emdash 0.12.0 → 0.13.0

package/dist/api-tokens-D3C9v02m.mjs

@@ -0,0 +1,3 @@
+import { TOKEN_PREFIXES, VALID_SCOPES, generatePrefixedToken, hasScope, hashPrefixedToken as hashApiToken } from "@emdash-cms/auth";
+
+export { hashApiToken as a, hasScope as i, VALID_SCOPES as n, generatePrefixedToken as r, TOKEN_PREFIXES as t };

package/dist/api-tokens-eYymBhIT.mjs

@@ -0,0 +1,153 @@
+import { a as hashApiToken, r as generatePrefixedToken } from "./api-tokens-D3C9v02m.mjs";
+import { ulid } from "ulidx";
+
+//#region src/api/handlers/api-tokens.ts
+/**
+* Create a new API token for a user.
+*/
+async function handleApiTokenCreate(db, userId, input) {
+	try {
+		const id = ulid();
+		const { raw, hash, prefix } = generatePrefixedToken("ec_pat_");
+		await db.insertInto("_emdash_api_tokens").values({
+			id,
+			name: input.name,
+			token_hash: hash,
+			prefix,
+			user_id: userId,
+			scopes: JSON.stringify(input.scopes),
+			expires_at: input.expiresAt ?? null
+		}).execute();
+		return {
+			success: true,
+			data: {
+				token: raw,
+				info: {
+					id,
+					name: input.name,
+					prefix,
+					scopes: input.scopes,
+					userId,
+					expiresAt: input.expiresAt ?? null,
+					lastUsedAt: null,
+					createdAt: (/* @__PURE__ */ new Date()).toISOString()
+				}
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "TOKEN_CREATE_ERROR",
+				message: "Failed to create API token"
+			}
+		};
+	}
+}
+/**
+* List all API tokens for a user (never returns the raw token or hash).
+*/
+async function handleApiTokenList(db, userId) {
+	try {
+		return {
+			success: true,
+			data: { items: (await db.selectFrom("_emdash_api_tokens").select([
+				"id",
+				"name",
+				"prefix",
+				"scopes",
+				"user_id",
+				"expires_at",
+				"last_used_at",
+				"created_at"
+			]).where("user_id", "=", userId).orderBy("created_at", "desc").execute()).map((row) => ({
+				id: row.id,
+				name: row.name,
+				prefix: row.prefix,
+				scopes: JSON.parse(row.scopes),
+				userId: row.user_id,
+				expiresAt: row.expires_at,
+				lastUsedAt: row.last_used_at,
+				createdAt: row.created_at
+			})) }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "TOKEN_LIST_ERROR",
+				message: "Failed to list API tokens"
+			}
+		};
+	}
+}
+/**
+* Revoke (delete) an API token.
+*/
+async function handleApiTokenRevoke(db, tokenId, userId) {
+	try {
+		if ((await db.deleteFrom("_emdash_api_tokens").where("id", "=", tokenId).where("user_id", "=", userId).executeTakeFirst()).numDeletedRows === 0n) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "Token not found"
+			}
+		};
+		return {
+			success: true,
+			data: { revoked: true }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "TOKEN_REVOKE_ERROR",
+				message: "Failed to revoke API token"
+			}
+		};
+	}
+}
+/**
+* Resolve a raw API token (ec_pat_...) to a user ID and scopes.
+* Updates last_used_at on successful lookup.
+* Returns null if the token is invalid or expired.
+*/
+async function resolveApiToken(db, rawToken) {
+	const hash = hashApiToken(rawToken);
+	const row = await db.selectFrom("_emdash_api_tokens").select([
+		"id",
+		"user_id",
+		"scopes",
+		"expires_at"
+	]).where("token_hash", "=", hash).executeTakeFirst();
+	if (!row) return null;
+	if (row.expires_at && new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
+	db.updateTable("_emdash_api_tokens").set({ last_used_at: (/* @__PURE__ */ new Date()).toISOString() }).where("id", "=", row.id).execute().catch(() => {});
+	return {
+		userId: row.user_id,
+		scopes: JSON.parse(row.scopes)
+	};
+}
+/**
+* Resolve an OAuth access token (ec_oat_...) to a user ID and scopes.
+* Returns null if the token is invalid or expired.
+*/
+async function resolveOAuthToken(db, rawToken) {
+	const hash = hashApiToken(rawToken);
+	const row = await db.selectFrom("_emdash_oauth_tokens").select([
+		"user_id",
+		"scopes",
+		"expires_at",
+		"token_type"
+	]).where("token_hash", "=", hash).where("token_type", "=", "access").executeTakeFirst();
+	if (!row) return null;
+	if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
+	return {
+		userId: row.user_id,
+		scopes: JSON.parse(row.scopes)
+	};
+}
+
+//#endregion
+export { resolveOAuthToken as a, resolveApiToken as i, handleApiTokenList as n, handleApiTokenRevoke as r, handleApiTokenCreate as t };
+//# sourceMappingURL=api-tokens-eYymBhIT.mjs.map

package/dist/api-tokens-eYymBhIT.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-tokens-eYymBhIT.mjs","names":[],"sources":["../src/api/handlers/api-tokens.ts"],"sourcesContent":["/**\n * API token management handlers.\n *\n * Creates, lists, and revokes Personal Access Tokens (PATs).\n * Token format: ec_pat_<base64url>\n * Only the SHA-256 hash is stored — raw token shown once at creation.\n */\n\nimport type { Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { hashApiToken, generatePrefixedToken } from \"../../auth/api-tokens.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface ApiTokenInfo {\n\tid: string;\n\tname: string;\n\tprefix: string;\n\tscopes: string[];\n\tuserId: string;\n\texpiresAt: string | null;\n\tlastUsedAt: string | null;\n\tcreatedAt: string;\n}\n\nexport interface ApiTokenCreateResult {\n\t/** The raw token — shown once, never stored */\n\ttoken: string;\n\t/** Token metadata */\n\tinfo: ApiTokenInfo;\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new API token for a user.\n */\nexport async function handleApiTokenCreate(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tinput: {\n\t\tname: string;\n\t\tscopes: string[];\n\t\texpiresAt?: string;\n\t},\n): Promise<ApiResult<ApiTokenCreateResult>> {\n\ttry {\n\t\tconst id = ulid();\n\t\tconst { raw, hash, prefix } = generatePrefixedToken(\"ec_pat_\");\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_api_tokens\")\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tname: input.name,\n\t\t\t\ttoken_hash: hash,\n\t\t\t\tprefix,\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(input.scopes),\n\t\t\t\texpires_at: input.expiresAt ?? null,\n\t\t\t})\n\t\t\t.execute();\n\n\t\tconst info: ApiTokenInfo = {\n\t\t\tid,\n\t\t\tname: input.name,\n\t\t\tprefix,\n\t\t\tscopes: input.scopes,\n\t\t\tuserId,\n\t\t\texpiresAt: input.expiresAt ?? null,\n\t\t\tlastUsedAt: null,\n\t\t\tcreatedAt: new Date().toISOString(),\n\t\t};\n\n\t\treturn { success: true, data: { token: raw, info } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * List all API tokens for a user (never returns the raw token or hash).\n */\nexport async function handleApiTokenList(\n\tdb: Kysely<Database>,\n\tuserId: string,\n): Promise<ApiResult<{ items: ApiTokenInfo[] }>> {\n\ttry {\n\t\tconst rows = await db\n\t\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t\t.select([\n\t\t\t\t\"id\",\n\t\t\t\t\"name\",\n\t\t\t\t\"prefix\",\n\t\t\t\t\"scopes\",\n\t\t\t\t\"user_id\",\n\t\t\t\t\"expires_at\",\n\t\t\t\t\"last_used_at\",\n\t\t\t\t\"created_at\",\n\t\t\t])\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.execute();\n\n\t\tconst items: ApiTokenInfo[] = rows.map((row) => ({\n\t\t\tid: row.id,\n\t\t\tname: row.name,\n\t\t\tprefix: row.prefix,\n\t\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\t\tuserId: row.user_id,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tcreatedAt: row.created_at,\n\t\t}));\n\n\t\treturn { success: true, data: { items } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list API tokens\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Revoke (delete) an API token.\n */\nexport async function handleApiTokenRevoke(\n\tdb: Kysely<Database>,\n\ttokenId: string,\n\tuserId: string,\n): Promise<ApiResult<{ revoked: boolean }>> {\n\ttry {\n\t\tconst result = await db\n\t\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t\t.where(\"id\", \"=\", tokenId)\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (result.numDeletedRows === 0n) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"Token not found\" },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: { revoked: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REVOKE_ERROR\",\n\t\t\t\tmessage: \"Failed to revoke API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Resolve a raw API token (ec_pat_...) to a user ID and scopes.\n * Updates last_used_at on successful lookup.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveApiToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<{ userId: string; scopes: string[] } | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t.select([\"id\", \"user_id\", \"scopes\", \"expires_at\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (row.expires_at && new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\t// Update last_used_at (fire-and-forget, don't block the request)\n\tdb.updateTable(\"_emdash_api_tokens\")\n\t\t.set({ last_used_at: new Date().toISOString() })\n\t\t.where(\"id\", \"=\", row.id)\n\t\t.execute()\n\t\t.catch(() => {}); // Non-critical, swallow errors\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t};\n}\n\n/**\n * Resolve an OAuth access token (ec_oat_...) to a user ID and scopes.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveOAuthToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<{ userId: string; scopes: string[] } | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t.select([\"user_id\", \"scopes\", \"expires_at\", \"token_type\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.where(\"token_type\", \"=\", \"access\")\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t};\n}\n"],"mappings":";;;;;;;AA4CA,eAAsB,qBACrB,IACA,QACA,OAK2C;AAC3C,KAAI;EACH,MAAM,KAAK,MAAM;EACjB,MAAM,EAAE,KAAK,MAAM,WAAW,sBAAsB,UAAU;AAE9D,QAAM,GACJ,WAAW,qBAAqB,CAChC,OAAO;GACP;GACA,MAAM,MAAM;GACZ,YAAY;GACZ;GACA,SAAS;GACT,QAAQ,KAAK,UAAU,MAAM,OAAO;GACpC,YAAY,MAAM,aAAa;GAC/B,CAAC,CACD,SAAS;AAaX,SAAO;GAAE,SAAS;GAAM,MAAM;IAAE,OAAO;IAAK,MAXjB;KAC1B;KACA,MAAM,MAAM;KACZ;KACA,QAAQ,MAAM;KACd;KACA,WAAW,MAAM,aAAa;KAC9B,YAAY;KACZ,4BAAW,IAAI,MAAM,EAAC,aAAa;KACnC;IAEiD;GAAE;SAC7C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,mBACrB,IACA,QACgD;AAChD,KAAI;AA4BH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,QA3BnB,MAAM,GACjB,WAAW,qBAAqB,CAChC,OAAO;IACP;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,CAAC,CACD,MAAM,WAAW,KAAK,OAAO,CAC7B,QAAQ,cAAc,OAAO,CAC7B,SAAS,EAEwB,KAAK,SAAS;IAChD,IAAI,IAAI;IACR,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;IAC9B,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,YAAY,IAAI;IAChB,WAAW,IAAI;IACf,EAAE,EAEoC;GAAE;SAClC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,qBACrB,IACA,SACA,QAC2C;AAC3C,KAAI;AAOH,OANe,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,MAAM,KAAK,QAAQ,CACzB,MAAM,WAAW,KAAK,OAAO,CAC7B,kBAAkB,EAET,mBAAmB,GAC7B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAAmB;GACxD;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;AASH,eAAsB,gBACrB,IACA,UACuD;CACvD,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,qBAAqB,CAChC,OAAO;EAAC;EAAM;EAAW;EAAU;EAAa,CAAC,CACjD,MAAM,cAAc,KAAK,KAAK,CAC9B,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CAC1D,QAAO;AAIR,IAAG,YAAY,qBAAqB,CAClC,IAAI,EAAE,+BAAc,IAAI,MAAM,EAAC,aAAa,EAAE,CAAC,CAC/C,MAAM,MAAM,KAAK,IAAI,GAAG,CACxB,SAAS,CACT,YAAY,GAAG;AAEjB,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAC9B;;;;;;AAOF,eAAsB,kBACrB,IACA,UACuD;CACvD,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,OAAO;EAAC;EAAW;EAAU;EAAc;EAAa,CAAC,CACzD,MAAM,cAAc,KAAK,KAAK,CAC9B,MAAM,cAAc,KAAK,SAAS,CAClC,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CACxC,QAAO;AAGR,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAC9B"}

package/dist/{apply-C1ZORgcy.mjs → apply-v4DBgjPw.mjs}

@@ -1,347 +1,20 @@
-import { i as __exportAll } from "./runner-DIcU2UCC.mjs";
+import { i as __exportAll } from "./runner-DdnQIwz_.mjs";
 import { n as getI18nConfig } from "./config-CVssduLe.mjs";
-import { r as RevisionRepository, t as ContentRepository } from "./content-CERxPUN0.mjs";
-import { o as setSiteSettings, s as MediaRepository } from "./settings-nTXPRi3D.mjs";
-import { t as TaxonomyRepository } from "./taxonomy-D6NvlKo8.mjs";
-import { t as withTransaction } from "./transaction-D44LBXvU.mjs";
-import { t as RedirectRepository } from "./redirect-C5H7VGIX.mjs";
-import { t as BylineRepository } from "./byline-gFn1r0vA.mjs";
-import { i as FTSManager, n as SchemaRegistry } from "./registry-Do34mz_P.mjs";
-import { t as validateSeed } from "./validate-UK4Ja1uo.mjs";
+import { r as RevisionRepository, t as ContentRepository } from "./content-D6YG26WG.mjs";
+import { t as MediaRepository } from "./media-Dg7he9uK.mjs";
+import { t as TaxonomyRepository } from "./taxonomy-wPfusMK9.mjs";
+import { t as withTransaction } from "./transaction-NQj4VJ7Z.mjs";
+import { t as RedirectRepository } from "./redirect-DkaDxq8e.mjs";
+import { t as BylineRepository } from "./byline-D09BaS4j.mjs";
+import { t as FTSManager } from "./fts-manager-B633C-kQ.mjs";
+import { n as SchemaRegistry } from "./registry-BnCeHYsf.mjs";
+import { s as setSiteSettings } from "./settings-xQKsWnzQ.mjs";
+import { a as validateExternalUrl, r as ssrfSafeFetch } from "./ssrf-DzFN_qV-.mjs";
+import { t as validateSeed } from "./validate-DlFxcVVK.mjs";
 import { ulid } from "ulidx";
 import { imageSize } from "image-size";
 import mime from "mime/lite";
 
-//#region src/import/ssrf.ts
-/**
-* SSRF protection for import URLs.
-*
-* Validates that URLs don't target internal/private network addresses.
-* Applied before any fetch() call in the import pipeline.
-*/
-const IPV4_MAPPED_IPV6_DOTTED_PATTERN = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i;
-const IPV4_MAPPED_IPV6_HEX_PATTERN = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-const IPV4_TRANSLATED_HEX_PATTERN = /^::ffff:0:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-const IPV6_EXPANDED_MAPPED_PATTERN = /^0{0,4}:0{0,4}:0{0,4}:0{0,4}:0{0,4}:ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-/**
-* IPv4-compatible (deprecated) addresses: ::XXXX:XXXX
-*
-* The WHATWG URL parser normalizes [::127.0.0.1] to [::7f00:1] (no ffff prefix).
-* These are deprecated but still parsed, and bypass the ffff-based checks.
-*/
-const IPV4_COMPATIBLE_HEX_PATTERN = /^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-/**
-* NAT64 prefix (RFC 6052): 64:ff9b::XXXX:XXXX
-*
-* Used by NAT64 gateways to embed IPv4 addresses in IPv6.
-* [64:ff9b::127.0.0.1] normalizes to [64:ff9b::7f00:1].
-*/
-const NAT64_HEX_PATTERN = /^64:ff9b::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-const IPV6_BRACKET_PATTERN = /^\[|\]$/g;
-/** Match fc00::/7 ULA — first byte 0xfc or 0xfd followed by any byte. */
-const IPV6_ULA_FC_PATTERN = /^fc[0-9a-f]{2}:/;
-const IPV6_ULA_FD_PATTERN = /^fd[0-9a-f]{2}:/;
-/** Strip trailing dots from an FQDN-form hostname ("localhost." -> "localhost"). */
-const TRAILING_DOT_PATTERN = /\.+$/;
-/**
-* Private and reserved IP ranges that should never be fetched.
-*
-* Includes:
-* - Loopback (127.0.0.0/8)
-* - Private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
-* - Link-local (169.254.0.0/16)
-* - Cloud metadata (169.254.169.254 — AWS/GCP/Azure)
-* - IPv6 loopback and link-local
-*/
-const BLOCKED_PATTERNS = [
-	{
-		start: ip4ToNum(127, 0, 0, 0),
-		end: ip4ToNum(127, 255, 255, 255)
-	},
-	{
-		start: ip4ToNum(10, 0, 0, 0),
-		end: ip4ToNum(10, 255, 255, 255)
-	},
-	{
-		start: ip4ToNum(172, 16, 0, 0),
-		end: ip4ToNum(172, 31, 255, 255)
-	},
-	{
-		start: ip4ToNum(192, 168, 0, 0),
-		end: ip4ToNum(192, 168, 255, 255)
-	},
-	{
-		start: ip4ToNum(169, 254, 0, 0),
-		end: ip4ToNum(169, 254, 255, 255)
-	},
-	{
-		start: ip4ToNum(0, 0, 0, 0),
-		end: ip4ToNum(0, 255, 255, 255)
-	}
-];
-const BLOCKED_HOSTNAMES = new Set([
-	"localhost",
-	"metadata.google.internal",
-	"metadata.google",
-	"::1"
-]);
-/**
-* Wildcard DNS services that publicly resolve arbitrary IPs embedded in the
-* hostname. Commonly used in local dev and by SSRF exploit tooling to bypass
-* hostname-only blocklists (e.g. 127.0.0.1.nip.io -> 127.0.0.1).
-*
-* Matched case-insensitively as a suffix, so both the apex and any subdomain
-* are blocked.
-*/
-const BLOCKED_HOSTNAME_SUFFIXES = [
-	"nip.io",
-	"sslip.io",
-	"xip.io",
-	"traefik.me",
-	"lvh.me",
-	"localtest.me"
-];
-/** Blocked URL schemes */
-const ALLOWED_SCHEMES = new Set(["http:", "https:"]);
-function ip4ToNum(a, b, c, d) {
-	return (a << 24 | b << 16 | c << 8 | d) >>> 0;
-}
-function parseIpv4(ip) {
-	const parts = ip.split(".");
-	if (parts.length !== 4) return null;
-	const nums = parts.map(Number);
-	if (nums.some((n) => isNaN(n) || n < 0 || n > 255)) return null;
-	return ip4ToNum(nums[0], nums[1], nums[2], nums[3]);
-}
-/**
-* Convert IPv4-mapped/translated IPv6 addresses from hex form back to IPv4.
-*
-* The WHATWG URL parser normalizes dotted-decimal to hex:
-*   [::ffff:127.0.0.1] -> [::ffff:7f00:1]
-*   [::ffff:169.254.169.254] -> [::ffff:a9fe:a9fe]
-*
-* Without this conversion, the hex forms bypass isPrivateIp() regex checks.
-*/
-function normalizeIPv6MappedToIPv4(ip) {
-	let match = ip.match(IPV4_MAPPED_IPV6_HEX_PATTERN);
-	if (!match) match = ip.match(IPV4_TRANSLATED_HEX_PATTERN);
-	if (!match) match = ip.match(IPV6_EXPANDED_MAPPED_PATTERN);
-	if (!match) match = ip.match(IPV4_COMPATIBLE_HEX_PATTERN);
-	if (!match) match = ip.match(NAT64_HEX_PATTERN);
-	if (match) {
-		const high = parseInt(match[1] ?? "", 16);
-		const low = parseInt(match[2] ?? "", 16);
-		return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
-	}
-	return null;
-}
-function isPrivateIp(ip) {
-	const normalized = ip.toLowerCase();
-	if (normalized === "::1" || normalized === "::ffff:127.0.0.1") return true;
-	const hexIpv4 = normalizeIPv6MappedToIPv4(normalized);
-	if (hexIpv4) return isPrivateIp(hexIpv4);
-	const v4Match = normalized.match(IPV4_MAPPED_IPV6_DOTTED_PATTERN);
-	const num = parseIpv4(v4Match ? v4Match[1] : normalized);
-	if (num === null) return normalized.startsWith("fe80:") || IPV6_ULA_FC_PATTERN.test(normalized) || IPV6_ULA_FD_PATTERN.test(normalized);
-	return BLOCKED_PATTERNS.some((range) => num >= range.start && num <= range.end);
-}
-/**
-* Error thrown when SSRF protection blocks a URL.
-*/
-var SsrfError = class extends Error {
-	code = "SSRF_BLOCKED";
-	constructor(message) {
-		super(message);
-		this.name = "SsrfError";
-	}
-};
-/**
-* Validate that a URL is safe to fetch (not targeting internal networks).
-*
-* Checks:
-* 1. URL is well-formed with http/https scheme
-* 2. Hostname is not a known internal name (localhost, metadata endpoints)
-* 3. If hostname is an IP literal, it's not in a private range
-*
-* Note: DNS rebinding attacks are not fully mitigated (hostname could resolve
-* to a private IP). Full protection requires resolving DNS and checking the IP
-* before connecting, which needs a custom fetch implementation. This covers
-* the most common SSRF vectors.
-*
-* @throws SsrfError if the URL targets an internal address
-*/
-/** Maximum number of redirects to follow in ssrfSafeFetch */
-const MAX_REDIRECTS = 5;
-function validateExternalUrl(url) {
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		throw new SsrfError("Invalid URL");
-	}
-	if (!ALLOWED_SCHEMES.has(parsed.protocol)) throw new SsrfError(`Scheme '${parsed.protocol}' is not allowed`);
-	const normalizedHost = parsed.hostname.replace(IPV6_BRACKET_PATTERN, "").toLowerCase().replace(TRAILING_DOT_PATTERN, "");
-	if (BLOCKED_HOSTNAMES.has(normalizedHost)) throw new SsrfError("URLs targeting internal hosts are not allowed");
-	for (const suffix of BLOCKED_HOSTNAME_SUFFIXES) if (normalizedHost === suffix || normalizedHost.endsWith(`.${suffix}`)) throw new SsrfError("URLs targeting wildcard DNS services are not allowed");
-	if (isPrivateIp(normalizedHost)) throw new SsrfError("URLs targeting private IP addresses are not allowed");
-	return parsed;
-}
-/**
-* Module-level default resolver. Tests can swap this with a stub so fetch
-* mocks don't see unexpected DoH round-trips. Production code should leave
-* it alone.
-*/
-let defaultResolver = null;
-/** Timeout for a single DoH request, in milliseconds. */
-const DOH_TIMEOUT_MS = 3e3;
-/** Default DoH endpoint — Cloudflare's public resolver. */
-const DEFAULT_DOH_URL = "https://cloudflare-dns.com/dns-query";
-function hasProperty(obj, key) {
-	return typeof obj === "object" && obj !== null && key in obj;
-}
-/**
-* Narrow an unknown JSON body to a DohResponse shape we can read safely.
-* Throws if the body doesn't look like a DoH response — a malformed body is
-* indistinguishable from a failure and must not be silently treated as empty.
-*/
-function parseDohResponse(raw) {
-	if (!hasProperty(raw, "Status") || typeof raw.Status !== "number") throw new Error("DoH response missing Status field");
-	const answers = [];
-	if (hasProperty(raw, "Answer") && Array.isArray(raw.Answer)) {
-		for (const entry of raw.Answer) if (hasProperty(entry, "data") && typeof entry.data === "string") answers.push({ data: entry.data });
-	}
-	return {
-		Status: raw.Status,
-		Answer: answers
-	};
-}
-/**
-* Resolve a hostname via DNS over HTTPS (Cloudflare). Returns all A and AAAA
-* records. Works in both Workers and Node without requiring node:dns.
-*
-* Fails closed: any network error, non-2xx response, or DNS rcode != 0
-* causes a rejected promise so the calling validator treats it as a block.
-*/
-const cloudflareDohResolver = async (hostname) => {
-	async function query(type) {
-		const params = new URLSearchParams({
-			name: hostname,
-			type
-		});
-		const controller = new AbortController();
-		const timeout = setTimeout(() => controller.abort(), DOH_TIMEOUT_MS);
-		try {
-			const response = await globalThis.fetch(`${DEFAULT_DOH_URL}?${params.toString()}`, {
-				headers: { Accept: "application/dns-json" },
-				signal: controller.signal
-			});
-			if (!response.ok) throw new Error(`DoH lookup failed: ${response.status}`);
-			const body = parseDohResponse(await response.json());
-			if (body.Status === 3) return [];
-			if (body.Status !== 0) throw new Error(`DoH ${type} lookup failed: rcode=${body.Status}`);
-			return body.Answer.map((a) => a.data).filter(isIpLiteral);
-		} finally {
-			clearTimeout(timeout);
-		}
-	}
-	const [a, aaaa] = await Promise.all([query("A"), query("AAAA")]);
-	return [...a, ...aaaa];
-};
-/**
-* Validate a URL and resolve its hostname to check the actual IPs against
-* the private-range blocklist. This catches DNS rebinding attacks using
-* attacker-controlled domains that publicly resolve to private addresses,
-* and wildcard DNS services like nip.io used by exploit tooling.
-*
-* Runs `validateExternalUrl` first for cheap pre-flight checks (scheme,
-* literal IP, known-bad hostnames). Then resolves the hostname and rejects
-* if ANY returned address is private.
-*
-* Fails closed: if resolution fails or returns no records, throws SsrfError.
-*
-* **Caveats.** This does NOT fully close the TOCTOU between check and
-* connect. Attacks that still work against this layer include:
-*
-* - TTL=0 rebind: authoritative server returns public IP to the check, then
-*   private IP to the subsequent fetch() a few milliseconds later.
-* - Split-view via EDNS Client Subnet or source-IP inspection: the
-*   authoritative server returns public IP to Cloudflare's DoH resolver and
-*   private IP to the victim's own resolver (used by fetch()).
-* - Host-file overrides or split-horizon corporate DNS on self-hosted Node.
-* - Attacker-controlled rebinding services the caller has allowlisted.
-*
-* The only complete defense is a network-layer egress firewall. On
-* Cloudflare Workers, the platform fetch pipeline provides most of that.
-* On self-hosted Node, operators must restrict egress themselves.
-*/
-async function resolveAndValidateExternalUrl(url, options) {
-	const parsed = validateExternalUrl(url);
-	const hostname = parsed.hostname.replace(IPV6_BRACKET_PATTERN, "");
-	if (isIpLiteral(hostname)) return parsed;
-	const resolver = options?.resolver ?? defaultResolver ?? cloudflareDohResolver;
-	let addresses;
-	try {
-		addresses = await resolver(hostname);
-	} catch (error) {
-		throw new SsrfError(`Could not resolve hostname: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	if (addresses.length === 0) throw new SsrfError("Hostname resolved to no addresses");
-	for (const ip of addresses) if (isPrivateIp(ip)) throw new SsrfError("Hostname resolves to a private IP address");
-	return parsed;
-}
-/** True when a string looks like an IPv4 or IPv6 literal. */
-function isIpLiteral(host) {
-	if (parseIpv4(host) !== null) return true;
-	return host.includes(":");
-}
-/**
-* Fetch a URL with SSRF protection on redirects.
-*
-* Uses `redirect: "manual"` to intercept redirects and re-validate each
-* redirect target against SSRF rules before following it. This prevents
-* an attacker from setting up an allowed external URL that redirects to
-* an internal IP (e.g. 169.254.169.254 for cloud metadata).
-*
-* @throws SsrfError if the initial URL or any redirect target is internal
-*/
-/** Headers that must be stripped when a redirect crosses origins */
-const CREDENTIAL_HEADERS = [
-	"authorization",
-	"cookie",
-	"proxy-authorization"
-];
-async function ssrfSafeFetch(url, init, options) {
-	let currentUrl = url;
-	let currentInit = init;
-	for (let i = 0; i <= MAX_REDIRECTS; i++) {
-		await resolveAndValidateExternalUrl(currentUrl, options);
-		const response = await globalThis.fetch(currentUrl, {
-			...currentInit,
-			redirect: "manual"
-		});
-		if (response.status < 300 || response.status >= 400) return response;
-		const location = response.headers.get("Location");
-		if (!location) return response;
-		const previousOrigin = new URL(currentUrl).origin;
-		currentUrl = new URL(location, currentUrl).href;
-		if (previousOrigin !== new URL(currentUrl).origin && currentInit) currentInit = stripCredentialHeaders(currentInit);
-	}
-	throw new SsrfError(`Too many redirects (max ${MAX_REDIRECTS})`);
-}
-/**
-* Return a copy of init with credential headers removed.
-*/
-function stripCredentialHeaders(init) {
-	if (!init.headers) return init;
-	const headers = new Headers(init.headers);
-	for (const name of CREDENTIAL_HEADERS) headers.delete(name);
-	return {
-		...init,
-		headers
-	};
-}
-
-//#endregion
 //#region src/seed/apply.ts
 /**
 * Seed engine - applies seed files to database
@@ -823,9 +496,9 @@ async function applySeed(db, seed, options = {}) {
 			}
 		}
 	}
-	const { invalidateBylineCache } = await import("./bylines-DTFI8nDM.mjs").then((n) => n.t);
-	const { invalidateRedirectCache } = await import("./cache-BAJbeoZ8.mjs").then((n) => n.t);
-	const { invalidateUrlPatternCache } = await import("./query-yA3-rFji.mjs").then((n) => n.o);
+	const { invalidateBylineCache } = await import("./bylines-BTM2xtP8.mjs").then((n) => n.t);
+	const { invalidateRedirectCache } = await import("./cache-CXCpjWiL.mjs").then((n) => n.t);
+	const { invalidateUrlPatternCache } = await import("./query-axZmO6Tn.mjs").then((n) => n.o);
 	invalidateBylineCache();
 	invalidateRedirectCache();
 	invalidateUrlPatternCache();
@@ -909,7 +582,7 @@ async function applyContentTaxonomies(db, collectionSlug, contentId, entry, isUp
 	if (isUpdate) await db.deleteFrom("content_taxonomies").where("collection", "=", collectionSlug).where("entry_id", "=", contentId).execute();
 	if (!entry.taxonomies) {
 		if (isUpdate) {
-			const { invalidateTermCache } = await import("./taxonomies-JmQQZiG1.mjs").then((n) => n.u);
+			const { invalidateTermCache } = await import("./taxonomies-Cn9UpaR2.mjs").then((n) => n.u);
 			invalidateTermCache();
 		}
 		return;
@@ -921,7 +594,7 @@ async function applyContentTaxonomies(db, collectionSlug, contentId, entry, isUp
 			if (term) await termRepo.attachToEntry(collectionSlug, contentId, term.id);
 		}
 	}
-	const { invalidateTermCache } = await import("./taxonomies-JmQQZiG1.mjs").then((n) => n.u);
+	const { invalidateTermCache } = await import("./taxonomies-Cn9UpaR2.mjs").then((n) => n.u);
 	invalidateTermCache();
 }
 /**
@@ -1167,5 +840,5 @@ function getImageDimensions(buffer) {
 }
 
 //#endregion
-export { ssrfSafeFetch as a, resolveAndValidateExternalUrl as i, apply_exports as n, stripCredentialHeaders as o, SsrfError as r, validateExternalUrl as s, applySeed as t };
-//# sourceMappingURL=apply-C1ZORgcy.mjs.map
+export { apply_exports as n, applySeed as t };
+//# sourceMappingURL=apply-v4DBgjPw.mjs.map