[PerryLink]

Fixes #432.

@cordisjs/url-is-local@^1.0.0 is declared by adapters/dingtalk, adapters/discord,
adapters/kook and adapters/qq, but the package was never published, so a fresh install
dies in the resolution step before any job can run:

YN0035: @cordisjs/url-is-local@npm:^1.0.0: Package not found
YN0035:   Response Code: 404 (Not Found)
YN0035:   Request URL: https://registry.yarnpkg.com/@cordisjs%2furl-is-local

What this does

1. Adds isLocal to @satorijs/core (packages/core/src/url.ts, re-exported from
   index.ts). This is option 2 of the three in the issue: a pure code change, no new
   dependency, no package to publish. All four adapters already declare @satorijs/core
   as a peer dependency, so nothing else has to move. Happy to switch to whichever option
   you prefer.
2. Points the four import isLocal from ... sites at it, leaving every call site
   (await isLocal(attrs.src || attrs.url)) untouched.
3. Removes the dependency from the four package.json files.

Semantics

HTTP#isLocal was removed from the http plugin in 678f1857d8 ("refa: remove
http.isLocal()"). Its last published implementation resolves the host and tests the address
against the bogon ranges; the v4 branch still calls it as this.bot.http.isLocal(...).
The new helper is that same implementation, so "local" keeps meaning exactly what it meant
on v4. I could not find the package's own published source anywhere (it is not on npm,
and no repo of that name is public), so v4 is the only reference I could match against.

Verified on a clean clone of upstream main:

• before: corepack yarn install exits 1 with the YN0035 above
• after: corepack yarn install exits 0, 559 packages resolved, no stub or external/
  workaround of any kind
• packages/core/src/url.ts type-checks; tsc emits lib/url.d.ts and reports nothing
  for it

CI, before and after

This branch (run 174): the Install step passes in all four jobs, where it used to abort.
What it then reaches is a separate, older set of failures that this patch does not touch
and does not claim to fix:

• lint: 36 problems (30 errors, 6 warnings) - identical to the count produced locally
  against unmodified main, all in files this patch does not touch
• build: 70 tsc errors in 44 files - none of them in packages/core, and all of the
  shape "@cordisjs/plugin-http" has no exported member named 'HTTP'
• test (22) and test (24): the protocol spec dies with
  ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX because yakumo test removes --import tsx from the
  child node --test invocation, so the loader never reaches it

Those are worth their own issues; they are not this one.

[PerryLink]

Noting the CI state, because the red here is not this change.

Before this branch, Install failed in all four jobs:

YN0035: @cordisjs/url-is-local@npm:^1.0.0: Package not found
Response Code: 404

With this branch, Install succeeds — as far as I can tell it is the only pull request
in this repository that currently gets past that step. The jobs then fail one layer further
down, on problems this change does not touch and that predate it:

• Build — TypeScript errors, including
  TS2724: '"@cordisjs/plugin-http"' has no exported member named 'HTTP'. Did you mean 'Http'?
• Lint
• Unit Test (node 22 and node 24)

So the remaining red is the next layer, not a defect in this one. The HTTP error is what
#435 addresses, and the lint errors are what #436 addresses.

[PerryLink]

Closing this: main's install step is blocked by the unpublished @cordisjs/url-is-local package, so the branch cannot be validated here.