emdash 0.11.1 → 0.13.0

package/dist/setup-BGAJ2uXs.mjs

@@ -0,0 +1,137 @@
+import { Mn as roleLevel, On as httpUrl } from "./redirects-Dmj6KRU3.mjs";
+import { z } from "zod";
+
+//#region src/api/schemas/auth.ts
+const authenticatorTransport$1 = z.enum([
+	"usb",
+	"nfc",
+	"ble",
+	"internal",
+	"hybrid"
+]);
+/** RegistrationResponse — sent by the browser after navigator.credentials.create() */
+const registrationCredential$1 = z.object({
+	id: z.string(),
+	rawId: z.string(),
+	type: z.literal("public-key"),
+	response: z.object({
+		clientDataJSON: z.string(),
+		attestationObject: z.string(),
+		transports: z.array(authenticatorTransport$1).optional()
+	}),
+	authenticatorAttachment: z.enum(["platform", "cross-platform"]).optional()
+});
+/** AuthenticationResponse — sent by the browser after navigator.credentials.get() */
+const authenticationCredential = z.object({
+	id: z.string(),
+	rawId: z.string(),
+	type: z.literal("public-key"),
+	response: z.object({
+		clientDataJSON: z.string(),
+		authenticatorData: z.string(),
+		signature: z.string(),
+		userHandle: z.string().optional()
+	}),
+	authenticatorAttachment: z.enum(["platform", "cross-platform"]).optional()
+});
+const signupRequestBody = z.object({ email: z.string().email() }).meta({ id: "SignupRequestBody" });
+const signupCompleteBody = z.object({
+	token: z.string().min(1),
+	credential: registrationCredential$1,
+	name: z.string().optional()
+}).meta({ id: "SignupCompleteBody" });
+const inviteCreateBody = z.object({
+	email: z.string().email(),
+	role: roleLevel.optional()
+}).meta({ id: "InviteCreateBody" });
+const inviteRegisterOptionsBody = z.object({
+	token: z.string().min(1),
+	name: z.string().optional()
+}).meta({ id: "InviteRegisterOptionsBody" });
+const inviteCompleteBody = z.object({
+	token: z.string().min(1),
+	credential: registrationCredential$1,
+	name: z.string().optional()
+}).meta({ id: "InviteCompleteBody" });
+const magicLinkSendBody = z.object({ email: z.string().email() }).meta({ id: "MagicLinkSendBody" });
+const passkeyOptionsBody = z.object({ email: z.string().email().optional() }).meta({ id: "PasskeyOptionsBody" });
+const passkeyVerifyBody = z.object({ credential: authenticationCredential }).meta({ id: "PasskeyVerifyBody" });
+const passkeyRegisterOptionsBody = z.object({ name: z.string().optional() }).meta({ id: "PasskeyRegisterOptionsBody" });
+const passkeyRegisterVerifyBody = z.object({
+	credential: registrationCredential$1,
+	name: z.string().optional()
+}).meta({ id: "PasskeyRegisterVerifyBody" });
+const passkeyRenameBody = z.object({ name: z.string().min(1) }).meta({ id: "PasskeyRenameBody" });
+const authMeActionBody = z.object({ action: z.string().min(1) }).meta({ id: "AuthMeActionBody" });
+
+//#endregion
+//#region src/api/schemas/import.ts
+const importProbeBody = z.object({ url: httpUrl });
+const wpPluginAnalyzeBody = z.object({
+	url: httpUrl,
+	token: z.string().min(1)
+});
+const wpPluginExecuteBody = z.object({
+	url: httpUrl,
+	token: z.string().min(1),
+	config: z.record(z.string(), z.unknown())
+});
+const wpPrepareBody = z.object({ postTypes: z.array(z.object({
+	name: z.string().min(1),
+	collection: z.string().min(1),
+	fields: z.array(z.object({
+		slug: z.string().min(1),
+		label: z.string().min(1),
+		type: z.string().min(1),
+		required: z.boolean(),
+		searchable: z.boolean().optional()
+	})).optional()
+})) });
+const wpMediaImportBody = z.object({
+	attachments: z.array(z.record(z.string(), z.unknown())),
+	stream: z.boolean().optional()
+});
+const wpRewriteUrlsBody = z.object({
+	urlMap: z.record(z.string(), z.string()),
+	collections: z.array(z.string()).optional()
+});
+
+//#endregion
+//#region src/api/schemas/setup.ts
+/** Registration credential — duplicated reference for setup flow.
+*  The canonical definition lives in auth.ts but setup needs it independently
+*  because setup runs before auth is configured. */
+const authenticatorTransport = z.enum([
+	"usb",
+	"nfc",
+	"ble",
+	"internal",
+	"hybrid"
+]);
+const registrationCredential = z.object({
+	id: z.string(),
+	rawId: z.string(),
+	type: z.literal("public-key"),
+	response: z.object({
+		clientDataJSON: z.string(),
+		attestationObject: z.string(),
+		transports: z.array(authenticatorTransport).optional()
+	}),
+	authenticatorAttachment: z.enum(["platform", "cross-platform"]).optional()
+});
+const setupBody = z.object({
+	title: z.string().min(1),
+	tagline: z.string().optional(),
+	includeContent: z.boolean()
+});
+const setupAdminBody = z.object({
+	email: z.string().email(),
+	name: z.string().optional()
+});
+const setupAdminVerifyBody = z.object({ credential: registrationCredential });
+const atprotoLoginBody = z.object({ handle: z.string().trim().min(1) });
+const setupAtprotoAdminBody = z.object({ handle: z.string().trim().min(1) });
+
+//#endregion
+export { signupRequestBody as C, signupCompleteBody as S, passkeyOptionsBody as _, setupBody as a, passkeyRenameBody as b, wpPluginAnalyzeBody as c, wpRewriteUrlsBody as d, authMeActionBody as f, magicLinkSendBody as g, inviteRegisterOptionsBody as h, setupAtprotoAdminBody as i, wpPluginExecuteBody as l, inviteCreateBody as m, setupAdminBody as n, importProbeBody as o, inviteCompleteBody as p, setupAdminVerifyBody as r, wpMediaImportBody as s, atprotoLoginBody as t, wpPrepareBody as u, passkeyRegisterOptionsBody as v, passkeyVerifyBody as x, passkeyRegisterVerifyBody as y };
+//# sourceMappingURL=setup-BGAJ2uXs.mjs.map

package/dist/setup-BGAJ2uXs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-BGAJ2uXs.mjs","names":["authenticatorTransport","registrationCredential"],"sources":["../src/api/schemas/auth.ts","../src/api/schemas/import.ts","../src/api/schemas/setup.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { roleLevel } from \"./common.js\";\n\n// ---------------------------------------------------------------------------\n// WebAuthn credential schemas (matching @emdash-cms/auth/passkey types)\n// ---------------------------------------------------------------------------\n\nconst authenticatorTransport = z.enum([\"usb\", \"nfc\", \"ble\", \"internal\", \"hybrid\"]);\n\n/** RegistrationResponse — sent by the browser after navigator.credentials.create() */\nconst registrationCredential = z.object({\n\tid: z.string(),\n\trawId: z.string(),\n\ttype: z.literal(\"public-key\"),\n\tresponse: z.object({\n\t\tclientDataJSON: z.string(),\n\t\tattestationObject: z.string(),\n\t\ttransports: z.array(authenticatorTransport).optional(),\n\t}),\n\tauthenticatorAttachment: z.enum([\"platform\", \"cross-platform\"]).optional(),\n});\n\n/** AuthenticationResponse — sent by the browser after navigator.credentials.get() */\nconst authenticationCredential = z.object({\n\tid: z.string(),\n\trawId: z.string(),\n\ttype: z.literal(\"public-key\"),\n\tresponse: z.object({\n\t\tclientDataJSON: z.string(),\n\t\tauthenticatorData: z.string(),\n\t\tsignature: z.string(),\n\t\tuserHandle: z.string().optional(),\n\t}),\n\tauthenticatorAttachment: z.enum([\"platform\", \"cross-platform\"]).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Auth: Input schemas\n// ---------------------------------------------------------------------------\n\nexport const signupRequestBody = z\n\t.object({\n\t\temail: z.string().email(),\n\t})\n\t.meta({ id: \"SignupRequestBody\" });\n\nexport const signupCompleteBody = z\n\t.object({\n\t\ttoken: z.string().min(1),\n\t\tcredential: registrationCredential,\n\t\tname: z.string().optional(),\n\t})\n\t.meta({ id: \"SignupCompleteBody\" });\n\nexport const inviteCreateBody = z\n\t.object({\n\t\temail: z.string().email(),\n\t\trole: roleLevel.optional(),\n\t})\n\t.meta({ id: \"InviteCreateBody\" });\n\nexport const inviteRegisterOptionsBody = z\n\t.object({\n\t\ttoken: z.string().min(1),\n\t\tname: z.string().optional(),\n\t})\n\t.meta({ id: \"InviteRegisterOptionsBody\" });\n\nexport const inviteCompleteBody = z\n\t.object({\n\t\ttoken: z.string().min(1),\n\t\tcredential: registrationCredential,\n\t\tname: z.string().optional(),\n\t})\n\t.meta({ id: \"InviteCompleteBody\" });\n\nexport const magicLinkSendBody = z\n\t.object({\n\t\temail: z.string().email(),\n\t})\n\t.meta({ id: \"MagicLinkSendBody\" });\n\nexport const passkeyOptionsBody = z\n\t.object({\n\t\temail: z.string().email().optional(),\n\t})\n\t.meta({ id: \"PasskeyOptionsBody\" });\n\nexport const passkeyVerifyBody = z\n\t.object({\n\t\tcredential: authenticationCredential,\n\t})\n\t.meta({ id: \"PasskeyVerifyBody\" });\n\nexport const passkeyRegisterOptionsBody = z\n\t.object({\n\t\tname: z.string().optional(),\n\t})\n\t.meta({ id: \"PasskeyRegisterOptionsBody\" });\n\nexport const passkeyRegisterVerifyBody = z\n\t.object({\n\t\tcredential: registrationCredential,\n\t\tname: z.string().optional(),\n\t})\n\t.meta({ id: \"PasskeyRegisterVerifyBody\" });\n\nexport const passkeyRenameBody = z\n\t.object({\n\t\tname: z.string().min(1),\n\t})\n\t.meta({ id: \"PasskeyRenameBody\" });\n\nexport const authMeActionBody = z\n\t.object({\n\t\taction: z.string().min(1),\n\t})\n\t.meta({ id: \"AuthMeActionBody\" });\n","import { z } from \"zod\";\n\nimport { httpUrl } from \"./common.js\";\n\n// ---------------------------------------------------------------------------\n// Import\n// ---------------------------------------------------------------------------\n\nexport const importProbeBody = z.object({\n\turl: httpUrl,\n});\n\nexport const wpPluginAnalyzeBody = z.object({\n\turl: httpUrl,\n\ttoken: z.string().min(1),\n});\n\nexport const wpPluginExecuteBody = z.object({\n\turl: httpUrl,\n\ttoken: z.string().min(1),\n\tconfig: z.record(z.string(), z.unknown()),\n});\n\nexport const wpPrepareBody = z.object({\n\tpostTypes: z.array(\n\t\tz.object({\n\t\t\tname: z.string().min(1),\n\t\t\tcollection: z.string().min(1),\n\t\t\tfields: z\n\t\t\t\t.array(\n\t\t\t\t\tz.object({\n\t\t\t\t\t\tslug: z.string().min(1),\n\t\t\t\t\t\tlabel: z.string().min(1),\n\t\t\t\t\t\ttype: z.string().min(1),\n\t\t\t\t\t\trequired: z.boolean(),\n\t\t\t\t\t\tsearchable: z.boolean().optional(),\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\t.optional(),\n\t\t}),\n\t),\n});\n\nexport const wpMediaImportBody = z.object({\n\tattachments: z.array(z.record(z.string(), z.unknown())),\n\tstream: z.boolean().optional(),\n});\n\nexport const wpRewriteUrlsBody = z.object({\n\turlMap: z.record(z.string(), z.string()),\n\tcollections: z.array(z.string()).optional(),\n});\n","import { z } from \"zod\";\n\n// ---------------------------------------------------------------------------\n// Setup\n// ---------------------------------------------------------------------------\n\n/** Registration credential — duplicated reference for setup flow.\n *  The canonical definition lives in auth.ts but setup needs it independently\n *  because setup runs before auth is configured. */\nconst authenticatorTransport = z.enum([\"usb\", \"nfc\", \"ble\", \"internal\", \"hybrid\"]);\n\nconst registrationCredential = z.object({\n\tid: z.string(),\n\trawId: z.string(),\n\ttype: z.literal(\"public-key\"),\n\tresponse: z.object({\n\t\tclientDataJSON: z.string(),\n\t\tattestationObject: z.string(),\n\t\ttransports: z.array(authenticatorTransport).optional(),\n\t}),\n\tauthenticatorAttachment: z.enum([\"platform\", \"cross-platform\"]).optional(),\n});\n\nexport const setupBody = z.object({\n\ttitle: z.string().min(1),\n\ttagline: z.string().optional(),\n\tincludeContent: z.boolean(),\n});\n\nexport const setupAdminBody = z.object({\n\temail: z.string().email(),\n\tname: z.string().optional(),\n});\n\nexport const setupAdminVerifyBody = z.object({\n\tcredential: registrationCredential,\n});\n\nexport const atprotoLoginBody = z.object({\n\thandle: z.string().trim().min(1),\n});\n\nexport const setupAtprotoAdminBody = z.object({\n\thandle: z.string().trim().min(1),\n});\n"],"mappings":";;;;AAQA,MAAMA,2BAAyB,EAAE,KAAK;CAAC;CAAO;CAAO;CAAO;CAAY;CAAS,CAAC;;AAGlF,MAAMC,2BAAyB,EAAE,OAAO;CACvC,IAAI,EAAE,QAAQ;CACd,OAAO,EAAE,QAAQ;CACjB,MAAM,EAAE,QAAQ,aAAa;CAC7B,UAAU,EAAE,OAAO;EAClB,gBAAgB,EAAE,QAAQ;EAC1B,mBAAmB,EAAE,QAAQ;EAC7B,YAAY,EAAE,MAAMD,yBAAuB,CAAC,UAAU;EACtD,CAAC;CACF,yBAAyB,EAAE,KAAK,CAAC,YAAY,iBAAiB,CAAC,CAAC,UAAU;CAC1E,CAAC;;AAGF,MAAM,2BAA2B,EAAE,OAAO;CACzC,IAAI,EAAE,QAAQ;CACd,OAAO,EAAE,QAAQ;CACjB,MAAM,EAAE,QAAQ,aAAa;CAC7B,UAAU,EAAE,OAAO;EAClB,gBAAgB,EAAE,QAAQ;EAC1B,mBAAmB,EAAE,QAAQ;EAC7B,WAAW,EAAE,QAAQ;EACrB,YAAY,EAAE,QAAQ,CAAC,UAAU;EACjC,CAAC;CACF,yBAAyB,EAAE,KAAK,CAAC,YAAY,iBAAiB,CAAC,CAAC,UAAU;CAC1E,CAAC;AAMF,MAAa,oBAAoB,EAC/B,OAAO,EACP,OAAO,EAAE,QAAQ,CAAC,OAAO,EACzB,CAAC,CACD,KAAK,EAAE,IAAI,qBAAqB,CAAC;AAEnC,MAAa,qBAAqB,EAChC,OAAO;CACP,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;CACxB,YAAYC;CACZ,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,CAAC,CACD,KAAK,EAAE,IAAI,sBAAsB,CAAC;AAEpC,MAAa,mBAAmB,EAC9B,OAAO;CACP,OAAO,EAAE,QAAQ,CAAC,OAAO;CACzB,MAAM,UAAU,UAAU;CAC1B,CAAC,CACD,KAAK,EAAE,IAAI,oBAAoB,CAAC;AAElC,MAAa,4BAA4B,EACvC,OAAO;CACP,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;CACxB,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,CAAC,CACD,KAAK,EAAE,IAAI,6BAA6B,CAAC;AAE3C,MAAa,qBAAqB,EAChC,OAAO;CACP,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;CACxB,YAAYA;CACZ,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,CAAC,CACD,KAAK,EAAE,IAAI,sBAAsB,CAAC;AAEpC,MAAa,oBAAoB,EAC/B,OAAO,EACP,OAAO,EAAE,QAAQ,CAAC,OAAO,EACzB,CAAC,CACD,KAAK,EAAE,IAAI,qBAAqB,CAAC;AAEnC,MAAa,qBAAqB,EAChC,OAAO,EACP,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,EACpC,CAAC,CACD,KAAK,EAAE,IAAI,sBAAsB,CAAC;AAEpC,MAAa,oBAAoB,EAC/B,OAAO,EACP,YAAY,0BACZ,CAAC,CACD,KAAK,EAAE,IAAI,qBAAqB,CAAC;AAEnC,MAAa,6BAA6B,EACxC,OAAO,EACP,MAAM,EAAE,QAAQ,CAAC,UAAU,EAC3B,CAAC,CACD,KAAK,EAAE,IAAI,8BAA8B,CAAC;AAE5C,MAAa,4BAA4B,EACvC,OAAO;CACP,YAAYA;CACZ,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,CAAC,CACD,KAAK,EAAE,IAAI,6BAA6B,CAAC;AAE3C,MAAa,oBAAoB,EAC/B,OAAO,EACP,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EACvB,CAAC,CACD,KAAK,EAAE,IAAI,qBAAqB,CAAC;AAEnC,MAAa,mBAAmB,EAC9B,OAAO,EACP,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EACzB,CAAC,CACD,KAAK,EAAE,IAAI,oBAAoB,CAAC;;;;AC9GlC,MAAa,kBAAkB,EAAE,OAAO,EACvC,KAAK,SACL,CAAC;AAEF,MAAa,sBAAsB,EAAE,OAAO;CAC3C,KAAK;CACL,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;CACxB,CAAC;AAEF,MAAa,sBAAsB,EAAE,OAAO;CAC3C,KAAK;CACL,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;CACxB,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;CACzC,CAAC;AAEF,MAAa,gBAAgB,EAAE,OAAO,EACrC,WAAW,EAAE,MACZ,EAAE,OAAO;CACR,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;CACvB,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC7B,QAAQ,EACN,MACA,EAAE,OAAO;EACR,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;EACvB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;EACxB,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;EACvB,UAAU,EAAE,SAAS;EACrB,YAAY,EAAE,SAAS,CAAC,UAAU;EAClC,CAAC,CACF,CACA,UAAU;CACZ,CAAC,CACF,EACD,CAAC;AAEF,MAAa,oBAAoB,EAAE,OAAO;CACzC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;CACvD,QAAQ,EAAE,SAAS,CAAC,UAAU;CAC9B,CAAC;AAEF,MAAa,oBAAoB,EAAE,OAAO;CACzC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC;CACxC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,UAAU;CAC3C,CAAC;;;;;;;AC1CF,MAAM,yBAAyB,EAAE,KAAK;CAAC;CAAO;CAAO;CAAO;CAAY;CAAS,CAAC;AAElF,MAAM,yBAAyB,EAAE,OAAO;CACvC,IAAI,EAAE,QAAQ;CACd,OAAO,EAAE,QAAQ;CACjB,MAAM,EAAE,QAAQ,aAAa;CAC7B,UAAU,EAAE,OAAO;EAClB,gBAAgB,EAAE,QAAQ;EAC1B,mBAAmB,EAAE,QAAQ;EAC7B,YAAY,EAAE,MAAM,uBAAuB,CAAC,UAAU;EACtD,CAAC;CACF,yBAAyB,EAAE,KAAK,CAAC,YAAY,iBAAiB,CAAC,CAAC,UAAU;CAC1E,CAAC;AAEF,MAAa,YAAY,EAAE,OAAO;CACjC,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;CACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;CAC9B,gBAAgB,EAAE,SAAS;CAC3B,CAAC;AAEF,MAAa,iBAAiB,EAAE,OAAO;CACtC,OAAO,EAAE,QAAQ,CAAC,OAAO;CACzB,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,CAAC;AAEF,MAAa,uBAAuB,EAAE,OAAO,EAC5C,YAAY,wBACZ,CAAC;AAEF,MAAa,mBAAmB,EAAE,OAAO,EACxC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAChC,CAAC;AAEF,MAAa,wBAAwB,EAAE,OAAO,EAC7C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAChC,CAAC"}

package/dist/setup-complete-C6ZCLhKo.mjs

@@ -0,0 +1,26 @@
+import { t as OptionsRepository } from "./options-BL4X94qY.mjs";
+
+//#region src/api/setup-complete.ts
+/**
+* Finalize setup after the first admin user is created.
+*
+* Reads the setup_state option (written by the setup wizard's step 1),
+* persists site_title and site_tagline, then marks setup complete.
+*
+* Safe to call multiple times — checks setup_complete first and no-ops
+* if already done.
+*/
+async function finalizeSetup(db) {
+	const options = new OptionsRepository(db);
+	const setupComplete = await options.get("emdash:setup_complete");
+	if (setupComplete === true || setupComplete === "true") return;
+	const setupState = await options.get("emdash:setup_state");
+	if (setupState?.title && typeof setupState.title === "string") await options.set("emdash:site_title", setupState.title);
+	if (setupState?.tagline && typeof setupState.tagline === "string") await options.set("emdash:site_tagline", setupState.tagline);
+	await options.set("emdash:setup_complete", true);
+	await options.delete("emdash:setup_state");
+}
+
+//#endregion
+export { finalizeSetup as t };
+//# sourceMappingURL=setup-complete-C6ZCLhKo.mjs.map

package/dist/setup-complete-C6ZCLhKo.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-complete-C6ZCLhKo.mjs","names":[],"sources":["../src/api/setup-complete.ts"],"sourcesContent":["/**\n * Shared setup completion logic.\n *\n * Called by OAuth callbacks and the passkey verify step when the first user\n * is created during setup. Persists site title/tagline from setup state\n * and marks setup as complete.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport type { Database } from \"../database/types.js\";\n\n/**\n * Finalize setup after the first admin user is created.\n *\n * Reads the setup_state option (written by the setup wizard's step 1),\n * persists site_title and site_tagline, then marks setup complete.\n *\n * Safe to call multiple times — checks setup_complete first and no-ops\n * if already done.\n */\nexport async function finalizeSetup(db: Kysely<Database>): Promise<void> {\n\tconst options = new OptionsRepository(db);\n\n\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\tif (setupComplete === true || setupComplete === \"true\") return;\n\n\t// Persist site title/tagline from setup state (stored in step 1)\n\tconst setupState = await options.get<Record<string, unknown>>(\"emdash:setup_state\");\n\tif (setupState?.title && typeof setupState.title === \"string\") {\n\t\tawait options.set(\"emdash:site_title\", setupState.title);\n\t}\n\tif (setupState?.tagline && typeof setupState.tagline === \"string\") {\n\t\tawait options.set(\"emdash:site_tagline\", setupState.tagline);\n\t}\n\n\tawait options.set(\"emdash:setup_complete\", true);\n\tawait options.delete(\"emdash:setup_state\");\n}\n"],"mappings":";;;;;;;;;;;;AAsBA,eAAsB,cAAc,IAAqC;CACxE,MAAM,UAAU,IAAI,kBAAkB,GAAG;CAEzC,MAAM,gBAAgB,MAAM,QAAQ,IAAI,wBAAwB;AAChE,KAAI,kBAAkB,QAAQ,kBAAkB,OAAQ;CAGxD,MAAM,aAAa,MAAM,QAAQ,IAA6B,qBAAqB;AACnF,KAAI,YAAY,SAAS,OAAO,WAAW,UAAU,SACpD,OAAM,QAAQ,IAAI,qBAAqB,WAAW,MAAM;AAEzD,KAAI,YAAY,WAAW,OAAO,WAAW,YAAY,SACxD,OAAM,QAAQ,IAAI,uBAAuB,WAAW,QAAQ;AAG7D,OAAM,QAAQ,IAAI,yBAAyB,KAAK;AAChD,OAAM,QAAQ,OAAO,qBAAqB"}

package/dist/setup-nonce-CY1gQiAU.mjs

@@ -0,0 +1,25 @@
+//#region src/auth/setup-nonce.ts
+/**
+* Session binding for the first-setup admin-creation flow.
+*
+* Shared constants for the nonce cookie that ties /_emdash/api/setup/admin
+* and /_emdash/api/setup/admin/verify to the same browser. Without this
+* binding, any unauthenticated caller could POST /setup/admin during the
+* setup window and substitute their own email into the stored setup state
+* before the legitimate admin completes passkey verification.
+*
+* Implementation lives in the two route handlers; this module is just
+* the name / lifetime so both ends agree.
+*/
+/** Cookie name carrying the setup-admin session nonce. */
+const SETUP_NONCE_COOKIE = "emdash_setup_nonce";
+/**
+* Cookie max-age in seconds. One hour is plenty of time to complete
+* a passkey registration; if the user lingers longer the admin step
+* can simply be retried.
+*/
+const SETUP_NONCE_MAX_AGE_SECONDS = 3600;
+
+//#endregion
+export { SETUP_NONCE_MAX_AGE_SECONDS as n, SETUP_NONCE_COOKIE as t };
+//# sourceMappingURL=setup-nonce-CY1gQiAU.mjs.map

package/dist/setup-nonce-CY1gQiAU.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-nonce-CY1gQiAU.mjs","names":[],"sources":["../src/auth/setup-nonce.ts"],"sourcesContent":["/**\n * Session binding for the first-setup admin-creation flow.\n *\n * Shared constants for the nonce cookie that ties /_emdash/api/setup/admin\n * and /_emdash/api/setup/admin/verify to the same browser. Without this\n * binding, any unauthenticated caller could POST /setup/admin during the\n * setup window and substitute their own email into the stored setup state\n * before the legitimate admin completes passkey verification.\n *\n * Implementation lives in the two route handlers; this module is just\n * the name / lifetime so both ends agree.\n */\n\n/** Cookie name carrying the setup-admin session nonce. */\nexport const SETUP_NONCE_COOKIE = \"emdash_setup_nonce\";\n\n/**\n * Cookie max-age in seconds. One hour is plenty of time to complete\n * a passkey registration; if the user lingers longer the admin step\n * can simply be retried.\n */\nexport const SETUP_NONCE_MAX_AGE_SECONDS = 60 * 60;\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAa,qBAAqB;;;;;;AAOlC,MAAa,8BAA8B"}

package/dist/site-url-D-M4Fd8O.mjs

@@ -0,0 +1,13 @@
+import { t as OptionsRepository } from "./options-BL4X94qY.mjs";
+
+//#region src/api/site-url.ts
+async function getSiteBaseUrl(db, request) {
+	const storedUrl = await new OptionsRepository(db).get("emdash:site_url");
+	if (storedUrl) return `${storedUrl}/_emdash`;
+	const url = new URL(request.url);
+	return `${url.protocol}//${url.host}/_emdash`;
+}
+
+//#endregion
+export { getSiteBaseUrl as t };
+//# sourceMappingURL=site-url-D-M4Fd8O.mjs.map

package/dist/site-url-D-M4Fd8O.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-url-D-M4Fd8O.mjs","names":[],"sources":["../src/api/site-url.ts"],"sourcesContent":["/**\n * Resolve the canonical site base URL for use in outbound links (emails, etc.).\n *\n * Uses the stored `emdash:site_url` (set during setup on the real domain)\n * so that Host header spoofing in later requests cannot redirect users to\n * attacker-controlled domains.\n *\n * Falls back to the request URL only if no stored value exists (pre-setup).\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport type { Database } from \"../database/types.js\";\n\nexport async function getSiteBaseUrl(db: Kysely<Database>, request: Request): Promise<string> {\n\tconst options = new OptionsRepository(db);\n\tconst storedUrl = await options.get<string>(\"emdash:site_url\");\n\tif (storedUrl) {\n\t\treturn `${storedUrl}/_emdash`;\n\t}\n\t// Fallback: derive from request (only reached before setup completes)\n\tconst url = new URL(request.url);\n\treturn `${url.protocol}//${url.host}/_emdash`;\n}\n"],"mappings":";;;AAeA,eAAsB,eAAe,IAAsB,SAAmC;CAE7F,MAAM,YAAY,MADF,IAAI,kBAAkB,GAAG,CACT,IAAY,kBAAkB;AAC9D,KAAI,UACH,QAAO,GAAG,UAAU;CAGrB,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAChC,QAAO,GAAG,IAAI,SAAS,IAAI,IAAI,KAAK"}

package/dist/slugify-Cjh1ssOZ.mjs

@@ -0,0 +1,30 @@
+//#region src/utils/slugify.ts
+const DIACRITICS_PATTERN = /[\u0300-\u036f]/g;
+const WHITESPACE_UNDERSCORE_PATTERN = /[\s_]+/g;
+const NON_ALPHANUMERIC_HYPHEN_PATTERN = /[^a-z0-9-]/g;
+const MULTIPLE_HYPHENS_PATTERN = /-+/g;
+const LEADING_TRAILING_HYPHEN_PATTERN = /^-|-$/g;
+const TRAILING_HYPHEN_PATTERN = /-$/;
+/**
+* Convert a string to a URL-friendly slug.
+*
+* Handles unicode by normalizing to NFD and stripping diacritics,
+* so "café" becomes "cafe", "naïve" becomes "naive", etc.
+*/
+/**
+* Decode a URI-encoded slug parameter.
+*
+* Browsers percent-encode non-ASCII characters in URLs, so a slug like
+* "మేష-రాసి" arrives as "%e0%b0%ae%e0%b1%87%e0%b0%b7-%e0%b0%b0%e0%b0%be%e0%b0%b8%e0%b0%bf".
+* Call this on `Astro.params.slug` before using it in database lookups.
+*/
+function decodeSlug(raw) {
+	return raw ? decodeURIComponent(raw) : void 0;
+}
+function slugify(text, maxLength = 80) {
+	return text.toLowerCase().normalize("NFD").replace(DIACRITICS_PATTERN, "").replace(WHITESPACE_UNDERSCORE_PATTERN, "-").replace(NON_ALPHANUMERIC_HYPHEN_PATTERN, "").replace(MULTIPLE_HYPHENS_PATTERN, "-").replace(LEADING_TRAILING_HYPHEN_PATTERN, "").slice(0, maxLength).replace(TRAILING_HYPHEN_PATTERN, "");
+}
+
+//#endregion
+export { slugify as n, decodeSlug as t };
+//# sourceMappingURL=slugify-Cjh1ssOZ.mjs.map

package/dist/slugify-Cjh1ssOZ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"slugify-Cjh1ssOZ.mjs","names":[],"sources":["../src/utils/slugify.ts"],"sourcesContent":["// Regex patterns for slug normalization\nconst DIACRITICS_PATTERN = /[\\u0300-\\u036f]/g;\nconst WHITESPACE_UNDERSCORE_PATTERN = /[\\s_]+/g;\nconst NON_ALPHANUMERIC_HYPHEN_PATTERN = /[^a-z0-9-]/g;\nconst MULTIPLE_HYPHENS_PATTERN = /-+/g;\nconst LEADING_TRAILING_HYPHEN_PATTERN = /^-|-$/g;\nconst TRAILING_HYPHEN_PATTERN = /-$/;\n\n/**\n * Convert a string to a URL-friendly slug.\n *\n * Handles unicode by normalizing to NFD and stripping diacritics,\n * so \"café\" becomes \"cafe\", \"naïve\" becomes \"naive\", etc.\n */\n/**\n * Decode a URI-encoded slug parameter.\n *\n * Browsers percent-encode non-ASCII characters in URLs, so a slug like\n * \"మేష-రాసి\" arrives as \"%e0%b0%ae%e0%b1%87%e0%b0%b7-%e0%b0%b0%e0%b0%be%e0%b0%b8%e0%b0%bf\".\n * Call this on `Astro.params.slug` before using it in database lookups.\n */\nexport function decodeSlug(raw: string | undefined): string | undefined {\n\treturn raw ? decodeURIComponent(raw) : undefined;\n}\n\nexport function slugify(text: string, maxLength: number = 80): string {\n\treturn (\n\t\ttext\n\t\t\t.toLowerCase()\n\t\t\t.normalize(\"NFD\")\n\t\t\t.replace(DIACRITICS_PATTERN, \"\")\n\t\t\t.replace(WHITESPACE_UNDERSCORE_PATTERN, \"-\")\n\t\t\t.replace(NON_ALPHANUMERIC_HYPHEN_PATTERN, \"\")\n\t\t\t.replace(MULTIPLE_HYPHENS_PATTERN, \"-\")\n\t\t\t.replace(LEADING_TRAILING_HYPHEN_PATTERN, \"\")\n\t\t\t.slice(0, maxLength)\n\t\t\t// Clean trailing hyphen from truncation\n\t\t\t.replace(TRAILING_HYPHEN_PATTERN, \"\")\n\t);\n}\n"],"mappings":";AACA,MAAM,qBAAqB;AAC3B,MAAM,gCAAgC;AACtC,MAAM,kCAAkC;AACxC,MAAM,2BAA2B;AACjC,MAAM,kCAAkC;AACxC,MAAM,0BAA0B;;;;;;;;;;;;;;AAehC,SAAgB,WAAW,KAA6C;AACvE,QAAO,MAAM,mBAAmB,IAAI,GAAG;;AAGxC,SAAgB,QAAQ,MAAc,YAAoB,IAAY;AACrE,QACC,KACE,aAAa,CACb,UAAU,MAAM,CAChB,QAAQ,oBAAoB,GAAG,CAC/B,QAAQ,+BAA+B,IAAI,CAC3C,QAAQ,iCAAiC,GAAG,CAC5C,QAAQ,0BAA0B,IAAI,CACtC,QAAQ,iCAAiC,GAAG,CAC5C,MAAM,GAAG,UAAU,CAEnB,QAAQ,yBAAyB,GAAG"}

package/dist/ssrf-CTul4uQi.mjs

@@ -0,0 +1 @@
+export {  };

package/dist/ssrf-DzFN_qV-.mjs

@@ -0,0 +1,332 @@
+//#region src/security/ssrf.ts
+/**
+* SSRF protection for import URLs.
+*
+* Validates that URLs don't target internal/private network addresses.
+* Applied before any fetch() call in the import pipeline.
+*/
+const IPV4_MAPPED_IPV6_DOTTED_PATTERN = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i;
+const IPV4_MAPPED_IPV6_HEX_PATTERN = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
+const IPV4_TRANSLATED_HEX_PATTERN = /^::ffff:0:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
+const IPV6_EXPANDED_MAPPED_PATTERN = /^0{0,4}:0{0,4}:0{0,4}:0{0,4}:0{0,4}:ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
+/**
+* IPv4-compatible (deprecated) addresses: ::XXXX:XXXX
+*
+* The WHATWG URL parser normalizes [::127.0.0.1] to [::7f00:1] (no ffff prefix).
+* These are deprecated but still parsed, and bypass the ffff-based checks.
+*/
+const IPV4_COMPATIBLE_HEX_PATTERN = /^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
+/**
+* NAT64 prefix (RFC 6052): 64:ff9b::XXXX:XXXX
+*
+* Used by NAT64 gateways to embed IPv4 addresses in IPv6.
+* [64:ff9b::127.0.0.1] normalizes to [64:ff9b::7f00:1].
+*/
+const NAT64_HEX_PATTERN = /^64:ff9b::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
+const IPV6_BRACKET_PATTERN = /^\[|\]$/g;
+/** Match fc00::/7 ULA — first byte 0xfc or 0xfd followed by any byte. */
+const IPV6_ULA_FC_PATTERN = /^fc[0-9a-f]{2}:/;
+const IPV6_ULA_FD_PATTERN = /^fd[0-9a-f]{2}:/;
+/** Strip trailing dots from an FQDN-form hostname ("localhost." -> "localhost"). */
+const TRAILING_DOT_PATTERN = /\.+$/;
+/**
+* Private and reserved IP ranges that should never be fetched.
+*
+* Includes:
+* - Loopback (127.0.0.0/8)
+* - Private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
+* - Link-local (169.254.0.0/16)
+* - Cloud metadata (169.254.169.254 — AWS/GCP/Azure)
+* - IPv6 loopback and link-local
+*/
+const BLOCKED_PATTERNS = [
+	{
+		start: ip4ToNum(127, 0, 0, 0),
+		end: ip4ToNum(127, 255, 255, 255)
+	},
+	{
+		start: ip4ToNum(10, 0, 0, 0),
+		end: ip4ToNum(10, 255, 255, 255)
+	},
+	{
+		start: ip4ToNum(172, 16, 0, 0),
+		end: ip4ToNum(172, 31, 255, 255)
+	},
+	{
+		start: ip4ToNum(192, 168, 0, 0),
+		end: ip4ToNum(192, 168, 255, 255)
+	},
+	{
+		start: ip4ToNum(169, 254, 0, 0),
+		end: ip4ToNum(169, 254, 255, 255)
+	},
+	{
+		start: ip4ToNum(0, 0, 0, 0),
+		end: ip4ToNum(0, 255, 255, 255)
+	}
+];
+const BLOCKED_HOSTNAMES = new Set([
+	"localhost",
+	"metadata.google.internal",
+	"metadata.google",
+	"::1"
+]);
+/**
+* Wildcard DNS services that publicly resolve arbitrary IPs embedded in the
+* hostname. Commonly used in local dev and by SSRF exploit tooling to bypass
+* hostname-only blocklists (e.g. 127.0.0.1.nip.io -> 127.0.0.1).
+*
+* Matched case-insensitively as a suffix, so both the apex and any subdomain
+* are blocked.
+*/
+const BLOCKED_HOSTNAME_SUFFIXES = [
+	"nip.io",
+	"sslip.io",
+	"xip.io",
+	"traefik.me",
+	"lvh.me",
+	"localtest.me"
+];
+/** Blocked URL schemes */
+const ALLOWED_SCHEMES = new Set(["http:", "https:"]);
+function ip4ToNum(a, b, c, d) {
+	return (a << 24 | b << 16 | c << 8 | d) >>> 0;
+}
+function parseIpv4(ip) {
+	const parts = ip.split(".");
+	if (parts.length !== 4) return null;
+	const nums = parts.map(Number);
+	if (nums.some((n) => isNaN(n) || n < 0 || n > 255)) return null;
+	return ip4ToNum(nums[0], nums[1], nums[2], nums[3]);
+}
+/**
+* Convert IPv4-mapped/translated IPv6 addresses from hex form back to IPv4.
+*
+* The WHATWG URL parser normalizes dotted-decimal to hex:
+*   [::ffff:127.0.0.1] -> [::ffff:7f00:1]
+*   [::ffff:169.254.169.254] -> [::ffff:a9fe:a9fe]
+*
+* Without this conversion, the hex forms bypass isPrivateIp() regex checks.
+*/
+function normalizeIPv6MappedToIPv4(ip) {
+	let match = ip.match(IPV4_MAPPED_IPV6_HEX_PATTERN);
+	if (!match) match = ip.match(IPV4_TRANSLATED_HEX_PATTERN);
+	if (!match) match = ip.match(IPV6_EXPANDED_MAPPED_PATTERN);
+	if (!match) match = ip.match(IPV4_COMPATIBLE_HEX_PATTERN);
+	if (!match) match = ip.match(NAT64_HEX_PATTERN);
+	if (match) {
+		const high = parseInt(match[1] ?? "", 16);
+		const low = parseInt(match[2] ?? "", 16);
+		return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
+	}
+	return null;
+}
+function isPrivateIp(ip) {
+	const normalized = ip.toLowerCase();
+	if (normalized === "::1" || normalized === "::ffff:127.0.0.1") return true;
+	const hexIpv4 = normalizeIPv6MappedToIPv4(normalized);
+	if (hexIpv4) return isPrivateIp(hexIpv4);
+	const v4Match = normalized.match(IPV4_MAPPED_IPV6_DOTTED_PATTERN);
+	const num = parseIpv4(v4Match ? v4Match[1] : normalized);
+	if (num === null) return normalized.startsWith("fe80:") || IPV6_ULA_FC_PATTERN.test(normalized) || IPV6_ULA_FD_PATTERN.test(normalized);
+	return BLOCKED_PATTERNS.some((range) => num >= range.start && num <= range.end);
+}
+/**
+* Error thrown when SSRF protection blocks a URL.
+*/
+var SsrfError = class extends Error {
+	code = "SSRF_BLOCKED";
+	constructor(message) {
+		super(message);
+		this.name = "SsrfError";
+	}
+};
+/**
+* Validate that a URL is safe to fetch (not targeting internal networks).
+*
+* Checks:
+* 1. URL is well-formed with http/https scheme
+* 2. Hostname is not a known internal name (localhost, metadata endpoints)
+* 3. If hostname is an IP literal, it's not in a private range
+*
+* Note: DNS rebinding attacks are not fully mitigated (hostname could resolve
+* to a private IP). Full protection requires resolving DNS and checking the IP
+* before connecting, which needs a custom fetch implementation. This covers
+* the most common SSRF vectors.
+*
+* @throws SsrfError if the URL targets an internal address
+*/
+/** Maximum number of redirects to follow in ssrfSafeFetch */
+const MAX_REDIRECTS = 5;
+function validateExternalUrl(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new SsrfError("Invalid URL");
+	}
+	if (!ALLOWED_SCHEMES.has(parsed.protocol)) throw new SsrfError(`Scheme '${parsed.protocol}' is not allowed`);
+	const normalizedHost = parsed.hostname.replace(IPV6_BRACKET_PATTERN, "").toLowerCase().replace(TRAILING_DOT_PATTERN, "");
+	if (BLOCKED_HOSTNAMES.has(normalizedHost)) throw new SsrfError("URLs targeting internal hosts are not allowed");
+	for (const suffix of BLOCKED_HOSTNAME_SUFFIXES) if (normalizedHost === suffix || normalizedHost.endsWith(`.${suffix}`)) throw new SsrfError("URLs targeting wildcard DNS services are not allowed");
+	if (isPrivateIp(normalizedHost)) throw new SsrfError("URLs targeting private IP addresses are not allowed");
+	return parsed;
+}
+/**
+* Module-level default resolver. Tests can swap this with a stub so fetch
+* mocks don't see unexpected DoH round-trips. Production code should leave
+* it alone.
+*/
+let defaultResolver = null;
+/** Timeout for a single DoH request, in milliseconds. */
+const DOH_TIMEOUT_MS = 3e3;
+/** Default DoH endpoint — Cloudflare's public resolver. */
+const DEFAULT_DOH_URL = "https://cloudflare-dns.com/dns-query";
+function hasProperty(obj, key) {
+	return typeof obj === "object" && obj !== null && key in obj;
+}
+/**
+* Narrow an unknown JSON body to a DohResponse shape we can read safely.
+* Throws if the body doesn't look like a DoH response — a malformed body is
+* indistinguishable from a failure and must not be silently treated as empty.
+*/
+function parseDohResponse(raw) {
+	if (!hasProperty(raw, "Status") || typeof raw.Status !== "number") throw new Error("DoH response missing Status field");
+	const answers = [];
+	if (hasProperty(raw, "Answer") && Array.isArray(raw.Answer)) {
+		for (const entry of raw.Answer) if (hasProperty(entry, "data") && typeof entry.data === "string") answers.push({ data: entry.data });
+	}
+	return {
+		Status: raw.Status,
+		Answer: answers
+	};
+}
+/**
+* Resolve a hostname via DNS over HTTPS (Cloudflare). Returns all A and AAAA
+* records. Works in both Workers and Node without requiring node:dns.
+*
+* Fails closed: any network error, non-2xx response, or DNS rcode != 0
+* causes a rejected promise so the calling validator treats it as a block.
+*/
+const cloudflareDohResolver = async (hostname) => {
+	async function query(type) {
+		const params = new URLSearchParams({
+			name: hostname,
+			type
+		});
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), DOH_TIMEOUT_MS);
+		try {
+			const response = await globalThis.fetch(`${DEFAULT_DOH_URL}?${params.toString()}`, {
+				headers: { Accept: "application/dns-json" },
+				signal: controller.signal
+			});
+			if (!response.ok) throw new Error(`DoH lookup failed: ${response.status}`);
+			const body = parseDohResponse(await response.json());
+			if (body.Status === 3) return [];
+			if (body.Status !== 0) throw new Error(`DoH ${type} lookup failed: rcode=${body.Status}`);
+			return body.Answer.map((a) => a.data).filter(isIpLiteral);
+		} finally {
+			clearTimeout(timeout);
+		}
+	}
+	const [a, aaaa] = await Promise.all([query("A"), query("AAAA")]);
+	return [...a, ...aaaa];
+};
+/**
+* Validate a URL and resolve its hostname to check the actual IPs against
+* the private-range blocklist. This catches DNS rebinding attacks using
+* attacker-controlled domains that publicly resolve to private addresses,
+* and wildcard DNS services like nip.io used by exploit tooling.
+*
+* Runs `validateExternalUrl` first for cheap pre-flight checks (scheme,
+* literal IP, known-bad hostnames). Then resolves the hostname and rejects
+* if ANY returned address is private.
+*
+* Fails closed: if resolution fails or returns no records, throws SsrfError.
+*
+* **Caveats.** This does NOT fully close the TOCTOU between check and
+* connect. Attacks that still work against this layer include:
+*
+* - TTL=0 rebind: authoritative server returns public IP to the check, then
+*   private IP to the subsequent fetch() a few milliseconds later.
+* - Split-view via EDNS Client Subnet or source-IP inspection: the
+*   authoritative server returns public IP to Cloudflare's DoH resolver and
+*   private IP to the victim's own resolver (used by fetch()).
+* - Host-file overrides or split-horizon corporate DNS on self-hosted Node.
+* - Attacker-controlled rebinding services the caller has allowlisted.
+*
+* The only complete defense is a network-layer egress firewall. On
+* Cloudflare Workers, the platform fetch pipeline provides most of that.
+* On self-hosted Node, operators must restrict egress themselves.
+*/
+async function resolveAndValidateExternalUrl(url, options) {
+	const parsed = validateExternalUrl(url);
+	const hostname = parsed.hostname.replace(IPV6_BRACKET_PATTERN, "");
+	if (isIpLiteral(hostname)) return parsed;
+	const resolver = options?.resolver ?? defaultResolver ?? cloudflareDohResolver;
+	let addresses;
+	try {
+		addresses = await resolver(hostname);
+	} catch (error) {
+		throw new SsrfError(`Could not resolve hostname: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (addresses.length === 0) throw new SsrfError("Hostname resolved to no addresses");
+	for (const ip of addresses) if (isPrivateIp(ip)) throw new SsrfError("Hostname resolves to a private IP address");
+	return parsed;
+}
+/** True when a string looks like an IPv4 or IPv6 literal. */
+function isIpLiteral(host) {
+	if (parseIpv4(host) !== null) return true;
+	return host.includes(":");
+}
+/**
+* Fetch a URL with SSRF protection on redirects.
+*
+* Uses `redirect: "manual"` to intercept redirects and re-validate each
+* redirect target against SSRF rules before following it. This prevents
+* an attacker from setting up an allowed external URL that redirects to
+* an internal IP (e.g. 169.254.169.254 for cloud metadata).
+*
+* @throws SsrfError if the initial URL or any redirect target is internal
+*/
+/** Headers that must be stripped when a redirect crosses origins */
+const CREDENTIAL_HEADERS = [
+	"authorization",
+	"cookie",
+	"proxy-authorization"
+];
+async function ssrfSafeFetch(url, init, options) {
+	let currentUrl = url;
+	let currentInit = init;
+	for (let i = 0; i <= MAX_REDIRECTS; i++) {
+		await resolveAndValidateExternalUrl(currentUrl, options);
+		const response = await globalThis.fetch(currentUrl, {
+			...currentInit,
+			redirect: "manual"
+		});
+		if (response.status < 300 || response.status >= 400) return response;
+		const location = response.headers.get("Location");
+		if (!location) return response;
+		const previousOrigin = new URL(currentUrl).origin;
+		currentUrl = new URL(location, currentUrl).href;
+		if (previousOrigin !== new URL(currentUrl).origin && currentInit) currentInit = stripCredentialHeaders(currentInit);
+	}
+	throw new SsrfError(`Too many redirects (max ${MAX_REDIRECTS})`);
+}
+/**
+* Return a copy of init with credential headers removed.
+*/
+function stripCredentialHeaders(init) {
+	if (!init.headers) return init;
+	const headers = new Headers(init.headers);
+	for (const name of CREDENTIAL_HEADERS) headers.delete(name);
+	return {
+		...init,
+		headers
+	};
+}
+
+//#endregion
+export { validateExternalUrl as a, stripCredentialHeaders as i, resolveAndValidateExternalUrl as n, ssrfSafeFetch as r, SsrfError as t };
+//# sourceMappingURL=ssrf-DzFN_qV-.mjs.map