Update features and dependencies

apps/web/app/api/v1/ai/import-url/route.ts

@@ -2,8 +2,9 @@ import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 import { requireSession } from "@/lib/api-auth";
 import { applyRateLimit } from "@/lib/rate-limit";
-import { checkTierLimit, incrementUsage } from "@/lib/tiers";
+import { checkAndIncrementTierLimit } from "@/lib/tiers";
 import { importFromUrl } from "@/lib/ai/features/import-url";
+import { validateWebhookUrl } from "@/lib/validate-webhook-url";
 
 const Schema = z.object({
   url: z.string().url(),
@@ -21,17 +22,20 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
   }
 
+  const ssrfError = await validateWebhookUrl(parsed.data.url);
+  if (ssrfError) {
+    return NextResponse.json({ error: ssrfError }, { status: 400 });
+  }
+
   const limited = await applyRateLimit(`rl:ai:${session!.user.id}`, 10, 60);
   if (limited) return limited;
 
-  await checkTierLimit(session!.user.id, session!.user.tier as "free" | "pro", "aiCall");
+  await checkAndIncrementTierLimit(session!.user.id, session!.user.tier as "free" | "pro", "aiCall");
 
   const recipe = await importFromUrl(parsed.data.url, {
     provider: parsed.data.provider,
     model: parsed.data.model,
   });
 
-  await incrementUsage(session!.user.id, "aiCall");
-
   return NextResponse.json(recipe);
 }