@nexpress/wp-import 0.1.0

package/dist/index.js

@@ -0,0 +1,2448 @@
+// src/parse/wxr.ts
+import { XMLParser } from "fast-xml-parser";
+function parseWxr(xml) {
+  const parser = new XMLParser({
+    ignoreAttributes: false,
+    attributeNamePrefix: "@_",
+    parseAttributeValue: false,
+    parseTagValue: false,
+    trimValues: true,
+    cdataPropName: "__cdata",
+    isArray: (name) => MULTI_VALUE_TAGS.has(name)
+  });
+  const tree = parser.parse(xml);
+  const channel = tree.rss?.channel;
+  if (!channel) {
+    throw new Error("Invalid WXR: missing <rss><channel> root");
+  }
+  const site = parseSite(channel);
+  const authors = parseAuthors(channel);
+  const terms = parseChannelTerms(channel);
+  const records = parseRecords(channel);
+  return { site, authors, terms, records };
+}
+var MULTI_VALUE_TAGS = /* @__PURE__ */ new Set([
+  "item",
+  "wp:author",
+  "wp:category",
+  "wp:tag",
+  "wp:term",
+  "wp:postmeta",
+  "wp:comment",
+  "category"
+]);
+function asText(value) {
+  if (!value) return "";
+  if (typeof value === "string") return value;
+  if (typeof value.__cdata === "string") return value.__cdata;
+  if (typeof value["#text"] === "string") return value["#text"];
+  return "";
+}
+function asOptionalText(value) {
+  const text = asText(value);
+  return text.length > 0 ? text : null;
+}
+function parseSite(channel) {
+  return {
+    title: asText(channel.title),
+    link: asText(channel.link),
+    description: asText(channel.description),
+    baseSiteUrl: asText(channel["wp:base_site_url"]),
+    baseBlogUrl: asText(channel["wp:base_blog_url"]),
+    language: asOptionalText(channel.language)
+  };
+}
+function parseAuthors(channel) {
+  const rows = channel["wp:author"] ?? [];
+  return rows.map((row) => ({
+    wpId: parseIntOrZero(asText(row["wp:author_id"])),
+    login: asText(row["wp:author_login"]),
+    email: asText(row["wp:author_email"]),
+    displayName: asText(row["wp:author_display_name"]),
+    description: asOptionalText(row["wp:author_description"])
+  }));
+}
+function parseChannelTerms(channel) {
+  const out = [];
+  for (const row of channel["wp:category"] ?? []) {
+    out.push({
+      taxonomy: "category",
+      slug: asText(row["wp:category_nicename"]),
+      name: asText(row["wp:cat_name"])
+    });
+  }
+  for (const row of channel["wp:tag"] ?? []) {
+    out.push({
+      taxonomy: "post_tag",
+      slug: asText(row["wp:tag_slug"]),
+      name: asText(row["wp:tag_name"])
+    });
+  }
+  for (const row of channel["wp:term"] ?? []) {
+    const taxonomy = asText(row["wp:term_taxonomy"]) || asText(row["wp:taxonomy"]);
+    if (!taxonomy) continue;
+    out.push({
+      taxonomy,
+      slug: asText(row["wp:term_slug"]),
+      name: asText(row["wp:term_name"])
+    });
+  }
+  return out;
+}
+function parseRecords(channel) {
+  const items = channel.item ?? [];
+  return items.map((item) => parseRecord(item));
+}
+function parseRecord(item) {
+  const meta = parseMeta(item);
+  const status = coerceStatus(asText(item["wp:status"]));
+  const wpType = asText(item["wp:post_type"]);
+  const rawContent = asText(item["content:encoded"]);
+  const attachmentUrl = asText(item["wp:attachment_url"]);
+  return {
+    wpId: parseIntOrZero(asText(item["wp:post_id"])),
+    wpType,
+    status,
+    slug: asText(item["wp:post_name"]),
+    title: asText(item.title),
+    excerpt: asOptionalText(item["excerpt:encoded"]),
+    rawContent,
+    wpAuthorLogin: asText(item["dc:creator"]),
+    publishedAt: asText(item["wp:post_date_gmt"]),
+    updatedAt: asText(item["wp:post_modified_gmt"]),
+    terms: parseItemCategories(item),
+    meta,
+    mediaRefs: parseMediaRefs({ rawContent, attachmentUrl, wpType, meta }),
+    comments: parseComments(item)
+  };
+}
+function parseItemCategories(item) {
+  const out = [];
+  for (const row of item.category ?? []) {
+    const taxonomy = row["@_domain"] ?? "category";
+    out.push({
+      taxonomy,
+      slug: row["@_nicename"] ?? "",
+      // Real WXR exports wrap the term name in CDATA, but tests
+      // and hand-written XML may use plain text. Read both.
+      name: row.__cdata ?? row["#text"] ?? ""
+    });
+  }
+  return out;
+}
+function parseMeta(item) {
+  const out = {};
+  for (const row of item["wp:postmeta"] ?? []) {
+    const key = asText(row["wp:meta_key"]);
+    if (!key) continue;
+    out[key] = asText(row["wp:meta_value"]);
+  }
+  return out;
+}
+function parseComments(item) {
+  const rows = item["wp:comment"] ?? [];
+  return rows.map((row) => ({
+    wpId: parseIntOrZero(asText(row["wp:comment_id"])),
+    parentWpId: parseOptionalInt(asText(row["wp:comment_parent"])),
+    authorName: asText(row["wp:comment_author"]),
+    authorEmail: asOptionalText(row["wp:comment_author_email"]),
+    authorUrl: asOptionalText(row["wp:comment_author_url"]),
+    date: asText(row["wp:comment_date_gmt"]),
+    content: asText(row["wp:comment_content"]),
+    approved: asText(row["wp:comment_approved"]) === "1"
+  }));
+}
+var IMG_TAG_RE = /<img\b[^>]*>/gi;
+var SRC_ATTR_RE = /\bsrc\s*=\s*["']([^"']+)["']/i;
+var WP_ATTACHMENT_ID_RE = /wp-image-(\d+)/i;
+function parseMediaRefs(args) {
+  const refs = [];
+  const thumbId = args.meta._thumbnail_id;
+  if (thumbId) {
+    refs.push({
+      sourceUrl: "",
+      wpAttachmentId: parseIntOrZero(thumbId),
+      kind: "featured"
+    });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const tagMatch of args.rawContent.matchAll(IMG_TAG_RE)) {
+    const tag = tagMatch[0];
+    const srcMatch = SRC_ATTR_RE.exec(tag);
+    const url = srcMatch?.[1];
+    if (!url || seen.has(url)) continue;
+    seen.add(url);
+    const idMatch = WP_ATTACHMENT_ID_RE.exec(tag);
+    refs.push({
+      sourceUrl: url,
+      wpAttachmentId: idMatch ? parseIntOrZero(idMatch[1] ?? "") : null,
+      kind: "inline"
+    });
+  }
+  if (args.wpType === "attachment" && args.attachmentUrl) {
+    refs.push({
+      sourceUrl: args.attachmentUrl,
+      wpAttachmentId: null,
+      kind: "inline"
+    });
+  }
+  return refs;
+}
+function coerceStatus(raw) {
+  switch (raw) {
+    case "publish":
+    case "draft":
+    case "private":
+    case "pending":
+    case "trash":
+    case "auto-draft":
+      return raw;
+    default:
+      return "draft";
+  }
+}
+function parseIntOrZero(value) {
+  const n = Number.parseInt(value, 10);
+  return Number.isFinite(n) ? n : 0;
+}
+function parseOptionalInt(value) {
+  if (!value) return null;
+  const n = Number.parseInt(value, 10);
+  return Number.isFinite(n) && n > 0 ? n : null;
+}
+
+// src/parse/wxr-stream.ts
+import { createReadStream } from "fs";
+var DEFAULT_HIGH_WATER_MARK = 64 * 1024;
+var DEFAULT_MAX_ITEM_BYTES = 64 * 1024 * 1024;
+var ITEM_OPEN = "<item>";
+var ITEM_CLOSE = "</item>";
+var WpImportStreamError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WpImportStreamError";
+  }
+};
+async function parseWxrStream(path, options = {}) {
+  const highWaterMark = options.highWaterMark ?? DEFAULT_HIGH_WATER_MARK;
+  const maxItemBytes = options.maxItemBytes ?? DEFAULT_MAX_ITEM_BYTES;
+  const stream = createReadStream(path, { encoding: "utf8", highWaterMark });
+  const reader = stream[Symbol.asyncIterator]();
+  let buffer = "";
+  let firstItemAt = -1;
+  while (firstItemAt < 0) {
+    const next = await reader.next();
+    if (next.done) break;
+    buffer += next.value;
+    firstItemAt = buffer.indexOf(ITEM_OPEN);
+    if (buffer.length > maxItemBytes && firstItemAt < 0) {
+      throw new WpImportStreamError(
+        `header exceeded ${maxItemBytes} bytes without finding any <item> \u2014 is this a WXR file?`
+      );
+    }
+  }
+  const headerXml = firstItemAt >= 0 ? buffer.slice(0, firstItemAt) + "</channel></rss>" : buffer + "</channel></rss>";
+  const headerBundle = parseWxr(headerXml);
+  const tail = firstItemAt >= 0 ? buffer.slice(firstItemAt) : "";
+  async function* iterate() {
+    let local = tail;
+    let exhausted = false;
+    while (true) {
+      const open = local.indexOf(ITEM_OPEN);
+      if (open < 0) {
+        if (exhausted) return;
+        const next = await reader.next();
+        if (next.done) {
+          exhausted = true;
+          continue;
+        }
+        local += next.value;
+        if (local.length > maxItemBytes) {
+          throw new WpImportStreamError(
+            `WXR item exceeded ${maxItemBytes} bytes \u2014 abort. Likely an embedded base64 payload that won't fit; raise --max-item-bytes if you really need it.`
+          );
+        }
+        continue;
+      }
+      const close = local.indexOf(ITEM_CLOSE, open);
+      if (close < 0) {
+        const next = await reader.next();
+        if (next.done) {
+          if (exhausted) return;
+          exhausted = true;
+          continue;
+        }
+        local += next.value;
+        if (local.length > maxItemBytes) {
+          throw new WpImportStreamError(
+            `WXR item exceeded ${maxItemBytes} bytes \u2014 abort.`
+          );
+        }
+        continue;
+      }
+      const itemEnd = close + ITEM_CLOSE.length;
+      const itemSlice = local.slice(open, itemEnd);
+      local = local.slice(itemEnd);
+      const wrapped = wrapInChannel(itemSlice);
+      const single = parseWxr(wrapped);
+      const record = single.records[0];
+      if (record) yield record;
+    }
+  }
+  return {
+    header: {
+      site: headerBundle.site,
+      authors: headerBundle.authors,
+      terms: headerBundle.terms
+    },
+    items: { [Symbol.asyncIterator]: iterate }
+  };
+}
+function wrapInChannel(itemXml) {
+  return `<?xml version="1.0" encoding="UTF-8"?><rss version="2.0" xmlns:excerpt="http://wordpress.org/export/1.2/excerpt/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:wp="http://wordpress.org/export/1.2/"><channel><title></title><link></link><description></description><wp:base_site_url></wp:base_site_url><wp:base_blog_url></wp:base_blog_url>` + itemXml + `</channel></rss>`;
+}
+
+// src/cli/index.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { parseArgs } from "util";
+
+// src/cli/config.ts
+import { readFileSync } from "fs";
+var WpImportConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WpImportConfigError";
+  }
+};
+function loadConfigFromPath(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (err) {
+    throw new WpImportConfigError(
+      `cannot read config ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  return parseConfig(raw, path);
+}
+function parseConfig(source, displayPath = "<inline>") {
+  let parsed;
+  try {
+    parsed = JSON.parse(source);
+  } catch (err) {
+    throw new WpImportConfigError(
+      `${displayPath}: invalid JSON \u2014 ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new WpImportConfigError(`${displayPath}: top-level value must be a JSON object`);
+  }
+  const root = parsed;
+  const mappings = root.mappings;
+  const collectionMappings = {};
+  if (mappings !== void 0) {
+    if (!Array.isArray(mappings)) {
+      throw new WpImportConfigError(`${displayPath}: "mappings" must be an array`);
+    }
+    for (const [i, entry] of mappings.entries()) {
+      const mapping = parseMapping(entry, `${displayPath}#mappings[${i}]`);
+      if (collectionMappings[mapping.wpType]) {
+        throw new WpImportConfigError(
+          `${displayPath}: duplicate mapping for wpType "${mapping.wpType}"`
+        );
+      }
+      collectionMappings[mapping.wpType] = {
+        collection: mapping.collection,
+        fieldOverrides: mapping.fieldOverrides
+      };
+    }
+  }
+  return { collectionMappings };
+}
+function parseMapping(value, displayPath) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new WpImportConfigError(`${displayPath}: each mapping must be an object`);
+  }
+  const row = value;
+  const wpType = row.wpType ?? row.wp_type;
+  const collection = row.collection;
+  if (typeof wpType !== "string" || wpType.length === 0) {
+    throw new WpImportConfigError(`${displayPath}: "wpType" is required and must be a non-empty string`);
+  }
+  if (typeof collection !== "string" || collection.length === 0) {
+    throw new WpImportConfigError(
+      `${displayPath}: "collection" is required and must be a non-empty string`
+    );
+  }
+  let fieldOverrides;
+  const rawOverrides = row.fieldOverrides ?? row.field_overrides;
+  if (rawOverrides !== void 0) {
+    if (!rawOverrides || typeof rawOverrides !== "object" || Array.isArray(rawOverrides)) {
+      throw new WpImportConfigError(`${displayPath}: "fieldOverrides" must be an object`);
+    }
+    fieldOverrides = {};
+    for (const [k, v] of Object.entries(rawOverrides)) {
+      if (typeof v !== "string" || v.length === 0) {
+        throw new WpImportConfigError(
+          `${displayPath}: fieldOverrides["${k}"] must be a non-empty string`
+        );
+      }
+      fieldOverrides[k] = v;
+    }
+  }
+  return { wpType, collection, fieldOverrides };
+}
+
+// src/cli/format.ts
+function formatSummary(args) {
+  const { bundle, sourcePath, dryRun } = args;
+  const lines = [];
+  lines.push(`WordPress import${dryRun ? " \u2014 dry run" : ""}`);
+  lines.push("");
+  lines.push(`Source: ${sourcePath}`);
+  lines.push(`Site:   ${bundle.site.title || "(untitled)"}`);
+  if (bundle.site.link) lines.push(`        ${bundle.site.link}`);
+  if (bundle.site.language) lines.push(`Lang:   ${bundle.site.language}`);
+  lines.push("");
+  lines.push(`Authors (${bundle.authors.length})`);
+  for (const author of bundle.authors) {
+    const email = author.email ? ` <${author.email}>` : "";
+    const display = author.displayName ? `  ${author.displayName}` : "";
+    lines.push(`  ${author.login}${email}${display}`);
+  }
+  if (bundle.authors.length === 0) {
+    lines.push("  (none)");
+  }
+  lines.push("");
+  const taxoCounts = countByKey(bundle.terms, (t) => t.taxonomy);
+  lines.push(`Channel taxonomies (${taxoCounts.size})`);
+  for (const [taxonomy, count] of sortedEntries(taxoCounts)) {
+    lines.push(`  ${taxonomy.padEnd(12)} ${count}`);
+  }
+  if (taxoCounts.size === 0) {
+    lines.push("  (none)");
+  }
+  lines.push("");
+  const typeCounts = countByKey(bundle.records, (r) => r.wpType);
+  lines.push(`Records (${bundle.records.length})`);
+  for (const [wpType, count] of sortedEntries(typeCounts)) {
+    const annotation = typeAnnotation(wpType, bundle.records);
+    lines.push(`  ${wpType.padEnd(12)} ${count}${annotation ? `  ${annotation}` : ""}`);
+  }
+  if (typeCounts.size === 0) {
+    lines.push("  (no items)");
+  }
+  const mediaUrls = collectInlineMediaUrls(bundle.records);
+  const featuredCount = bundle.records.reduce(
+    (acc, r) => acc + r.mediaRefs.filter((m) => m.kind === "featured").length,
+    0
+  );
+  lines.push("");
+  lines.push(`Inline media refs (${mediaUrls.size} unique URL${mediaUrls.size === 1 ? "" : "s"})`);
+  lines.push(`Featured images   (${featuredCount})`);
+  const totalComments = bundle.records.reduce((acc, r) => acc + r.comments.length, 0);
+  if (totalComments > 0) {
+    const recordsWithComments = bundle.records.filter((r) => r.comments.length > 0).length;
+    lines.push("");
+    lines.push(
+      `Comments: ${totalComments} across ${recordsWithComments} record${recordsWithComments === 1 ? "" : "s"}`
+    );
+  }
+  lines.push("");
+  if (dryRun) {
+    lines.push("This was a dry run. Pass --apply to write to the database.");
+  } else {
+    lines.push("Pass --apply to write to the database, or omit it to keep this summary view.");
+  }
+  return lines.join("\n");
+}
+function typeAnnotation(wpType, _records) {
+  if (wpType === "attachment") {
+    return "(downloaded + uploaded by the media pipeline)";
+  }
+  return "";
+}
+function countByKey(rows, keyOf) {
+  const out = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const key = keyOf(row);
+    out.set(key, (out.get(key) ?? 0) + 1);
+  }
+  return out;
+}
+function sortedEntries(map) {
+  return Array.from(map.entries()).sort(([a], [b]) => a.localeCompare(b));
+}
+function collectInlineMediaUrls(records) {
+  const out = /* @__PURE__ */ new Set();
+  for (const record of records) {
+    for (const ref of record.mediaRefs) {
+      if (ref.kind === "inline" && ref.sourceUrl) {
+        out.add(ref.sourceUrl);
+      }
+    }
+  }
+  return out;
+}
+function formatApplyReport(report, args) {
+  const lines = [];
+  lines.push(args.dryRun ? "Apply \u2014 dry run" : "Apply");
+  lines.push("");
+  lines.push(`${args.dryRun ? "Would write" : "Written"}: ${report.applied.length}`);
+  for (const row of report.applied) {
+    lines.push(`  ${row.collection.padEnd(8)} ${row.slug}  "${row.title}"`);
+  }
+  if (report.applied.length === 0) {
+    lines.push("  (none)");
+  }
+  lines.push("");
+  lines.push(`Skipped: ${report.skipped.length}`);
+  const reasonCounts = /* @__PURE__ */ new Map();
+  for (const row of report.skipped) {
+    reasonCounts.set(row.reason, (reasonCounts.get(row.reason) ?? 0) + 1);
+  }
+  for (const [reason, count] of [...reasonCounts.entries()].sort()) {
+    lines.push(`  ${count.toString().padStart(3)}  ${reason}`);
+  }
+  if (report.skipped.length === 0) {
+    lines.push("  (none)");
+  }
+  if (report.errors.length > 0) {
+    lines.push("");
+    lines.push(`Errors: ${report.errors.length}`);
+    for (const err of report.errors) {
+      lines.push(`  ${err.slug}: ${err.message}`);
+    }
+  }
+  lines.push("");
+  if (report.media) {
+    const m = report.media;
+    lines.push(
+      `Media: ${m.uploaded} uploaded, ${m.reused} reused (hash match), ${m.skipped} skipped (dry run), ${m.errors.length} errors`
+    );
+    for (const err of m.errors) {
+      lines.push(`  ${err.url}: ${err.reason}`);
+    }
+  } else {
+    lines.push("Media: pipeline not run (no upload hook supplied)");
+  }
+  lines.push("");
+  if (report.taxonomies) {
+    const t = report.taxonomies;
+    lines.push(
+      `Taxonomies: ${t.termIds.size} resolved, ${t.skipped.length} skipped, ${t.errors.length} errors`
+    );
+    for (const err of t.errors) {
+      lines.push(`  ${err.key.taxonomy}/${err.key.slug}: ${err.reason}`);
+    }
+    for (const skip of t.skipped) {
+      lines.push(`  skipped ${skip.taxonomy}/${skip.slug}`);
+    }
+  } else {
+    lines.push("Taxonomies: resolver not supplied \u2014 terms dropped");
+  }
+  lines.push("");
+  if (report.comments) {
+    const c = report.comments;
+    lines.push(
+      `Comments: ${c.applied} imported, ${c.skippedUnapproved} unapproved, ${c.skippedByResume} resume-skipped, ${c.errors.length} errors`
+    );
+    for (const err of c.errors) {
+      lines.push(`  #${err.wpCommentId}: ${err.reason}`);
+    }
+  } else {
+    lines.push("Comments: deps not supplied \u2014 comments dropped");
+  }
+  lines.push("");
+  if (report.authors) {
+    const a = report.authors;
+    lines.push(
+      `Authors: ${a.authorIds.size} resolved, ${a.skipped.length} skipped, ${a.errors.length} errors`
+    );
+    for (const err of a.errors) {
+      lines.push(`  ${err.login}: ${err.reason}`);
+    }
+    for (const skip of a.skipped) {
+      lines.push(`  skipped ${skip}`);
+    }
+  } else {
+    lines.push("Authors: resolver not supplied \u2014 posts attributed to the import actor");
+  }
+  if (report.notes.length > 0) {
+    lines.push("");
+    lines.push("Notes");
+    for (const note of report.notes) {
+      lines.push(`  - ${note}`);
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/cli/index.ts
+var DEFAULT_IO = {
+  stdout: (line) => console.log(line),
+  stderr: (line) => console.error(line)
+};
+var CLI_OPTIONS = {
+  "dry-run": { type: "boolean", default: true },
+  apply: { type: "boolean", default: false },
+  /**
+   * Phase 21.8 — opt out of staff-user creation. With this flag the
+   * shim swaps in a resolver that returns null for every author, so
+   * imported posts have no `author` set and are attributed to the
+   * import operator via `createdBy` / `updatedBy`.
+   */
+  "no-create-authors": { type: "boolean", default: false },
+  /**
+   * Phase 21.9 — path to a JSON config file that declares custom-
+   * post-type → collection mappings and optional postmeta-key →
+   * field-name overrides. Records whose `wpType` isn't in the
+   * config (and isn't post / page / attachment) are skipped with a
+   * warning.
+   */
+  config: { type: "string" },
+  /**
+   * Phase 21.12 — escalate sub-pipeline warnings (media 4xx, MIME
+   * reject, taxonomy/author resolver failures) into errors so the
+   * CLI exits non-zero. Useful for "clean import or fail" scripts.
+   */
+  strict: { type: "boolean", default: false },
+  /**
+   * Phase 21.12 — rewrite the existing document instead of
+   * skipping when a slug collides. Comments are NOT re-imported on
+   * an update pass — that needs the per-comment idempotency keys
+   * landing in 21.14.
+   */
+  update: { type: "boolean", default: false },
+  /**
+   * Phase 21.12 — write a side-by-side HTML/Lexical diff for every
+   * imported record so the operator can spot-check the conversion.
+   * Defaults to writing `<wxr>.report.html` next to the source.
+   */
+  "report-html": { type: "boolean", default: false },
+  /**
+   * Phase 21.12 — override the default `<wxr>.report.html` path.
+   * Implies `--report-html`; passing a path without the flag is
+   * fine too.
+   */
+  "report-html-path": { type: "string" },
+  /**
+   * Phase 21.14 — load + persist a sidecar resume marker so re-runs
+   * skip work that already landed and dedupe comments by
+   * `wpCommentId`. Defaults the marker path to
+   * `<wxr>.import-state.json`; override with `--resume-state`.
+   */
+  resume: { type: "boolean", default: false },
+  /** Phase 21.14 — override the default resume-marker path. */
+  "resume-state": { type: "string" },
+  help: { type: "boolean", short: "h" }
+};
+async function runCli(argv, io = DEFAULT_IO, hooks) {
+  let parsed;
+  try {
+    parsed = parseArgs({
+      args: argv,
+      options: CLI_OPTIONS,
+      allowPositionals: true
+    });
+  } catch (error) {
+    io.stderr(error instanceof Error ? `wp-import: ${error.message}` : "wp-import: bad arguments");
+    io.stderr("");
+    io.stderr(USAGE);
+    return 2;
+  }
+  if (parsed.values.help) {
+    io.stdout(USAGE);
+    return 0;
+  }
+  const sourcePath = parsed.positionals[0];
+  if (!sourcePath) {
+    io.stderr("wp-import: missing path to a WXR file");
+    io.stderr("");
+    io.stderr(USAGE);
+    return 2;
+  }
+  let xml;
+  try {
+    xml = readFileSync2(sourcePath, "utf8");
+  } catch (error) {
+    io.stderr(
+      `wp-import: cannot read ${sourcePath}: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return 1;
+  }
+  let bundle;
+  try {
+    bundle = parseWxr(xml);
+  } catch (error) {
+    io.stderr(`wp-import: parse failed: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+  let collectionMappings = {};
+  if (parsed.values.config) {
+    try {
+      collectionMappings = loadConfigFromPath(parsed.values.config).collectionMappings;
+    } catch (error) {
+      io.stderr(
+        error instanceof WpImportConfigError ? `wp-import: ${error.message}` : `wp-import: ${error instanceof Error ? error.message : String(error)}`
+      );
+      return 1;
+    }
+  }
+  if (!parsed.values.apply) {
+    io.stdout(formatSummary({ bundle, sourcePath, dryRun: parsed.values["dry-run"] }));
+    return 0;
+  }
+  if (!hooks) {
+    io.stderr(
+      "wp-import: --apply requires the shim that bootstraps core services. Run via `pnpm wp-import` from apps/web, not directly."
+    );
+    return 1;
+  }
+  let actor;
+  try {
+    actor = await hooks.resolveActor();
+  } catch (error) {
+    io.stderr(
+      `wp-import: cannot resolve admin actor: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return 1;
+  }
+  const reportHtmlPathOverride = parsed.values["report-html-path"];
+  const reportHtmlPath = reportHtmlPathOverride && reportHtmlPathOverride.length > 0 ? reportHtmlPathOverride : parsed.values["report-html"] ? `${sourcePath}.report.html` : null;
+  const resumeStatePathOverride = parsed.values["resume-state"];
+  const resumeStatePath = resumeStatePathOverride && resumeStatePathOverride.length > 0 ? resumeStatePathOverride : parsed.values.resume ? `${sourcePath}.import-state.json` : null;
+  const report = await hooks.applyBundle(bundle, {
+    actor,
+    dryRun: parsed.values["dry-run"],
+    log: (line) => io.stdout(line),
+    createAuthors: !parsed.values["no-create-authors"],
+    collectionMappings,
+    strict: parsed.values.strict,
+    update: parsed.values.update,
+    reportHtmlPath,
+    resumeStatePath
+  });
+  io.stdout(formatApplyReport(report, { dryRun: parsed.values["dry-run"] }));
+  return report.errors.length > 0 ? 1 : 0;
+}
+var USAGE = `Usage: wp-import <wxr-file> [--apply] [--dry-run] [--strict] [--update] [--no-create-authors] [--report-html] [--report-html-path <path>] [--resume] [--resume-state <path>]
+
+Reads a WordPress eXtended RSS export and either prints a summary
+of what would be imported (default) or applies it to the database
+(--apply). With --apply you can still pass --dry-run to walk the
+records and surface skip / collision decisions without writing.
+
+Options:
+  --apply               Run the applier (writes via @nexpress/core).
+                        Without this flag only the parsed summary
+                        is printed.
+  --dry-run             When combined with --apply, walk records
+                        but skip the actual writes. Useful for
+                        previewing what the import will do against
+                        a real DB.
+  --no-create-authors   Skip creating staff users for WP authors.
+                        Imported posts come in without an author
+                        wired and the import operator takes credit
+                        via createdBy / updatedBy (Phase 21.8).
+  --config <path>       Path to a JSON config file declaring
+                        custom-post-type mappings. Each mapping
+                        routes a wpType into a NexPress collection
+                        and optionally maps WP postmeta keys to
+                        collection field names (Phase 21.9).
+  --strict              Escalate sub-pipeline warnings (media 4xx,
+                        MIME reject, taxonomy / author resolver
+                        failures) into errors so the CLI exits
+                        non-zero (Phase 21.12).
+  --update              Rewrite the existing document instead of
+                        skipping when a slug collides. Comments
+                        are NOT re-imported on an update pass
+                        (Phase 21.12).
+  --report-html         Write a side-by-side HTML/Lexical diff of
+                        every imported record so the operator can
+                        spot-check the conversion. Defaults to
+                        <wxr>.report.html (Phase 21.12).
+  --report-html-path <path>
+                        Override the default report path. Implies
+                        --report-html.
+  --resume              Read + persist a sidecar resume marker so
+                        re-runs skip work that already landed and
+                        dedupe comments by wpCommentId. Defaults
+                        to <wxr>.import-state.json (Phase 21.14).
+  --resume-state <path>
+                        Override the default resume-marker path.
+                        Implies --resume.
+  -h, --help            Show this help message.`;
+
+// src/apply/index.ts
+import { findDocuments, saveDocument } from "@nexpress/core";
+
+// src/convert/html-to-lexical.ts
+import { NodeType, parse } from "node-html-parser";
+
+// src/convert/gutenberg.ts
+var FENCE_RE = /<!--\s*(\/?)wp:([\w/-]+)(\s+(\{[\s\S]*?\}))?\s*(\/)?\s*-->/g;
+function isGutenbergSource(html) {
+  return /<!--\s*wp:[\w/-]+/i.test(html);
+}
+function parseGutenbergBlocks(source) {
+  const blocks = [];
+  const stack = [];
+  let cursor = 0;
+  FENCE_RE.lastIndex = 0;
+  let match;
+  while (match = FENCE_RE.exec(source)) {
+    const [full, slash, rawName, , attrsJson, selfSlash] = match;
+    const isCloser = slash === "/";
+    const isSelfClosing = !isCloser && selfSlash === "/";
+    const name = (rawName ?? "").trim();
+    const attrsRaw = (attrsJson ?? "").trim();
+    const attrs = parseAttrsJson(attrsRaw);
+    const matchStart = match.index;
+    const matchEnd = matchStart + full.length;
+    if (isCloser) {
+      if (stack.length === 0) {
+        cursor = matchEnd;
+        continue;
+      }
+      const top = stack[stack.length - 1];
+      if (!top || top.name !== name) {
+        cursor = matchEnd;
+        continue;
+      }
+      stack.pop();
+      if (stack.length === 0) {
+        const innerHtml = source.slice(top.innerStart, matchStart);
+        blocks.push({
+          name: top.name,
+          attrs: top.attrs,
+          rawAttrs: top.rawAttrs,
+          innerHtml,
+          selfClosing: false
+        });
+      }
+      cursor = matchEnd;
+      continue;
+    }
+    if (isSelfClosing) {
+      if (stack.length === 0 && matchStart > cursor) {
+        const looseHtml = source.slice(cursor, matchStart);
+        if (looseHtml.trim().length > 0) {
+          blocks.push({
+            name: "gutenberg-loose",
+            attrs: {},
+            rawAttrs: "",
+            innerHtml: looseHtml,
+            selfClosing: false
+          });
+        }
+      }
+      if (stack.length === 0) {
+        blocks.push({ name, attrs, rawAttrs: attrsRaw, innerHtml: "", selfClosing: true });
+      }
+      cursor = matchEnd;
+      continue;
+    }
+    if (stack.length === 0 && matchStart > cursor) {
+      const looseHtml = source.slice(cursor, matchStart);
+      if (looseHtml.trim().length > 0) {
+        blocks.push({
+          name: "gutenberg-loose",
+          attrs: {},
+          rawAttrs: "",
+          innerHtml: looseHtml,
+          selfClosing: false
+        });
+      }
+    }
+    stack.push({ name, attrs, rawAttrs: attrsRaw, innerStart: matchEnd });
+    cursor = matchEnd;
+  }
+  if (stack.length === 0 && cursor < source.length) {
+    const tail = source.slice(cursor);
+    if (tail.trim().length > 0) {
+      blocks.push({
+        name: "gutenberg-loose",
+        attrs: {},
+        rawAttrs: "",
+        innerHtml: tail,
+        selfClosing: false
+      });
+    }
+  }
+  const root = stack[0];
+  if (root) {
+    blocks.push({
+      name: root.name,
+      attrs: root.attrs,
+      rawAttrs: root.rawAttrs,
+      innerHtml: source.slice(root.innerStart),
+      selfClosing: false
+    });
+  }
+  return blocks;
+}
+function parseAttrsJson(raw) {
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+  }
+  return {};
+}
+
+// src/convert/html-to-lexical.ts
+var FORMAT_BOLD = 1;
+var FORMAT_ITALIC = 2;
+var FORMAT_STRIKETHROUGH = 4;
+var FORMAT_UNDERLINE = 8;
+var FORMAT_CODE = 16;
+function htmlToLexical(html) {
+  const trimmed = html.trim();
+  if (!trimmed) {
+    return emptyDocument();
+  }
+  const blocks = [];
+  if (isGutenbergSource(trimmed)) {
+    for (const block of parseGutenbergBlocks(trimmed)) {
+      convertGutenbergBlock(block, blocks);
+    }
+  } else {
+    const parsed = parse(trimmed, { lowerCaseTagName: true });
+    for (const child of parsed.childNodes) {
+      convertTopLevel(child, blocks);
+    }
+  }
+  if (blocks.length === 0) {
+    return emptyDocument();
+  }
+  return {
+    root: {
+      type: "root",
+      direction: null,
+      format: "",
+      indent: 0,
+      version: 1,
+      children: blocks
+    }
+  };
+}
+function convertGutenbergBlock(block, out) {
+  if (block.selfClosing) {
+    if (block.name === "separator") {
+      out.push({
+        type: "horizontalrule",
+        version: 1,
+        format: "",
+        indent: 0,
+        direction: null
+      });
+    }
+    return;
+  }
+  if (block.name === "gutenberg-loose") {
+    runClassicPath(block.innerHtml, out);
+    return;
+  }
+  switch (block.name) {
+    case "heading": {
+      const innerBlocks = [];
+      runClassicPath(block.innerHtml, innerBlocks);
+      const heading = innerBlocks.find((b) => b.type === "heading");
+      if (heading) {
+        const lvl = block.attrs.level;
+        if (typeof lvl === "number" && lvl >= 1 && lvl <= 6) {
+          heading.tag = `h${lvl}`;
+        }
+        out.push(heading);
+        for (const b of innerBlocks) if (b !== heading) out.push(b);
+      } else {
+        const lvl = typeof block.attrs.level === "number" ? block.attrs.level : 2;
+        out.push({
+          type: "heading",
+          version: 1,
+          format: "",
+          indent: 0,
+          direction: null,
+          tag: `h${Math.min(6, Math.max(1, lvl))}`,
+          children: [textNode(stripTags(block.innerHtml), 0)]
+        });
+      }
+      return;
+    }
+    case "list": {
+      const innerBlocks = [];
+      runClassicPath(block.innerHtml, innerBlocks);
+      const list = innerBlocks.find((b) => b.type === "list");
+      if (list) {
+        if (block.attrs.ordered === true) list.listType = "number";
+        else if (block.attrs.ordered === false) list.listType = "bullet";
+        out.push(list);
+      } else {
+        runClassicPath(block.innerHtml, out);
+      }
+      return;
+    }
+    default:
+      runClassicPath(block.innerHtml, out);
+  }
+}
+function runClassicPath(html, out) {
+  const parsed = parse(html, { lowerCaseTagName: true });
+  for (const child of parsed.childNodes) {
+    convertTopLevel(child, out);
+  }
+}
+function stripTags(html) {
+  return html.replace(/<[^>]+>/g, "").replace(/&nbsp;/g, " ").trim();
+}
+function emptyDocument() {
+  return {
+    root: {
+      type: "root",
+      direction: null,
+      format: "",
+      indent: 0,
+      version: 1,
+      children: [paragraph([])]
+    }
+  };
+}
+function convertTopLevel(node, out) {
+  if (node.nodeType === NodeType.TEXT_NODE) {
+    const text = node.text;
+    if (text.trim().length === 0) return;
+    out.push(paragraph([textNode(text, 0)]));
+    return;
+  }
+  if (node.nodeType !== NodeType.ELEMENT_NODE) return;
+  const el = node;
+  const tag = el.tagName?.toLowerCase();
+  switch (tag) {
+    case "p":
+      out.push(paragraph(convertInline(el)));
+      return;
+    case "h1":
+    case "h2":
+    case "h3":
+    case "h4":
+    case "h5":
+    case "h6":
+      out.push({
+        type: "heading",
+        version: 1,
+        format: "",
+        indent: 0,
+        direction: null,
+        tag,
+        children: convertInline(el)
+      });
+      return;
+    case "blockquote":
+      out.push({
+        type: "quote",
+        version: 1,
+        format: "",
+        indent: 0,
+        direction: null,
+        children: convertInline(el)
+      });
+      return;
+    case "ul":
+    case "ol":
+      out.push(convertList(el, tag === "ol" ? "number" : "bullet"));
+      return;
+    case "pre":
+      out.push({
+        type: "code",
+        version: 1,
+        format: "",
+        indent: 0,
+        direction: null,
+        children: [textNode(el.text, 0)]
+      });
+      return;
+    case "hr":
+      out.push({
+        type: "horizontalrule",
+        version: 1,
+        format: "",
+        indent: 0,
+        direction: null
+      });
+      return;
+    case "img":
+      out.push(imageBlock(el));
+      return;
+    case "br":
+      out.push(paragraph([]));
+      return;
+    case "div":
+    case "section":
+    case "article":
+      for (const child of el.childNodes) convertTopLevel(child, out);
+      return;
+    default: {
+      const hasBlockChild = el.childNodes.some(
+        (c) => c.nodeType === NodeType.ELEMENT_NODE && isBlockTag(c)
+      );
+      if (hasBlockChild) {
+        for (const child of el.childNodes) convertTopLevel(child, out);
+      } else {
+        const inline = convertInline(el);
+        if (inline.length > 0) out.push(paragraph(inline));
+      }
+    }
+  }
+}
+var BLOCK_TAGS = /* @__PURE__ */ new Set([
+  "p",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "blockquote",
+  "ul",
+  "ol",
+  "li",
+  "pre",
+  "hr",
+  "div",
+  "section",
+  "article",
+  "table",
+  "tr",
+  "td",
+  "th",
+  "thead",
+  "tbody"
+]);
+function isBlockTag(el) {
+  return BLOCK_TAGS.has((el.tagName ?? "").toLowerCase());
+}
+function paragraph(children) {
+  return {
+    type: "paragraph",
+    version: 1,
+    format: "",
+    indent: 0,
+    direction: null,
+    children
+  };
+}
+function textNode(text, format) {
+  return {
+    type: "text",
+    version: 1,
+    format,
+    indent: 0,
+    direction: null,
+    text
+  };
+}
+function imageBlock(el) {
+  return {
+    type: "image",
+    version: 1,
+    format: "",
+    indent: 0,
+    direction: null,
+    src: el.getAttribute("src") ?? "",
+    altText: el.getAttribute("alt") ?? ""
+  };
+}
+function convertList(el, listType) {
+  const items = [];
+  for (const child of el.childNodes) {
+    if (child.nodeType !== NodeType.ELEMENT_NODE) continue;
+    const inner = child;
+    if ((inner.tagName ?? "").toLowerCase() !== "li") continue;
+    items.push({
+      type: "listitem",
+      version: 1,
+      format: "",
+      indent: 0,
+      direction: null,
+      children: convertInline(inner)
+    });
+  }
+  return {
+    type: "list",
+    version: 1,
+    format: "",
+    indent: 0,
+    direction: null,
+    listType,
+    children: items
+  };
+}
+function convertInline(el) {
+  const out = [];
+  walkInline(el, 0, out);
+  return out;
+}
+function walkInline(node, format, out) {
+  if (node.nodeType === NodeType.TEXT_NODE) {
+    const text = node.text;
+    if (!text) return;
+    out.push(textNode(text, format));
+    return;
+  }
+  if (node.nodeType !== NodeType.ELEMENT_NODE) return;
+  const el = node;
+  const tag = (el.tagName ?? "").toLowerCase();
+  switch (tag) {
+    case "strong":
+    case "b":
+      for (const child of el.childNodes) walkInline(child, format | FORMAT_BOLD, out);
+      return;
+    case "em":
+    case "i":
+      for (const child of el.childNodes) walkInline(child, format | FORMAT_ITALIC, out);
+      return;
+    case "u":
+      for (const child of el.childNodes) walkInline(child, format | FORMAT_UNDERLINE, out);
+      return;
+    case "s":
+    case "del":
+    case "strike":
+      for (const child of el.childNodes) walkInline(child, format | FORMAT_STRIKETHROUGH, out);
+      return;
+    case "code":
+      for (const child of el.childNodes) walkInline(child, format | FORMAT_CODE, out);
+      return;
+    case "a": {
+      const url = el.getAttribute("href") ?? "";
+      const inner = [];
+      for (const child of el.childNodes) walkInline(child, format, inner);
+      out.push({
+        type: "link",
+        version: 1,
+        format: "",
+        indent: 0,
+        direction: null,
+        url,
+        children: inner
+      });
+      return;
+    }
+    case "br":
+      out.push({
+        type: "linebreak",
+        version: 1,
+        format: "",
+        indent: 0,
+        direction: null
+      });
+      return;
+    case "img":
+      out.push(imageBlock(el));
+      return;
+    case "span":
+      for (const child of el.childNodes) walkInline(child, format, out);
+      return;
+    default: {
+      for (const child of el.childNodes) walkInline(child, format, out);
+    }
+  }
+}
+
+// src/media/pipeline.ts
+import { createHash } from "crypto";
+
+// src/media/download.ts
+import { Buffer } from "buffer";
+import { promises as dnsPromises } from "dns";
+import { Agent } from "undici";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_RETRIES = 1;
+var DEFAULT_MAX_REDIRECTS = 3;
+var DEFAULT_MAX_BYTES = 100 * 1024 * 1024;
+var WpMediaDownloadError = class extends Error {
+  url;
+  status;
+  constructor(url, message, status = null) {
+    super(message);
+    this.name = "WpMediaDownloadError";
+    this.url = url;
+    this.status = status;
+  }
+};
+var WpMediaSsrfError = class extends WpMediaDownloadError {
+  constructor(url, message) {
+    super(url, message);
+    this.name = "WpMediaSsrfError";
+  }
+};
+async function downloadMedia(url, opts = {}) {
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  if (!fetchImpl) {
+    throw new WpMediaDownloadError(url, "no fetch implementation available");
+  }
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const maxRetries = opts.retries ?? DEFAULT_RETRIES;
+  const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+  const maxBytes = opts.maxBytes ?? DEFAULT_MAX_BYTES;
+  assertHttpScheme(url);
+  let lastError = null;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      return await fetchWithRedirects(url, {
+        fetchImpl,
+        dnsLookupImpl: opts.dnsLookupImpl,
+        signal: controller.signal,
+        maxRedirects,
+        maxBytes,
+        allowPrivateHosts: opts.allowPrivateHosts ?? false
+      });
+    } catch (err) {
+      lastError = err;
+      if (err instanceof WpMediaSsrfError) throw err;
+      if (err instanceof WpMediaDownloadError && err.status !== null && err.status >= 400 && err.status < 500) {
+        throw err;
+      }
+      if (attempt >= maxRetries) {
+        if (err instanceof WpMediaDownloadError) throw err;
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new WpMediaDownloadError(url, msg);
+      }
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  throw lastError instanceof Error ? lastError : new WpMediaDownloadError(url, "download failed");
+}
+async function fetchWithRedirects(originalUrl, opts) {
+  let currentUrl = originalUrl;
+  for (let hop = 0; hop <= opts.maxRedirects; hop++) {
+    let pinned = null;
+    if (!opts.allowPrivateHosts) {
+      pinned = await assertHostAllowed(currentUrl, opts.dnsLookupImpl);
+    }
+    const dispatcher = pinned ? createPinnedAgent(pinned) : void 0;
+    const init = {
+      signal: opts.signal,
+      redirect: "manual"
+    };
+    if (dispatcher) init.dispatcher = dispatcher;
+    const res = await opts.fetchImpl(currentUrl, init);
+    if (isRedirectStatus(res.status)) {
+      const next = res.headers.get("location");
+      if (!next) {
+        throw new WpMediaDownloadError(
+          currentUrl,
+          `redirect ${res.status} without Location header`,
+          res.status
+        );
+      }
+      currentUrl = new URL(next, currentUrl).toString();
+      assertHttpScheme(currentUrl);
+      continue;
+    }
+    if (!res.ok) {
+      throw new WpMediaDownloadError(
+        currentUrl,
+        `source responded ${res.status} ${res.statusText || ""}`.trim(),
+        res.status
+      );
+    }
+    const declaredLength = res.headers.get("content-length");
+    if (declaredLength !== null) {
+      const n = Number(declaredLength);
+      if (Number.isFinite(n) && n > opts.maxBytes) {
+        throw new WpMediaDownloadError(
+          currentUrl,
+          `content-length ${n} exceeds maxBytes ${opts.maxBytes}`
+        );
+      }
+    }
+    const arrayBuffer = await res.arrayBuffer();
+    if (arrayBuffer.byteLength > opts.maxBytes) {
+      throw new WpMediaDownloadError(
+        currentUrl,
+        `body ${arrayBuffer.byteLength} bytes exceeds maxBytes ${opts.maxBytes}`
+      );
+    }
+    const buffer = Buffer.from(arrayBuffer);
+    const mimeType = parseMime(res.headers.get("content-type"));
+    const filename = inferFilename(originalUrl);
+    return { buffer, mimeType, filename };
+  }
+  throw new WpMediaDownloadError(currentUrl, `too many redirects (max ${opts.maxRedirects})`);
+}
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function assertHttpScheme(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new WpMediaSsrfError(url, `invalid URL "${url}"`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new WpMediaSsrfError(url, `unsupported scheme "${parsed.protocol}" \u2014 only http(s) is allowed`);
+  }
+}
+async function assertHostAllowed(url, dnsLookupImpl) {
+  const parsed = new URL(url);
+  const rawHostname = parsed.hostname;
+  const hostname = rawHostname.startsWith("[") && rawHostname.endsWith("]") ? rawHostname.slice(1, -1) : rawHostname;
+  const lowered = hostname.toLowerCase();
+  if (lowered === "localhost" || lowered.endsWith(".localhost")) {
+    throw new WpMediaSsrfError(url, `hostname "${hostname}" resolves to a private address`);
+  }
+  const literal = classifyIpLiteral(hostname);
+  if (literal === "private") {
+    throw new WpMediaSsrfError(url, `hostname "${hostname}" resolves to a private address`);
+  }
+  if (literal === "public") {
+    return { address: hostname, family: hostname.includes(":") ? 6 : 4 };
+  }
+  const lookup = dnsLookupImpl ?? defaultDnsLookup;
+  let addrs;
+  try {
+    addrs = await lookup(hostname);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new WpMediaSsrfError(url, `DNS lookup failed for "${hostname}": ${msg}`);
+  }
+  if (addrs.length === 0) {
+    throw new WpMediaSsrfError(url, `DNS returned no addresses for "${hostname}"`);
+  }
+  let pinned = null;
+  for (const { address, family } of addrs) {
+    const cls = classifyIpAddress(address, family);
+    if (cls === "private") {
+      throw new WpMediaSsrfError(
+        url,
+        `hostname "${hostname}" resolves to private address ${address}`
+      );
+    }
+    if (!pinned && (family === 4 || family === 6)) {
+      pinned = { address, family };
+    }
+  }
+  if (!pinned) {
+    throw new WpMediaSsrfError(url, `DNS returned no usable addresses for "${hostname}"`);
+  }
+  return pinned;
+}
+function createPinnedAgent(pinned) {
+  return new Agent({
+    connect: {
+      lookup: (_hostname, _options, callback) => {
+        callback(null, pinned.address, pinned.family);
+      }
+    }
+  });
+}
+async function defaultDnsLookup(hostname) {
+  return dnsPromises.lookup(hostname, { all: true });
+}
+function classifyIpLiteral(input) {
+  if (looksLikeIpv4(input)) return classifyIpAddress(input, 4);
+  if (input.includes(":")) return classifyIpAddress(input, 6);
+  return "not-an-ip";
+}
+function classifyIpAddress(address, family) {
+  if (family === 4) {
+    return isPrivateIpv4(address) ? "private" : "public";
+  }
+  if (family === 6) {
+    return isPrivateIpv6(address) ? "private" : "public";
+  }
+  return "private";
+}
+function looksLikeIpv4(s) {
+  return /^\d{1,3}(\.\d{1,3}){3}$/.test(s);
+}
+function ipv4ToInt(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  let n = 0;
+  for (const part of parts) {
+    const v = Number(part);
+    if (!Number.isInteger(v) || v < 0 || v > 255) return null;
+    n = n * 256 + v >>> 0;
+  }
+  return n >>> 0;
+}
+var PRIVATE_IPV4_RANGES = [
+  ["0.0.0.0", 8],
+  //         "this network"
+  ["10.0.0.0", 8],
+  //        RFC 1918
+  ["100.64.0.0", 10],
+  //     CGNAT
+  ["127.0.0.0", 8],
+  //       loopback
+  ["169.254.0.0", 16],
+  //    link-local (incl. cloud metadata 169.254.169.254)
+  ["172.16.0.0", 12],
+  //     RFC 1918
+  ["192.0.0.0", 24],
+  //      protocol assignments
+  ["192.0.2.0", 24],
+  //      TEST-NET-1
+  ["192.168.0.0", 16],
+  //    RFC 1918
+  ["198.18.0.0", 15],
+  //     benchmarking
+  ["198.51.100.0", 24],
+  //   TEST-NET-2
+  ["203.0.113.0", 24],
+  //    TEST-NET-3
+  ["224.0.0.0", 4],
+  //       multicast
+  ["240.0.0.0", 4],
+  //       reserved
+  ["255.255.255.255", 32]
+  // broadcast
+];
+function isPrivateIpv4(ip) {
+  const n = ipv4ToInt(ip);
+  if (n === null) return true;
+  for (const [base, bits] of PRIVATE_IPV4_RANGES) {
+    const baseN = ipv4ToInt(base);
+    if (baseN === null) continue;
+    const mask = bits === 0 ? 0 : 4294967295 << 32 - bits >>> 0;
+    if ((n & mask) === (baseN & mask)) return true;
+  }
+  return false;
+}
+function isPrivateIpv6(ip) {
+  const lower = ip.toLowerCase();
+  if (lower === "::1" || lower === "::") return true;
+  if (/^fc[0-9a-f]{2}:/.test(lower) || /^fd[0-9a-f]{2}:/.test(lower)) return true;
+  if (/^fe[89ab][0-9a-f]:/.test(lower)) return true;
+  if (/^ff[0-9a-f]{2}:/.test(lower)) return true;
+  const v4Mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(lower);
+  if (v4Mapped) return isPrivateIpv4(v4Mapped[1]);
+  const v4Compat = /^::(\d+\.\d+\.\d+\.\d+)$/i.exec(lower);
+  if (v4Compat) return isPrivateIpv4(v4Compat[1]);
+  return false;
+}
+function parseMime(header) {
+  if (!header) return "application/octet-stream";
+  const semi = header.indexOf(";");
+  return (semi >= 0 ? header.slice(0, semi) : header).trim().toLowerCase();
+}
+function inferFilename(url) {
+  try {
+    const parsed = new URL(url);
+    const segments = parsed.pathname.split("/").filter(Boolean);
+    const last = segments[segments.length - 1];
+    if (last) return decodeURIComponent(last);
+  } catch {
+  }
+  return "download";
+}
+function resolveEnvDownloadOptions(env = process.env) {
+  const opts = {};
+  const allow = env.NP_WP_IMPORT_ALLOW_PRIVATE_HOSTS;
+  if (allow === "1" || allow === "true") {
+    opts.allowPrivateHosts = true;
+  }
+  const maxBytesRaw = env.NP_WP_IMPORT_MAX_BYTES;
+  if (maxBytesRaw) {
+    const n = Number.parseInt(maxBytesRaw, 10);
+    if (Number.isFinite(n) && n > 0) {
+      opts.maxBytes = n;
+    }
+  }
+  return opts;
+}
+function isAllowedMimeType(mimeType) {
+  return mimeType.startsWith("image/") || mimeType.startsWith("video/") || mimeType === "application/pdf";
+}
+
+// src/media/pipeline.ts
+var DEFAULT_PER_HOST_CONCURRENCY = 4;
+async function runMediaPipeline(bundle, attachments, deps, options = {}) {
+  const log = options.log ?? noop;
+  const dryRun = options.dryRun ?? false;
+  const envDefaults = resolveEnvDownloadOptions();
+  const download = deps.download ?? ((url) => downloadMedia(url, envDefaults));
+  const concurrency = Math.max(1, options.perHostConcurrency ?? DEFAULT_PER_HOST_CONCURRENCY);
+  const byUrl = /* @__PURE__ */ new Map();
+  const byAttachmentId = /* @__PURE__ */ new Map();
+  const errors = [];
+  let uploaded = 0;
+  let skipped = 0;
+  let reused = 0;
+  const targets = collectTargets(bundle, attachments);
+  const fetchable = [];
+  for (const target of targets) {
+    if (!target.url) {
+      errors.push({
+        url: `(wp-attachment-id ${target.wpAttachmentId})`,
+        reason: "attachment record missing from WXR \u2014 cannot resolve URL"
+      });
+      continue;
+    }
+    fetchable.push(target);
+  }
+  const byHost = /* @__PURE__ */ new Map();
+  for (const target of fetchable) {
+    const host = parseHost(target.url);
+    const list = byHost.get(host);
+    if (list) list.push(target);
+    else byHost.set(host, [target]);
+  }
+  const processOne = async (target) => {
+    if (byUrl.has(target.url)) {
+      if (target.wpAttachmentId !== null) {
+        byAttachmentId.set(target.wpAttachmentId, byUrl.get(target.url));
+      }
+      return;
+    }
+    if (dryRun) {
+      log(`media plan  ${target.url}`);
+      skipped++;
+      return;
+    }
+    try {
+      const result = await download(target.url);
+      if (!isAllowedMimeType(result.mimeType)) {
+        errors.push({
+          url: target.url,
+          reason: `disallowed MIME type "${result.mimeType}"`
+        });
+        return;
+      }
+      let mediaId = null;
+      if (deps.findExistingByHash) {
+        const sha256 = createHash("sha256").update(result.buffer).digest("hex");
+        const existing = await deps.findExistingByHash(sha256);
+        if (existing) {
+          mediaId = existing.id;
+          reused++;
+          log(`media reuse ${target.url} \u2192 ${existing.id}`);
+        }
+      }
+      if (!mediaId) {
+        const upload = await deps.upload({
+          buffer: result.buffer,
+          originalFilename: result.filename,
+          mimeType: result.mimeType
+        });
+        mediaId = upload.id;
+        uploaded++;
+        log(`media write ${target.url} \u2192 ${upload.id}`);
+      }
+      byUrl.set(target.url, mediaId);
+      if (target.wpAttachmentId !== null) {
+        byAttachmentId.set(target.wpAttachmentId, mediaId);
+      }
+    } catch (err) {
+      const reason = err instanceof WpMediaDownloadError ? err.status !== null ? `HTTP ${err.status}: ${err.message}` : err.message : err instanceof Error ? err.message : String(err);
+      errors.push({ url: target.url, reason });
+      log(`media error ${target.url}: ${reason}`);
+    }
+  };
+  await Promise.all(
+    Array.from(byHost.entries()).map(async ([_host, queue]) => {
+      let cursor = 0;
+      const next = async () => {
+        while (cursor < queue.length) {
+          const i = cursor++;
+          const target = queue[i];
+          if (target) await processOne(target);
+        }
+      };
+      const workers = Array.from({ length: Math.min(concurrency, queue.length) }, () => next());
+      await Promise.all(workers);
+    })
+  );
+  return {
+    resolution: { byUrl, byAttachmentId },
+    uploaded,
+    skipped,
+    reused,
+    errors
+  };
+}
+function collectTargets(bundle, attachments) {
+  const seen = /* @__PURE__ */ new Set();
+  const targets = [];
+  for (const entry of attachments.byId.values()) {
+    if (!entry.sourceUrl) continue;
+    if (seen.has(entry.sourceUrl)) continue;
+    seen.add(entry.sourceUrl);
+    targets.push({ url: entry.sourceUrl, wpAttachmentId: entry.wpAttachmentId });
+  }
+  for (const record of bundle.records) {
+    if (record.wpType === "attachment") continue;
+    for (const ref of record.mediaRefs) {
+      if (ref.kind === "featured" && ref.wpAttachmentId !== null) {
+        const entry = attachments.byId.get(ref.wpAttachmentId);
+        const url = entry?.sourceUrl ?? "";
+        if (url && seen.has(url)) continue;
+        if (url) seen.add(url);
+        targets.push({ url, wpAttachmentId: ref.wpAttachmentId });
+        continue;
+      }
+      if (ref.sourceUrl && !seen.has(ref.sourceUrl)) {
+        seen.add(ref.sourceUrl);
+        targets.push({ url: ref.sourceUrl, wpAttachmentId: ref.wpAttachmentId });
+      }
+    }
+  }
+  return targets;
+}
+function parseHost(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return "(invalid)";
+  }
+}
+function noop() {
+}
+
+// src/media/rewrite.ts
+function rewriteLexicalMedia(root, resolution) {
+  if (resolution.byUrl.size === 0) {
+    return root;
+  }
+  const cloned = JSON.parse(JSON.stringify(root));
+  walk(cloned.root, resolution);
+  return cloned;
+}
+function walk(node, resolution) {
+  if (!node || typeof node !== "object") return;
+  if (node.type === "image") {
+    const src = typeof node.src === "string" ? node.src : "";
+    const mediaId = src ? resolution.byUrl.get(src) : void 0;
+    if (mediaId) {
+      node.mediaId = mediaId;
+    }
+  }
+  const children = node.children;
+  if (Array.isArray(children)) {
+    for (const child of children) walk(child, resolution);
+  }
+}
+
+// src/apply/attachment-index.ts
+function buildAttachmentIndex(bundle) {
+  const byId = /* @__PURE__ */ new Map();
+  const byUrl = /* @__PURE__ */ new Map();
+  for (const record of bundle.records) {
+    if (record.wpType !== "attachment") continue;
+    const url = pickAttachmentUrl(record);
+    const entry = {
+      wpAttachmentId: record.wpId,
+      sourceUrl: url,
+      meta: record.meta,
+      title: record.title
+    };
+    if (record.wpId > 0) byId.set(record.wpId, entry);
+    if (url) byUrl.set(url, entry);
+  }
+  return { byId, byUrl };
+}
+function pickAttachmentUrl(record) {
+  const fromMediaRef = record.mediaRefs.find((ref) => ref.sourceUrl);
+  return fromMediaRef?.sourceUrl ?? "";
+}
+
+// src/apply/authors.ts
+async function resolveAuthors(bundle, resolver) {
+  const logins = /* @__PURE__ */ new Set();
+  for (const record of bundle.records) {
+    if (record.wpType === "attachment") continue;
+    if (record.wpAuthorLogin) logins.add(record.wpAuthorLogin);
+  }
+  const byLogin = new Map(bundle.authors.map((a) => [a.login, a]));
+  const authorIds = /* @__PURE__ */ new Map();
+  const skipped = [];
+  const errors = [];
+  for (const login of logins) {
+    try {
+      const out = await resolver.resolveAuthor({
+        wpAuthorLogin: login,
+        wpAuthor: byLogin.get(login)
+      });
+      if (out) {
+        authorIds.set(login, out.id);
+      } else {
+        skipped.push(login);
+      }
+    } catch (err) {
+      errors.push({ login, reason: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  return { authorIds, skipped, errors };
+}
+
+// src/apply/comments.ts
+async function importPostComments(args) {
+  const { record, postId, collection, deps, plan, resume } = args;
+  const log = args.log ?? noop2;
+  if (record.comments.length === 0) return;
+  const ordered = [...record.comments].sort((a, b) => a.wpId - b.wpId);
+  const wpToNexpressId = /* @__PURE__ */ new Map();
+  if (resume) {
+    for (const c of ordered) {
+      const prior = resume.state.comments[c.wpId];
+      if (prior) wpToNexpressId.set(c.wpId, prior);
+    }
+  }
+  for (const wpComment of ordered) {
+    if (resume?.state.comments[wpComment.wpId]) {
+      plan.skippedByResume++;
+      continue;
+    }
+    if (!wpComment.approved) {
+      plan.skippedUnapproved++;
+      continue;
+    }
+    try {
+      const member = await ensureMemberFor(wpComment, deps);
+      if (!member) {
+        plan.skippedNoMember++;
+        continue;
+      }
+      const parentId = wpComment.parentWpId !== null ? wpToNexpressId.get(wpComment.parentWpId) ?? null : null;
+      const createdAt = parseWpDate(wpComment.date);
+      const inserted = await deps.insertComment({
+        targetType: collection,
+        targetId: postId,
+        parentId,
+        memberId: member.id,
+        bodyMd: wpComment.content,
+        bodyHtml: deps.renderBody(wpComment.content),
+        createdAt
+      });
+      wpToNexpressId.set(wpComment.wpId, inserted.id);
+      plan.applied++;
+      log(`comment write ${collection}/${record.slug} #${wpComment.wpId}`);
+      if (resume) {
+        resume.state.comments[wpComment.wpId] = inserted.id;
+        resume.persist();
+      }
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      plan.errors.push({ wpCommentId: wpComment.wpId, reason });
+      log(`comment error ${collection}/${record.slug} #${wpComment.wpId}: ${reason}`);
+    }
+  }
+}
+async function ensureMemberFor(comment, deps) {
+  const fallbackName = comment.authorName?.trim() || "guest";
+  const slugSource = comment.authorEmail ?? fallbackName;
+  const handle = `${slugify(slugSource)}-wpimp`;
+  if (!handle || handle === "-wpimp") return null;
+  return deps.ensureImportedMember({
+    handle,
+    email: comment.authorEmail,
+    displayName: fallbackName
+  });
+}
+function slugify(input) {
+  return input.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "").slice(0, 40);
+}
+function parseWpDate(raw) {
+  if (!raw) return /* @__PURE__ */ new Date();
+  const iso = raw.includes("T") ? raw : `${raw.replace(" ", "T")}Z`;
+  const date = new Date(iso);
+  return Number.isNaN(date.getTime()) ? /* @__PURE__ */ new Date() : date;
+}
+function emptyCommentPlan() {
+  return { applied: 0, skippedUnapproved: 0, skippedNoMember: 0, skippedByResume: 0, errors: [] };
+}
+function noop2() {
+}
+
+// src/apply/resume.ts
+import { readFileSync as readFileSync3, writeFileSync } from "fs";
+function emptyResumeState(source) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    version: 1,
+    source,
+    startedAt: now,
+    updatedAt: now,
+    documents: {},
+    comments: {},
+    authors: {},
+    media: {},
+    taxonomies: {}
+  };
+}
+var ResumeStateError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ResumeStateError";
+  }
+};
+function loadResumeState(path, source) {
+  let raw;
+  try {
+    raw = readFileSync3(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return emptyResumeState(source);
+    }
+    throw new ResumeStateError(
+      `cannot read resume state ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new ResumeStateError(
+      `${path}: invalid JSON \u2014 ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new ResumeStateError(`${path}: top-level value must be a JSON object`);
+  }
+  const root = parsed;
+  if (root.version !== 1) {
+    throw new ResumeStateError(`${path}: unsupported version ${String(root.version)}`);
+  }
+  return {
+    version: 1,
+    source: typeof root.source === "string" ? root.source : source,
+    startedAt: typeof root.startedAt === "string" ? root.startedAt : (/* @__PURE__ */ new Date()).toISOString(),
+    updatedAt: typeof root.updatedAt === "string" ? root.updatedAt : (/* @__PURE__ */ new Date()).toISOString(),
+    documents: asStringMap(root.documents),
+    comments: asNumberKeyMap(root.comments),
+    authors: asStringMap(root.authors),
+    media: asStringMap(root.media),
+    taxonomies: asStringMap(root.taxonomies)
+  };
+}
+function persistResumeState(path, state) {
+  state.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  writeFileSync(path, JSON.stringify(state, null, 2), "utf8");
+}
+function documentKey(collection, slug) {
+  return `${collection}/${slug}`;
+}
+function asStringMap(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    if (typeof v === "string") out[k] = v;
+  }
+  return out;
+}
+function asNumberKeyMap(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    const n = Number.parseInt(k, 10);
+    if (Number.isFinite(n) && typeof v === "string") out[n] = v;
+  }
+  return out;
+}
+
+// src/apply/taxonomies.ts
+function termCacheKey(taxonomy, slug) {
+  return `${taxonomy}:${slug}`;
+}
+async function resolveTaxonomies(records, channelTerms, resolver) {
+  const seen = /* @__PURE__ */ new Map();
+  const remember = (term) => {
+    if (!term.slug) return;
+    const key = termCacheKey(term.taxonomy, term.slug);
+    if (seen.has(key)) return;
+    seen.set(key, { taxonomy: term.taxonomy, slug: term.slug, name: term.name || term.slug });
+  };
+  for (const term of channelTerms) remember(term);
+  for (const record of records) {
+    if (record.wpType === "attachment") continue;
+    for (const term of record.terms) remember(term);
+  }
+  const termIds = /* @__PURE__ */ new Map();
+  const errors = [];
+  const skipped = [];
+  for (const [key, value] of seen.entries()) {
+    try {
+      const result = await resolver.findOrCreate(value);
+      if (!result) {
+        skipped.push(value);
+        continue;
+      }
+      termIds.set(key, result.id);
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      errors.push({ key: value, reason });
+    }
+  }
+  return { termIds, errors, skipped };
+}
+function pickPostTermIds(record, resolution) {
+  const categoryIds = [];
+  const tagIds = [];
+  const seenCategory = /* @__PURE__ */ new Set();
+  const seenTag = /* @__PURE__ */ new Set();
+  for (const term of record.terms) {
+    if (!term.slug) continue;
+    const id = resolution.termIds.get(termCacheKey(term.taxonomy, term.slug));
+    if (!id) continue;
+    if (term.taxonomy === "category" && !seenCategory.has(id)) {
+      categoryIds.push(id);
+      seenCategory.add(id);
+    } else if (term.taxonomy === "post_tag" && !seenTag.has(id)) {
+      tagIds.push(id);
+      seenTag.add(id);
+    }
+  }
+  return { categoryIds, tagIds };
+}
+
+// src/apply/index.ts
+var TYPE_TO_COLLECTION = {
+  post: "posts",
+  page: "pages"
+};
+async function applyBundle(bundle, options) {
+  const log = options.log ?? noop3;
+  const dryRun = options.dryRun ?? false;
+  const attachments = buildAttachmentIndex(bundle);
+  let media = null;
+  let resolution = { byUrl: /* @__PURE__ */ new Map(), byAttachmentId: /* @__PURE__ */ new Map() };
+  if (options.media) {
+    media = await runMediaPipeline(bundle, attachments, options.media, { dryRun, log });
+    resolution = media.resolution;
+  }
+  let taxonomies = null;
+  if (options.taxonomies && !dryRun) {
+    taxonomies = await resolveTaxonomies(bundle.records, bundle.terms, options.taxonomies);
+  }
+  let authors = null;
+  if (options.authors && !dryRun) {
+    authors = await resolveAuthors(bundle, options.authors);
+  }
+  const commentsPlan = options.comments && !dryRun ? emptyCommentPlan() : null;
+  const applied = [];
+  const skipped = [];
+  const errors = [];
+  let privateCount = 0;
+  let pendingCount = 0;
+  let droppedAuthorCount = 0;
+  let coverWiredCount = 0;
+  let coverMissingCount = 0;
+  for (const record of bundle.records) {
+    const builtin = TYPE_TO_COLLECTION[record.wpType];
+    const customMapping = !builtin && options.collectionMappings ? options.collectionMappings[record.wpType] : void 0;
+    const collection = builtin ?? customMapping?.collection;
+    if (!collection) {
+      skipped.push({
+        wpId: record.wpId,
+        wpType: record.wpType,
+        slug: record.slug,
+        reason: record.wpType === "attachment" ? "attachment \u2014 handled by media pipeline" : `unmapped wpType "${record.wpType}" \u2014 add an entry to wp-import config to route it`
+      });
+      continue;
+    }
+    if (record.status === "trash" || record.status === "auto-draft") {
+      skipped.push({
+        wpId: record.wpId,
+        wpType: record.wpType,
+        slug: record.slug,
+        reason: `status="${record.status}"`
+      });
+      continue;
+    }
+    if (!record.slug) {
+      skipped.push({
+        wpId: record.wpId,
+        wpType: record.wpType,
+        slug: "",
+        reason: "missing slug"
+      });
+      continue;
+    }
+    try {
+      const markerId = options.resume?.state.documents[documentKey(collection, record.slug)];
+      const exists = markerId ? { docs: [{ id: markerId }] } : await findDocuments(
+        collection,
+        { where: { slug: record.slug }, limit: 1 },
+        options.actor
+      );
+      const existingId = exists.docs.length > 0 && typeof exists.docs[0]?.id === "string" ? exists.docs[0]?.id : void 0;
+      const updateMode = options.update === true && existingId !== void 0;
+      if (exists.docs.length > 0 && !updateMode) {
+        skipped.push({
+          wpId: record.wpId,
+          wpType: record.wpType,
+          slug: record.slug,
+          reason: markerId ? "resume marker \u2014 already imported" : "slug already exists"
+        });
+        log(`skip  ${collection}/${record.slug} (${markerId ? "resume marker" : "already exists"})`);
+        await emitAudit(options.audit, {
+          action: "import.wp.skipped",
+          targetType: collection,
+          targetId: existingId,
+          payload: {
+            wpId: record.wpId,
+            wpType: record.wpType,
+            slug: record.slug,
+            reason: markerId ? "resume marker" : "slug already exists"
+          }
+        });
+        continue;
+      }
+      if (record.status === "private") privateCount++;
+      else if (record.status === "pending") pendingCount++;
+      if (record.wpAuthorLogin && !authors?.authorIds.has(record.wpAuthorLogin)) {
+        droppedAuthorCount++;
+      }
+      const coverImageId = resolveCoverImageId(record, resolution);
+      if (collection === "posts") {
+        if (coverImageId) {
+          coverWiredCount++;
+        } else if (recordHasFeaturedImage(record)) {
+          coverMissingCount++;
+        }
+      }
+      const termIds = collection === "posts" && taxonomies ? pickPostTermIds(record, taxonomies) : { categoryIds: [], tagIds: [] };
+      const authorId = collection === "posts" && authors && record.wpAuthorLogin ? authors.authorIds.get(record.wpAuthorLogin) ?? void 0 : void 0;
+      if (dryRun) {
+        applied.push({
+          wpId: record.wpId,
+          wpType: record.wpType,
+          collection,
+          slug: record.slug,
+          title: record.title,
+          coverImageId,
+          categoryIds: termIds.categoryIds,
+          tagIds: termIds.tagIds,
+          authorId
+        });
+        log(`plan  ${collection}/${record.slug}`);
+        continue;
+      }
+      const originalAuthorField = options.preserveOriginalAuthor?.[collection];
+      const originalAuthorName = originalAuthorField ? resolveOriginalAuthorName(record, bundle) : void 0;
+      const data = buildDocData(
+        record,
+        resolution,
+        collection,
+        coverImageId,
+        termIds,
+        authorId,
+        customMapping?.fieldOverrides,
+        originalAuthorField && originalAuthorName ? { field: originalAuthorField, value: originalAuthorName } : void 0
+      );
+      const mappedStatus = mapStatusToFramework(record.status);
+      const saved = await saveDocument(
+        collection,
+        updateMode && existingId ? existingId : null,
+        // Phase 21.17 — visibility rides the data payload (it's a
+        // collection column, validated by the Zod schema), while
+        // status stays as the saveDocument opts override. Both
+        // are derived from the WP record's `<wp:status>` here.
+        { ...data, visibility: mappedStatus.visibility },
+        options.actor,
+        {
+          status: mappedStatus.status
+        }
+      );
+      const savedId = typeof saved.doc.id === "string" ? saved.doc.id : void 0;
+      applied.push({
+        wpId: record.wpId,
+        wpType: record.wpType,
+        collection,
+        slug: record.slug,
+        title: record.title,
+        coverImageId,
+        categoryIds: termIds.categoryIds,
+        tagIds: termIds.tagIds,
+        authorId
+      });
+      log(updateMode ? `update ${collection}/${record.slug}` : `write ${collection}/${record.slug}`);
+      options.reportHtml?.emit({
+        wpId: record.wpId,
+        wpType: record.wpType,
+        slug: record.slug,
+        title: record.title,
+        rawContent: record.rawContent,
+        lexical: data.content
+      });
+      await emitAudit(options.audit, {
+        action: updateMode ? "import.wp.updated" : "import.wp.applied",
+        targetType: collection,
+        targetId: savedId,
+        payload: {
+          wpId: record.wpId,
+          wpType: record.wpType,
+          slug: record.slug,
+          title: record.title,
+          coverImageId,
+          categoryIds: termIds.categoryIds,
+          tagIds: termIds.tagIds,
+          authorId
+        }
+      });
+      if (options.resume && savedId) {
+        options.resume.state.documents[documentKey(collection, record.slug)] = savedId;
+        options.resume.persist();
+      }
+      if (commentsPlan && options.comments && collection === "posts") {
+        const postId = typeof saved.doc.id === "string" ? saved.doc.id : null;
+        if (postId) {
+          await importPostComments({
+            record,
+            postId,
+            collection,
+            deps: options.comments,
+            plan: commentsPlan,
+            log,
+            resume: options.resume
+          });
+        }
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      errors.push({ wpId: record.wpId, slug: record.slug, message });
+      log(`error ${collection}/${record.slug}: ${message}`);
+      await emitAudit(options.audit, {
+        action: "import.wp.error",
+        targetType: collection,
+        payload: {
+          wpId: record.wpId,
+          wpType: record.wpType,
+          slug: record.slug,
+          message
+        }
+      });
+    }
+  }
+  const notes = [];
+  if (privateCount > 0) {
+    notes.push(
+      `${privateCount} record${privateCount === 1 ? "" : "s"} with WP status "private" imported as published with visibility=private (Phase 21.17).`
+    );
+  }
+  if (pendingCount > 0) {
+    notes.push(
+      `${pendingCount} record${pendingCount === 1 ? "" : "s"} with WP status "pending" imported as draft.`
+    );
+  }
+  if (droppedAuthorCount > 0) {
+    notes.push(
+      authors ? `${droppedAuthorCount} record${droppedAuthorCount === 1 ? "" : "s"} dropped their original WP author (resolver returned null for the matching login).` : `${droppedAuthorCount} record${droppedAuthorCount === 1 ? "" : "s"} dropped their original WP author \u2014 opt in by passing \`authors\` to \`applyBundle\` (Phase 21.8).`
+    );
+  }
+  if (coverWiredCount > 0) {
+    notes.push(
+      `${coverWiredCount} post${coverWiredCount === 1 ? "" : "s"} wired a featured image to coverImage from the WP _thumbnail_id reference.`
+    );
+  }
+  if (coverMissingCount > 0) {
+    notes.push(
+      `${coverMissingCount} post${coverMissingCount === 1 ? "" : "s"} declared a WP featured image but the source asset was not resolvable (download failed, MIME rejected, or attachment record missing).`
+    );
+  }
+  if (taxonomies) {
+    if (taxonomies.errors.length > 0) {
+      notes.push(
+        `${taxonomies.errors.length} taxonomy term${taxonomies.errors.length === 1 ? "" : "s"} failed to resolve \u2014 see Taxonomies section.`
+      );
+    }
+    if (taxonomies.skipped.length > 0) {
+      notes.push(
+        `${taxonomies.skipped.length} taxonomy term${taxonomies.skipped.length === 1 ? "" : "s"} skipped by the resolver (likely a custom taxonomy the project doesn't track).`
+      );
+    }
+  } else if (hasAnyTerm(bundle)) {
+    notes.push(
+      "Categories/tags found in the WXR but no taxonomy resolver was supplied \u2014 terms were dropped (Phase 21.6 \u2014 opt in by passing `taxonomies` to `applyBundle`)."
+    );
+  }
+  if (commentsPlan) {
+    if (commentsPlan.skippedUnapproved > 0) {
+      notes.push(
+        `${commentsPlan.skippedUnapproved} comment${commentsPlan.skippedUnapproved === 1 ? "" : "s"} dropped because <wp:comment_approved> was not "1".`
+      );
+    }
+    if (commentsPlan.errors.length > 0) {
+      notes.push(
+        `${commentsPlan.errors.length} comment${commentsPlan.errors.length === 1 ? "" : "s"} failed to insert \u2014 see Comments section.`
+      );
+    }
+  } else if (hasAnyComment(bundle)) {
+    notes.push(
+      "Comments found in the WXR but no comments deps were supplied \u2014 comments were dropped (Phase 21.7 \u2014 opt in by passing `comments` to `applyBundle`)."
+    );
+  }
+  if (authors) {
+    if (authors.errors.length > 0) {
+      notes.push(
+        `${authors.errors.length} author${authors.errors.length === 1 ? "" : "s"} failed to resolve \u2014 see Authors section.`
+      );
+    }
+  }
+  if (options.strict) {
+    if (media) {
+      for (const e of media.errors) {
+        errors.push({ wpId: 0, slug: e.url, message: `media: ${e.reason}` });
+      }
+    }
+    if (taxonomies) {
+      for (const e of taxonomies.errors) {
+        errors.push({
+          wpId: 0,
+          slug: `${e.key.taxonomy}/${e.key.slug}`,
+          message: `taxonomy: ${e.reason}`
+        });
+      }
+    }
+    if (authors) {
+      for (const e of authors.errors) {
+        errors.push({ wpId: 0, slug: e.login, message: `author: ${e.reason}` });
+      }
+    }
+    if (commentsPlan) {
+      for (const e of commentsPlan.errors) {
+        errors.push({
+          wpId: 0,
+          slug: `comment#${e.wpCommentId}`,
+          message: `comment: ${e.reason}`
+        });
+      }
+    }
+  }
+  return {
+    applied,
+    skipped,
+    errors,
+    attachments,
+    media,
+    taxonomies,
+    comments: commentsPlan,
+    authors,
+    notes
+  };
+}
+function buildDocData(record, resolution, collection, coverImageId, termIds, authorId, fieldOverrides, originalAuthor) {
+  const lexical = htmlToLexical(record.rawContent);
+  const rewritten = rewriteLexicalMedia(lexical, resolution);
+  const data = {
+    title: record.title || "(untitled)",
+    slug: record.slug,
+    content: rewritten
+  };
+  if (record.excerpt) {
+    data.excerpt = record.excerpt;
+  }
+  if (collection === "posts" && coverImageId) {
+    data.coverImage = coverImageId;
+  }
+  if (collection === "posts") {
+    if (termIds.categoryIds.length > 0) data.categories = termIds.categoryIds;
+    if (termIds.tagIds.length > 0) data.tags = termIds.tagIds;
+    if (authorId) data.author = authorId;
+  }
+  if (fieldOverrides) {
+    const protectedFields = /* @__PURE__ */ new Set(["title", "slug", "content", "excerpt", "publishedAt", "coverImage", "categories", "tags", "author"]);
+    for (const [metaKey, fieldName] of Object.entries(fieldOverrides)) {
+      if (protectedFields.has(fieldName)) continue;
+      const value = record.meta[metaKey];
+      if (typeof value === "string" && value.length > 0) {
+        data[fieldName] = value;
+      }
+    }
+  }
+  if (originalAuthor) {
+    data[originalAuthor.field] = originalAuthor.value;
+  }
+  if (record.publishedAt) {
+    const iso = record.publishedAt.replace(" ", "T") + "Z";
+    const date = new Date(iso);
+    if (!Number.isNaN(date.getTime())) {
+      data.publishedAt = date.toISOString();
+    }
+  }
+  return data;
+}
+function recordHasFeaturedImage(record) {
+  return record.mediaRefs.some((ref) => ref.kind === "featured");
+}
+function hasAnyTerm(bundle) {
+  if (bundle.terms.length > 0) return true;
+  return bundle.records.some((r) => r.terms.length > 0 && r.wpType !== "attachment");
+}
+function hasAnyComment(bundle) {
+  return bundle.records.some((r) => r.comments.length > 0 && r.wpType !== "attachment");
+}
+function resolveOriginalAuthorName(record, bundle) {
+  const login = record.wpAuthorLogin;
+  if (!login) return void 0;
+  const match = bundle.authors.find((a) => a.login === login);
+  return match?.displayName?.trim() || login;
+}
+function resolveCoverImageId(record, resolution) {
+  const ref = record.mediaRefs.find((m) => m.kind === "featured");
+  if (!ref) return void 0;
+  if (ref.wpAttachmentId !== null) {
+    const id = resolution.byAttachmentId.get(ref.wpAttachmentId);
+    if (id) return id;
+  }
+  if (ref.sourceUrl) {
+    const id = resolution.byUrl.get(ref.sourceUrl);
+    if (id) return id;
+  }
+  return void 0;
+}
+function mapStatusToFramework(status) {
+  if (status === "publish") return { status: "published", visibility: "public" };
+  if (status === "private") return { status: "published", visibility: "private" };
+  return { status: "draft", visibility: "public" };
+}
+function noop3() {
+}
+async function emitAudit(deps, event) {
+  if (!deps) return;
+  try {
+    await deps.record(event);
+  } catch {
+  }
+}
+export {
+  ResumeStateError,
+  WpImportConfigError,
+  WpImportStreamError,
+  WpMediaDownloadError,
+  WpMediaSsrfError,
+  applyBundle,
+  buildAttachmentIndex,
+  documentKey,
+  downloadMedia,
+  emptyCommentPlan,
+  emptyResumeState,
+  formatApplyReport,
+  formatSummary,
+  htmlToLexical,
+  importPostComments,
+  isAllowedMimeType,
+  loadConfigFromPath,
+  loadResumeState,
+  parseConfig,
+  parseWxr,
+  parseWxrStream,
+  persistResumeState,
+  pickPostTermIds,
+  resolveAuthors,
+  resolveEnvDownloadOptions,
+  resolveTaxonomies,
+  rewriteLexicalMedia,
+  runCli,
+  runMediaPipeline,
+  termCacheKey
+};