@uncefact/untp-utils 0.1.0 → 0.2.0

package/build/node/errors.js

@@ -0,0 +1,80 @@
+import { StructuredError } from '../structured-error.js';
+/**
+ * Base for every diagnostic from `@uncefact/untp-utils/node`. Catch to
+ * handle any URL-validation failure generically; catch a concrete subclass
+ * for specific handling.
+ */
+export class UrlValidationError extends StructuredError {
+}
+/** The string passed could not be parsed as a URL by `new URL(...)`. */
+export class InvalidUrlError extends UrlValidationError {
+    constructor(received, cause) {
+        super({ code: 'url.invalid', message: 'URL could not be parsed.', received, cause });
+    }
+}
+/** The URL's scheme is not in the allowed list (default `http`, `https`). */
+export class UnsupportedSchemeError extends UrlValidationError {
+    constructor(scheme, allowedSchemes) {
+        super({
+            code: 'url.unsupported-scheme',
+            message: `URL scheme ${scheme} is not in the allowed list.`,
+            received: scheme,
+            expected: [...allowedSchemes],
+            remediation: `Use one of: ${allowedSchemes.join(', ')}.`,
+        });
+    }
+}
+/**
+ * The hostname is a known private/local name (`localhost`, `*.localhost`,
+ * `*.local`, `*.internal`, etc.), an IP literal in a non-public range, or
+ * empty.
+ */
+export class PrivateHostnameError extends UrlValidationError {
+    constructor(hostname) {
+        super({
+            code: 'url.private-hostname',
+            message: `Hostname ${hostname || '(empty)'} names a private or local resource.`,
+            received: hostname,
+            remediation: 'Use a publicly-routable hostname.',
+        });
+    }
+}
+/** DNS resolution rejected (`ENOTFOUND`, `EAI_AGAIN`, etc.). */
+export class ResolutionFailedError extends UrlValidationError {
+    constructor(hostname, cause) {
+        super({
+            code: 'url.resolution-failed',
+            message: `DNS resolution failed for ${hostname}.`,
+            received: cause instanceof Error ? cause.message : String(cause),
+            cause,
+        });
+    }
+}
+/** DNS resolution succeeded but returned no addresses. */
+export class ResolutionEmptyError extends UrlValidationError {
+    constructor(hostname) {
+        super({
+            code: 'url.resolution-empty',
+            message: `DNS resolver returned no addresses for ${hostname}.`,
+            received: hostname,
+        });
+    }
+}
+/**
+ * At least one resolved IP is in a private / loopback / link-local /
+ * cloud-metadata range. The full list is exposed on
+ * {@link resolvedAddresses} for triage.
+ */
+export class PrivateAddressError extends UrlValidationError {
+    resolvedAddresses;
+    constructor(hostname, resolvedAddresses) {
+        super({
+            code: 'url.private-address',
+            message: `Hostname ${hostname} resolved to a private address.`,
+            received: resolvedAddresses,
+            remediation: 'Verify the hostname does not resolve to private or reserved network space.',
+        });
+        this.resolvedAddresses = resolvedAddresses;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/build/node/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/node/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,eAAe;CAAG;AAE1D,wEAAwE;AACxE,MAAM,OAAO,eAAgB,SAAQ,kBAAkB;IACrD,YAAY,QAAgB,EAAE,KAAc;QAC1C,KAAK,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,sBAAuB,SAAQ,kBAAkB;IAC5D,YAAY,MAAc,EAAE,cAAiC;QAC3D,KAAK,CAAC;YACJ,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,cAAc,MAAM,8BAA8B;YAC3D,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC;YAC7B,WAAW,EAAE,eAAe,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACzD,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,kBAAkB;IAC1D,YAAY,QAAgB;QAC1B,KAAK,CAAC;YACJ,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,YAAY,QAAQ,IAAI,SAAS,qCAAqC;YAC/E,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,mCAAmC;SACjD,CAAC,CAAC;IACL,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,OAAO,qBAAsB,SAAQ,kBAAkB;IAC3D,YAAY,QAAgB,EAAE,KAAc;QAC1C,KAAK,CAAC;YACJ,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,6BAA6B,QAAQ,GAAG;YACjD,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAChE,KAAK;SACN,CAAC,CAAC;IACL,CAAC;CACF;AAED,0DAA0D;AAC1D,MAAM,OAAO,oBAAqB,SAAQ,kBAAkB;IAC1D,YAAY,QAAgB;QAC1B,KAAK,CAAC;YACJ,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,0CAA0C,QAAQ,GAAG;YAC9D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,kBAAkB;IAChD,iBAAiB,CAAoB;IAC9C,YAAY,QAAgB,EAAE,iBAAoC;QAChE,KAAK,CAAC;YACJ,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,YAAY,QAAQ,iCAAiC;YAC9D,QAAQ,EAAE,iBAAiB;YAC3B,WAAW,EAAE,4EAA4E;SAC1F,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;CACF"}

package/build/node/index.d.ts

@@ -0,0 +1,3 @@
+export { UrlValidationError, InvalidUrlError, UnsupportedSchemeError, PrivateHostnameError, ResolutionFailedError, ResolutionEmptyError, PrivateAddressError, } from './errors.js';
+export { isPrivateHostname, isPrivateIpv4, isPrivateIpv6 } from './is-private-ip.js';
+export { validatePublicUrl, type ValidatePublicUrlOptions, type ResolvedAddress } from './validate-public-url.js';

package/build/node/index.js

@@ -0,0 +1,4 @@
+export { UrlValidationError, InvalidUrlError, UnsupportedSchemeError, PrivateHostnameError, ResolutionFailedError, ResolutionEmptyError, PrivateAddressError, } from './errors.js';
+export { isPrivateHostname, isPrivateIpv4, isPrivateIpv6 } from './is-private-ip.js';
+export { validatePublicUrl } from './validate-public-url.js';
+//# sourceMappingURL=index.js.map

package/build/node/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAuD,MAAM,0BAA0B,CAAC"}

package/build/node/is-private-ip.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Returns `true` if `address` is an IPv4 address string that does not fall in
+ * the public unicast range, or that matches a known cloud-metadata IP. Use
+ * this to gate outbound connections to tenant-supplied addresses.
+ *
+ * Fails closed: if `ipaddr.js` cannot parse a value that passed
+ * `node:net`'s `isIPv4` (parser/grammar skew across versions), the function
+ * returns `true` rather than letting the address through.
+ *
+ * Returns `false` for non-IPv4 input (including unparseable strings).
+ * Callers handle parsing themselves and pass only IP literals. Never throws.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc1918 Address Allocation for Private Internets
+ * @see https://datatracker.ietf.org/doc/html/rfc6598 IANA-Reserved IPv4 Prefix for Shared Address Space (CGNAT)
+ * @see https://datatracker.ietf.org/doc/html/rfc3927 Dynamic Configuration of IPv4 Link-Local Addresses
+ * @see https://datatracker.ietf.org/doc/html/rfc5735 Special Use IPv4 Addresses
+ */
+export declare function isPrivateIpv4(address: string): boolean;
+/**
+ * Returns `true` if `address` is an IPv6 address string that does not fall in
+ * the public unicast range. IPv4-mapped addresses (`::ffff:a.b.c.d`) are
+ * additionally re-checked against {@link isPrivateIpv4} so an IPv4 private
+ * address tunnelled as IPv6 cannot bypass the predicate.
+ *
+ * Fails closed on parser drift, mirroring {@link isPrivateIpv4}.
+ *
+ * Returns `false` for non-IPv6 input. Never throws.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc4291 IP Version 6 Addressing Architecture
+ * @see https://datatracker.ietf.org/doc/html/rfc4193 Unique Local IPv6 Unicast Addresses
+ */
+export declare function isPrivateIpv6(address: string): boolean;
+/**
+ * Returns `true` if `host` always names a local resource (`localhost`,
+ * anything under `.localhost`, `.local`, `.internal`, etc.) or an IP literal
+ * in a non-public range.
+ *
+ * The empty string is treated as private (a URL with no hostname must never
+ * be allowed out).
+ */
+export declare function isPrivateHostname(host: string): boolean;

package/build/node/is-private-ip.js

@@ -0,0 +1,138 @@
+import { isIPv4, isIPv6 } from 'node:net';
+import ipaddr from 'ipaddr.js';
+/**
+ * The single `ipaddr.js` range category that represents a publicly routable
+ * unicast address. Anything else (loopback, link-local, private, multicast,
+ * unique-local, reserved, 6to4, teredo, etc.) is rejected. An allowlist is
+ * safer than enumerating disallowed buckets: new range names introduced by
+ * future `ipaddr.js` versions default to "block" rather than "allow".
+ */
+const PUBLIC_RANGE = 'unicast';
+/**
+ * Cloud-metadata IPv4 addresses listed explicitly for belt-and-braces
+ * coverage. Both addresses are already classified as non-`unicast` by
+ * `ipaddr.js` (the AWS / GCP / Azure address via link-local
+ * `169.254.0.0/16`, the Alibaba address via CGNAT `100.64.0.0/10`), but the
+ * explicit listing means a future change to `ipaddr.js`'s range taxonomy
+ * cannot accidentally promote them to `unicast`.
+ *
+ * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html
+ * @see https://help.aliyun.com/document_detail/49122.html
+ */
+const ADDITIONAL_BLOCKED_IPV4 = new Set(['169.254.169.254', '100.100.100.200']);
+/**
+ * Hostname suffixes that name resources reachable only on a local network and
+ * must not be allowed to leave the host. Matched case-insensitively against
+ * the full hostname (e.g. `foo.localhost`, `printer.local`, `db.internal`).
+ *
+ * `.localhost` is reserved by RFC 6761; `.local` is reserved by RFC 6762
+ * (Multicast DNS); `.internal` is on the IANA / ICANN reserved list for
+ * private use (per RFC 9499 and ICANN board resolution, 2024); the
+ * remainder (`.intranet`, `.lan`, `.home`, `.corp`, `.private`) are
+ * widely-used private-network conventions that are blocked from ICANN
+ * delegation. Treating them as private is a conservative default for an
+ * SSRF guard.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc6761 Special-Use Domain Names
+ * @see https://datatracker.ietf.org/doc/html/rfc6762 Multicast DNS
+ * @see https://datatracker.ietf.org/doc/html/rfc9499 DNS Terminology
+ */
+const PRIVATE_HOSTNAME_SUFFIXES = [
+    '.localhost',
+    '.local',
+    '.internal',
+    '.intranet',
+    '.lan',
+    '.home',
+    '.corp',
+    '.private',
+];
+/**
+ * Returns `true` if `address` is an IPv4 address string that does not fall in
+ * the public unicast range, or that matches a known cloud-metadata IP. Use
+ * this to gate outbound connections to tenant-supplied addresses.
+ *
+ * Fails closed: if `ipaddr.js` cannot parse a value that passed
+ * `node:net`'s `isIPv4` (parser/grammar skew across versions), the function
+ * returns `true` rather than letting the address through.
+ *
+ * Returns `false` for non-IPv4 input (including unparseable strings).
+ * Callers handle parsing themselves and pass only IP literals. Never throws.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc1918 Address Allocation for Private Internets
+ * @see https://datatracker.ietf.org/doc/html/rfc6598 IANA-Reserved IPv4 Prefix for Shared Address Space (CGNAT)
+ * @see https://datatracker.ietf.org/doc/html/rfc3927 Dynamic Configuration of IPv4 Link-Local Addresses
+ * @see https://datatracker.ietf.org/doc/html/rfc5735 Special Use IPv4 Addresses
+ */
+export function isPrivateIpv4(address) {
+    if (!isIPv4(address))
+        return false;
+    if (ADDITIONAL_BLOCKED_IPV4.has(address))
+        return true;
+    try {
+        return ipaddr.parse(address).range() !== PUBLIC_RANGE;
+    }
+    catch {
+        return true; // Fail closed: cannot prove the address is public, so treat as private.
+    }
+}
+/**
+ * Returns `true` if `address` is an IPv6 address string that does not fall in
+ * the public unicast range. IPv4-mapped addresses (`::ffff:a.b.c.d`) are
+ * additionally re-checked against {@link isPrivateIpv4} so an IPv4 private
+ * address tunnelled as IPv6 cannot bypass the predicate.
+ *
+ * Fails closed on parser drift, mirroring {@link isPrivateIpv4}.
+ *
+ * Returns `false` for non-IPv6 input. Never throws.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc4291 IP Version 6 Addressing Architecture
+ * @see https://datatracker.ietf.org/doc/html/rfc4193 Unique Local IPv6 Unicast Addresses
+ */
+export function isPrivateIpv6(address) {
+    if (!isIPv6(address))
+        return false;
+    try {
+        const parsed = ipaddr.parse(address);
+        if (parsed.kind() !== 'ipv6')
+            return true; // Defensive: parser/version skew. Fail closed.
+        const v6 = parsed;
+        if (v6.isIPv4MappedAddress()) {
+            return isPrivateIpv4(v6.toIPv4Address().toString());
+        }
+        return v6.range() !== PUBLIC_RANGE;
+    }
+    catch {
+        return true; // Fail closed: cannot prove the address is public, so treat as private.
+    }
+}
+/**
+ * Returns `true` if `host` always names a local resource (`localhost`,
+ * anything under `.localhost`, `.local`, `.internal`, etc.) or an IP literal
+ * in a non-public range.
+ *
+ * The empty string is treated as private (a URL with no hostname must never
+ * be allowed out).
+ */
+export function isPrivateHostname(host) {
+    if (!host)
+        return true;
+    // Strip leading/trailing brackets (URL.hostname wraps IPv6 literals like
+    // `[::1]`) and any trailing dot before further checks; without this, a
+    // direct caller passing `URL.hostname` for an IPv6 URL would silently
+    // miss the private-range match.
+    const lower = host
+        .toLowerCase()
+        .replace(/^\[|\]$/g, '')
+        .replace(/\.$/, '');
+    if (lower === 'localhost')
+        return true;
+    if (PRIVATE_HOSTNAME_SUFFIXES.some((suffix) => lower.endsWith(suffix)))
+        return true;
+    if (isIPv4(lower))
+        return isPrivateIpv4(lower);
+    if (isIPv6(lower))
+        return isPrivateIpv6(lower);
+    return false;
+}
+//# sourceMappingURL=is-private-ip.js.map

package/build/node/is-private-ip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-private-ip.js","sourceRoot":"","sources":["../../src/node/is-private-ip.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,MAAM,MAAM,WAAW,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,yBAAyB,GAAG;IAChC,YAAY;IACZ,QAAQ;IACR,WAAW;IACX,WAAW;IACX,MAAM;IACN,OAAO;IACP,OAAO;IACP,UAAU;CACX,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,YAAY,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,wEAAwE;IACvF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,+CAA+C;QAC1F,MAAM,EAAE,GAAG,MAAqB,CAAC;QACjC,IAAI,EAAE,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC7B,OAAO,aAAa,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,YAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,wEAAwE;IACvF,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,gCAAgC;IAChC,MAAM,KAAK,GAAG,IAAI;SACf,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC"}

package/build/node/is-private-ip.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/node/is-private-ip.test.js

@@ -0,0 +1,96 @@
+import { isPrivateHostname, isPrivateIpv4, isPrivateIpv6 } from './is-private-ip.js';
+describe('isPrivateIpv4', () => {
+    it.each([['1.1.1.1'], ['8.8.8.8'], ['151.101.0.1']])('returns false for the unmistakeably public address %s', (addr) => {
+        expect(isPrivateIpv4(addr)).toBe(false);
+    });
+    it.each([
+        ['0.0.0.0'], // unspecified
+        ['10.0.0.1'], // RFC 1918
+        ['10.255.255.255'],
+        ['100.64.0.1'], // CGNAT
+        ['127.0.0.1'], // loopback
+        ['127.255.255.255'],
+        ['169.254.0.1'], // link-local
+        ['169.254.169.254'], // cloud metadata (AWS/GCP/Azure)
+        ['172.16.0.1'], // RFC 1918
+        ['172.31.255.255'],
+        ['192.168.0.1'], // RFC 1918
+        ['192.168.255.255'],
+        ['224.0.0.1'], // multicast
+        ['255.255.255.255'], // broadcast
+        ['198.18.0.1'], // benchmarking
+        ['203.0.113.1'], // TEST-NET-3 (reserved)
+        ['100.100.100.200'], // Alibaba Cloud metadata (publicly routable, but explicitly blocked)
+    ])('returns true for the private/reserved/metadata address %s', (addr) => {
+        expect(isPrivateIpv4(addr)).toBe(true);
+    });
+    it('returns false for non-IPv4 input', () => {
+        expect(isPrivateIpv4('not an ip')).toBe(false);
+        expect(isPrivateIpv4('::1')).toBe(false);
+        expect(isPrivateIpv4('')).toBe(false);
+    });
+});
+describe('isPrivateIpv6', () => {
+    it.each([
+        ['2606:4700:4700::1111'], // Cloudflare public DNS
+        ['2001:4860:4860::8888'], // Google public DNS
+    ])('returns false for the unmistakeably public address %s', (addr) => {
+        expect(isPrivateIpv6(addr)).toBe(false);
+    });
+    it.each([
+        ['::'], // unspecified
+        ['::1'], // loopback
+        ['fe80::1'], // link-local
+        ['fc00::1'], // unique local
+        ['fd00::1'], // unique local
+        ['ff02::1'], // multicast
+        ['2001:db8::1'], // documentation / reserved
+        ['2002::1'], // 6to4
+    ])('returns true for the non-public address %s', (addr) => {
+        expect(isPrivateIpv6(addr)).toBe(true);
+    });
+    it('treats IPv4-mapped IPv6 addresses by their embedded IPv4 status', () => {
+        expect(isPrivateIpv6('::ffff:127.0.0.1')).toBe(true);
+        expect(isPrivateIpv6('::ffff:169.254.169.254')).toBe(true);
+        expect(isPrivateIpv6('::ffff:1.1.1.1')).toBe(false);
+    });
+    it('returns false for non-IPv6 input', () => {
+        expect(isPrivateIpv6('not an ip')).toBe(false);
+        expect(isPrivateIpv6('10.0.0.1')).toBe(false);
+        expect(isPrivateIpv6('')).toBe(false);
+    });
+});
+describe('isPrivateHostname', () => {
+    it.each([
+        [''],
+        ['localhost'],
+        ['LOCALHOST'],
+        ['foo.localhost'],
+        ['bar.local'],
+        ['printer.local.'], // trailing dot is stripped
+        ['db.internal'],
+        ['svc.intranet'],
+        ['file-server.lan'],
+        ['router.home'],
+        ['app.corp'],
+        ['vault.private'],
+    ])('returns true for the private hostname %s', (host) => {
+        expect(isPrivateHostname(host)).toBe(true);
+    });
+    it.each([['example.com'], ['api.cloudflare.com'], ['google.com.']])('returns false for the public hostname %s', (host) => {
+        expect(isPrivateHostname(host)).toBe(false);
+    });
+    it('defers to IP predicates when the hostname is an IP literal', () => {
+        expect(isPrivateHostname('127.0.0.1')).toBe(true);
+        expect(isPrivateHostname('169.254.169.254')).toBe(true);
+        expect(isPrivateHostname('::1')).toBe(true);
+        expect(isPrivateHostname('1.1.1.1')).toBe(false);
+        expect(isPrivateHostname('2606:4700:4700::1111')).toBe(false);
+    });
+    it('handles IPv6 literals wrapped in brackets (as URL.hostname returns)', () => {
+        expect(isPrivateHostname('[::1]')).toBe(true);
+        expect(isPrivateHostname('[fc00::1]')).toBe(true);
+        expect(isPrivateHostname('[2606:4700:4700::1111]')).toBe(false);
+    });
+});
+//# sourceMappingURL=is-private-ip.test.js.map

package/build/node/is-private-ip.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-private-ip.test.js","sourceRoot":"","sources":["../../src/node/is-private-ip.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAErF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAClD,uDAAuD,EACvD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,SAAS,CAAC,EAAE,cAAc;QAC3B,CAAC,UAAU,CAAC,EAAE,WAAW;QACzB,CAAC,gBAAgB,CAAC;QAClB,CAAC,YAAY,CAAC,EAAE,QAAQ;QACxB,CAAC,WAAW,CAAC,EAAE,WAAW;QAC1B,CAAC,iBAAiB,CAAC;QACnB,CAAC,aAAa,CAAC,EAAE,aAAa;QAC9B,CAAC,iBAAiB,CAAC,EAAE,iCAAiC;QACtD,CAAC,YAAY,CAAC,EAAE,WAAW;QAC3B,CAAC,gBAAgB,CAAC;QAClB,CAAC,aAAa,CAAC,EAAE,WAAW;QAC5B,CAAC,iBAAiB,CAAC;QACnB,CAAC,WAAW,CAAC,EAAE,YAAY;QAC3B,CAAC,iBAAiB,CAAC,EAAE,YAAY;QACjC,CAAC,YAAY,CAAC,EAAE,eAAe;QAC/B,CAAC,aAAa,CAAC,EAAE,wBAAwB;QACzC,CAAC,iBAAiB,CAAC,EAAE,qEAAqE;KAC3F,CAAC,CAAC,2DAA2D,EAAE,CAAC,IAAI,EAAE,EAAE;QACvE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,sBAAsB,CAAC,EAAE,wBAAwB;QAClD,CAAC,sBAAsB,CAAC,EAAE,oBAAoB;KAC/C,CAAC,CAAC,uDAAuD,EAAE,CAAC,IAAI,EAAE,EAAE;QACnE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,IAAI,CAAC,EAAE,cAAc;QACtB,CAAC,KAAK,CAAC,EAAE,WAAW;QACpB,CAAC,SAAS,CAAC,EAAE,aAAa;QAC1B,CAAC,SAAS,CAAC,EAAE,eAAe;QAC5B,CAAC,SAAS,CAAC,EAAE,eAAe;QAC5B,CAAC,SAAS,CAAC,EAAE,YAAY;QACzB,CAAC,aAAa,CAAC,EAAE,2BAA2B;QAC5C,CAAC,SAAS,CAAC,EAAE,OAAO;KACrB,CAAC,CAAC,4CAA4C,EAAE,CAAC,IAAI,EAAE,EAAE;QACxD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,EAAE,CAAC;QACJ,CAAC,WAAW,CAAC;QACb,CAAC,WAAW,CAAC;QACb,CAAC,eAAe,CAAC;QACjB,CAAC,WAAW,CAAC;QACb,CAAC,gBAAgB,CAAC,EAAE,2BAA2B;QAC/C,CAAC,aAAa,CAAC;QACf,CAAC,cAAc,CAAC;QAChB,CAAC,iBAAiB,CAAC;QACnB,CAAC,aAAa,CAAC;QACf,CAAC,UAAU,CAAC;QACZ,CAAC,eAAe,CAAC;KAClB,CAAC,CAAC,0CAA0C,EAAE,CAAC,IAAI,EAAE,EAAE;QACtD,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CACjE,0CAA0C,EAC1C,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/build/node/validate-public-url.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Options for {@link validatePublicUrl}.
+ */
+export interface ValidatePublicUrlOptions {
+    /**
+     * URL schemes that are allowed (e.g. `['http', 'https']`). Compared
+     * case-insensitively. Defaults to `['http', 'https']`.
+     */
+    allowedSchemes?: readonly string[];
+    /**
+     * IP family hint passed to `dns.lookup`. `0` (default) returns whichever
+     * family the resolver prefers, `4` forces IPv4-only, `6` forces IPv6-only.
+     */
+    family?: 0 | 4 | 6;
+}
+/**
+ * The resolved address that callers must use as the connect target so the
+ * connection lands on the IP that validation checked. Connecting via the
+ * hostname instead opens a DNS rebinding window.
+ */
+export interface ResolvedAddress {
+    address: string;
+    family: 4 | 6;
+}
+/**
+ * Validates that `url` is a parseable HTTP(S) URL whose hostname resolves
+ * to publicly routable IP addresses, and returns one of those addresses
+ * pinned for the caller to use as the connect target.
+ *
+ * DNS resolution is performed with `all: true`; the URL is rejected if any
+ * resolved address is in a private / loopback / link-local /
+ * cloud-metadata range, so a mixed public/private DNS response cannot
+ * sneak a private record through.
+ *
+ * Per ADR-035, this function throws subclasses of {@link UrlValidationError}
+ * on failure. The structured payload (`code`, `message`, `received`,
+ * `expected`, `remediation`, `pointer`, `cause`) is available on the thrown
+ * instance.
+ *
+ * @see https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
+ * @see ../../../docs/adrs/035-utils-throws-structured-errors.md
+ * @throws {InvalidUrlError} `url` is not a parseable URL.
+ * @throws {UnsupportedSchemeError} the URL's scheme is not allowed.
+ * @throws {PrivateHostnameError} the hostname names a private resource.
+ * @throws {ResolutionFailedError} DNS resolution rejected.
+ * @throws {ResolutionEmptyError} DNS resolution returned no records.
+ * @throws {PrivateAddressError} any resolved record is private.
+ */
+export declare function validatePublicUrl(url: string, options?: ValidatePublicUrlOptions): Promise<ResolvedAddress>;

package/build/node/validate-public-url.js

@@ -0,0 +1,94 @@
+import { isIP } from 'node:net';
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { isPrivateHostname, isPrivateIpv4, isPrivateIpv6 } from './is-private-ip.js';
+import { InvalidUrlError, PrivateAddressError, PrivateHostnameError, ResolutionEmptyError, ResolutionFailedError, UnsupportedSchemeError, } from './errors.js';
+const DEFAULT_ALLOWED_SCHEMES = ['http', 'https'];
+/**
+ * Validates that `url` is a parseable HTTP(S) URL whose hostname resolves
+ * to publicly routable IP addresses, and returns one of those addresses
+ * pinned for the caller to use as the connect target.
+ *
+ * DNS resolution is performed with `all: true`; the URL is rejected if any
+ * resolved address is in a private / loopback / link-local /
+ * cloud-metadata range, so a mixed public/private DNS response cannot
+ * sneak a private record through.
+ *
+ * Per ADR-035, this function throws subclasses of {@link UrlValidationError}
+ * on failure. The structured payload (`code`, `message`, `received`,
+ * `expected`, `remediation`, `pointer`, `cause`) is available on the thrown
+ * instance.
+ *
+ * @see https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
+ * @see ../../../docs/adrs/035-utils-throws-structured-errors.md
+ * @throws {InvalidUrlError} `url` is not a parseable URL.
+ * @throws {UnsupportedSchemeError} the URL's scheme is not allowed.
+ * @throws {PrivateHostnameError} the hostname names a private resource.
+ * @throws {ResolutionFailedError} DNS resolution rejected.
+ * @throws {ResolutionEmptyError} DNS resolution returned no records.
+ * @throws {PrivateAddressError} any resolved record is private.
+ */
+export async function validatePublicUrl(url, options) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch (cause) {
+        throw new InvalidUrlError(url, cause);
+    }
+    const allowedSchemes = options?.allowedSchemes ?? DEFAULT_ALLOWED_SCHEMES;
+    const scheme = parsed.protocol.toLowerCase().replace(/:$/, '');
+    if (!allowedSchemes.some((s) => s.toLowerCase() === scheme)) {
+        throw new UnsupportedSchemeError(scheme, allowedSchemes);
+    }
+    // URL.hostname wraps IPv6 literals in brackets (e.g. `[::1]`); strip them
+    // so the hostname can be passed to predicates and DNS resolution. Note
+    // that `URL` already discards any `userinfo@` prefix from the hostname,
+    // so smuggling attempts like `http://evil.com@127.0.0.1/` resolve to
+    // `127.0.0.1` and are caught by isPrivateHostname below.
+    const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
+    if (isPrivateHostname(hostname)) {
+        throw new PrivateHostnameError(hostname);
+    }
+    // If the hostname is already an IP literal, skip DNS resolution; the
+    // literal itself is the resolved address, and the private-range check
+    // above (via isPrivateHostname) has already validated it.
+    const literalFamily = isIP(hostname);
+    if (literalFamily === 4 || literalFamily === 6) {
+        return { address: hostname, family: literalFamily };
+    }
+    let records;
+    try {
+        records = await dnsLookup(hostname, { family: options?.family ?? 0, all: true });
+    }
+    catch (cause) {
+        throw new ResolutionFailedError(hostname, cause);
+    }
+    if (records.length === 0) {
+        throw new ResolutionEmptyError(hostname);
+    }
+    const privateRecords = [];
+    let firstPublicRecord = null;
+    for (const record of records) {
+        if (record.family !== 4 && record.family !== 6) {
+            throw new ResolutionFailedError(hostname, new Error(`unsupported address family ${record.family}`));
+        }
+        const isPrivate = record.family === 4 ? isPrivateIpv4(record.address) : isPrivateIpv6(record.address);
+        if (isPrivate) {
+            privateRecords.push(record.address);
+        }
+        else if (!firstPublicRecord) {
+            firstPublicRecord = { address: record.address, family: record.family };
+        }
+    }
+    if (privateRecords.length > 0) {
+        throw new PrivateAddressError(hostname, privateRecords);
+    }
+    // Defensive: `records.length > 0` and `privateRecords.length === 0`
+    // implies a public record was assigned in the loop. Throwing rather
+    // than `!`-asserting keeps the invariant explicit at the boundary.
+    if (!firstPublicRecord) {
+        throw new ResolutionEmptyError(hostname);
+    }
+    return firstPublicRecord;
+}
+//# sourceMappingURL=validate-public-url.js.map

package/build/node/validate-public-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-public-url.js","sourceRoot":"","sources":["../../src/node/validate-public-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AA4BrB,MAAM,uBAAuB,GAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,OAAkC;IACrF,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,uBAAuB,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,sBAAsB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3D,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,qEAAqE;IACrE,yDAAyD;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,qEAAqE;IACrE,sEAAsE;IACtE,0DAA0D;IAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,aAAa,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,OAA8C,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,IAAI,iBAAiB,GAA2B,IAAI,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtG,IAAI,SAAS,EAAE,CAAC;YACd,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9B,iBAAiB,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC1D,CAAC;IAED,oEAAoE;IACpE,oEAAoE;IACpE,mEAAmE;IACnE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC"}

package/build/node/validate-public-url.test.d.ts

@@ -0,0 +1 @@
+export {};