checked, so a rebind between this check and the socket connecting is
+ * still possible; catching that needs a runtime-level connect hook.
+ */
+async function assertResolvedHostAllowed(
+  hostname: string,
+  options: SafeFetchOptions
+): Promise<void> {
+  if (options.allowedHosts) return
+  const resolver =
+    options.resolveHost === null
+      ? undefined
+      : (options.resolveHost ?? defaultHostResolver)
+  if (!resolver || isIpLiteral(hostname)) return
+
+  const addresses = await resolver(hostname)
+  if (addresses.length === 0) {
+    throw new Error(`Refusing to fetch: '${hostname}' resolved to no addresses`)
+  }
+  for (const address of addresses) {
+    if (isPrivateHost(address)) {
+      throw new Error(
+        `Refusing to fetch from a private/internal host: '${hostname}' resolves to ${address}`
+      )
+    }
+  }
 }
 
 export function assertFetchableUrl(
@@ -142,7 +313,9 @@ export async function safeFetch(
   options: SafeFetchOptions = {}
 ): Promise<Response> {
   const maxRedirects = options.maxRedirects ?? 3
-  let currentUrl = assertFetchableUrl(url, options).toString()
+  const initial = assertFetchableUrl(url, options)
+  await assertResolvedHostAllowed(initial.hostname, options)
+  let currentUrl = initial.toString()
   let currentInit = init
 
   for (let hop = 0; ; hop++) {
@@ -157,10 +330,12 @@ export async function safeFetch(
     if (!location || hop >= maxRedirects) {
       return response
     }
-    const nextUrl = assertFetchableUrl(
+    const next = assertFetchableUrl(
       new URL(location, currentUrl).toString(),
       options
-    ).toString()
+    )
+    await assertResolvedHostAllowed(next.hostname, options)
+    const nextUrl = next.toString()
     await response.body?.cancel()
     let nextInit = redirectInit(response.status, currentInit)
     if (new URL(nextUrl).origin !== new URL(currentUrl).origin) {