@drawbridge/drawbridge-utils 0.0.96 → 0.0.98

package/dist/ai.cjs

@@ -177,6 +177,17 @@ var cost = {
     cached: 3,
     input: 30,
     output: 3e3
+  },
+  // gemini-3-pro-image-preview — verified against Google's pricing page
+  // 2026-08-12: $2.00 input / $12.00 text output per 1M, and image output
+  // tokens at ~$120/1M (a 1K-2K image is 1120 tokens = $0.134, a 4K image
+  // 2000 tokens = $0.24). Encoded the flash-image way: one flat output rate
+  // that reproduces the per-image price from the tokens usageMetadata
+  // reports. Growth's hero generation runs this model today.
+  "gemini-3-pro-image-preview": {
+    cached: 20,
+    input: 200,
+    output: 12e3
   }
 };
 var toolCost = {

package/dist/ai.js

@@ -143,6 +143,17 @@ var cost = {
     cached: 3,
     input: 30,
     output: 3e3
+  },
+  // gemini-3-pro-image-preview — verified against Google's pricing page
+  // 2026-08-12: $2.00 input / $12.00 text output per 1M, and image output
+  // tokens at ~$120/1M (a 1K-2K image is 1120 tokens = $0.134, a 4K image
+  // 2000 tokens = $0.24). Encoded the flash-image way: one flat output rate
+  // that reproduces the per-image price from the tokens usageMetadata
+  // reports. Growth's hero generation runs this model today.
+  "gemini-3-pro-image-preview": {
+    cached: 20,
+    input: 200,
+    output: 12e3
   }
 };
 var toolCost = {

package/dist/billing.cjs

@@ -177,6 +177,17 @@ var cost = {
     cached: 3,
     input: 30,
     output: 3e3
+  },
+  // gemini-3-pro-image-preview — verified against Google's pricing page
+  // 2026-08-12: $2.00 input / $12.00 text output per 1M, and image output
+  // tokens at ~$120/1M (a 1K-2K image is 1120 tokens = $0.134, a 4K image
+  // 2000 tokens = $0.24). Encoded the flash-image way: one flat output rate
+  // that reproduces the per-image price from the tokens usageMetadata
+  // reports. Growth's hero generation runs this model today.
+  "gemini-3-pro-image-preview": {
+    cached: 20,
+    input: 200,
+    output: 12e3
   }
 };
 var toolCost = {

package/dist/billing.d.cts

@@ -48,6 +48,17 @@ const cost = {
 		cached : 3,
 		input : 30,
 		output : 3000
+	},
+	// gemini-3-pro-image-preview — verified against Google's pricing page
+	// 2026-08-12: $2.00 input / $12.00 text output per 1M, and image output
+	// tokens at ~$120/1M (a 1K-2K image is 1120 tokens = $0.134, a 4K image
+	// 2000 tokens = $0.24). Encoded the flash-image way: one flat output rate
+	// that reproduces the per-image price from the tokens usageMetadata
+	// reports. Growth's hero generation runs this model today.
+	'gemini-3-pro-image-preview' : {
+		cached : 20,
+		input : 200,
+		output : 12000
 	}
 };
 

package/dist/billing.d.ts

@@ -48,6 +48,17 @@ const cost = {
 		cached : 3,
 		input : 30,
 		output : 3000
+	},
+	// gemini-3-pro-image-preview — verified against Google's pricing page
+	// 2026-08-12: $2.00 input / $12.00 text output per 1M, and image output
+	// tokens at ~$120/1M (a 1K-2K image is 1120 tokens = $0.134, a 4K image
+	// 2000 tokens = $0.24). Encoded the flash-image way: one flat output rate
+	// that reproduces the per-image price from the tokens usageMetadata
+	// reports. Growth's hero generation runs this model today.
+	'gemini-3-pro-image-preview' : {
+		cached : 20,
+		input : 200,
+		output : 12000
 	}
 };
 

package/dist/billing.js

@@ -147,6 +147,17 @@ var cost = {
     cached: 3,
     input: 30,
     output: 3e3
+  },
+  // gemini-3-pro-image-preview — verified against Google's pricing page
+  // 2026-08-12: $2.00 input / $12.00 text output per 1M, and image output
+  // tokens at ~$120/1M (a 1K-2K image is 1120 tokens = $0.134, a 4K image
+  // 2000 tokens = $0.24). Encoded the flash-image way: one flat output rate
+  // that reproduces the per-image price from the tokens usageMetadata
+  // reports. Growth's hero generation runs this model today.
+  "gemini-3-pro-image-preview": {
+    cached: 20,
+    input: 200,
+    output: 12e3
   }
 };
 var toolCost = {

package/dist/domains.cjs

@@ -0,0 +1,109 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lib/domains.js
+var domains_exports = {};
+__export(domains_exports, {
+  companyDomain: () => companyDomain,
+  freeEmailDomains: () => freeEmailDomains,
+  isFreeEmailDomain: () => isFreeEmailDomain,
+  normalizeDomain: () => normalizeDomain,
+  normalizeEmail: () => normalizeEmail
+});
+module.exports = __toCommonJS(domains_exports);
+var freeEmailDomains = /* @__PURE__ */ new Set([
+  "aol.com",
+  "comcast.net",
+  "gmail.com",
+  "googlemail.com",
+  "gmx.com",
+  "gmx.de",
+  "hey.com",
+  "hotmail.co.uk",
+  "hotmail.com",
+  "hotmail.fr",
+  "icloud.com",
+  "inbox.com",
+  "live.com",
+  "mac.com",
+  "mail.com",
+  "mail.ru",
+  "me.com",
+  "msn.com",
+  "outlook.com",
+  "pm.me",
+  "proton.me",
+  "protonmail.com",
+  "qq.com",
+  "rocketmail.com",
+  "sbcglobal.net",
+  "verizon.net",
+  "yahoo.co.uk",
+  "yahoo.com",
+  "yahoo.fr",
+  "yandex.com",
+  "yandex.ru",
+  "ymail.com",
+  "zoho.com"
+]);
+var isFreeEmailDomain = (domain) => {
+  if (typeof domain !== "string") return false;
+  return freeEmailDomains.has(domain.trim().toLowerCase());
+};
+var normalizeEmail = (value) => {
+  if (typeof value !== "string") return null;
+  const email = value.trim().toLowerCase().normalize("NFC");
+  if (!email.includes("@")) return null;
+  const [local, domain] = email.split("@");
+  if (!local || !domain || !domain.includes(".")) return null;
+  return email;
+};
+var normalizeDomain = (value) => {
+  if (typeof value !== "string") return null;
+  let host = value.trim().toLowerCase();
+  if (!host) return null;
+  if (host.includes("://")) {
+    try {
+      host = new URL(host).hostname;
+    } catch {
+      return null;
+    }
+  } else {
+    host = host.split("/")[0].split("?")[0];
+  }
+  host = host.replace(/^www\./, "");
+  if (!host.includes(".")) return null;
+  return host;
+};
+var companyDomain = ({ email, website } = {}) => {
+  const fromWebsite = normalizeDomain(website);
+  if (fromWebsite) return fromWebsite;
+  const normalized = normalizeEmail(email);
+  if (!normalized) return null;
+  const domain = normalized.split("@")[1];
+  if (isFreeEmailDomain(domain)) return null;
+  return domain;
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  companyDomain,
+  freeEmailDomains,
+  isFreeEmailDomain,
+  normalizeDomain,
+  normalizeEmail
+});

package/dist/domains.d.cts

@@ -0,0 +1,133 @@
+// Email-domain classification. Separate from ./email (which canonicalizes an
+// address for identity matching) and from ./sanitize's disposable-domain check
+// (which decides whether an address is acceptable at all) — this answers a
+// third, orthogonal question: does this address belong to a company?
+//
+// A free-provider address is not disposable and a disposable address is not a
+// free provider, so a caller that cares about both has to ask both.
+
+// Consumer email providers. An email domain on this list must never stand in for
+// a company — otherwise every gmail.com address would resolve to one giant
+// "company" (and, for signup autogeneration, we would scrape gmail.com).
+const freeEmailDomains = new Set([
+	'aol.com',
+	'comcast.net',
+	'gmail.com',
+	'googlemail.com',
+	'gmx.com',
+	'gmx.de',
+	'hey.com',
+	'hotmail.co.uk',
+	'hotmail.com',
+	'hotmail.fr',
+	'icloud.com',
+	'inbox.com',
+	'live.com',
+	'mac.com',
+	'mail.com',
+	'mail.ru',
+	'me.com',
+	'msn.com',
+	'outlook.com',
+	'pm.me',
+	'proton.me',
+	'protonmail.com',
+	'qq.com',
+	'rocketmail.com',
+	'sbcglobal.net',
+	'verizon.net',
+	'yahoo.co.uk',
+	'yahoo.com',
+	'yahoo.fr',
+	'yandex.com',
+	'yandex.ru',
+	'ymail.com',
+	'zoho.com'
+]);
+
+// Takes a BARE domain, not a full address.
+const isFreeEmailDomain = ( domain ) => {
+
+	if( typeof domain !== 'string' ) return false;
+
+	return freeEmailDomains.has( domain.trim().toLowerCase() );
+
+};
+
+// Trim, lowercase, NFC-normalize. Unicode normalization matters because a
+// composed and a decomposed é are different bytes but the same address.
+const normalizeEmail = ( value ) => {
+
+	if( typeof value !== 'string' ) return null;
+
+	const email = value.trim().toLowerCase().normalize( 'NFC' );
+
+	if( ! email.includes( '@' ) ) return null;
+
+	// Reject obvious garbage rather than treating it as an address.
+	const [ local, domain ] = email.split( '@' );
+
+	if( ! local || ! domain || ! domain.includes( '.' ) ) return null;
+
+	return email;
+
+};
+
+// Host part of a URL or a bare hostname, lowercased with www. removed.
+const normalizeDomain = ( value ) => {
+
+	if( typeof value !== 'string' ) return null;
+
+	let host = value.trim().toLowerCase();
+
+	if( ! host ) return null;
+
+	if( host.includes( '://' ) ){
+
+		try {
+
+			host = new URL( host ).hostname;
+
+		} catch {
+
+			return null;
+
+		}
+
+	} else {
+
+		// Strip a path or query someone pasted in without a scheme.
+		host = host.split( '/' )[ 0 ].split( '?' )[ 0 ];
+
+	}
+
+	host = host.replace( /^www\./, '' );
+
+	if( ! host.includes( '.' ) ) return null;
+
+	return host;
+
+};
+
+// The company domain behind an address, or null when there isn't one. An email
+// domain only counts when it is not a consumer provider; an explicit website
+// always counts and wins.
+const companyDomain = ({ email, website } = {}) => {
+
+	const fromWebsite = normalizeDomain( website );
+
+	if( fromWebsite ) return fromWebsite;
+
+	const normalized = normalizeEmail( email );
+
+	if( ! normalized ) return null;
+
+	const domain = normalized.split( '@' )[ 1 ];
+
+	if( isFreeEmailDomain( domain ) ) return null;
+
+	return domain;
+
+};
+
+export { companyDomain, freeEmailDomains, isFreeEmailDomain, normalizeDomain, normalizeEmail };

package/dist/domains.d.ts

@@ -0,0 +1,133 @@
+// Email-domain classification. Separate from ./email (which canonicalizes an
+// address for identity matching) and from ./sanitize's disposable-domain check
+// (which decides whether an address is acceptable at all) — this answers a
+// third, orthogonal question: does this address belong to a company?
+//
+// A free-provider address is not disposable and a disposable address is not a
+// free provider, so a caller that cares about both has to ask both.
+
+// Consumer email providers. An email domain on this list must never stand in for
+// a company — otherwise every gmail.com address would resolve to one giant
+// "company" (and, for signup autogeneration, we would scrape gmail.com).
+const freeEmailDomains = new Set([
+	'aol.com',
+	'comcast.net',
+	'gmail.com',
+	'googlemail.com',
+	'gmx.com',
+	'gmx.de',
+	'hey.com',
+	'hotmail.co.uk',
+	'hotmail.com',
+	'hotmail.fr',
+	'icloud.com',
+	'inbox.com',
+	'live.com',
+	'mac.com',
+	'mail.com',
+	'mail.ru',
+	'me.com',
+	'msn.com',
+	'outlook.com',
+	'pm.me',
+	'proton.me',
+	'protonmail.com',
+	'qq.com',
+	'rocketmail.com',
+	'sbcglobal.net',
+	'verizon.net',
+	'yahoo.co.uk',
+	'yahoo.com',
+	'yahoo.fr',
+	'yandex.com',
+	'yandex.ru',
+	'ymail.com',
+	'zoho.com'
+]);
+
+// Takes a BARE domain, not a full address.
+const isFreeEmailDomain = ( domain ) => {
+
+	if( typeof domain !== 'string' ) return false;
+
+	return freeEmailDomains.has( domain.trim().toLowerCase() );
+
+};
+
+// Trim, lowercase, NFC-normalize. Unicode normalization matters because a
+// composed and a decomposed é are different bytes but the same address.
+const normalizeEmail = ( value ) => {
+
+	if( typeof value !== 'string' ) return null;
+
+	const email = value.trim().toLowerCase().normalize( 'NFC' );
+
+	if( ! email.includes( '@' ) ) return null;
+
+	// Reject obvious garbage rather than treating it as an address.
+	const [ local, domain ] = email.split( '@' );
+
+	if( ! local || ! domain || ! domain.includes( '.' ) ) return null;
+
+	return email;
+
+};
+
+// Host part of a URL or a bare hostname, lowercased with www. removed.
+const normalizeDomain = ( value ) => {
+
+	if( typeof value !== 'string' ) return null;
+
+	let host = value.trim().toLowerCase();
+
+	if( ! host ) return null;
+
+	if( host.includes( '://' ) ){
+
+		try {
+
+			host = new URL( host ).hostname;
+
+		} catch {
+
+			return null;
+
+		}
+
+	} else {
+
+		// Strip a path or query someone pasted in without a scheme.
+		host = host.split( '/' )[ 0 ].split( '?' )[ 0 ];
+
+	}
+
+	host = host.replace( /^www\./, '' );
+
+	if( ! host.includes( '.' ) ) return null;
+
+	return host;
+
+};
+
+// The company domain behind an address, or null when there isn't one. An email
+// domain only counts when it is not a consumer provider; an explicit website
+// always counts and wins.
+const companyDomain = ({ email, website } = {}) => {
+
+	const fromWebsite = normalizeDomain( website );
+
+	if( fromWebsite ) return fromWebsite;
+
+	const normalized = normalizeEmail( email );
+
+	if( ! normalized ) return null;
+
+	const domain = normalized.split( '@' )[ 1 ];
+
+	if( isFreeEmailDomain( domain ) ) return null;
+
+	return domain;
+
+};
+
+export { companyDomain, freeEmailDomains, isFreeEmailDomain, normalizeDomain, normalizeEmail };

package/dist/domains.js

@@ -0,0 +1,81 @@
+// lib/domains.js
+var freeEmailDomains = /* @__PURE__ */ new Set([
+  "aol.com",
+  "comcast.net",
+  "gmail.com",
+  "googlemail.com",
+  "gmx.com",
+  "gmx.de",
+  "hey.com",
+  "hotmail.co.uk",
+  "hotmail.com",
+  "hotmail.fr",
+  "icloud.com",
+  "inbox.com",
+  "live.com",
+  "mac.com",
+  "mail.com",
+  "mail.ru",
+  "me.com",
+  "msn.com",
+  "outlook.com",
+  "pm.me",
+  "proton.me",
+  "protonmail.com",
+  "qq.com",
+  "rocketmail.com",
+  "sbcglobal.net",
+  "verizon.net",
+  "yahoo.co.uk",
+  "yahoo.com",
+  "yahoo.fr",
+  "yandex.com",
+  "yandex.ru",
+  "ymail.com",
+  "zoho.com"
+]);
+var isFreeEmailDomain = (domain) => {
+  if (typeof domain !== "string") return false;
+  return freeEmailDomains.has(domain.trim().toLowerCase());
+};
+var normalizeEmail = (value) => {
+  if (typeof value !== "string") return null;
+  const email = value.trim().toLowerCase().normalize("NFC");
+  if (!email.includes("@")) return null;
+  const [local, domain] = email.split("@");
+  if (!local || !domain || !domain.includes(".")) return null;
+  return email;
+};
+var normalizeDomain = (value) => {
+  if (typeof value !== "string") return null;
+  let host = value.trim().toLowerCase();
+  if (!host) return null;
+  if (host.includes("://")) {
+    try {
+      host = new URL(host).hostname;
+    } catch {
+      return null;
+    }
+  } else {
+    host = host.split("/")[0].split("?")[0];
+  }
+  host = host.replace(/^www\./, "");
+  if (!host.includes(".")) return null;
+  return host;
+};
+var companyDomain = ({ email, website } = {}) => {
+  const fromWebsite = normalizeDomain(website);
+  if (fromWebsite) return fromWebsite;
+  const normalized = normalizeEmail(email);
+  if (!normalized) return null;
+  const domain = normalized.split("@")[1];
+  if (isFreeEmailDomain(domain)) return null;
+  return domain;
+};
+export {
+  companyDomain,
+  freeEmailDomains,
+  isFreeEmailDomain,
+  normalizeDomain,
+  normalizeEmail
+};

package/dist/safe-http.cjs

@@ -0,0 +1,180 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lib/safe-http.js
+var safe_http_exports = {};
+__export(safe_http_exports, {
+  assertSafeHost: () => assertSafeHost,
+  pinnedAgent: () => pinnedAgent,
+  resolveSafeHost: () => resolveSafeHost,
+  safeRequest: () => safeRequest
+});
+module.exports = __toCommonJS(safe_http_exports);
+var import_dns2 = __toESM(require("dns"), 1);
+var http2 = __toESM(require("http"), 1);
+var https2 = __toESM(require("https"), 1);
+
+// lib/axios.js
+var import_axios = __toESM(require("axios"), 1);
+var import_dns = __toESM(require("dns"), 1);
+var http = __toESM(require("http"), 1);
+var https = __toESM(require("https"), 1);
+var import_net = __toESM(require("net"), 1);
+var dnsLookup = import_dns.default.promises.lookup;
+var isBlockedIPv4 = (ip) => {
+  const parts = ip.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) return true;
+  const [a, b] = parts;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 192 && b === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 198 && b === 51) return true;
+  if (a === 203 && b === 0) return true;
+  if (a >= 224) return true;
+  return false;
+};
+var isBlockedIPv6 = (ip) => {
+  const lower = ip.toLowerCase();
+  if (lower === "::1" || lower === "::") return true;
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
+  if (/^fe[89ab]/.test(lower)) return true;
+  if (lower.startsWith("ff")) return true;
+  if (lower.startsWith("::ffff:")) {
+    const v4 = lower.slice(7);
+    return isBlockedIPv4(v4);
+  }
+  ;
+  return false;
+};
+var isBlockedIP = (ip) => {
+  const version = import_net.default.isIP(ip);
+  if (version === 4) return isBlockedIPv4(ip);
+  if (version === 6) return isBlockedIPv6(ip);
+  return true;
+};
+var axios = import_axios.default.create({
+  timeout: 3e4,
+  httpAgent: new http.Agent({ keepAlive: true, maxSockets: 128 }),
+  httpsAgent: new https.Agent({ keepAlive: true, maxSockets: 128 })
+});
+
+// lib/safe-http.js
+var DEFAULT_TIMEOUT_MS = 15e3;
+var resolveSafeHost = async (url) => {
+  const parsed = new URL(url);
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error("Only http(s) URLs are allowed");
+  }
+  const records = await import_dns2.default.promises.lookup(parsed.hostname, { all: true });
+  if (!(records == null ? void 0 : records.length)) {
+    throw new Error("Host could not be resolved");
+  }
+  for (const record of records) {
+    if (isBlockedIP(record.address)) {
+      throw new Error("Host resolves to a blocked IP range");
+    }
+  }
+  return { parsed, records };
+};
+var assertSafeHost = async (url) => {
+  await resolveSafeHost(url);
+};
+var pinnedAgent = async (url) => {
+  const { parsed, records } = await resolveSafeHost(url);
+  const pinned = records[0];
+  const lookup = (hostname, options, callback) => {
+    if (options == null ? void 0 : options.all) {
+      callback(null, [{ address: pinned.address, family: pinned.family }]);
+    } else {
+      callback(null, pinned.address, pinned.family);
+    }
+  };
+  return {
+    protocol: parsed.protocol,
+    agent: parsed.protocol === "https:" ? new https2.Agent({ lookup }) : new http2.Agent({ lookup })
+  };
+};
+var safeRequest = async ({
+  body,
+  headers = {},
+  method = "GET",
+  query,
+  timeout = DEFAULT_TIMEOUT_MS,
+  type = "json",
+  url
+}) => {
+  const full = new URL(url);
+  if (query) {
+    Object.entries(query).forEach(([key, value]) => full.searchParams.set(key, value));
+  }
+  const { protocol, agent } = await pinnedAgent(full.toString());
+  const isForm = type === "form";
+  try {
+    const response = await axios({
+      method,
+      url: full.toString(),
+      headers: {
+        "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
+        ...headers
+      },
+      ...body !== void 0 && {
+        data: isForm ? new URLSearchParams(body).toString() : body
+      },
+      timeout,
+      maxRedirects: 0,
+      httpAgent: protocol === "http:" ? agent : void 0,
+      httpsAgent: protocol === "https:" ? agent : void 0,
+      responseType: "json",
+      validateStatus: (status) => status >= 200 && status < 300
+    });
+    return response.data || null;
+  } catch (error) {
+    if (error == null ? void 0 : error.response) {
+      const normalized = new Error(
+        typeof error.response.data === "string" ? error.response.data : error.message || "Request failed"
+      );
+      normalized.status = error.response.status;
+      normalized.response = error.response.data;
+      throw normalized;
+    }
+    throw error;
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  assertSafeHost,
+  pinnedAgent,
+  resolveSafeHost,
+  safeRequest
+});

package/dist/safe-http.d.cts

@@ -0,0 +1,174 @@
+import dns from 'dns';
+import * as http from 'node:http';
+import * as https from 'node:https';
+import { isBlockedIP, axios } from './axios.cjs';
+import 'axios';
+import 'net';
+
+// SSRF-safe outbound HTTP for user-supplied URLs (scrape targets, video assets,
+// outgoing webhooks, signup domain pre-flights). The sibling `safe.get` in
+// ./axios is https-only, GET-only, and hard-caps the body at 5MB — too small for
+// video and no help for POST/redirect control — so this offers the same
+// protection with the transport under the caller's control:
+//
+//   1. resolve the host and reject if ANY record is a private/reserved IP
+//      (blocks direct navigation to 10.x / 127.x / 169.254.169.254 / etc.)
+//   2. pin the vetted IP on the connection agent so a second lookup can't be
+//      re-pointed at an internal address between the check and the connect
+//      (DNS rebinding), and
+//   3. callers pass maxRedirects:0 — a redirect to an internal host would
+//      otherwise re-resolve past the pin.
+//
+// isBlockedIP is the shared allow/deny logic in ./axios, so this and safe.get
+// stay in lockstep on what counts as a blocked range.
+
+const DEFAULT_TIMEOUT_MS = 15000;
+
+// Resolve + validate a URL's host. Throws if the URL is not http(s), the host is
+// unresolvable, or any resolved record is a blocked IP. Returns the parsed URL
+// and its DNS records so callers can pin.
+const resolveSafeHost = async ( url ) => {
+
+	const parsed = new URL( url );
+
+	if( parsed.protocol !== 'https:' && parsed.protocol !== 'http:' ){
+
+		throw new Error( 'Only http(s) URLs are allowed' );
+
+	}
+
+	const records = await dns.promises.lookup( parsed.hostname, { all : true } );
+
+	if( ! records?.length ){
+
+		throw new Error( 'Host could not be resolved' );
+
+	}
+
+	for( const record of records ){
+
+		if( isBlockedIP( record.address ) ){
+
+			throw new Error( 'Host resolves to a blocked IP range' );
+
+		}
+
+	}
+
+	return { parsed, records };
+
+};
+
+// Throwing guard for callers that manage their own transport (e.g. Puppeteer,
+// which does its own DNS/redirects and can't take our agent). Rejects the URL if
+// it resolves to a blocked range.
+const assertSafeHost = async ( url ) => {
+
+	await resolveSafeHost( url );
+
+};
+
+// Build an http(s).Agent pinned to the vetted IP for `url`'s host. Pair with
+// maxRedirects:0 on the request. Throws (via resolveSafeHost) if the host is blocked.
+const pinnedAgent = async ( url ) => {
+
+	const { parsed, records } = await resolveSafeHost( url );
+	const pinned = records[ 0 ];
+
+	const lookup = ( hostname, options, callback ) => {
+
+		if( options?.all ){
+
+			callback( null, [ { address : pinned.address, family : pinned.family } ] );
+
+		} else {
+
+			callback( null, pinned.address, pinned.family );
+
+		}
+
+	};
+
+	return {
+		protocol : parsed.protocol,
+		agent : parsed.protocol === 'https:'
+			? new https.Agent({ lookup })
+			: new http.Agent({ lookup })
+	};
+
+};
+
+// SSRF-safe drop-in for ./http `request`: identical call / return / throw
+// contract (parsed JSON body on success, throws Error with .status on non-2xx),
+// but pins the vetted IP and refuses redirects. A webhook endpoint that
+// 3xx-redirects is treated as a failure — an intentional trade for closing the
+// redirect-to-internal vector.
+const safeRequest = async ({
+	body,
+	headers = {},
+	method = 'GET',
+	query,
+	timeout = DEFAULT_TIMEOUT_MS,
+	type = 'json',
+	url
+}) => {
+
+	const full = new URL( url );
+
+	if( query ){
+
+		Object.entries( query ).forEach( ([ key, value ]) => full.searchParams.set( key, value ) );
+
+	}
+
+	const { protocol, agent } = await pinnedAgent( full.toString() );
+	const isForm = type === 'form';
+
+	try {
+
+		const response = await axios({
+			method,
+			url : full.toString(),
+			headers : {
+				'Content-Type' : isForm ? 'application/x-www-form-urlencoded' : 'application/json',
+				...headers
+			},
+			...( body !== undefined && {
+				data : isForm ? new URLSearchParams( body ).toString() : body
+			}),
+			timeout,
+			maxRedirects : 0,
+			httpAgent : protocol === 'http:' ? agent : undefined,
+			httpsAgent : protocol === 'https:' ? agent : undefined,
+			responseType : 'json',
+			validateStatus : ( status ) => status >= 200 && status < 300
+		});
+
+		return response.data || null;
+
+	} catch ( error ) {
+
+		// Normalize to the ./http `request` error shape so existing callers
+		// (which read error.status / error.message / error.response) behave the same.
+		if( error?.response ){
+
+			const normalized = new Error(
+				typeof error.response.data === 'string'
+					? error.response.data
+					: ( error.message || 'Request failed' )
+			);
+
+			normalized.status = error.response.status;
+			normalized.response = error.response.data;
+
+			throw normalized;
+
+		}
+
+		throw error;
+
+	}
+
+};
+
+export { assertSafeHost, pinnedAgent, resolveSafeHost, safeRequest };

package/dist/safe-http.d.ts

@@ -0,0 +1,174 @@
+import dns from 'dns';
+import * as http from 'node:http';
+import * as https from 'node:https';
+import { isBlockedIP, axios } from './axios.js';
+import 'axios';
+import 'net';
+
+// SSRF-safe outbound HTTP for user-supplied URLs (scrape targets, video assets,
+// outgoing webhooks, signup domain pre-flights). The sibling `safe.get` in
+// ./axios is https-only, GET-only, and hard-caps the body at 5MB — too small for
+// video and no help for POST/redirect control — so this offers the same
+// protection with the transport under the caller's control:
+//
+//   1. resolve the host and reject if ANY record is a private/reserved IP
+//      (blocks direct navigation to 10.x / 127.x / 169.254.169.254 / etc.)
+//   2. pin the vetted IP on the connection agent so a second lookup can't be
+//      re-pointed at an internal address between the check and the connect
+//      (DNS rebinding), and
+//   3. callers pass maxRedirects:0 — a redirect to an internal host would
+//      otherwise re-resolve past the pin.
+//
+// isBlockedIP is the shared allow/deny logic in ./axios, so this and safe.get
+// stay in lockstep on what counts as a blocked range.
+
+const DEFAULT_TIMEOUT_MS = 15000;
+
+// Resolve + validate a URL's host. Throws if the URL is not http(s), the host is
+// unresolvable, or any resolved record is a blocked IP. Returns the parsed URL
+// and its DNS records so callers can pin.
+const resolveSafeHost = async ( url ) => {
+
+	const parsed = new URL( url );
+
+	if( parsed.protocol !== 'https:' && parsed.protocol !== 'http:' ){
+
+		throw new Error( 'Only http(s) URLs are allowed' );
+
+	}
+
+	const records = await dns.promises.lookup( parsed.hostname, { all : true } );
+
+	if( ! records?.length ){
+
+		throw new Error( 'Host could not be resolved' );
+
+	}
+
+	for( const record of records ){
+
+		if( isBlockedIP( record.address ) ){
+
+			throw new Error( 'Host resolves to a blocked IP range' );
+
+		}
+
+	}
+
+	return { parsed, records };
+
+};
+
+// Throwing guard for callers that manage their own transport (e.g. Puppeteer,
+// which does its own DNS/redirects and can't take our agent). Rejects the URL if
+// it resolves to a blocked range.
+const assertSafeHost = async ( url ) => {
+
+	await resolveSafeHost( url );
+
+};
+
+// Build an http(s).Agent pinned to the vetted IP for `url`'s host. Pair with
+// maxRedirects:0 on the request. Throws (via resolveSafeHost) if the host is blocked.
+const pinnedAgent = async ( url ) => {
+
+	const { parsed, records } = await resolveSafeHost( url );
+	const pinned = records[ 0 ];
+
+	const lookup = ( hostname, options, callback ) => {
+
+		if( options?.all ){
+
+			callback( null, [ { address : pinned.address, family : pinned.family } ] );
+
+		} else {
+
+			callback( null, pinned.address, pinned.family );
+
+		}
+
+	};
+
+	return {
+		protocol : parsed.protocol,
+		agent : parsed.protocol === 'https:'
+			? new https.Agent({ lookup })
+			: new http.Agent({ lookup })
+	};
+
+};
+
+// SSRF-safe drop-in for ./http `request`: identical call / return / throw
+// contract (parsed JSON body on success, throws Error with .status on non-2xx),
+// but pins the vetted IP and refuses redirects. A webhook endpoint that
+// 3xx-redirects is treated as a failure — an intentional trade for closing the
+// redirect-to-internal vector.
+const safeRequest = async ({
+	body,
+	headers = {},
+	method = 'GET',
+	query,
+	timeout = DEFAULT_TIMEOUT_MS,
+	type = 'json',
+	url
+}) => {
+
+	const full = new URL( url );
+
+	if( query ){
+
+		Object.entries( query ).forEach( ([ key, value ]) => full.searchParams.set( key, value ) );
+
+	}
+
+	const { protocol, agent } = await pinnedAgent( full.toString() );
+	const isForm = type === 'form';
+
+	try {
+
+		const response = await axios({
+			method,
+			url : full.toString(),
+			headers : {
+				'Content-Type' : isForm ? 'application/x-www-form-urlencoded' : 'application/json',
+				...headers
+			},
+			...( body !== undefined && {
+				data : isForm ? new URLSearchParams( body ).toString() : body
+			}),
+			timeout,
+			maxRedirects : 0,
+			httpAgent : protocol === 'http:' ? agent : undefined,
+			httpsAgent : protocol === 'https:' ? agent : undefined,
+			responseType : 'json',
+			validateStatus : ( status ) => status >= 200 && status < 300
+		});
+
+		return response.data || null;
+
+	} catch ( error ) {
+
+		// Normalize to the ./http `request` error shape so existing callers
+		// (which read error.status / error.message / error.response) behave the same.
+		if( error?.response ){
+
+			const normalized = new Error(
+				typeof error.response.data === 'string'
+					? error.response.data
+					: ( error.message || 'Request failed' )
+			);
+
+			normalized.status = error.response.status;
+			normalized.response = error.response.data;
+
+			throw normalized;
+
+		}
+
+		throw error;
+
+	}
+
+};
+
+export { assertSafeHost, pinnedAgent, resolveSafeHost, safeRequest };

package/dist/safe-http.js

@@ -0,0 +1,143 @@
+// lib/safe-http.js
+import dns2 from "dns";
+import * as http2 from "http";
+import * as https2 from "https";
+
+// lib/axios.js
+import axiosLib from "axios";
+import dns from "dns";
+import * as http from "http";
+import * as https from "https";
+import net from "net";
+var dnsLookup = dns.promises.lookup;
+var isBlockedIPv4 = (ip) => {
+  const parts = ip.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) return true;
+  const [a, b] = parts;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 192 && b === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 198 && b === 51) return true;
+  if (a === 203 && b === 0) return true;
+  if (a >= 224) return true;
+  return false;
+};
+var isBlockedIPv6 = (ip) => {
+  const lower = ip.toLowerCase();
+  if (lower === "::1" || lower === "::") return true;
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
+  if (/^fe[89ab]/.test(lower)) return true;
+  if (lower.startsWith("ff")) return true;
+  if (lower.startsWith("::ffff:")) {
+    const v4 = lower.slice(7);
+    return isBlockedIPv4(v4);
+  }
+  ;
+  return false;
+};
+var isBlockedIP = (ip) => {
+  const version = net.isIP(ip);
+  if (version === 4) return isBlockedIPv4(ip);
+  if (version === 6) return isBlockedIPv6(ip);
+  return true;
+};
+var axios = axiosLib.create({
+  timeout: 3e4,
+  httpAgent: new http.Agent({ keepAlive: true, maxSockets: 128 }),
+  httpsAgent: new https.Agent({ keepAlive: true, maxSockets: 128 })
+});
+
+// lib/safe-http.js
+var DEFAULT_TIMEOUT_MS = 15e3;
+var resolveSafeHost = async (url) => {
+  const parsed = new URL(url);
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error("Only http(s) URLs are allowed");
+  }
+  const records = await dns2.promises.lookup(parsed.hostname, { all: true });
+  if (!(records == null ? void 0 : records.length)) {
+    throw new Error("Host could not be resolved");
+  }
+  for (const record of records) {
+    if (isBlockedIP(record.address)) {
+      throw new Error("Host resolves to a blocked IP range");
+    }
+  }
+  return { parsed, records };
+};
+var assertSafeHost = async (url) => {
+  await resolveSafeHost(url);
+};
+var pinnedAgent = async (url) => {
+  const { parsed, records } = await resolveSafeHost(url);
+  const pinned = records[0];
+  const lookup = (hostname, options, callback) => {
+    if (options == null ? void 0 : options.all) {
+      callback(null, [{ address: pinned.address, family: pinned.family }]);
+    } else {
+      callback(null, pinned.address, pinned.family);
+    }
+  };
+  return {
+    protocol: parsed.protocol,
+    agent: parsed.protocol === "https:" ? new https2.Agent({ lookup }) : new http2.Agent({ lookup })
+  };
+};
+var safeRequest = async ({
+  body,
+  headers = {},
+  method = "GET",
+  query,
+  timeout = DEFAULT_TIMEOUT_MS,
+  type = "json",
+  url
+}) => {
+  const full = new URL(url);
+  if (query) {
+    Object.entries(query).forEach(([key, value]) => full.searchParams.set(key, value));
+  }
+  const { protocol, agent } = await pinnedAgent(full.toString());
+  const isForm = type === "form";
+  try {
+    const response = await axios({
+      method,
+      url: full.toString(),
+      headers: {
+        "Content-Type": isForm ? "application/x-www-form-urlencoded" : "application/json",
+        ...headers
+      },
+      ...body !== void 0 && {
+        data: isForm ? new URLSearchParams(body).toString() : body
+      },
+      timeout,
+      maxRedirects: 0,
+      httpAgent: protocol === "http:" ? agent : void 0,
+      httpsAgent: protocol === "https:" ? agent : void 0,
+      responseType: "json",
+      validateStatus: (status) => status >= 200 && status < 300
+    });
+    return response.data || null;
+  } catch (error) {
+    if (error == null ? void 0 : error.response) {
+      const normalized = new Error(
+        typeof error.response.data === "string" ? error.response.data : error.message || "Request failed"
+      );
+      normalized.status = error.response.status;
+      normalized.response = error.response.data;
+      throw normalized;
+    }
+    throw error;
+  }
+};
+export {
+  assertSafeHost,
+  pinnedAgent,
+  resolveSafeHost,
+  safeRequest
+};

package/package.json

@@ -13,7 +13,7 @@
     "tinycolor2": "1.6.0"
   },
   "devDependencies": {
-    "@drawbridge/drawbridge-agents": "0.1.28",
+    "@drawbridge/drawbridge-agents": "0.1.31",
     "@node-oauth/oauth2-server": "5.3.0",
     "tsup": "8.5.1",
     "typescript": "5.9.3"
@@ -47,6 +47,11 @@
       "import": "./dist/color.js",
       "require": "./dist/color.cjs"
     },
+    "./domains": {
+      "types": "./dist/domains.d.ts",
+      "import": "./dist/domains.js",
+      "require": "./dist/domains.cjs"
+    },
     "./email": {
       "types": "./dist/email.d.ts",
       "import": "./dist/email.js",
@@ -107,6 +112,11 @@
       "import": "./dist/redirect.js",
       "require": "./dist/redirect.cjs"
     },
+    "./safe-http": {
+      "types": "./dist/safe-http.d.ts",
+      "import": "./dist/safe-http.js",
+      "require": "./dist/safe-http.cjs"
+    },
     "./sanitize": {
       "types": "./dist/sanitize.d.ts",
       "import": "./dist/sanitize.js",
@@ -169,5 +179,5 @@
     "test": ". \"$HOME/.nvm/nvm.sh\" && nvm use && node --test"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.96"
+  "version": "0.0.98"
 }