fix: validate turbopuffer_base_url with outbound URL policy

[bigint]

Motivation

• Prevent an admin-configurable SSRF/exfiltration vector by ensuring turbopuffer_base_url is normalized and validated with the same outbound URL safety policy used for S3 endpoints so settings-test/apply flows cannot contact arbitrary or private endpoints.

Description

• Apply normalize_url_root (with UnsafeOutboundUrlError handling) to turbopuffer_base_url in validate_setting_value alongside the existing S3 endpoint keys, and update the instance-settings docs to require normalized HTTPS roots that pass outbound safety checks.

Testing

• Ran lint/format attempts and doc checks: uv run ruff check --fix / uv run ruff format failed due to an external dependency download error, and pnpm exec biome check --write reported the docs path was ignored, so no automated test changes were executed in this environment.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
bigrag	Ready	Preview	May 22, 2026 10:59am