pubface 1.0.18 → 1.1.0

package/.github/workflows/release.yaml

@@ -31,6 +31,6 @@ jobs:
             - uses: actions/setup-node@v4
               with:
                   node-version: 24
-                  registry-url: "https://registry.npmjs.org"
+                  registry-url: 'https://registry.npmjs.org'
             - run: npm ci
             - run: npm publish --provenance --access public

package/.github/workflows/test.yaml

@@ -0,0 +1,22 @@
+on:
+    push:
+        branches:
+            - master
+    pull_request:
+        branches:
+            - master
+
+name: test
+jobs:
+    test:
+        runs-on: ubuntu-latest
+        strategy:
+            matrix:
+                node-version: [22, 24]
+        steps:
+            - uses: actions/checkout@v4
+            - uses: actions/setup-node@v4
+              with:
+                  node-version: ${{ matrix.node-version }}
+            - run: npm ci
+            - run: npm test

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "1.0.18"
+    ".": "1.1.0"
 }

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [1.1.0](https://github.com/postalsys/pubface/compare/v1.0.19...v1.1.0) (2026-03-25)
+
+
+### Features
+
+* add test suite, eslint, and CI workflow ([c0baf91](https://github.com/postalsys/pubface/commit/c0baf91b6b50339026c8808e5f7da65ff89d6678))
+
+
+### Bug Fixes
+
+* require Node 22+ for test CI workflow ([0df3095](https://github.com/postalsys/pubface/commit/0df3095808bb56dcdb932b69d86f48b43428ae4a))
+
+## [1.0.19](https://github.com/postalsys/pubface/compare/v1.0.18...v1.0.19) (2026-03-23)
+
+
+### Bug Fixes
+
+* bumped deps ([d7708a3](https://github.com/postalsys/pubface/commit/d7708a3bca8bc7f63570a9be0a5b4bc65cf2980d))
+
 ## [1.0.18](https://github.com/postalsys/pubface/compare/v1.0.17...v1.0.18) (2026-01-28)
 
 

package/eslint.config.mjs

@@ -0,0 +1,31 @@
+import js from '@eslint/js';
+
+export default [
+    {
+        ignores: ['node_modules/', 'ee-dist/']
+    },
+    js.configs.recommended,
+    {
+        files: ['**/*.js'],
+        languageOptions: {
+            ecmaVersion: 2022,
+            sourceType: 'commonjs',
+            globals: {
+                require: 'readonly',
+                module: 'readonly',
+                exports: 'readonly',
+                process: 'readonly',
+                __dirname: 'readonly',
+                __filename: 'readonly',
+                console: 'readonly',
+                Buffer: 'readonly',
+                setTimeout: 'readonly',
+                clearTimeout: 'readonly',
+                URL: 'readonly'
+            }
+        },
+        rules: {
+            'no-unused-vars': ['error', { argsIgnorePattern: '^_', caughtErrorsIgnorePattern: '^_' }]
+        }
+    }
+];

package/index.js

@@ -11,6 +11,7 @@ const RESOLV_URL = process.env.RESOLV_URL || 'https://api.nodemailer.com/';
 const RESOLV_TIMEOUT = Number(process.env.RESOLV_TIMEOUT) || 5;
 
 const RESOLV_TIMEOUT_SEC = RESOLV_TIMEOUT * 1000;
+const DNS_TTL = 10 * 60 * 1000;
 const DNS_CACHE = {};
 
 function getPtrAddr(address) {
@@ -33,7 +34,7 @@ function getPtrAddr(address) {
 
 async function resolvePtr(address) {
     let ptrAddress = getPtrAddr(address);
-    return await dns.resolvePtr(ptrAddress);
+    return dns.resolvePtr(ptrAddress);
 }
 
 async function updateDns() {
@@ -44,7 +45,7 @@ async function updateDns() {
         DNS_CACHE.AAAA = false;
         DNS_CACHE.A = {
             host: url.hostname,
-            expires: new Date(Date.now() + 10 * 60 * 1000)
+            expires: new Date(Date.now() + DNS_TTL)
         };
         return;
     }
@@ -53,7 +54,7 @@ async function updateDns() {
         DNS_CACHE.A = false;
         DNS_CACHE.AAAA = {
             host: url.hostname,
-            expires: new Date(Date.now() + 10 * 60 * 1000)
+            expires: new Date(Date.now() + DNS_TTL)
         };
         return;
     }
@@ -67,7 +68,7 @@ async function updateDns() {
             if (results && results.length) {
                 DNS_CACHE.A = {
                     host: results[0],
-                    expires: new Date(Date.now() + 10 * 60 * 1000)
+                    expires: new Date(Date.now() + DNS_TTL)
                 };
             }
         } catch (err) {
@@ -84,7 +85,7 @@ async function updateDns() {
             if (results && results.length) {
                 DNS_CACHE.AAAA = {
                     host: results[0],
-                    expires: new Date(Date.now() + 10 * 60 * 1000)
+                    expires: new Date(Date.now() + DNS_TTL)
                 };
             }
         } catch (err) {
@@ -99,23 +100,23 @@ async function updateDns() {
 function getPublicInterfaces() {
     let interfaces = os.networkInterfaces();
     let publicInterfaces = { IPv4: [], IPv6: [] };
-    Object.keys(interfaces)
-        .flatMap(iface => interfaces[iface].filter(entry => !entry.internal).map(entry => Object.assign({ iface }, entry)))
-        .forEach(originalEntry => {
-            let entry = Object.assign({}, originalEntry);
 
-            let family = typeof entry.family === 'number' ? `IPv${entry.family}` : entry.family;
-            if (entry.family !== family) {
-                entry.family = family;
+    for (let [name, entries] of Object.entries(interfaces)) {
+        for (let entry of entries) {
+            if (entry.internal) {
+                continue;
             }
+            let family = typeof entry.family === 'number' ? `IPv${entry.family}` : entry.family;
             if (Array.isArray(publicInterfaces[family])) {
-                publicInterfaces[family].push(entry);
+                publicInterfaces[family].push({ ...entry, iface: name, family });
             }
-        });
+        }
+    }
+
     return publicInterfaces;
 }
 
-async function timedFunction(prom, timeout, localAddress) {
+function timedFunction(prom, timeout, localAddress) {
     return new Promise((resolve, reject) => {
         setTimeout(() => {
             let err = new Error('Resolving requested resource timed out');
@@ -129,13 +130,14 @@ async function timedFunction(prom, timeout, localAddress) {
 }
 
 async function resolveIP(localAddress, family) {
+    let resolvHostname = new URL(RESOLV_URL).hostname;
     let data = await new Promise((resolve, reject) => {
         let req = fetchUrl(RESOLV_URL, {
             userAgent: `${packageData.name}/${packageData.version}`,
             tls: {
                 host: DNS_CACHE[family] && DNS_CACHE[family].host,
-                servername: new URL(RESOLV_URL).hostname,
-                hostname: new URL(RESOLV_URL).hostname,
+                servername: resolvHostname,
+                hostname: resolvHostname,
                 rejectUnauthorized: false,
                 localAddress
             }
@@ -149,9 +151,7 @@ async function resolveIP(localAddress, family) {
             }
         });
 
-        req.on('error', err => {
-            reject(err);
-        });
+        req.on('error', reject);
 
         req.on('end', () => {
             try {
@@ -172,39 +172,41 @@ async function resolveIP(localAddress, family) {
         if (name && name.length) {
             data.name = name[0];
         }
-    } catch (err) {
+    } catch (_err) {
         // can ignore this
     }
 
-    return Object.assign({ localAddress }, data);
+    return { localAddress, ...data };
 }
 
 async function resolvePublicInterfaces() {
     let interfaces = getPublicInterfaces();
     let promises = [];
 
-    // update resolver IP4/6 addresses
     await updateDns();
 
     if (DNS_CACHE.A && DNS_CACHE.A.host) {
-        // default
         promises.push(timedFunction(resolveIP(false, 'A'), RESOLV_TIMEOUT_SEC, false));
-        interfaces.IPv4.forEach(iface => {
+        for (let iface of interfaces.IPv4) {
             promises.push(timedFunction(resolveIP(iface.address, 'A'), RESOLV_TIMEOUT_SEC, iface.address));
-        });
+        }
     }
 
     if (DNS_CACHE.AAAA && DNS_CACHE.AAAA.host) {
         promises.push(timedFunction(resolveIP(false, 'AAAA'), RESOLV_TIMEOUT_SEC, false));
-        interfaces.IPv6.forEach(iface => {
+        for (let iface of interfaces.IPv6) {
             promises.push(timedFunction(resolveIP(iface.address, 'AAAA'), RESOLV_TIMEOUT_SEC, iface.address));
-        });
+        }
     }
 
     let defaults = {};
     let results = (await Promise.allSettled(promises))
         .filter(entry => entry.status === 'fulfilled')
-        .map(entry => Object.assign(entry.value, { family: net.isIPv6(entry.value.ip || entry.value.localAddress) ? 'IPv6' : 'IPv4' }))
+        .map(entry => {
+            let value = entry.value;
+            value.family = net.isIPv6(value.ip || value.localAddress) ? 'IPv6' : 'IPv4';
+            return value;
+        })
         .filter(entry => {
             if (!entry.localAddress) {
                 defaults[entry.family] = entry;
@@ -213,22 +215,24 @@ async function resolvePublicInterfaces() {
             return true;
         });
 
-    results.forEach(entry => {
+    for (let entry of results) {
         if (defaults[entry.family] && defaults[entry.family].ip === entry.ip) {
             entry.defaultInterface = true;
             defaults[entry.family] = false;
         }
-    });
+    }
 
     if (defaults.IPv4) {
-        results.push(Object.assign(defaults.IPv4, { defaultInterface: true }));
+        defaults.IPv4.defaultInterface = true;
+        results.push(defaults.IPv4);
     }
 
     if (defaults.IPv6) {
-        results.push(Object.assign(defaults.IPv6, { defaultInterface: true }));
+        defaults.IPv6.defaultInterface = true;
+        results.push(defaults.IPv6);
     }
 
-    results = results.sort((a, b) => {
+    results.sort((a, b) => {
         if (a.family !== b.family) {
             return a.family.localeCompare(b.family);
         }
@@ -245,3 +249,6 @@ async function resolvePublicInterfaces() {
 }
 
 module.exports = { resolvePublicInterfaces };
+
+// exported for testing
+module.exports._internal = { getPtrAddr, getPublicInterfaces, timedFunction, resolvePtr, updateDns, resolveIP, DNS_CACHE, RESOLV_TIMEOUT_SEC };

package/package.json

@@ -1,11 +1,12 @@
 {
     "name": "pubface",
-    "version": "1.0.18",
+    "version": "1.1.0",
     "description": "Resolve public network interfaces for current machine",
     "main": "index.js",
     "scripts": {
-        "test": "echo \"Error: no test specified\" && exit 1",
+        "test": "node --test 'test/**/*.test.js'",
         "format": "prettier --write .",
+        "lint": "eslint .",
         "build-source": "rm -rf node_modules package-lock.json && npm install && npm run licenses && rm -rf node_modules package-lock.json && npm install --production && rm -rf package-lock.json",
         "build-dist": "npx pkg --compress Brotli package.json && rm -rf package-lock.json && npm install",
         "build-dist-fast": "npx pkg --debug  package.json && rm -rf package-lock.json && npm install",
@@ -28,11 +29,14 @@
     },
     "dependencies": {
         "ipaddr.js": "2.3.0",
-        "nodemailer": "7.0.13"
+        "nodemailer": "8.0.4"
     },
     "devDependencies": {
+        "@eslint/js": "^10.0.1",
+        "eslint": "^10.1.0",
+        "license-report": "6.8.2",
         "pkg": "5.8.1",
-        "license-report": "6.8.1"
+        "prettier": "^3.8.1"
     },
     "pkg": {
         "assets": [

package/test/index.test.js

@@ -0,0 +1,508 @@
+'use strict';
+
+const { describe, it, mock, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const os = require('node:os');
+const dns = require('node:dns');
+
+const { resolvePublicInterfaces, _internal } = require('../index.js');
+const { getPtrAddr, getPublicInterfaces, timedFunction, resolvePtr, updateDns, DNS_CACHE, RESOLV_TIMEOUT_SEC } = _internal;
+
+function resetDnsCache() {
+    delete DNS_CACHE.A;
+    delete DNS_CACHE.AAAA;
+}
+
+// -- getPtrAddr ---------------------------------------------------------------
+
+describe('getPtrAddr', () => {
+    it('should convert IPv4 to reverse PTR format', () => {
+        assert.equal(getPtrAddr('1.2.3.4'), '4.3.2.1.in-addr.arpa.');
+    });
+
+    it('should reverse octets for 192.168.1.1', () => {
+        assert.equal(getPtrAddr('192.168.1.1'), '1.1.168.192.in-addr.arpa.');
+    });
+
+    it('should handle 0.0.0.0', () => {
+        assert.equal(getPtrAddr('0.0.0.0'), '0.0.0.0.in-addr.arpa.');
+    });
+
+    it('should handle 255.255.255.255', () => {
+        assert.equal(getPtrAddr('255.255.255.255'), '255.255.255.255.in-addr.arpa.');
+    });
+
+    it('should handle 10.0.0.1', () => {
+        assert.equal(getPtrAddr('10.0.0.1'), '1.0.0.10.in-addr.arpa.');
+    });
+
+    it('should convert IPv6 loopback to PTR format', () => {
+        // ::1 bytes are all 0x00 except the last which is 0x01
+        // All bytes < 0x0a, so the padding bug does not affect this case
+        const result = getPtrAddr('::1');
+        assert.equal(result, '1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.');
+    });
+
+    it('should convert IPv6 address with only sub-0x0a bytes', () => {
+        // 2001:0002:0003:0004:0005:0006:0007:0008
+        // All bytes are < 0x0a, so no padding bug
+        const result = getPtrAddr('2001:2:3:4:5:6:7:8');
+        assert.equal(result, '8.0.0.0.7.0.0.0.6.0.0.0.5.0.0.0.4.0.0.0.3.0.0.0.2.0.0.0.1.0.0.2.ip6.arpa.');
+    });
+
+    it('should produce result for 2001:db8::1 (known hex-padding bug)', () => {
+        // Bug: byte 0x0d (13) only produces 'd' instead of '0d' because the
+        // padding condition uses 0x0a instead of 0x10. This results in 31
+        // nibbles instead of 32, making the PTR address invalid.
+        const result = getPtrAddr('2001:db8::1');
+        // Actual (buggy) output -- the '0' before 'd' is missing:
+        assert.equal(result, '1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.1.0.0.2.ip6.arpa.');
+        // Correct output would be:
+        // '1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.'
+    });
+
+    it('should produce result for full IPv6 (known hex-padding bug)', () => {
+        // 2001:0db8:85a3::8a2e:0370:7334
+        // Byte 0x0d produces 'd' instead of '0d'
+        const result = getPtrAddr('2001:0db8:85a3:0000:0000:8a2e:0370:7334');
+        assert.equal(result, '4.3.3.7.0.7.3.0.e.2.a.8.0.0.0.0.0.0.0.0.3.a.5.8.8.b.d.1.0.0.2.ip6.arpa.');
+    });
+
+    it('should throw for invalid address', () => {
+        assert.throws(() => getPtrAddr('not-an-ip'));
+    });
+
+    it('should throw for empty string', () => {
+        assert.throws(() => getPtrAddr(''));
+    });
+
+    it('should return undefined for address that parses but is neither v4 nor v6', () => {
+        // This cannot actually happen with valid IP addresses, but tests the fallthrough
+        // ipaddr.parse only accepts v4/v6, so it throws first
+        assert.throws(() => getPtrAddr('abc'));
+    });
+});
+
+// -- getPublicInterfaces ------------------------------------------------------
+
+describe('getPublicInterfaces', () => {
+    afterEach(() => {
+        mock.restoreAll();
+    });
+
+    it('should filter out internal interfaces', () => {
+        mock.method(os, 'networkInterfaces', () => ({
+            lo0: [{ address: '127.0.0.1', family: 'IPv4', internal: true, mac: '00:00:00:00:00:00' }],
+            en0: [{ address: '192.168.1.100', family: 'IPv4', internal: false, mac: 'aa:bb:cc:dd:ee:ff' }]
+        }));
+
+        const result = getPublicInterfaces();
+        assert.equal(result.IPv4.length, 1);
+        assert.equal(result.IPv4[0].address, '192.168.1.100');
+        assert.equal(result.IPv4[0].iface, 'en0');
+        assert.equal(result.IPv6.length, 0);
+    });
+
+    it('should group interfaces by IPv4 and IPv6', () => {
+        mock.method(os, 'networkInterfaces', () => ({
+            en0: [
+                { address: '192.168.1.100', family: 'IPv4', internal: false },
+                { address: 'fe80::1', family: 'IPv6', internal: false }
+            ]
+        }));
+
+        const result = getPublicInterfaces();
+        assert.equal(result.IPv4.length, 1);
+        assert.equal(result.IPv6.length, 1);
+        assert.equal(result.IPv4[0].address, '192.168.1.100');
+        assert.equal(result.IPv6[0].address, 'fe80::1');
+    });
+
+    it('should normalize numeric family 4 to IPv4', () => {
+        mock.method(os, 'networkInterfaces', () => ({
+            en0: [{ address: '192.168.1.100', family: 4, internal: false }]
+        }));
+
+        const result = getPublicInterfaces();
+        assert.equal(result.IPv4[0].family, 'IPv4');
+    });
+
+    it('should normalize numeric family 6 to IPv6', () => {
+        mock.method(os, 'networkInterfaces', () => ({
+            en0: [{ address: 'fe80::1', family: 6, internal: false }]
+        }));
+
+        const result = getPublicInterfaces();
+        assert.equal(result.IPv6[0].family, 'IPv6');
+    });
+
+    it('should return empty arrays when no public interfaces', () => {
+        mock.method(os, 'networkInterfaces', () => ({
+            lo0: [{ address: '127.0.0.1', family: 'IPv4', internal: true }]
+        }));
+
+        const result = getPublicInterfaces();
+        assert.equal(result.IPv4.length, 0);
+        assert.equal(result.IPv6.length, 0);
+    });
+
+    it('should return empty arrays for empty interface map', () => {
+        mock.method(os, 'networkInterfaces', () => ({}));
+
+        const result = getPublicInterfaces();
+        assert.equal(result.IPv4.length, 0);
+        assert.equal(result.IPv6.length, 0);
+    });
+
+    it('should collect interfaces from multiple adapters', () => {
+        mock.method(os, 'networkInterfaces', () => ({
+            en0: [{ address: '192.168.1.100', family: 'IPv4', internal: false }],
+            en1: [{ address: '10.0.0.1', family: 'IPv4', internal: false }],
+            lo0: [{ address: '127.0.0.1', family: 'IPv4', internal: true }]
+        }));
+
+        const result = getPublicInterfaces();
+        assert.equal(result.IPv4.length, 2);
+        const addresses = result.IPv4.map(i => i.address).sort();
+        assert.deepEqual(addresses, ['10.0.0.1', '192.168.1.100']);
+    });
+
+    it('should attach iface name to each entry', () => {
+        mock.method(os, 'networkInterfaces', () => ({
+            eth0: [{ address: '10.0.0.5', family: 'IPv4', internal: false }]
+        }));
+
+        const result = getPublicInterfaces();
+        assert.equal(result.IPv4[0].iface, 'eth0');
+    });
+
+    it('should not mutate original interface entries', () => {
+        const original = { address: '192.168.1.100', family: 4, internal: false };
+        mock.method(os, 'networkInterfaces', () => ({ en0: [original] }));
+
+        getPublicInterfaces();
+        assert.equal(original.family, 4);
+    });
+
+    it('should ignore unknown family types', () => {
+        mock.method(os, 'networkInterfaces', () => ({
+            en0: [{ address: '192.168.1.100', family: 'IPX', internal: false }]
+        }));
+
+        const result = getPublicInterfaces();
+        assert.equal(result.IPv4.length, 0);
+        assert.equal(result.IPv6.length, 0);
+    });
+
+    it('should handle adapter with mixed internal and external', () => {
+        mock.method(os, 'networkInterfaces', () => ({
+            en0: [
+                { address: '127.0.0.1', family: 'IPv4', internal: true },
+                { address: '192.168.1.100', family: 'IPv4', internal: false },
+                { address: '::1', family: 'IPv6', internal: true },
+                { address: 'fe80::1', family: 'IPv6', internal: false }
+            ]
+        }));
+
+        const result = getPublicInterfaces();
+        assert.equal(result.IPv4.length, 1);
+        assert.equal(result.IPv6.length, 1);
+    });
+});
+
+// -- timedFunction ------------------------------------------------------------
+
+describe('timedFunction', () => {
+    it('should resolve when promise resolves before timeout', async () => {
+        const result = await timedFunction(Promise.resolve('ok'), 1000);
+        assert.equal(result, 'ok');
+    });
+
+    it('should resolve with complex data', async () => {
+        const data = { ip: '1.2.3.4', name: 'test.example.com' };
+        const result = await timedFunction(Promise.resolve(data), 1000);
+        assert.deepEqual(result, data);
+    });
+
+    it('should reject when promise rejects before timeout', async () => {
+        await assert.rejects(() => timedFunction(Promise.reject(new Error('network error')), 1000), { message: 'network error' });
+    });
+
+    it('should reject with timeout error when promise does not settle', async () => {
+        let cleanup;
+        const slow = new Promise(resolve => {
+            cleanup = resolve;
+        });
+        // ref'd timer keeps event loop alive while the .unref()'d timer in timedFunction fires
+        const keepAlive = setTimeout(() => {}, 5000);
+        try {
+            await assert.rejects(() => timedFunction(slow, 50), { message: 'Resolving requested resource timed out' });
+        } finally {
+            clearTimeout(keepAlive);
+            cleanup();
+        }
+    });
+
+    it('should include _source on timeout error when localAddress given', async () => {
+        let cleanup;
+        const slow = new Promise(resolve => {
+            cleanup = resolve;
+        });
+        const keepAlive = setTimeout(() => {}, 5000);
+        try {
+            await timedFunction(slow, 50, '192.168.1.100');
+            assert.fail('Should have thrown');
+        } catch (err) {
+            assert.equal(err.message, 'Resolving requested resource timed out');
+            assert.equal(err._source, '192.168.1.100');
+        } finally {
+            clearTimeout(keepAlive);
+            cleanup();
+        }
+    });
+
+    it('should not set _source when localAddress is false', async () => {
+        let cleanup;
+        const slow = new Promise(resolve => {
+            cleanup = resolve;
+        });
+        const keepAlive = setTimeout(() => {}, 5000);
+        try {
+            await timedFunction(slow, 50, false);
+            assert.fail('Should have thrown');
+        } catch (err) {
+            assert.equal(err._source, undefined);
+        } finally {
+            clearTimeout(keepAlive);
+            cleanup();
+        }
+    });
+
+    it('should not set _source when localAddress is omitted', async () => {
+        let cleanup;
+        const slow = new Promise(resolve => {
+            cleanup = resolve;
+        });
+        const keepAlive = setTimeout(() => {}, 5000);
+        try {
+            await timedFunction(slow, 50);
+            assert.fail('Should have thrown');
+        } catch (err) {
+            assert.equal(err._source, undefined);
+        } finally {
+            clearTimeout(keepAlive);
+            cleanup();
+        }
+    });
+});
+
+// -- resolvePtr ---------------------------------------------------------------
+
+describe('resolvePtr', () => {
+    afterEach(() => {
+        mock.restoreAll();
+    });
+
+    it('should call dns.resolvePtr with correct PTR address for IPv4', async () => {
+        mock.method(dns.promises, 'resolvePtr', async addr => {
+            assert.equal(addr, '4.3.2.1.in-addr.arpa.');
+            return ['host.example.com'];
+        });
+
+        const result = await resolvePtr('1.2.3.4');
+        assert.deepEqual(result, ['host.example.com']);
+    });
+
+    it('should return multiple PTR records', async () => {
+        mock.method(dns.promises, 'resolvePtr', async () => {
+            return ['a.example.com', 'b.example.com'];
+        });
+
+        const result = await resolvePtr('1.2.3.4');
+        assert.equal(result.length, 2);
+    });
+
+    it('should propagate DNS errors', async () => {
+        mock.method(dns.promises, 'resolvePtr', async () => {
+            throw new Error('ENOTFOUND');
+        });
+
+        await assert.rejects(() => resolvePtr('1.2.3.4'), { message: 'ENOTFOUND' });
+    });
+});
+
+// -- updateDns ----------------------------------------------------------------
+
+describe('updateDns', () => {
+    afterEach(() => {
+        mock.restoreAll();
+        resetDnsCache();
+    });
+
+    it('should populate A cache on successful IPv4 resolution', async () => {
+        mock.method(dns.promises, 'resolve4', async () => ['93.184.216.34']);
+        mock.method(dns.promises, 'resolve6', async () => {
+            throw new Error('ENODATA');
+        });
+
+        await updateDns();
+
+        assert.ok(DNS_CACHE.A);
+        assert.equal(DNS_CACHE.A.host, '93.184.216.34');
+        assert.ok(DNS_CACHE.A.expires instanceof Date);
+        assert.ok(DNS_CACHE.A.expires > new Date());
+    });
+
+    it('should populate AAAA cache on successful IPv6 resolution', async () => {
+        mock.method(dns.promises, 'resolve4', async () => {
+            throw new Error('ENODATA');
+        });
+        mock.method(dns.promises, 'resolve6', async () => ['2606:2800:220:1:248:1893:25c8:1946']);
+
+        await updateDns();
+
+        assert.ok(DNS_CACHE.AAAA);
+        assert.equal(DNS_CACHE.AAAA.host, '2606:2800:220:1:248:1893:25c8:1946');
+    });
+
+    it('should populate both A and AAAA when both resolve', async () => {
+        mock.method(dns.promises, 'resolve4', async () => ['93.184.216.34']);
+        mock.method(dns.promises, 'resolve6', async () => ['2606:2800:220:1:248:1893:25c8:1946']);
+
+        await updateDns();
+
+        assert.equal(DNS_CACHE.A.host, '93.184.216.34');
+        assert.equal(DNS_CACHE.AAAA.host, '2606:2800:220:1:248:1893:25c8:1946');
+    });
+
+    it('should store error when IPv4 resolution fails', async () => {
+        const err = new Error('ENOTFOUND');
+        mock.method(dns.promises, 'resolve4', async () => {
+            throw err;
+        });
+        mock.method(dns.promises, 'resolve6', async () => {
+            throw new Error('ENODATA');
+        });
+
+        await updateDns();
+
+        assert.ok(DNS_CACHE.A);
+        assert.equal(DNS_CACHE.A.error, err);
+        assert.equal(DNS_CACHE.A.host, undefined);
+    });
+
+    it('should store error when IPv6 resolution fails', async () => {
+        const err = new Error('ENOTFOUND');
+        mock.method(dns.promises, 'resolve4', async () => {
+            throw new Error('ENODATA');
+        });
+        mock.method(dns.promises, 'resolve6', async () => {
+            throw err;
+        });
+
+        await updateDns();
+
+        assert.ok(DNS_CACHE.AAAA);
+        assert.equal(DNS_CACHE.AAAA.error, err);
+    });
+
+    it('should use first result when DNS returns multiple addresses', async () => {
+        mock.method(dns.promises, 'resolve4', async () => ['1.1.1.1', '2.2.2.2']);
+        mock.method(dns.promises, 'resolve6', async () => {
+            throw new Error('ENODATA');
+        });
+
+        await updateDns();
+
+        assert.equal(DNS_CACHE.A.host, '1.1.1.1');
+    });
+
+    it('should set expiry 10 minutes in the future', async () => {
+        mock.method(dns.promises, 'resolve4', async () => ['1.1.1.1']);
+        mock.method(dns.promises, 'resolve6', async () => {
+            throw new Error('ENODATA');
+        });
+
+        const before = Date.now();
+        await updateDns();
+        const after = Date.now();
+
+        const expiryMs = DNS_CACHE.A.expires.getTime();
+        // Should be ~10 minutes (600000ms) from now
+        assert.ok(expiryMs >= before + 9 * 60 * 1000);
+        assert.ok(expiryMs <= after + 11 * 60 * 1000);
+    });
+});
+
+// -- RESOLV_TIMEOUT_SEC -------------------------------------------------------
+
+describe('RESOLV_TIMEOUT_SEC', () => {
+    it('should default to 5000ms (RESOLV_TIMEOUT=5)', () => {
+        assert.equal(RESOLV_TIMEOUT_SEC, 5000);
+    });
+});
+
+// -- resolvePublicInterfaces (no-network) -------------------------------------
+
+describe('resolvePublicInterfaces', () => {
+    afterEach(() => {
+        mock.restoreAll();
+        resetDnsCache();
+    });
+
+    it('should be a function', () => {
+        assert.equal(typeof resolvePublicInterfaces, 'function');
+    });
+
+    it('should return empty array when all DNS resolution fails', async () => {
+        mock.method(dns.promises, 'resolve4', async () => {
+            throw new Error('ENODATA');
+        });
+        mock.method(dns.promises, 'resolve6', async () => {
+            throw new Error('ENODATA');
+        });
+        mock.method(os, 'networkInterfaces', () => ({}));
+
+        const result = await resolvePublicInterfaces();
+        assert.ok(Array.isArray(result));
+        assert.equal(result.length, 0);
+    });
+
+    it('should return empty array when DNS succeeds but no interfaces and API unreachable', async () => {
+        mock.method(dns.promises, 'resolve4', async () => ['127.0.0.1']);
+        mock.method(dns.promises, 'resolve6', async () => {
+            throw new Error('ENODATA');
+        });
+        mock.method(os, 'networkInterfaces', () => ({}));
+
+        // resolveIP will be called for the default interface (localAddress=false)
+        // It will fail since 127.0.0.1 is not a real resolver, but allSettled handles it
+        const result = await resolvePublicInterfaces();
+        assert.ok(Array.isArray(result));
+    });
+});
+
+// -- module exports -----------------------------------------------------------
+
+describe('module exports', () => {
+    it('should export resolvePublicInterfaces', () => {
+        const mod = require('../index.js');
+        assert.equal(typeof mod.resolvePublicInterfaces, 'function');
+    });
+
+    it('should export _internal with all helper functions', () => {
+        const mod = require('../index.js');
+        assert.ok(mod._internal);
+        assert.equal(typeof mod._internal.getPtrAddr, 'function');
+        assert.equal(typeof mod._internal.getPublicInterfaces, 'function');
+        assert.equal(typeof mod._internal.timedFunction, 'function');
+        assert.equal(typeof mod._internal.resolvePtr, 'function');
+        assert.equal(typeof mod._internal.updateDns, 'function');
+        assert.equal(typeof mod._internal.resolveIP, 'function');
+    });
+
+    it('should export DNS_CACHE as an object', () => {
+        const mod = require('../index.js');
+        assert.equal(typeof mod._internal.DNS_CACHE, 'object');
+    });
+});