@questpie/sandbox 3.16.0 → 3.17.0

package/src/guest-entry.ts

@@ -38,12 +38,16 @@
 
 // @ts-nocheck — Deno runtime file; not part of the Bun/tsc typecheck graph.
 
+import nodeProcess from "node:process";
+
 import { buildGuestBindings } from "./guest-bindings.ts";
 
 /** Marker so the supervisor can pick the result line out of guest stdout noise. */
 const RESULT_MARKER = "__QP_SANDBOX_RESULT__";
 /** Marker prefixing each FRAMED protocol message (bindings path). */
 const FRAME_MARKER = "__QP_SANDBOX_MSG__";
+/** Injected by the supervisor from the canonical decoded broker-body budget. */
+const HTTP_FETCH_BODY_CAP_BYTES = __QP_HTTP_FETCH_BODY_CAP_BYTES__;
 
 // ── 1. HARDEN GLOBALS (must happen before importing/eval'ing guest source) ──
 
@@ -70,6 +74,39 @@ for (const name of ["SharedArrayBuffer", "Atomics"]) {
 	}
 }
 
+// The supervisor starts from the stable OS cwd `/` and loads this entry through
+// an internal loopback module URL. Normalize every Deno/Node compatibility path
+// surface before guest import. If the qualified Deno runtime cannot lock one of
+// these surfaces, fail startup instead of leaking a host or principal path.
+Object.defineProperty(Deno, "cwd", {
+	value: () => "/work",
+	configurable: false,
+	writable: false,
+});
+Object.defineProperty(Deno, "mainModule", {
+	value: "questpie://sandbox/guest-entry.ts",
+	configurable: false,
+	writable: false,
+});
+Object.defineProperty(Deno, "execPath", {
+	value: () => "/runtime/deno",
+	configurable: false,
+	writable: false,
+});
+Object.defineProperty(nodeProcess, "cwd", {
+	value: () => "/work",
+	configurable: false,
+	writable: false,
+});
+Object.defineProperty(nodeProcess, "argv", {
+	value: Object.freeze(["deno", "questpie://sandbox/guest-entry.ts"]),
+	configurable: false,
+	writable: false,
+});
+nodeProcess.execPath = "/runtime/deno";
+// `argv0` is a non-configurable Deno Node-compat accessor. The supervisor sets
+// the real child argv[0] to the stable runtime name before this module loads.
+
 // ── 2. CAPTURE CONSOLE ──
 
 const logs: string[] = [];
@@ -97,7 +134,9 @@ for (const level of ["log", "error", "warn", "info"] as const) {
 						}
 					})
 					.join(" ");
-			logs.push(line.length > MAX_LOG_LEN ? line.slice(0, MAX_LOG_LEN) + "…" : line);
+			logs.push(
+				line.length > MAX_LOG_LEN ? line.slice(0, MAX_LOG_LEN) + "…" : line,
+			);
 		}
 	};
 }
@@ -165,20 +204,45 @@ function createLineReader() {
 	};
 }
 
-/** Write one framed message line to stdout. */
-function writeFrame(msg: unknown) {
+/** Write one complete framed message line to stdout without blocking the guest loop. */
+async function writeFrame(msg: unknown): Promise<void> {
 	let payload: string;
 	try {
 		payload = JSON.stringify(msg);
 	} catch {
-		payload = JSON.stringify({ type: "result", ok: false, error: "frame not serializable", logs });
+		payload = JSON.stringify({
+			type: "result",
+			ok: false,
+			error: "frame not serializable",
+			logs,
+		});
 	}
 	// deno-lint-ignore no-explicit-any
-	(Deno as any).stdout.writeSync(encoder.encode(FRAME_MARKER + payload + "\n"));
+	const stdout = (Deno as any).stdout;
+	const frame = encoder.encode(FRAME_MARKER + payload + "\n");
+	const maximumWriteBytes = 64 * 1024;
+	let offset = 0;
+	while (offset < frame.byteLength) {
+		const written = await stdout.write(
+			frame.subarray(
+				offset,
+				Math.min(frame.byteLength, offset + maximumWriteBytes),
+			),
+		);
+		if (!Number.isSafeInteger(written) || written <= 0) {
+			throw new Error("sandbox stdout closed during frame");
+		}
+		offset += written;
+	}
 }
 
 /** Emit the LEGACY single-line result (no bindings). */
-function emitLegacy(result: { ok: boolean; output?: unknown; logs: string[]; error?: string }) {
+function emitLegacy(result: {
+	ok: boolean;
+	output?: unknown;
+	logs: string[];
+	error?: string;
+}) {
 	let payload: string;
 	try {
 		payload = JSON.stringify(result);
@@ -195,7 +259,9 @@ function emitLegacy(result: { ok: boolean; output?: unknown; logs: string[]; err
 // ── 4. IMPORT + INVOKE THE GUEST ──
 
 /** Dynamic-import the guest source as a blob module and return its default fn. */
-async function loadGuestEntry(source: string): Promise<(input: unknown) => unknown> {
+async function loadGuestEntry(
+	source: string,
+): Promise<(input: unknown) => unknown> {
 	const guestUrl = URL.createObjectURL(
 		new Blob([source], { type: "application/typescript" }),
 	);
@@ -228,6 +294,7 @@ type Envelope = {
 
 /** Encode raw bytes to base64 (works for arbitrary binary; no Buffer in Deno). */
 function bytesToBase64(bytes: Uint8Array): string {
+	if (typeof bytes.toBase64 === "function") return bytes.toBase64();
 	let binary = "";
 	const chunk = 0x8000; // chunk to avoid arg-count limits on String.fromCharCode
 	for (let i = 0; i < bytes.length; i += chunk) {
@@ -238,6 +305,9 @@ function bytesToBase64(bytes: Uint8Array): string {
 
 /** Decode base64 to raw bytes (inverse of {@link bytesToBase64}). */
 function base64ToBytes(b64: string): Uint8Array {
+	if (typeof Uint8Array.fromBase64 === "function") {
+		return Uint8Array.fromBase64(b64);
+	}
 	const binary = atob(b64);
 	const out = new Uint8Array(binary.length);
 	for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
@@ -251,7 +321,9 @@ function base64ToBytes(b64: string): Uint8Array {
  * fetch (any body shape → bytes), then frames the {@link HttpFetchRequest} and
  * rebuilds a `Response` from the {@link HttpFetchResponse}.
  */
-function installFetchShim(hostCall: (method: string, args: unknown) => Promise<unknown>) {
+function installFetchShim(
+	hostCall: (method: string, args: unknown) => Promise<unknown>,
+) {
 	const brokeredFetch = async (
 		input: unknown,
 		init?: unknown,
@@ -276,7 +348,14 @@ function installFetchShim(hostCall: (method: string, args: unknown) => Promise<u
 		// no body; `arrayBuffer()` yields an empty buffer which we omit.
 		let bodyBase64: string | undefined;
 		const buf = await req.arrayBuffer();
-		if (buf.byteLength > 0) bodyBase64 = bytesToBase64(new Uint8Array(buf));
+		if (buf.byteLength > HTTP_FETCH_BODY_CAP_BYTES) {
+			// Send a deliberately malformed, tiny value so the trusted host performs
+			// the authoritative rejection and the supervisor latches it terminally.
+			// This avoids base64-encoding data already known to exceed the shared cap.
+			bodyBase64 = 0 as unknown as string;
+		} else if (buf.byteLength > 0) {
+			bodyBase64 = bytesToBase64(new Uint8Array(buf));
+		}
 
 		const request: HttpFetchRequest = {
 			url: req.url,
@@ -296,10 +375,13 @@ function installFetchShim(hostCall: (method: string, args: unknown) => Promise<u
 		}
 
 		const status = typeof value?.status === "number" ? value.status : 0;
-		const body = value?.bodyBase64 ? base64ToBytes(value.bodyBase64) : undefined;
+		const body = value?.bodyBase64
+			? base64ToBytes(value.bodyBase64)
+			: undefined;
 		// `Response` forbids a body for 101/204/205/304 and for null-body statuses;
 		// guard so reconstruction never throws on those.
-		const nullBody = status === 204 || status === 205 || status === 304 || status < 200;
+		const nullBody =
+			status === 204 || status === 205 || status === 304 || status < 200;
 		return new Response(nullBody ? null : (body ?? null), {
 			status,
 			statusText: typeof value?.statusText === "string" ? value.statusText : "",
@@ -327,18 +409,30 @@ interface HttpFetchResponse {
 }
 
 /** BINDINGS run — framed channel + `globalThis.questpie` proxy. */
-async function runWithBindings(envelope: Envelope, reader: { next(): Promise<string | null> }) {
+async function runWithBindings(
+	envelope: Envelope,
+	reader: { next(): Promise<string | null> },
+) {
 	// Pending host calls keyed by correlation id.
-	const pending = new Map<number, { resolve: (v: unknown) => void; reject: (e: unknown) => void }>();
+	const pending = new Map<
+		number,
+		{ resolve: (v: unknown) => void; reject: (e: unknown) => void }
+	>();
 	let nextId = 1;
 
 	// The injected transport: write an `rpc` frame, await its `rpc-result`.
-	const hostCall = (method: string, args: unknown): Promise<unknown> => {
+	const hostCall = async (method: string, args: unknown): Promise<unknown> => {
 		const id = nextId++;
-		return new Promise<unknown>((resolve, reject) => {
+		const response = new Promise<unknown>((resolve, reject) => {
 			pending.set(id, { resolve, reject });
-			writeFrame({ type: "rpc", id, method, args });
 		});
+		try {
+			await writeFrame({ type: "rpc", id, method, args });
+		} catch (error) {
+			pending.delete(id);
+			throw error;
+		}
+		return response;
 	};
 
 	// Background loop: consume `rpc-result` frames and settle pending calls. It
@@ -348,8 +442,16 @@ async function runWithBindings(envelope: Envelope, reader: { next(): Promise<str
 			const line = await reader.next();
 			if (line === null) break;
 			if (line.length === 0) continue;
-			const json = line.startsWith(FRAME_MARKER) ? line.slice(FRAME_MARKER.length) : line;
-			let msg: { type?: string; id?: number; ok?: boolean; value?: unknown; error?: { message?: string } };
+			const json = line.startsWith(FRAME_MARKER)
+				? line.slice(FRAME_MARKER.length)
+				: line;
+			let msg: {
+				type?: string;
+				id?: number;
+				ok?: boolean;
+				value?: unknown;
+				error?: { message?: string };
+			};
 			try {
 				msg = JSON.parse(json);
 			} catch {
@@ -386,9 +488,9 @@ async function runWithBindings(envelope: Envelope, reader: { next(): Promise<str
 	try {
 		const entry = await loadGuestEntry(envelope.source);
 		const output = await entry(envelope.input);
-		writeFrame({ type: "result", ok: true, output, logs });
+		await writeFrame({ type: "result", ok: true, output, logs });
 	} catch (err) {
-		writeFrame({
+		await writeFrame({
 			type: "result",
 			ok: false,
 			error: err instanceof Error ? err.message : String(err),
@@ -416,7 +518,11 @@ async function main() {
 			: firstLine;
 		envelope = JSON.parse(json);
 	} catch {
-		emitLegacy({ ok: false, error: "failed to read/parse request envelope", logs });
+		emitLegacy({
+			ok: false,
+			error: "failed to read/parse request envelope",
+			logs,
+		});
 		return;
 	}
 
@@ -435,7 +541,11 @@ async function main() {
 			const output = await entry(envelope.input);
 			emitLegacy({ ok: true, output, logs });
 		} catch (err) {
-			emitLegacy({ ok: false, error: err instanceof Error ? err.message : String(err), logs });
+			emitLegacy({
+				ok: false,
+				error: err instanceof Error ? err.message : String(err),
+				logs,
+			});
 		}
 	}
 }

package/src/guest-runtime-source.ts

@@ -0,0 +1,38 @@
+const GUEST_BINDINGS_IMPORT =
+	'import { buildGuestBindings } from "./guest-bindings.ts";';
+const HTTP_BODY_CAP_MARKER = "__QP_HTTP_FETCH_BODY_CAP_BYTES__";
+
+/** Inline the trusted dependency so the guest entry needs no host path/socket. */
+export function bundleGuestRuntimeSource(
+	guestEntrySource: string,
+	guestBindingsSource: string,
+	httpBodyCapBytes: number,
+): string {
+	if (!guestEntrySource.includes(GUEST_BINDINGS_IMPORT)) {
+		throw new Error(
+			"Guest entry does not contain the qualified bindings import.",
+		);
+	}
+	if (
+		!guestEntrySource.includes(HTTP_BODY_CAP_MARKER) ||
+		!Number.isSafeInteger(httpBodyCapBytes) ||
+		httpBodyCapBytes <= 0
+	) {
+		throw new Error("Guest entry does not contain a valid HTTP body cap.");
+	}
+	const inlinedBindings = guestBindingsSource.replace(/^export /gm, "");
+	return `${inlinedBindings}\n${guestEntrySource
+		.replace(GUEST_BINDINGS_IMPORT, "")
+		.replaceAll(HTTP_BODY_CAP_MARKER, String(httpBodyCapBytes))}`;
+}
+
+/** Build a local module URL that works inside an isolated network namespace. */
+export function guestRuntimeDataUrl(source: string): string {
+	const bytes = new TextEncoder().encode(source);
+	let binary = "";
+	const chunkSize = 0x8000;
+	for (let index = 0; index < bytes.length; index += chunkSize) {
+		binary += String.fromCharCode(...bytes.subarray(index, index + chunkSize));
+	}
+	return `data:application/typescript;base64,${btoa(binary)}`;
+}

package/src/net-validation.ts

@@ -144,7 +144,11 @@ function isPrivateIpv6(raw: string): boolean {
 	}
 
 	// fc00::/7 unique-local (fc.. and fd..).
-	if (/^f[cd][0-9a-f]{0,2}:/.test(ip) || ip.startsWith("fc") || ip.startsWith("fd")) {
+	if (
+		/^f[cd][0-9a-f]{0,2}:/.test(ip) ||
+		ip.startsWith("fc") ||
+		ip.startsWith("fd")
+	) {
 		const first = ip.split(":")[0];
 		if (first.length > 0) {
 			const hi = Number.parseInt(first.padStart(4, "0").slice(0, 2), 16);
@@ -153,7 +157,12 @@ function isPrivateIpv6(raw: string): boolean {
 	}
 
 	// fe80::/10 link-local.
-	if (ip.startsWith("fe8") || ip.startsWith("fe9") || ip.startsWith("fea") || ip.startsWith("feb")) {
+	if (
+		ip.startsWith("fe8") ||
+		ip.startsWith("fe9") ||
+		ip.startsWith("fea") ||
+		ip.startsWith("feb")
+	) {
 		return true;
 	}
 
@@ -182,13 +191,36 @@ export function classifyIpLiteral(ip: string): IpValidationResult {
 /** Bound each DNS lookup so a slow/hanging resolver can't stall validation. */
 const DNS_TIMEOUT_MS = 3_000;
 
-function withDnsTimeout<T>(p: Promise<T>): Promise<T> {
-	return Promise.race([
-		p,
-		new Promise<T>((_, reject) =>
-			setTimeout(() => reject(new Error(`DNS lookup timed out (${DNS_TIMEOUT_MS}ms)`)), DNS_TIMEOUT_MS),
-		),
-	]);
+function withDnsTimeout<T>(
+	promise: Promise<T>,
+	timeoutMs = DNS_TIMEOUT_MS,
+	signal?: AbortSignal,
+): Promise<T> {
+	return new Promise<T>((resolve, reject) => {
+		let settled = false;
+		const finish = (callback: () => void) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", onAbort);
+			callback();
+		};
+		const onAbort = () =>
+			finish(() => reject(new Error("DNS lookup cancelled")));
+		const timer = setTimeout(
+			() =>
+				finish(() =>
+					reject(new Error(`DNS lookup timed out (${timeoutMs}ms)`)),
+				),
+			timeoutMs,
+		);
+		if (signal?.aborted) onAbort();
+		else signal?.addEventListener("abort", onAbort, { once: true });
+		void promise.then(
+			(value) => finish(() => resolve(value)),
+			(error) => finish(() => reject(error)),
+		);
+	});
 }
 
 /** Lazily load `node:dns/promises` `resolve` (works on both Bun and Deno). */
@@ -208,7 +240,11 @@ async function defaultResolver(hostname: string): Promise<string[]> {
 			// If BOTH lookups failed (incl. timeout), surface an error so the caller
 			// fails CLOSED (rejects the host) rather than treating it as "no private
 			// addresses found" → allowed.
-			if (out.length === 0 && v4.status === "rejected" && v6.status === "rejected") {
+			if (
+				out.length === 0 &&
+				v4.status === "rejected" &&
+				v6.status === "rejected"
+			) {
 				throw new Error(
 					`DNS resolution failed (v4: ${reasonOf(v4)}, v6: ${reasonOf(v6)})`,
 				);
@@ -236,8 +272,15 @@ function reasonOf(settled: PromiseRejectedResult): string {
  */
 export async function validateHostEgress(
 	entry: string,
-	opts: { resolve?: DnsResolver } = {},
+	opts: {
+		resolve?: DnsResolver;
+		signal?: AbortSignal;
+		timeoutMs?: number;
+	} = {},
 ): Promise<IpValidationResult> {
+	if (opts.signal?.aborted) {
+		return { ok: false, reason: "DNS lookup cancelled" };
+	}
 	const { host } = parseHostEntry(entry);
 	const lower = host.toLowerCase();
 
@@ -245,7 +288,11 @@ export async function validateHostEgress(
 		return { ok: false, reason: "empty host" };
 	}
 	// Obvious loopback / mDNS names — never resolve these out.
-	if (lower === "localhost" || lower.endsWith(".localhost") || lower.endsWith(".local")) {
+	if (
+		lower === "localhost" ||
+		lower.endsWith(".localhost") ||
+		lower.endsWith(".local")
+	) {
 		return { ok: false, reason: `loopback/mDNS hostname not allowed: ${host}` };
 	}
 
@@ -260,7 +307,11 @@ export async function validateHostEgress(
 	const resolver = opts.resolve ?? defaultResolver;
 	let addrs: string[];
 	try {
-		addrs = await resolver(host);
+		addrs = await withDnsTimeout(
+			resolver(host),
+			opts.timeoutMs ?? DNS_TIMEOUT_MS,
+			opts.signal,
+		);
 	} catch (err) {
 		return {
 			ok: false,
@@ -268,7 +319,10 @@ export async function validateHostEgress(
 		};
 	}
 	if (addrs.length === 0) {
-		return { ok: false, reason: `DNS resolution returned no addresses for ${host}` };
+		return {
+			ok: false,
+			reason: `DNS resolution returned no addresses for ${host}`,
+		};
 	}
 	for (const addr of addrs) {
 		const c = classifyIpLiteral(addr);
@@ -288,11 +342,60 @@ export async function validateHostEgress(
  */
 export async function validateEgressHosts(
 	hosts: readonly string[],
-	opts: { resolve?: DnsResolver } = {},
+	opts: {
+		resolve?: DnsResolver;
+		signal?: AbortSignal;
+		timeoutMs?: number;
+		concurrency?: number;
+	} = {},
 ): Promise<IpValidationResult> {
-	for (const entry of hosts) {
-		const r = await validateHostEgress(entry, opts);
-		if (!r.ok) return { ok: false, reason: `host "${entry}": ${r.reason}` };
+	if (hosts.length === 0) return { ok: true };
+	const controller = new AbortController();
+	const onAbort = () => controller.abort();
+	if (opts.signal?.aborted) controller.abort();
+	else opts.signal?.addEventListener("abort", onAbort, { once: true });
+	const timeoutMs = Math.max(
+		1,
+		Math.min(DNS_TIMEOUT_MS, Math.floor(opts.timeoutMs ?? DNS_TIMEOUT_MS)),
+	);
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
+	const concurrency = Math.max(
+		1,
+		Math.min(8, Math.floor(opts.concurrency ?? 4)),
+	);
+	const results = Array.from<IpValidationResult | undefined>({
+		length: hosts.length,
+	});
+	let cursor = 0;
+	const worker = async () => {
+		while (cursor < hosts.length) {
+			const index = cursor;
+			cursor += 1;
+			results[index] = await validateHostEgress(hosts[index]!, {
+				...opts,
+				signal: controller.signal,
+				timeoutMs,
+			});
+		}
+	};
+	try {
+		await Promise.all(
+			Array.from({ length: Math.min(concurrency, hosts.length) }, () =>
+				worker(),
+			),
+		);
+	} finally {
+		clearTimeout(timer);
+		opts.signal?.removeEventListener("abort", onAbort);
+	}
+	for (let index = 0; index < results.length; index += 1) {
+		const result = results[index]!;
+		if (!result.ok) {
+			return {
+				ok: false,
+				reason: `host "${hosts[index]}": ${result.reason}`,
+			};
+		}
 	}
 	return { ok: true };
 }
@@ -314,45 +417,95 @@ export interface ResolvedEndpoint {
  * so a private result here is a rebind/inconsistency and must NOT become an
  * `accept` rule). The drop rules cover the private space regardless.
  *
- * Best-effort + fail-OPEN-on-resolution-error by design: a host that fails to
- * resolve simply yields no `accept` rule (the guest can't reach it → still safe);
- * this never throws so it cannot break the spawn path. The SECURITY guarantee is
- * carried by the DROP rules + the default-deny policy, not by this function.
+ * Best-effort and fail-safe on resolution error: a host that fails to resolve
+ * simply yields no `accept` rule (the guest can't reach it). This never throws,
+ * and the security guarantee remains the DROP rules plus default-deny policy.
  */
 export async function resolveAllowedEndpoints(
 	hosts: readonly string[],
-	opts: { resolve?: DnsResolver } = {},
+	opts: {
+		resolve?: DnsResolver;
+		signal?: AbortSignal;
+		timeoutMs?: number;
+		concurrency?: number;
+	} = {},
 ): Promise<ResolvedEndpoint[]> {
-	const out: ResolvedEndpoint[] = [];
-	const seen = new Set<string>();
-	const push = (ip: string, port?: number) => {
-		const key = `${ip}|${port ?? ""}`;
-		if (seen.has(key)) return;
-		seen.add(key);
-		out.push(port === undefined ? { ip } : { ip, port });
-	};
 	const resolver = opts.resolve ?? defaultResolver;
+	const controller = new AbortController();
+	const onAbort = () => controller.abort();
+	if (opts.signal?.aborted) controller.abort();
+	else opts.signal?.addEventListener("abort", onAbort, { once: true });
+	const timeoutMs = Math.max(
+		1,
+		Math.min(DNS_TIMEOUT_MS, Math.floor(opts.timeoutMs ?? DNS_TIMEOUT_MS)),
+	);
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
+	const concurrency = Math.max(
+		1,
+		Math.min(8, Math.floor(opts.concurrency ?? 4)),
+	);
+	const resolved = Array.from<ResolvedEndpoint[] | undefined>({
+		length: hosts.length,
+	});
+	let cursor = 0;
 
-	for (const entry of hosts) {
-		const { host, port } = parseHostEntry(entry);
-		const lower = host.toLowerCase();
-		if (lower.length === 0 || lower === "localhost" || lower.endsWith(".localhost") || lower.endsWith(".local")) {
-			continue;
-		}
-		// IP literal → accept only if it classifies as PUBLIC.
-		if (isIpv4Literal(host) || isIpv6Literal(host)) {
-			if (classifyIpLiteral(host).ok) push(host, port);
-			continue;
-		}
-		// Hostname → resolve; pin each PUBLIC address.
-		let addrs: string[];
-		try {
-			addrs = await resolver(host);
-		} catch {
-			continue; // unresolvable → no accept rule (guest can't reach it anyway)
-		}
-		for (const addr of addrs) {
-			if (classifyIpLiteral(addr).ok) push(addr, port);
+	try {
+		const worker = async () => {
+			while (cursor < hosts.length && !controller.signal.aborted) {
+				const index = cursor;
+				cursor += 1;
+				const { host, port } = parseHostEntry(hosts[index]!);
+				const lower = host.toLowerCase();
+				if (
+					lower.length === 0 ||
+					lower === "localhost" ||
+					lower.endsWith(".localhost") ||
+					lower.endsWith(".local")
+				) {
+					resolved[index] = [];
+					continue;
+				}
+				// IP literal → accept only if it classifies as PUBLIC.
+				if (isIpv4Literal(host) || isIpv6Literal(host)) {
+					resolved[index] = classifyIpLiteral(host).ok
+						? [port === undefined ? { ip: host } : { ip: host, port }]
+						: [];
+					continue;
+				}
+				// Hostname → resolve; pin each PUBLIC address.
+				try {
+					const addrs = await withDnsTimeout(
+						resolver(host),
+						timeoutMs,
+						controller.signal,
+					);
+					resolved[index] = addrs
+						.filter((addr) => classifyIpLiteral(addr).ok)
+						.map((ip) => (port === undefined ? { ip } : { ip, port }));
+				} catch {
+					// Unresolvable or cancelled → no accept rule.
+					resolved[index] = [];
+				}
+			}
+		};
+		await Promise.all(
+			Array.from({ length: Math.min(concurrency, hosts.length) }, () =>
+				worker(),
+			),
+		);
+	} finally {
+		clearTimeout(timer);
+		opts.signal?.removeEventListener("abort", onAbort);
+	}
+
+	const out: ResolvedEndpoint[] = [];
+	const seen = new Set<string>();
+	for (const endpoints of resolved) {
+		for (const endpoint of endpoints ?? []) {
+			const key = `${endpoint.ip}|${endpoint.port ?? ""}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			out.push(endpoint);
 		}
 	}
 	return out;