dineway 0.1.8 → 0.1.11

package/dist/{apply-iVSqz2qs.mjs → apply-Co5imxxT.mjs}

@@ -1,693 +1,19 @@
 import { t as __exportAll } from "./chunk-ClPoSABd.mjs";
-import { r as RevisionRepository, t as ContentRepository } from "./content-DWi4d0rT.mjs";
-import { t as MediaRepository } from "./media-DMTr80Gv.mjs";
-import { t as withTransaction } from "./transaction-Cn2rjY78.mjs";
-import { t as RedirectRepository } from "./redirect-DnEWAkVg.mjs";
-import { t as BylineRepository } from "./byline-OhH2dlRu.mjs";
-import { i as FTSManager, n as SchemaRegistry } from "./registry-C0zjeB9P.mjs";
-import { n as getDb } from "./loader-sMG4TZ-u.mjs";
-import { n as requestCached, t as peekRequestCache } from "./request-cache-Dk5qPSOx.mjs";
-import { t as validateSeed } from "./validate-BZ5wnLLp.mjs";
-import { sql } from "kysely";
+import { r as RevisionRepository, t as ContentRepository } from "./content-CyLkb-qH.mjs";
+import { t as MediaRepository } from "./media-_7Fxdu45.mjs";
+import { t as TaxonomyRepository } from "./taxonomy-D5cbhc8u.mjs";
+import { t as withTransaction } from "./transaction-x2tJQ-A1.mjs";
+import { t as RedirectRepository } from "./redirect-CGl64yOX.mjs";
+import { t as BylineRepository } from "./byline-naZxOPSa.mjs";
+import { t as FTSManager } from "./fts-manager-B1pTNEG_.mjs";
+import { n as SchemaRegistry } from "./registry-C-_hxLqa.mjs";
+import { o as setSiteSettings } from "./settings-4XnpVMOS.mjs";
+import { a as validateExternalUrl, r as ssrfSafeFetch } from "./ssrf-CmM76lLV.mjs";
+import { t as validateSeed } from "./validate-BJgA6TW_.mjs";
 import { ulid } from "ulidx";
 import { imageSize } from "image-size";
-import { lookup } from "node:dns/promises";
 import mime from "mime/lite";
 
-//#region src/database/repositories/taxonomy.ts
-/**
-* Taxonomy repository for categories, tags, and other classification
-*
-* Taxonomies are hierarchical (via parentId) and can be attached to content entries.
-*/
-var TaxonomyRepository = class {
-	constructor(db) {
-		this.db = db;
-	}
-	/**
-	* Create a new taxonomy term
-	*/
-	async create(input) {
-		const id = ulid();
-		const row = {
-			id,
-			name: input.name,
-			slug: input.slug,
-			label: input.label,
-			parent_id: input.parentId ?? null,
-			data: input.data ? JSON.stringify(input.data) : null
-		};
-		await this.db.insertInto("taxonomies").values(row).execute();
-		const taxonomy = await this.findById(id);
-		if (!taxonomy) throw new Error("Failed to create taxonomy");
-		return taxonomy;
-	}
-	/**
-	* Find taxonomy by ID
-	*/
-	async findById(id) {
-		const row = await this.db.selectFrom("taxonomies").selectAll().where("id", "=", id).executeTakeFirst();
-		return row ? this.rowToTaxonomy(row) : null;
-	}
-	/**
-	* Find taxonomy by name and slug (unique constraint)
-	*/
-	async findBySlug(name, slug) {
-		const row = await this.db.selectFrom("taxonomies").selectAll().where("name", "=", name).where("slug", "=", slug).executeTakeFirst();
-		return row ? this.rowToTaxonomy(row) : null;
-	}
-	/**
-	* Get all terms for a taxonomy (e.g., all categories)
-	*/
-	async findByName(name, options = {}) {
-		let query = this.db.selectFrom("taxonomies").selectAll().where("name", "=", name).orderBy("label", "asc");
-		if (options.parentId !== void 0) if (options.parentId === null) query = query.where("parent_id", "is", null);
-		else query = query.where("parent_id", "=", options.parentId);
-		return (await query.execute()).map((row) => this.rowToTaxonomy(row));
-	}
-	/**
-	* Get children of a taxonomy term
-	*/
-	async findChildren(parentId) {
-		return (await this.db.selectFrom("taxonomies").selectAll().where("parent_id", "=", parentId).orderBy("label", "asc").execute()).map((row) => this.rowToTaxonomy(row));
-	}
-	/**
-	* Update a taxonomy term
-	*/
-	async update(id, input) {
-		if (!await this.findById(id)) return null;
-		const updates = {};
-		if (input.slug !== void 0) updates.slug = input.slug;
-		if (input.label !== void 0) updates.label = input.label;
-		if (input.parentId !== void 0) updates.parent_id = input.parentId;
-		if (input.data !== void 0) updates.data = JSON.stringify(input.data);
-		if (Object.keys(updates).length > 0) await this.db.updateTable("taxonomies").set(updates).where("id", "=", id).execute();
-		return this.findById(id);
-	}
-	/**
-	* Delete a taxonomy term
-	*/
-	async delete(id) {
-		await this.db.deleteFrom("content_taxonomies").where("taxonomy_id", "=", id).execute();
-		return ((await this.db.deleteFrom("taxonomies").where("id", "=", id).executeTakeFirst()).numDeletedRows ?? 0) > 0;
-	}
-	/**
-	* Attach a taxonomy term to a content entry
-	*/
-	async attachToEntry(collection, entryId, taxonomyId) {
-		const row = {
-			collection,
-			entry_id: entryId,
-			taxonomy_id: taxonomyId
-		};
-		await this.db.insertInto("content_taxonomies").values(row).onConflict((oc) => oc.doNothing()).execute();
-	}
-	/**
-	* Detach a taxonomy term from a content entry
-	*/
-	async detachFromEntry(collection, entryId, taxonomyId) {
-		await this.db.deleteFrom("content_taxonomies").where("collection", "=", collection).where("entry_id", "=", entryId).where("taxonomy_id", "=", taxonomyId).execute();
-	}
-	/**
-	* Get all taxonomy terms for a content entry
-	*/
-	async getTermsForEntry(collection, entryId, taxonomyName) {
-		let query = this.db.selectFrom("content_taxonomies").innerJoin("taxonomies", "taxonomies.id", "content_taxonomies.taxonomy_id").selectAll("taxonomies").where("content_taxonomies.collection", "=", collection).where("content_taxonomies.entry_id", "=", entryId);
-		if (taxonomyName) query = query.where("taxonomies.name", "=", taxonomyName);
-		return (await query.execute()).map((row) => this.rowToTaxonomy(row));
-	}
-	/**
-	* Set all taxonomy terms for a content entry (replaces existing)
-	* Uses batch operations to avoid N+1 queries.
-	*/
-	async setTermsForEntry(collection, entryId, taxonomyName, taxonomyIds) {
-		const current = await this.getTermsForEntry(collection, entryId, taxonomyName);
-		const currentIds = new Set(current.map((t) => t.id));
-		const newIds = new Set(taxonomyIds);
-		const toRemove = current.filter((t) => !newIds.has(t.id)).map((t) => t.id);
-		if (toRemove.length > 0) await this.db.deleteFrom("content_taxonomies").where("collection", "=", collection).where("entry_id", "=", entryId).where("taxonomy_id", "in", toRemove).execute();
-		const toAdd = taxonomyIds.filter((id) => !currentIds.has(id));
-		if (toAdd.length > 0) await this.db.insertInto("content_taxonomies").values(toAdd.map((taxonomy_id) => ({
-			collection,
-			entry_id: entryId,
-			taxonomy_id
-		}))).onConflict((oc) => oc.doNothing()).execute();
-	}
-	/**
-	* Remove all taxonomy associations for an entry (use when entry is deleted)
-	*/
-	async clearEntryTerms(collection, entryId) {
-		const result = await this.db.deleteFrom("content_taxonomies").where("collection", "=", collection).where("entry_id", "=", entryId).executeTakeFirst();
-		return Number(result.numDeletedRows ?? 0);
-	}
-	/**
-	* Count entries that have a specific taxonomy term
-	*/
-	async countEntriesWithTerm(taxonomyId) {
-		const result = await this.db.selectFrom("content_taxonomies").select((eb) => eb.fn.count("entry_id").as("count")).where("taxonomy_id", "=", taxonomyId).executeTakeFirst();
-		return Number(result?.count || 0);
-	}
-	/**
-	* Convert database row to Taxonomy object
-	*/
-	rowToTaxonomy(row) {
-		return {
-			id: row.id,
-			name: row.name,
-			slug: row.slug,
-			label: row.label,
-			parentId: row.parent_id,
-			data: row.data ? JSON.parse(row.data) : null
-		};
-	}
-};
-
-//#endregion
-//#region src/database/repositories/options.ts
-function escapeLike(value) {
-	return value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_");
-}
-/**
-* Options repository for key-value settings storage
-*
-* Used for site settings, plugin configuration, and other arbitrary key-value data.
-* Values are stored as JSON for flexibility.
-*/
-var OptionsRepository = class {
-	constructor(db) {
-		this.db = db;
-	}
-	/**
-	* Get an option value
-	*/
-	async get(name) {
-		const row = await this.db.selectFrom("options").select("value").where("name", "=", name).executeTakeFirst();
-		if (!row) return null;
-		return JSON.parse(row.value);
-	}
-	/**
-	* Get an option value with a default
-	*/
-	async getOrDefault(name, defaultValue) {
-		return await this.get(name) ?? defaultValue;
-	}
-	/**
-	* Set an option value (creates or updates)
-	*/
-	async set(name, value) {
-		const row = {
-			name,
-			value: JSON.stringify(value)
-		};
-		await this.db.insertInto("options").values(row).onConflict((oc) => oc.column("name").doUpdateSet({ value: row.value })).execute();
-	}
-	/**
-	* Set an option value only if no row with that name exists.
-	*
-	* Returns true when the row was inserted, false when a row already existed,
-	* regardless of its value.
-	*/
-	async setIfAbsent(name, value) {
-		const row = {
-			name,
-			value: JSON.stringify(value)
-		};
-		return ((await this.db.insertInto("options").values(row).onConflict((oc) => oc.column("name").doNothing()).executeTakeFirst()).numInsertedOrUpdatedRows ?? 0n) > 0n;
-	}
-	/**
-	* Delete an option
-	*/
-	async delete(name) {
-		return ((await this.db.deleteFrom("options").where("name", "=", name).executeTakeFirst()).numDeletedRows ?? 0) > 0;
-	}
-	/**
-	* Check if an option exists
-	*/
-	async exists(name) {
-		return !!await this.db.selectFrom("options").select("name").where("name", "=", name).executeTakeFirst();
-	}
-	/**
-	* Get multiple options at once
-	*/
-	async getMany(names) {
-		if (names.length === 0) return /* @__PURE__ */ new Map();
-		const rows = await this.db.selectFrom("options").select(["name", "value"]).where("name", "in", names).execute();
-		const result = /* @__PURE__ */ new Map();
-		for (const row of rows) result.set(row.name, JSON.parse(row.value));
-		return result;
-	}
-	/**
-	* Set multiple options at once
-	*/
-	async setMany(options) {
-		const entries = Object.entries(options);
-		if (entries.length === 0) return;
-		for (const [name, value] of entries) await this.set(name, value);
-	}
-	/**
-	* Get all options (use sparingly)
-	*/
-	async getAll() {
-		const rows = await this.db.selectFrom("options").select(["name", "value"]).execute();
-		const result = /* @__PURE__ */ new Map();
-		for (const row of rows) result.set(row.name, JSON.parse(row.value));
-		return result;
-	}
-	/**
-	* Get all options matching a prefix
-	*/
-	async getByPrefix(prefix) {
-		const pattern = `${escapeLike(prefix)}%`;
-		const rows = await this.db.selectFrom("options").select(["name", "value"]).where(sql`name LIKE ${pattern} ESCAPE '\\'`).execute();
-		const result = /* @__PURE__ */ new Map();
-		for (const row of rows) result.set(row.name, JSON.parse(row.value));
-		return result;
-	}
-	/**
-	* Delete all options matching a prefix
-	*/
-	async deleteByPrefix(prefix) {
-		const pattern = `${escapeLike(prefix)}%`;
-		const result = await this.db.deleteFrom("options").where(sql`name LIKE ${pattern} ESCAPE '\\'`).executeTakeFirst();
-		return Number(result.numDeletedRows ?? 0);
-	}
-};
-
-//#endregion
-//#region src/settings/index.ts
-/** Prefix for site settings in the options table */
-const SETTINGS_PREFIX = "site:";
-/**
-* Type guard for MediaReference values
-*/
-function isMediaReference(value) {
-	return typeof value === "object" && value !== null && "mediaId" in value;
-}
-/**
-* Resolve a media reference to include the full URL
-*/
-async function resolveMediaReference(mediaRef, db, _storage) {
-	if (!mediaRef?.mediaId) return mediaRef;
-	try {
-		const media = await new MediaRepository(db).findById(mediaRef.mediaId);
-		if (media) return {
-			...mediaRef,
-			url: `/_dineway/api/media/file/${media.storageKey}`
-		};
-	} catch {}
-	return mediaRef;
-}
-/**
-* Get a single site setting by key
-*
-* Returns `undefined` if the setting has not been configured.
-* For media settings (logo, favicon), the URL is resolved automatically.
-*
-* @param key - The setting key (e.g., "title", "logo", "social")
-* @returns The setting value, or undefined if not set
-*
-* @example
-* ```ts
-* import { getSiteSetting } from "dineway";
-*
-* const title = await getSiteSetting("title");
-* const logo = await getSiteSetting("logo");
-* console.log(logo?.url); // Resolved URL
-* ```
-*/
-async function getSiteSetting(key) {
-	const primed = peekRequestCache("siteSettings");
-	if (primed) return (await primed)[key];
-	return requestCached(`siteSetting:${key}`, async () => {
-		return getSiteSettingWithDb(key, await getDb());
-	});
-}
-/**
-* Get a single site setting by key (with explicit db)
-*
-* @internal Use `getSiteSetting()` in templates. This variant is for admin routes
-* that already have a database handle.
-*/
-async function getSiteSettingWithDb(key, db, storage = null) {
-	const value = await new OptionsRepository(db).get(`${SETTINGS_PREFIX}${key}`);
-	if (!value) return;
-	if ((key === "logo" || key === "favicon") && isMediaReference(value)) return await resolveMediaReference(value, db, storage);
-	return value;
-}
-/**
-* Get all site settings
-*
-* Returns all configured settings. Unset values are undefined.
-* Media references (logo/favicon) are resolved to include URLs.
-*
-* @example
-* ```ts
-* import { getSiteSettings } from "dineway";
-*
-* const settings = await getSiteSettings();
-* console.log(settings.title); // "My Site"
-* console.log(settings.logo?.url); // "/_dineway/api/media/file/abc123"
-* ```
-*/
-async function getSiteSettings() {
-	return requestCached("siteSettings", async () => {
-		return getSiteSettingsWithDb(await getDb());
-	});
-}
-/**
-* Get all site settings (with explicit db)
-*
-* @internal Use `getSiteSettings()` in templates. This variant is for admin routes
-* that already have a database handle.
-*/
-async function getSiteSettingsWithDb(db, storage = null) {
-	const allOptions = await new OptionsRepository(db).getByPrefix(SETTINGS_PREFIX);
-	const settings = {};
-	for (const [key, value] of allOptions) {
-		const settingKey = key.replace(SETTINGS_PREFIX, "");
-		settings[settingKey] = value;
-	}
-	const typedSettings = settings;
-	if (typedSettings.logo) typedSettings.logo = await resolveMediaReference(typedSettings.logo, db, storage);
-	if (typedSettings.favicon) typedSettings.favicon = await resolveMediaReference(typedSettings.favicon, db, storage);
-	return typedSettings;
-}
-/**
-* Set site settings (internal function used by admin API)
-*
-* Merges provided settings with existing ones. Only provided fields are updated.
-* Media references should include just the mediaId; URLs are resolved on read.
-*
-* @param settings - Partial settings object with values to update
-* @param db - Kysely database instance
-* @returns Promise that resolves when settings are saved
-*
-* @internal
-*
-* @example
-* ```ts
-* // Update multiple settings at once
-* await setSiteSettings({
-*   title: "My Site",
-*   tagline: "Welcome",
-*   logo: { mediaId: "med_123", alt: "Logo" }
-* }, db);
-* ```
-*/
-async function setSiteSettings(settings, db) {
-	const options = new OptionsRepository(db);
-	const updates = {};
-	for (const [key, value] of Object.entries(settings)) if (value !== void 0) updates[`${SETTINGS_PREFIX}${key}`] = value;
-	await options.setMany(updates);
-}
-/**
-* Get a single plugin setting by key.
-*
-* Plugin settings are stored in the options table under
-* `plugin:<pluginId>:settings:<key>`.
-*/
-async function getPluginSetting(pluginId, key) {
-	return getPluginSettingWithDb(pluginId, key, await getDb());
-}
-/**
-* Get a single plugin setting by key (with explicit db).
-*
-* @internal Use `getPluginSetting()` in templates and plugin rendering code.
-*/
-async function getPluginSettingWithDb(pluginId, key, db) {
-	return await new OptionsRepository(db).get(`plugin:${pluginId}:settings:${key}`) ?? void 0;
-}
-/**
-* Get all persisted plugin settings for a plugin.
-*
-* Defaults declared in `admin.settingsSchema` are not materialized
-* automatically; callers should apply their own fallback defaults.
-*/
-async function getPluginSettings(pluginId) {
-	return getPluginSettingsWithDb(pluginId, await getDb());
-}
-/**
-* Get all persisted plugin settings for a plugin (with explicit db).
-*
-* @internal Use `getPluginSettings()` in templates and plugin rendering code.
-*/
-async function getPluginSettingsWithDb(pluginId, db) {
-	const prefix = `plugin:${pluginId}:settings:`;
-	const allOptions = await new OptionsRepository(db).getByPrefix(prefix);
-	const settings = {};
-	for (const [key, value] of allOptions) {
-		if (!key.startsWith(prefix)) continue;
-		settings[key.slice(prefix.length)] = value;
-	}
-	return settings;
-}
-
-//#endregion
-//#region src/import/ssrf.ts
-/**
-* SSRF protection for import URLs.
-*
-* Validates that URLs don't target internal/private network addresses.
-* Applied before any fetch() call in the import pipeline.
-*/
-const IPV4_MAPPED_IPV6_DOTTED_PATTERN = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i;
-const IPV4_MAPPED_IPV6_HEX_PATTERN = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-const IPV4_TRANSLATED_HEX_PATTERN = /^::ffff:0:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-const IPV6_EXPANDED_MAPPED_PATTERN = /^0{0,4}:0{0,4}:0{0,4}:0{0,4}:0{0,4}:ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-const IPV6_ULA_FC_PATTERN = /^fc[0-9a-f]{2}:/;
-const IPV6_ULA_FD_PATTERN = /^fd[0-9a-f]{2}:/;
-const TRAILING_DOT_PATTERN = /\.+$/;
-/**
-* IPv4-compatible (deprecated) addresses: ::XXXX:XXXX
-*
-* The WHATWG URL parser normalizes [::127.0.0.1] to [::7f00:1] (no ffff prefix).
-* These are deprecated but still parsed, and bypass the ffff-based checks.
-*/
-const IPV4_COMPATIBLE_HEX_PATTERN = /^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-/**
-* NAT64 prefix (RFC 6052): 64:ff9b::XXXX:XXXX
-*
-* Used by NAT64 gateways to embed IPv4 addresses in IPv6.
-* [64:ff9b::127.0.0.1] normalizes to [64:ff9b::7f00:1].
-*/
-const NAT64_HEX_PATTERN = /^64:ff9b::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-const IPV6_BRACKET_PATTERN = /^\[|\]$/g;
-/**
-* Private and reserved IP ranges that should never be fetched.
-*
-* Includes:
-* - Loopback (127.0.0.0/8)
-* - Private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
-* - Link-local (169.254.0.0/16)
-* - Cloud metadata (169.254.169.254 — AWS/GCP/Azure)
-* - IPv6 loopback and link-local
-*/
-const BLOCKED_PATTERNS = [
-	{
-		start: ip4ToNum(127, 0, 0, 0),
-		end: ip4ToNum(127, 255, 255, 255)
-	},
-	{
-		start: ip4ToNum(10, 0, 0, 0),
-		end: ip4ToNum(10, 255, 255, 255)
-	},
-	{
-		start: ip4ToNum(172, 16, 0, 0),
-		end: ip4ToNum(172, 31, 255, 255)
-	},
-	{
-		start: ip4ToNum(192, 168, 0, 0),
-		end: ip4ToNum(192, 168, 255, 255)
-	},
-	{
-		start: ip4ToNum(169, 254, 0, 0),
-		end: ip4ToNum(169, 254, 255, 255)
-	},
-	{
-		start: ip4ToNum(0, 0, 0, 0),
-		end: ip4ToNum(0, 255, 255, 255)
-	}
-];
-const BLOCKED_HOSTNAMES = new Set([
-	"localhost",
-	"metadata.google.internal",
-	"metadata.google",
-	"::1"
-]);
-const BLOCKED_HOSTNAME_SUFFIXES = [
-	"nip.io",
-	"sslip.io",
-	"xip.io",
-	"traefik.me",
-	"lvh.me",
-	"localtest.me"
-];
-/** Blocked URL schemes */
-const ALLOWED_SCHEMES = new Set(["http:", "https:"]);
-let defaultDnsResolver = null;
-function ip4ToNum(a, b, c, d) {
-	return (a << 24 | b << 16 | c << 8 | d) >>> 0;
-}
-function parseIpv4(ip) {
-	const parts = ip.split(".");
-	if (parts.length !== 4) return null;
-	const nums = parts.map(Number);
-	if (nums.some((n) => isNaN(n) || n < 0 || n > 255)) return null;
-	return ip4ToNum(nums[0], nums[1], nums[2], nums[3]);
-}
-function getNormalizedHostname(parsed) {
-	return parsed.hostname.replace(IPV6_BRACKET_PATTERN, "").toLowerCase().replace(TRAILING_DOT_PATTERN, "");
-}
-/**
-* Convert IPv4-mapped/translated IPv6 addresses from hex form back to IPv4.
-*
-* The WHATWG URL parser normalizes dotted-decimal to hex:
-*   [::ffff:127.0.0.1] -> [::ffff:7f00:1]
-*   [::ffff:169.254.169.254] -> [::ffff:a9fe:a9fe]
-*
-* Without this conversion, the hex forms bypass isPrivateIp() regex checks.
-*/
-function normalizeIPv6MappedToIPv4(ip) {
-	let match = ip.match(IPV4_MAPPED_IPV6_HEX_PATTERN);
-	if (!match) match = ip.match(IPV4_TRANSLATED_HEX_PATTERN);
-	if (!match) match = ip.match(IPV6_EXPANDED_MAPPED_PATTERN);
-	if (!match) match = ip.match(IPV4_COMPATIBLE_HEX_PATTERN);
-	if (!match) match = ip.match(NAT64_HEX_PATTERN);
-	if (match) {
-		const high = parseInt(match[1] ?? "", 16);
-		const low = parseInt(match[2] ?? "", 16);
-		return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
-	}
-	return null;
-}
-function isPrivateIp(ip) {
-	const normalized = ip.toLowerCase();
-	if (normalized === "::1" || normalized === "::ffff:127.0.0.1") return true;
-	const hexIpv4 = normalizeIPv6MappedToIPv4(normalized);
-	if (hexIpv4) return isPrivateIp(hexIpv4);
-	const v4Match = normalized.match(IPV4_MAPPED_IPV6_DOTTED_PATTERN);
-	const num = parseIpv4(v4Match ? v4Match[1] : normalized);
-	if (num === null) return normalized.startsWith("fe80:") || IPV6_ULA_FC_PATTERN.test(normalized) || IPV6_ULA_FD_PATTERN.test(normalized);
-	return BLOCKED_PATTERNS.some((range) => num >= range.start && num <= range.end);
-}
-function isIpLiteral(hostname) {
-	return parseIpv4(hostname) !== null || hostname.includes(":");
-}
-/**
-* Error thrown when SSRF protection blocks a URL.
-*/
-var SsrfError = class extends Error {
-	code = "SSRF_BLOCKED";
-	constructor(message) {
-		super(message);
-		this.name = "SsrfError";
-	}
-};
-/**
-* Validate that a URL is safe to fetch (not targeting internal networks).
-*
-* Checks:
-* 1. URL is well-formed with http/https scheme
-* 2. Hostname is not a known internal name (localhost, metadata endpoints)
-* 3. If hostname is an IP literal, it's not in a private range
-*
-* Use resolveAndValidateExternalUrl() or ssrfSafeFetch() before network I/O so
-* hostnames are also checked after DNS resolution.
-*
-* @throws SsrfError if the URL targets an internal address
-*/
-/** Maximum number of redirects to follow in ssrfSafeFetch */
-const MAX_REDIRECTS = 5;
-function validateExternalUrl(url) {
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		throw new SsrfError("Invalid URL");
-	}
-	if (!ALLOWED_SCHEMES.has(parsed.protocol)) throw new SsrfError(`Scheme '${parsed.protocol}' is not allowed`);
-	const hostname = getNormalizedHostname(parsed);
-	if (BLOCKED_HOSTNAMES.has(hostname)) throw new SsrfError("URLs targeting internal hosts are not allowed");
-	for (const suffix of BLOCKED_HOSTNAME_SUFFIXES) if (hostname === suffix || hostname.endsWith(`.${suffix}`)) throw new SsrfError("URLs targeting wildcard DNS services are not allowed");
-	if (isPrivateIp(hostname)) throw new SsrfError("URLs targeting private IP addresses are not allowed");
-	return parsed;
-}
-const nodeDnsResolver = async (hostname) => {
-	return (await lookup(hostname, { all: true })).map((entry) => entry.address);
-};
-/**
-* Validate a URL and resolve hostnames before network I/O.
-*
-* Fails closed if DNS resolution fails, returns no addresses, or any resolved
-* address targets a private/internal range.
-*/
-async function resolveAndValidateExternalUrl(url, options = {}) {
-	const parsed = validateExternalUrl(url);
-	const hostname = getNormalizedHostname(parsed);
-	if (isIpLiteral(hostname)) return parsed;
-	const resolver = options.resolver ?? defaultDnsResolver ?? nodeDnsResolver;
-	let addresses;
-	try {
-		addresses = await resolver(hostname);
-	} catch {
-		throw new SsrfError(`Could not resolve hostname: ${hostname}`);
-	}
-	if (addresses.length === 0) throw new SsrfError("Hostname resolved to no addresses");
-	for (const address of addresses) {
-		const normalizedAddress = address.replace(IPV6_BRACKET_PATTERN, "").toLowerCase();
-		if (!isIpLiteral(normalizedAddress)) throw new SsrfError("Hostname resolved to an invalid address");
-		if (isPrivateIp(normalizedAddress)) throw new SsrfError("Hostname resolves to a private IP address");
-	}
-	return parsed;
-}
-/**
-* Fetch a URL with SSRF protection on redirects.
-*
-* Uses `redirect: "manual"` to intercept redirects and re-validate each
-* redirect target against SSRF rules before following it. This prevents
-* an attacker from setting up an allowed external URL that redirects to
-* an internal IP (e.g. 169.254.169.254 for cloud metadata).
-*
-* @throws SsrfError if the initial URL or any redirect target is internal
-*/
-/** Headers that must be stripped when a redirect crosses origins */
-const CREDENTIAL_HEADERS = [
-	"authorization",
-	"cookie",
-	"proxy-authorization"
-];
-async function ssrfSafeFetch(url, init, options = {}) {
-	let currentUrl = url;
-	let currentInit = init;
-	for (let i = 0; i <= MAX_REDIRECTS; i++) {
-		await resolveAndValidateExternalUrl(currentUrl, options);
-		const response = await globalThis.fetch(currentUrl, {
-			...currentInit,
-			redirect: "manual"
-		});
-		if (response.status < 300 || response.status >= 400) return response;
-		const location = response.headers.get("Location");
-		if (!location) return response;
-		const previousOrigin = new URL(currentUrl).origin;
-		currentUrl = new URL(location, currentUrl).href;
-		if (previousOrigin !== new URL(currentUrl).origin && currentInit) currentInit = stripCredentialHeaders(currentInit);
-	}
-	throw new SsrfError(`Too many redirects (max ${MAX_REDIRECTS})`);
-}
-/**
-* Return a copy of init with credential headers removed.
-*/
-function stripCredentialHeaders(init) {
-	if (!init.headers) return init;
-	const headers = new Headers(init.headers);
-	for (const name of CREDENTIAL_HEADERS) headers.delete(name);
-	return {
-		...init,
-		headers
-	};
-}
-
-//#endregion
 //#region src/seed/apply.ts
 /**
 * Seed engine - applies seed files to database
@@ -1120,9 +446,9 @@ async function applySeed(db, seed, options = {}) {
 			}
 		}
 	}
-	const { invalidateBylineCache } = await import("./bylines-BGpD9_hy.mjs").then((n) => n.t);
-	const { invalidateUrlPatternCache } = await import("./query-kDmwCsHh.mjs").then((n) => n.o);
-	const { invalidateRedirectCache } = await import("./cache-BdSY-gQN.mjs").then((n) => n.t);
+	const { invalidateBylineCache } = await import("./bylines-BcOPh6Ej.mjs").then((n) => n.t);
+	const { invalidateUrlPatternCache } = await import("./query-RiobVwB5.mjs").then((n) => n.o);
+	const { invalidateRedirectCache } = await import("./cache-DEbQ13c9.mjs").then((n) => n.t);
 	invalidateBylineCache();
 	invalidateUrlPatternCache();
 	invalidateRedirectCache();
@@ -1429,4 +755,4 @@ function getImageDimensions(buffer) {
 }
 
 //#endregion
-export { ssrfSafeFetch as a, getPluginSetting as c, getSiteSettings as d, setSiteSettings as f, resolveAndValidateExternalUrl as i, getPluginSettings as l, TaxonomyRepository as m, apply_exports as n, stripCredentialHeaders as o, OptionsRepository as p, SsrfError as r, validateExternalUrl as s, applySeed as t, getSiteSetting as u };
+export { apply_exports as n, applySeed as t };