dineway 0.1.3 → 0.1.5

package/dist/{search-BNruJHDL.mjs → search-ByRGV2pq.mjs}

@@ -1,24 +1,29 @@
-import { n as createDatabase } from "./connection-C9pxzuag.mjs";
-import { o as jsonExtractExpr } from "./dialect-helpers-B9uSp2GJ.mjs";
-import { n as validateJsonFieldName, r as validatePluginIdentifier, t as validateIdentifier } from "./validate-CqRJb_xU.mjs";
-import { i as slugify, r as RevisionRepository, t as ContentRepository } from "./content-zSgdNmnt.mjs";
+import { runWithContext } from "./request-context.mjs";
+import { n as createDatabase } from "./connection-BCNICDWN.mjs";
+import { n as validateJsonFieldName, r as validatePluginIdentifier, t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
+import { o as jsonExtractExpr } from "./dialect-helpers-DhTzaUxP.mjs";
+import { a as slugify, r as RevisionRepository, t as ContentRepository } from "./content-DWi4d0rT.mjs";
 import { r as encodeBase64, t as decodeBase64 } from "./base64-F8-DUraK.mjs";
 import { n as decodeCursor, r as encodeCursor, t as DinewayValidationError } from "./types-BawVha09.mjs";
 import { t as MediaRepository } from "./media-DMTr80Gv.mjs";
-import { a as stripCredentialHeaders, f as OptionsRepository, i as ssrfSafeFetch, o as validateExternalUrl, r as SsrfError } from "./apply-CAPvMfoU.mjs";
-import { a as withTransaction, i as FTSManager, n as SchemaRegistry } from "./registry-DSd1GWB8.mjs";
-import { t as RedirectRepository } from "./redirect-JPqLAbxa.mjs";
-import { n as SQL_BATCH_SIZE, r as chunks, t as BylineRepository } from "./byline-DeWCMU_i.mjs";
-import { r as isI18nEnabled } from "./config-Cq8H0SfX.mjs";
-import { runWithContext } from "./request-context.mjs";
-import { n as getDb } from "./loader-qKmo0wAY.mjs";
-import { i as pluginManifestSchema } from "./manifest-schema-CTSEyIJ3.mjs";
-import { t as generatePreviewToken } from "./tokens-4vgYuXsZ.mjs";
+import { a as ssrfSafeFetch, i as resolveAndValidateExternalUrl, o as stripCredentialHeaders, p as OptionsRepository, r as SsrfError, s as validateExternalUrl } from "./apply-iVSqz2qs.mjs";
+import { t as withTransaction } from "./transaction-Cn2rjY78.mjs";
+import { t as RedirectRepository } from "./redirect-DnEWAkVg.mjs";
+import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks--4F8ddV4.mjs";
+import { t as BylineRepository } from "./byline-OhH2dlRu.mjs";
+import { r as isI18nEnabled } from "./config-BXwuX8Bx.mjs";
+import { i as invalidateRedirectCache } from "./cache-BdSY-gQN.mjs";
+import { i as FTSManager, n as SchemaRegistry } from "./registry-C0zjeB9P.mjs";
+import { n as getDb } from "./loader-sMG4TZ-u.mjs";
+import { n as requestCached } from "./request-cache-Dk5qPSOx.mjs";
+import { n as VERSION, t as COMMIT } from "./version-BKXPsfmJ.mjs";
+import { i as pluginManifestSchema } from "./manifest-schema-D1MSVnoI.mjs";
+import { t as generatePreviewToken } from "./tokens-CJz9ubV6.mjs";
 import BetterSqlite3 from "better-sqlite3";
 import { sql } from "kysely";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { ulid } from "ulidx";
 import { z } from "astro/zod";
-import { AsyncLocalStorage } from "node:async_hooks";
 import { z as z$1 } from "zod";
 import { createGzipDecoder, unpackTar } from "modern-tar";
 import { createHash } from "node:crypto";
@@ -995,6 +1000,13 @@ const SEO_DEFAULTS = {
 	canonical: null,
 	noIndex: false
 };
+var ContentUpdateApiError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "ContentUpdateApiError";
+	}
+};
 /**
 * Check if a collection has SEO enabled.
 */
@@ -1285,34 +1297,18 @@ async function handleContentUpdate(db, collection, id, body) {
 				message: `Collection "${collection}" does not have SEO enabled. Remove the seo field or enable SEO on this collection.`
 			}
 		};
-		const repo = new ContentRepository(db);
-		const resolvedId = await resolveId(repo, collection, id) ?? id;
-		if (body._rev) {
-			const existing = await repo.findById(collection, resolvedId);
-			if (!existing) return {
-				success: false,
-				error: {
-					code: "NOT_FOUND",
-					message: `Content item not found: ${id}`
-				}
-			};
-			const revCheck = validateRev(body._rev, existing);
-			if (!revCheck.valid) return {
-				success: false,
-				error: {
-					code: "CONFLICT",
-					message: revCheck.message
-				}
-			};
-		}
+		const resolvedId = await resolveId(new ContentRepository(db), collection, id) ?? id;
 		const item = await withTransaction(db, async (trx) => {
 			const trxRepo = new ContentRepository(trx);
 			const bylineRepo = new BylineRepository(trx);
-			let oldSlug;
-			if (body.slug) {
-				const existing = await trxRepo.findById(collection, resolvedId);
-				if (existing?.slug && existing.slug !== body.slug) oldSlug = existing.slug;
+			const existing = body._rev || body.slug ? await trxRepo.findById(collection, resolvedId) : null;
+			if (body._rev) {
+				if (!existing) throw new ContentUpdateApiError("NOT_FOUND", `Content item not found: ${id}`);
+				const revCheck = validateRev(body._rev, existing);
+				if (!revCheck.valid) throw new ContentUpdateApiError("CONFLICT", revCheck.message);
 			}
+			let oldSlug;
+			if (body.slug && existing?.slug && existing.slug !== body.slug) oldSlug = existing.slug;
 			const updated = await trxRepo.update(collection, resolvedId, {
 				data: body.data,
 				slug: body.slug,
@@ -1326,6 +1322,7 @@ async function handleContentUpdate(db, collection, id, body) {
 			if (oldSlug && body.slug) {
 				const collectionRow = await trx.selectFrom("_dineway_collections").select("url_pattern").where("slug", "=", collection).executeTakeFirst();
 				await new RedirectRepository(trx).createAutoRedirect(collection, oldSlug, body.slug, resolvedId, collectionRow?.url_pattern ?? null);
+				invalidateRedirectCache();
 			}
 			if (isI18nEnabled() && body.data && updated.translationGroup) await syncNonTranslatableFields(trx, collection, updated.id, updated.translationGroup, body.data);
 			if (body.seo && hasSeo) updated.seo = await new SeoRepository(trx).upsert(collection, resolvedId, body.seo);
@@ -1341,6 +1338,13 @@ async function handleContentUpdate(db, collection, id, body) {
 			}
 		};
 	} catch (error) {
+		if (error instanceof ContentUpdateApiError) return {
+			success: false,
+			error: {
+				code: error.code,
+				message: error.message
+			}
+		};
 		console.error("Content update error:", error);
 		return {
 			success: false,
@@ -1473,6 +1477,7 @@ async function handleContentPermanentDelete(db, collection, id) {
 			if (wasDeleted) {
 				await new SeoRepository(trx).delete(collection, resolvedId);
 				await new CommentRepository(trx).deleteByContent(collection, resolvedId);
+				await new RevisionRepository(trx).deleteByEntry(collection, resolvedId);
 			}
 			return wasDeleted;
 		})) return {
@@ -1847,6 +1852,151 @@ async function syncNonTranslatableFields(trx, collectionSlug, updatedItemId, tra
 	`.execute(trx);
 }
 
+//#endregion
+//#region src/plugins/state.ts
+function toPluginStatus(value) {
+	if (value === "active") return "active";
+	return "inactive";
+}
+function toPluginSource(value) {
+	if (value === "marketplace") return "marketplace";
+	return "config";
+}
+/**
+* Repository for plugin state in the database
+*/
+var PluginStateRepository = class {
+	constructor(db) {
+		this.db = db;
+	}
+	/**
+	* Get state for a specific plugin
+	*/
+	async get(pluginId) {
+		const row = await this.db.selectFrom("_plugin_state").selectAll().where("plugin_id", "=", pluginId).executeTakeFirst();
+		if (!row) return null;
+		return {
+			pluginId: row.plugin_id,
+			status: toPluginStatus(row.status),
+			version: row.version,
+			installedAt: new Date(row.installed_at),
+			activatedAt: row.activated_at ? new Date(row.activated_at) : null,
+			deactivatedAt: row.deactivated_at ? new Date(row.deactivated_at) : null,
+			source: toPluginSource(row.source),
+			marketplaceVersion: row.marketplace_version ?? null,
+			displayName: row.display_name ?? null,
+			description: row.description ?? null
+		};
+	}
+	/**
+	* Get all plugin states
+	*/
+	async getAll() {
+		return (await this.db.selectFrom("_plugin_state").selectAll().execute()).map((row) => ({
+			pluginId: row.plugin_id,
+			status: toPluginStatus(row.status),
+			version: row.version,
+			installedAt: new Date(row.installed_at),
+			activatedAt: row.activated_at ? new Date(row.activated_at) : null,
+			deactivatedAt: row.deactivated_at ? new Date(row.deactivated_at) : null,
+			source: toPluginSource(row.source),
+			marketplaceVersion: row.marketplace_version ?? null,
+			displayName: row.display_name ?? null,
+			description: row.description ?? null
+		}));
+	}
+	/**
+	* Get all marketplace-installed plugin states
+	*/
+	async getMarketplacePlugins() {
+		return (await this.db.selectFrom("_plugin_state").selectAll().where("source", "=", "marketplace").execute()).map((row) => ({
+			pluginId: row.plugin_id,
+			status: toPluginStatus(row.status),
+			version: row.version,
+			installedAt: new Date(row.installed_at),
+			activatedAt: row.activated_at ? new Date(row.activated_at) : null,
+			deactivatedAt: row.deactivated_at ? new Date(row.deactivated_at) : null,
+			source: toPluginSource(row.source),
+			marketplaceVersion: row.marketplace_version ?? null,
+			displayName: row.display_name ?? null,
+			description: row.description ?? null
+		}));
+	}
+	/**
+	* Create or update plugin state
+	*/
+	async upsert(pluginId, version, status, opts) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const existing = await this.get(pluginId);
+		if (existing) {
+			const updates = {
+				status,
+				version
+			};
+			if (status === "active" && existing.status !== "active") updates.activated_at = now;
+			else if (status === "inactive" && existing.status !== "inactive") updates.deactivated_at = now;
+			if (opts?.source) updates.source = opts.source;
+			if (opts?.marketplaceVersion !== void 0) updates.marketplace_version = opts.marketplaceVersion;
+			if (opts?.displayName !== void 0) updates.display_name = opts.displayName;
+			if (opts?.description !== void 0) updates.description = opts.description;
+			await this.db.updateTable("_plugin_state").set(updates).where("plugin_id", "=", pluginId).execute();
+		} else await this.db.insertInto("_plugin_state").values({
+			plugin_id: pluginId,
+			status,
+			version,
+			installed_at: now,
+			activated_at: status === "active" ? now : null,
+			deactivated_at: null,
+			data: null,
+			source: opts?.source ?? "config",
+			marketplace_version: opts?.marketplaceVersion ?? null,
+			display_name: opts?.displayName ?? null,
+			description: opts?.description ?? null
+		}).execute();
+		return await this.get(pluginId);
+	}
+	/**
+	* Enable a plugin
+	*/
+	async enable(pluginId, version) {
+		return this.upsert(pluginId, version, "active");
+	}
+	/**
+	* Disable a plugin
+	*/
+	async disable(pluginId, version) {
+		return this.upsert(pluginId, version, "inactive");
+	}
+	/**
+	* Delete plugin state
+	*/
+	async delete(pluginId) {
+		return ((await this.db.deleteFrom("_plugin_state").where("plugin_id", "=", pluginId).executeTakeFirst()).numDeletedRows ?? 0) > 0;
+	}
+};
+
+//#endregion
+//#region src/site-context/context-types.ts
+const SITE_CONTEXT_TYPES = [
+	"brand_voice",
+	"seo_strategy",
+	"audience",
+	"content_guideline",
+	"forbidden_terms",
+	"editorial_policy",
+	"migration_note",
+	"plugin_note",
+	"agent_reasoning",
+	"decision",
+	"risk",
+	"content_gap",
+	"style_exception"
+];
+const SITE_CONTEXT_TYPE_SET = new Set(SITE_CONTEXT_TYPES);
+function isSiteContextType(value) {
+	return SITE_CONTEXT_TYPE_SET.has(value);
+}
+
 //#endregion
 //#region src/utils/hash.ts
 /**
@@ -1901,7 +2051,8 @@ async function generateManifest(collections, plugins = {}) {
 		};
 	}
 	return {
-		version: "0.1.0",
+		version: VERSION,
+		commit: COMMIT,
 		hash: await hashString(JSON.stringify(manifestCollections)),
 		collections: manifestCollections,
 		plugins
@@ -2238,7 +2389,9 @@ async function handleMediaDelete(db, id) {
 * ```
 */
 async function getCollectionInfo(slug) {
-	return getCollectionInfoWithDb(await getDb(), slug);
+	return requestCached(`collection-info:${slug}`, async () => {
+		return getCollectionInfoWithDb(await getDb(), slug);
+	});
 }
 /**
 * Get collection metadata with an explicit db handle.
@@ -2250,129 +2403,6 @@ async function getCollectionInfoWithDb(db, slug) {
 	return new SchemaRegistry(db).getCollection(slug);
 }
 
-//#endregion
-//#region src/plugins/state.ts
-function toPluginStatus(value) {
-	if (value === "active") return "active";
-	return "inactive";
-}
-function toPluginSource(value) {
-	if (value === "marketplace") return "marketplace";
-	return "config";
-}
-/**
-* Repository for plugin state in the database
-*/
-var PluginStateRepository = class {
-	constructor(db) {
-		this.db = db;
-	}
-	/**
-	* Get state for a specific plugin
-	*/
-	async get(pluginId) {
-		const row = await this.db.selectFrom("_plugin_state").selectAll().where("plugin_id", "=", pluginId).executeTakeFirst();
-		if (!row) return null;
-		return {
-			pluginId: row.plugin_id,
-			status: toPluginStatus(row.status),
-			version: row.version,
-			installedAt: new Date(row.installed_at),
-			activatedAt: row.activated_at ? new Date(row.activated_at) : null,
-			deactivatedAt: row.deactivated_at ? new Date(row.deactivated_at) : null,
-			source: toPluginSource(row.source),
-			marketplaceVersion: row.marketplace_version ?? null,
-			displayName: row.display_name ?? null,
-			description: row.description ?? null
-		};
-	}
-	/**
-	* Get all plugin states
-	*/
-	async getAll() {
-		return (await this.db.selectFrom("_plugin_state").selectAll().execute()).map((row) => ({
-			pluginId: row.plugin_id,
-			status: toPluginStatus(row.status),
-			version: row.version,
-			installedAt: new Date(row.installed_at),
-			activatedAt: row.activated_at ? new Date(row.activated_at) : null,
-			deactivatedAt: row.deactivated_at ? new Date(row.deactivated_at) : null,
-			source: toPluginSource(row.source),
-			marketplaceVersion: row.marketplace_version ?? null,
-			displayName: row.display_name ?? null,
-			description: row.description ?? null
-		}));
-	}
-	/**
-	* Get all marketplace-installed plugin states
-	*/
-	async getMarketplacePlugins() {
-		return (await this.db.selectFrom("_plugin_state").selectAll().where("source", "=", "marketplace").execute()).map((row) => ({
-			pluginId: row.plugin_id,
-			status: toPluginStatus(row.status),
-			version: row.version,
-			installedAt: new Date(row.installed_at),
-			activatedAt: row.activated_at ? new Date(row.activated_at) : null,
-			deactivatedAt: row.deactivated_at ? new Date(row.deactivated_at) : null,
-			source: toPluginSource(row.source),
-			marketplaceVersion: row.marketplace_version ?? null,
-			displayName: row.display_name ?? null,
-			description: row.description ?? null
-		}));
-	}
-	/**
-	* Create or update plugin state
-	*/
-	async upsert(pluginId, version, status, opts) {
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const existing = await this.get(pluginId);
-		if (existing) {
-			const updates = {
-				status,
-				version
-			};
-			if (status === "active" && existing.status !== "active") updates.activated_at = now;
-			else if (status === "inactive" && existing.status !== "inactive") updates.deactivated_at = now;
-			if (opts?.source) updates.source = opts.source;
-			if (opts?.marketplaceVersion !== void 0) updates.marketplace_version = opts.marketplaceVersion;
-			if (opts?.displayName !== void 0) updates.display_name = opts.displayName;
-			if (opts?.description !== void 0) updates.description = opts.description;
-			await this.db.updateTable("_plugin_state").set(updates).where("plugin_id", "=", pluginId).execute();
-		} else await this.db.insertInto("_plugin_state").values({
-			plugin_id: pluginId,
-			status,
-			version,
-			installed_at: now,
-			activated_at: status === "active" ? now : null,
-			deactivated_at: null,
-			data: null,
-			source: opts?.source ?? "config",
-			marketplace_version: opts?.marketplaceVersion ?? null,
-			display_name: opts?.displayName ?? null,
-			description: opts?.description ?? null
-		}).execute();
-		return await this.get(pluginId);
-	}
-	/**
-	* Enable a plugin
-	*/
-	async enable(pluginId, version) {
-		return this.upsert(pluginId, version, "active");
-	}
-	/**
-	* Disable a plugin
-	*/
-	async disable(pluginId, version) {
-		return this.upsert(pluginId, version, "inactive");
-	}
-	/**
-	* Delete plugin state
-	*/
-	async delete(pluginId) {
-		return ((await this.db.deleteFrom("_plugin_state").where("plugin_id", "=", pluginId).executeTakeFirst()).numDeletedRows ?? 0) > 0;
-	}
-};
-
 //#endregion
 //#region src/sections/index.ts
 /**
@@ -2693,7 +2723,7 @@ const contentListQuery = cursorPaginationQuery.extend({
 const contentCreateBody = z$1.object({
 	data: z$1.record(z$1.string(), z$1.unknown()),
 	slug: z$1.string().nullish(),
-	status: z$1.string().optional(),
+	status: z$1.enum(["draft"]).optional(),
 	bylines: z$1.array(contentBylineInputSchema).optional(),
 	locale: localeCode.optional(),
 	translationOf: z$1.string().optional(),
@@ -2702,7 +2732,7 @@ const contentCreateBody = z$1.object({
 const contentUpdateBody = z$1.object({
 	data: z$1.record(z$1.string(), z$1.unknown()).optional(),
 	slug: z$1.string().nullish(),
-	status: z$1.string().optional(),
+	status: z$1.enum(["draft"]).optional(),
 	authorId: z$1.string().nullish(),
 	bylines: z$1.array(contentBylineInputSchema).optional(),
 	_rev: z$1.string().optional().meta({ description: "Opaque revision token for optimistic concurrency" }),
@@ -2713,6 +2743,10 @@ const contentScheduleBody = z$1.object({ scheduledAt: z$1.string().min(1, "sched
 	description: "ISO 8601 datetime for scheduled publishing",
 	example: "2025-06-15T09:00:00Z"
 }) }).meta({ id: "ContentScheduleBody" });
+const contentPublishBody = z$1.object({
+	reviewRequestId: z$1.string().optional().meta({ description: "Approved review request ID for token-authenticated publish execution." }),
+	review_request_id: z$1.string().optional().meta({ description: "Snake-case alias for reviewRequestId." })
+}).meta({ id: "ContentPublishBody" });
 const contentPreviewUrlBody = z$1.object({
 	expiresIn: z$1.union([z$1.string(), z$1.number()]).optional(),
 	pathPattern: z$1.string().optional()
@@ -2805,14 +2839,8 @@ const mediaUpdateBody = z$1.object({
 	width: z$1.number().int().positive().optional(),
 	height: z$1.number().int().positive().optional()
 }).meta({ id: "MediaUpdateBody" });
-/** Maximum allowed file upload size (50 MB). */
-const MAX_UPLOAD_SIZE = 50 * 1024 * 1024;
-const mediaUploadUrlBody = z$1.object({
-	filename: z$1.string().min(1, "filename is required"),
-	contentType: z$1.string().min(1, "contentType is required"),
-	size: z$1.number().int().positive().max(MAX_UPLOAD_SIZE, `File size must not exceed ${MAX_UPLOAD_SIZE / 1024 / 1024}MB`),
-	contentHash: z$1.string().optional()
-}).meta({ id: "MediaUploadUrlBody" });
+/** Default maximum allowed file upload size (50 MB). */
+const DEFAULT_MAX_UPLOAD_SIZE = 50 * 1024 * 1024;
 const mediaConfirmBody = z$1.object({
 	size: z$1.number().int().positive().optional(),
 	width: z$1.number().int().positive().optional(),
@@ -2875,9 +2903,11 @@ const collectionSupportValues = z$1.enum([
 	"search"
 ]);
 const collectionSourcePattern = /^(template:.+|import:.+|manual|discovered|seed)$/;
+const urlPatternSchema = z$1.string().refine((value) => !value || value.includes("{slug}"), "URL pattern must include a {slug} placeholder");
 const fieldTypeValues = z$1.enum([
 	"string",
 	"text",
+	"url",
 	"number",
 	"integer",
 	"boolean",
@@ -2897,6 +2927,7 @@ const repeaterSubFieldSchema = z$1.object({
 	type: z$1.enum([
 		"string",
 		"text",
+		"url",
 		"number",
 		"integer",
 		"boolean",
@@ -2928,7 +2959,7 @@ const createCollectionBody = z$1.object({
 	icon: z$1.string().optional(),
 	supports: z$1.array(collectionSupportValues).optional(),
 	source: z$1.string().regex(collectionSourcePattern).optional(),
-	urlPattern: z$1.string().optional(),
+	urlPattern: urlPatternSchema.optional(),
 	hasSeo: z$1.boolean().optional()
 }).meta({ id: "CreateCollectionBody" });
 const updateCollectionBody = z$1.object({
@@ -2937,7 +2968,7 @@ const updateCollectionBody = z$1.object({
 	description: z$1.string().optional(),
 	icon: z$1.string().optional(),
 	supports: z$1.array(collectionSupportValues).optional(),
-	urlPattern: z$1.string().nullish(),
+	urlPattern: urlPatternSchema.nullish(),
 	hasSeo: z$1.boolean().optional(),
 	commentsEnabled: z$1.boolean().optional(),
 	commentsModeration: z$1.enum([
@@ -3115,6 +3146,148 @@ const commentCountsResponseSchema = z$1.object({
 }).meta({ id: "CommentCountsResponse" });
 const commentBulkResponseSchema = z$1.object({ affected: z$1.number().int() }).meta({ id: "CommentBulkResponse" });
 
+//#endregion
+//#region src/api/schemas/context.ts
+const csvList = z$1.string().optional().transform((value) => value?.split(",").map((item) => item.trim()).filter((item) => item.length > 0));
+const contextTypesQuery$1 = z$1.string().optional().transform((value, ctx) => {
+	if (!value) return void 0;
+	const types = value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+	const invalid = types.find((type) => !isSiteContextType(type));
+	if (invalid) {
+		ctx.addIssue({
+			code: "custom",
+			message: `Invalid context type: ${invalid}`
+		});
+		return z$1.NEVER;
+	}
+	return types;
+});
+const optionalBooleanQuery$1 = z$1.enum(["true", "false"]).optional().transform((value) => value === void 0 ? void 0 : value === "true");
+const contextEntryListQuery = z$1.object({
+	q: z$1.string().optional(),
+	scope: z$1.string().optional(),
+	includeInherited: optionalBooleanQuery$1,
+	contextTypes: contextTypesQuery$1,
+	tags: csvList,
+	createdByActorType: z$1.enum([
+		"user",
+		"api_token",
+		"system"
+	]).optional(),
+	createdByActorId: z$1.string().optional(),
+	currentOnly: optionalBooleanQuery$1,
+	limit: z$1.coerce.number().int().min(1).max(100).optional(),
+	cursor: z$1.string().optional()
+}).meta({ id: "ContextEntryListQuery" });
+const contextEntryStaleQuery = contextEntryListQuery.omit({
+	q: true,
+	currentOnly: true
+}).extend({ now: z$1.string().optional() }).meta({ id: "ContextEntryStaleQuery" });
+const contextEntryDiffQuery = z$1.object({
+	since: z$1.string().min(1),
+	scope: z$1.string().optional(),
+	includeInherited: optionalBooleanQuery$1,
+	now: z$1.string().optional()
+}).meta({ id: "ContextEntryDiffQuery" });
+const contextEntryCreateBody = z$1.object({
+	scope: z$1.string().min(1),
+	contextType: z$1.enum(SITE_CONTEXT_TYPES),
+	title: z$1.string().min(1).max(200),
+	body: z$1.string().min(1).max(2e4),
+	tags: z$1.array(z$1.string()).max(50).optional(),
+	policyKey: z$1.string().max(200).nullable().optional(),
+	sourceActivityId: z$1.string().nullable().optional(),
+	validUntil: z$1.string().nullable().optional()
+}).meta({ id: "ContextEntryCreateBody" });
+const contextEntrySupersedeBody = z$1.object({
+	scope: z$1.string().min(1).optional(),
+	contextType: z$1.enum(SITE_CONTEXT_TYPES).optional(),
+	title: z$1.string().min(1).max(200),
+	body: z$1.string().min(1).max(2e4),
+	tags: z$1.array(z$1.string()).max(50).optional(),
+	policyKey: z$1.string().max(200).nullable().optional(),
+	sourceActivityId: z$1.string().nullable().optional(),
+	validUntil: z$1.string().nullable().optional()
+}).meta({ id: "ContextEntrySupersedeBody" });
+const contextEntryReviewBody = z$1.object({
+	reviewNote: z$1.string().max(5e3).nullable().optional(),
+	validUntil: z$1.string().nullable().optional()
+}).meta({ id: "ContextEntryReviewBody" });
+
+//#endregion
+//#region src/api/schemas/briefing.ts
+const optionalBooleanQuery = z$1.enum(["true", "false"]).optional().transform((value) => value === void 0 ? void 0 : value === "true");
+const contextTypesQuery = z$1.string().optional().transform((value, ctx) => {
+	if (!value) return void 0;
+	const types = value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+	const invalid = types.find((type) => !isSiteContextType(type));
+	if (invalid) {
+		ctx.addIssue({
+			code: "custom",
+			message: `Invalid context type: ${invalid}`
+		});
+		return z$1.NEVER;
+	}
+	return types;
+});
+const siteBriefingQuery = z$1.object({
+	scope: z$1.string().optional(),
+	since: z$1.string().optional(),
+	contextTypes: contextTypesQuery,
+	includeStale: optionalBooleanQuery,
+	tokenBudget: z$1.coerce.number().int().min(1).max(1e5).optional(),
+	activityLimit: z$1.coerce.number().int().min(1).max(100).optional()
+}).meta({ id: "SiteBriefingQuery" });
+
+//#endregion
+//#region src/api/schemas/hitl-requests.ts
+const optionalStatus$1 = z$1.enum([
+	"pending",
+	"approved",
+	"rejected"
+]).optional();
+const optionalPriority = z$1.enum([
+	"low",
+	"normal",
+	"high",
+	"urgent"
+]).optional();
+const hitlRequestListQuery = z$1.object({
+	status: optionalStatus$1,
+	priority: optionalPriority,
+	actionType: z$1.string().optional(),
+	scope: z$1.string().optional(),
+	targetRefType: z$1.string().optional(),
+	targetRefId: z$1.string().optional(),
+	limit: z$1.coerce.number().int().min(1).max(100).optional(),
+	cursor: z$1.string().optional()
+}).meta({ id: "HitlRequestListQuery" });
+const hitlRequestResolveBody = z$1.object({
+	decision: z$1.enum(["approved", "rejected"]),
+	reviewNote: z$1.string().max(5e3).nullable().optional()
+}).meta({ id: "HitlRequestResolveBody" });
+
+//#endregion
+//#region src/api/schemas/review-requests.ts
+const optionalStatus = z$1.enum([
+	"pending",
+	"approved",
+	"rejected"
+]).optional();
+const reviewRequestListQuery = z$1.object({
+	status: optionalStatus,
+	collection: z$1.string().optional(),
+	entryId: z$1.string().optional(),
+	scope: z$1.string().optional(),
+	actionType: z$1.string().optional(),
+	limit: z$1.coerce.number().int().min(1).max(100).optional(),
+	cursor: z$1.string().optional()
+}).meta({ id: "ReviewRequestListQuery" });
+const reviewRequestResolveBody = z$1.object({
+	decision: z$1.enum(["approved", "rejected"]),
+	reviewNote: z$1.string().max(5e3).nullable().optional()
+}).meta({ id: "ReviewRequestResolveBody" });
+
 //#endregion
 //#region src/api/schemas/auth.ts
 const authenticatorTransport$1 = z$1.enum([
@@ -3164,6 +3337,10 @@ const inviteCompleteBody = z$1.object({
 	credential: registrationCredential$1,
 	name: z$1.string().optional()
 }).meta({ id: "InviteCompleteBody" });
+const inviteRegisterOptionsBody = z$1.object({
+	token: z$1.string().min(1),
+	name: z$1.string().optional()
+}).meta({ id: "InviteRegisterOptionsBody" });
 const magicLinkSendBody = z$1.object({ email: z$1.string().email() }).meta({ id: "MagicLinkSendBody" });
 const passkeyOptionsBody = z$1.object({ email: z$1.string().email().optional() }).meta({ id: "PasskeyOptionsBody" });
 const passkeyVerifyBody = z$1.object({ credential: authenticationCredential }).meta({ id: "PasskeyVerifyBody" });
@@ -3400,6 +3577,7 @@ const mediaReference = z$1.object({
 	mediaId: z$1.string(),
 	alt: z$1.string().optional()
 });
+const resolvedMediaReference = mediaReference.extend({ url: z$1.string().optional() });
 const socialSettings = z$1.object({
 	twitter: z$1.string().optional(),
 	github: z$1.string().optional(),
@@ -3430,8 +3608,8 @@ const settingsUpdateBody = z$1.object({
 const siteSettingsSchema = z$1.object({
 	title: z$1.string().optional(),
 	tagline: z$1.string().optional(),
-	logo: mediaReference.optional(),
-	favicon: mediaReference.optional(),
+	logo: resolvedMediaReference.optional(),
+	favicon: resolvedMediaReference.optional(),
 	url: z$1.string().optional(),
 	postsPerPage: z$1.number().int().optional(),
 	dateFormat: z$1.string().optional(),
@@ -3713,7 +3891,8 @@ const redirectSchema = z$1.object({
 }).meta({ id: "Redirect" });
 const redirectListResponseSchema = z$1.object({
 	items: z$1.array(redirectSchema),
-	nextCursor: z$1.string().optional()
+	nextCursor: z$1.string().optional(),
+	loopRedirectIds: z$1.array(z$1.string()).optional()
 }).meta({ id: "RedirectListResponse" });
 const notFoundEntrySchema = z$1.object({
 	id: z$1.string(),
@@ -4270,6 +4449,14 @@ function convertCodeBlock(block) {
 	};
 }
 
+//#endregion
+//#region src/after.ts
+function after(fn) {
+	Promise.resolve().then(fn).catch((error) => {
+		console.error("[dineway] deferred task failed:", error);
+	});
+}
+
 //#endregion
 //#region src/preview/sidecar-client.ts
 /**
@@ -5744,6 +5931,35 @@ function resolveHook(hook, pluginId) {
 	};
 }
 
+//#endregion
+//#region src/auth/trusted-proxy.ts
+/**
+* RFC 7230 token characters for HTTP header names.
+* Invalid names throw when passed to `Headers.get()`.
+*/
+const HEADER_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9a-z]+$/;
+/** Cache for the env-derived value. `null` means "not yet parsed". */
+let envCache = null;
+function normalizeTrustedHeaders(names) {
+	return names.map((name) => name.trim().toLowerCase()).filter((name) => name.length > 0 && HEADER_NAME_PATTERN.test(name));
+}
+function getEnvTrustedHeaders() {
+	if (envCache !== null) return envCache;
+	let raw;
+	try {
+		const importMetaEnv = import.meta.env;
+		raw = (typeof process !== "undefined" ? process.env?.DINEWAY_TRUSTED_PROXY_HEADERS : void 0) || importMetaEnv?.DINEWAY_TRUSTED_PROXY_HEADERS;
+	} catch {
+		raw = void 0;
+	}
+	envCache = raw ? normalizeTrustedHeaders(raw.split(",")) : [];
+	return envCache;
+}
+function getTrustedProxyHeaders(config) {
+	if (config?.trustedProxyHeaders !== void 0) return normalizeTrustedHeaders(config.trustedProxyHeaders);
+	return getEnvTrustedHeaders();
+}
+
 //#endregion
 //#region src/plugins/request-meta.ts
 /**
@@ -5765,6 +5981,18 @@ function parseFirstForwardedIp(header) {
 	return IP_PATTERN.test(trimmed) ? trimmed : null;
 }
 /**
+* Read an IP from an operator-declared trusted header. Forwarded-for style
+* headers are parsed as comma-separated lists and the first entry is used.
+*/
+function readIpFromHeader(headers, name) {
+	const value = headers.get(name);
+	if (!value) return null;
+	if (name.endsWith("forwarded-for")) return parseFirstForwardedIp(value);
+	const trimmed = value.trim();
+	if (!trimmed) return null;
+	return IP_PATTERN.test(trimmed) ? trimmed : null;
+}
+/**
 * Get the runtime-provided `cf` object from the request, if present.
 */
 function getCfObject(request) {
@@ -5793,13 +6021,15 @@ function extractGeo(cf) {
 * 1. `CF-Connecting-IP` header — only trusted when a `cf` object is
 *    present on the request (proving the request came through a trusted
 *    edge/runtime that strips or overwrites client-supplied values).
-* 2. `X-Forwarded-For` header (first entry) — best-effort, spoofable
-*    when there is no trusted reverse proxy or runtime metadata.
-* 3. `null`
+* 2. `X-Forwarded-For` header (first entry) — trusted only with runtime
+*    edge metadata.
+* 3. Operator-declared trusted proxy headers, tried in order.
+* 4. `null`
 */
-function extractRequestMeta(request) {
+function extractRequestMeta(request, configOrTrustedHeaders) {
 	const headers = request.headers;
 	const cf = getCfObject(request);
+	const trustedHeaders = resolveTrustedHeaders(configOrTrustedHeaders);
 	let ip = null;
 	if (cf) {
 		const cfIp = headers.get("cf-connecting-ip")?.trim();
@@ -5809,6 +6039,13 @@ function extractRequestMeta(request) {
 		const xff = headers.get("x-forwarded-for");
 		ip = xff ? parseFirstForwardedIp(xff) : null;
 	}
+	if (!ip) for (const name of trustedHeaders) {
+		const value = readIpFromHeader(headers, name);
+		if (value) {
+			ip = value;
+			break;
+		}
+	}
 	const userAgent = headers.get("user-agent")?.trim() || null;
 	const referer = headers.get("referer")?.trim() || null;
 	const geo = extractGeo(cf);
@@ -5819,6 +6056,10 @@ function extractRequestMeta(request) {
 		geo
 	};
 }
+function resolveTrustedHeaders(value) {
+	if (Array.isArray(value)) return normalizeTrustedHeaders(value);
+	return getTrustedProxyHeaders(value);
+}
 /**
 * Headers that must never cross the RPC boundary to sandboxed plugins.
 * Session tokens, auth credentials, and infrastructure headers are stripped
@@ -5858,6 +6099,7 @@ function sanitizeHeadersForSandbox(headers) {
 */
 /** Stale lock threshold in minutes */
 const STALE_LOCK_MINUTES = 10;
+const MAX_ONESHOT_RETRIES = 5;
 /**
 * Executes overdue cron tasks.
 *
@@ -5918,12 +6160,30 @@ var CronExecutor = class {
 				hookFailed = true;
 				console.error(`[cron] Hook failed for ${task.plugin_id}:${task.task_name}:`, error);
 			}
-			if (task.is_oneshot) if (hookFailed) await sql`
+			if (task.is_oneshot) if (hookFailed) {
+				const retryMeta = parsedData?.__dineway != null && typeof parsedData.__dineway === "object" ? parsedData.__dineway : void 0;
+				const rawRetryCount = retryMeta?.retryCount;
+				const retryCount = typeof rawRetryCount === "number" && Number.isFinite(rawRetryCount) && rawRetryCount > 0 ? Math.floor(rawRetryCount) : 0;
+				if (retryCount >= MAX_ONESHOT_RETRIES) {
+					console.error(`[cron] One-shot task ${task.plugin_id}:${task.task_name} exceeded ${MAX_ONESHOT_RETRIES} retries, removing`);
+					await sql`
+							DELETE FROM _dineway_cron_tasks WHERE id = ${task.id}
+						`.execute(this.db);
+				} else {
+					const backoffMs = 6e4 * Math.pow(2, retryCount);
+					await sql`
 						UPDATE _dineway_cron_tasks
-						SET status = 'idle', locked_at = NULL, next_run_at = ${new Date(Date.now() + 6e4).toISOString()}
+						SET status = 'idle', locked_at = NULL, next_run_at = ${new Date(Date.now() + backoffMs).toISOString()}, data = ${JSON.stringify({
+						...parsedData,
+						__dineway: {
+							...retryMeta,
+							retryCount: retryCount + 1
+						}
+					})}
 						WHERE id = ${task.id}
 					`.execute(this.db);
-			else await sql`
+				}
+			} else await sql`
 						DELETE FROM _dineway_cron_tasks WHERE id = ${task.id}
 					`.execute(this.db);
 			else await sql`
@@ -6174,6 +6434,19 @@ async function assertSeoEnabled(seoRepo, collection, seo) {
 	if (seo !== void 0 && !hasSeo) throw new Error(`Collection "${collection}" does not have SEO enabled. Remove the seo field or enable SEO on this collection.`);
 	return hasSeo;
 }
+function toPluginContentItem(item) {
+	return {
+		id: item.id,
+		type: item.type,
+		slug: item.slug,
+		status: item.status,
+		data: item.data,
+		createdAt: item.createdAt,
+		updatedAt: item.updatedAt,
+		publishedAt: item.publishedAt,
+		locale: item.locale
+	};
+}
 /**
 * Create read-only content access
 */
@@ -6184,13 +6457,7 @@ function createContentAccess(db) {
 		async get(collection, id) {
 			const item = await contentRepo.findById(collection, id);
 			if (!item) return null;
-			const result = {
-				id: item.id,
-				type: item.type,
-				data: item.data,
-				createdAt: item.createdAt,
-				updatedAt: item.updatedAt
-			};
+			const result = toPluginContentItem(item);
 			if (await seoRepo.isEnabled(collection)) result.seo = await seoRepo.get(collection, item.id);
 			return result;
 		},
@@ -6206,15 +6473,10 @@ function createContentAccess(db) {
 			const result = await contentRepo.findMany(collection, {
 				limit: options?.limit ?? 50,
 				cursor: options?.cursor,
-				orderBy
+				orderBy,
+				where: options?.where
 			});
-			const items = result.items.map((item) => ({
-				id: item.id,
-				type: item.type,
-				data: item.data,
-				createdAt: item.createdAt,
-				updatedAt: item.updatedAt
-			}));
+			const items = result.items.map(toPluginContentItem);
 			if (items.length > 0 && await seoRepo.isEnabled(collection)) {
 				const seoMap = await seoRepo.getMany(collection, items.map((i) => i.id));
 				for (const item of items) {
@@ -6252,13 +6514,7 @@ function createContentAccessWithWrite(db) {
 					type: collection,
 					data: fields
 				});
-				const result = {
-					id: item.id,
-					type: item.type,
-					data: item.data,
-					createdAt: item.createdAt,
-					updatedAt: item.updatedAt
-				};
+				const result = toPluginContentItem(item);
 				if (hasSeo) result.seo = seo !== void 0 ? await trxSeoRepo.upsert(collection, item.id, seo) : await trxSeoRepo.get(collection, item.id);
 				return result;
 			});
@@ -6274,13 +6530,7 @@ function createContentAccessWithWrite(db) {
 					if (!existing) throw new Error("Content not found");
 					return existing;
 				})();
-				const result = {
-					id: item.id,
-					type: item.type,
-					data: item.data,
-					createdAt: item.createdAt,
-					updatedAt: item.updatedAt
-				};
+				const result = toPluginContentItem(item);
 				if (hasSeo) result.seo = seo !== void 0 ? await trxSeoRepo.upsert(collection, item.id, seo) : await trxSeoRepo.get(collection, item.id);
 				return result;
 			});
@@ -6340,17 +6590,18 @@ function createMediaAccessWithWrite(db, getUploadUrlFn, storage) {
 		getUploadUrl: getUploadUrlFn,
 		async upload(filename, contentType, bytes) {
 			if (!storage) throw new Error("Media upload() requires a storage backend. Configure storage in PluginContextFactoryOptions.");
-			const mediaId = ulid();
+			const keyPrefix = ulid();
 			const basename = filename.split("/").pop() ?? filename;
 			const dotIdx = basename.lastIndexOf(".");
-			const storageKey = `${mediaId}${dotIdx > 0 ? basename.slice(dotIdx).toLowerCase() : ""}`;
+			const storageKey = `${keyPrefix}${dotIdx > 0 ? basename.slice(dotIdx).toLowerCase() : ""}`;
 			await storage.upload({
 				key: storageKey,
 				body: new Uint8Array(bytes),
 				contentType
 			});
+			let media;
 			try {
-				await mediaRepo.create({
+				media = await mediaRepo.create({
 					filename: basename,
 					mimeType: contentType,
 					size: bytes.byteLength,
@@ -6364,7 +6615,7 @@ function createMediaAccessWithWrite(db, getUploadUrlFn, storage) {
 				throw error;
 			}
 			return {
-				mediaId,
+				mediaId: media.id,
 				storageKey,
 				url: `/_dineway/api/media/file/${storageKey}`
 			};
@@ -6779,6 +7030,8 @@ var HookPipeline = class HookPipeline {
 		while (remaining.length > 0) {
 			const ready = remaining.filter((hook) => hook.dependencies.every((dep) => sorted.some((s) => s.pluginId === dep)));
 			if (ready.length === 0) {
+				const pluginIds = remaining.map((hook) => hook.pluginId).join(", ");
+				console.warn(`[hooks] Hook dependency cycle or missing dependency detected among plugins: ${pluginIds}. Falling back to priority order.`);
 				remaining.sort((a, b) => a.priority - b.priority);
 				sorted.push(...remaining);
 				break;
@@ -6794,7 +7047,15 @@ var HookPipeline = class HookPipeline {
 	* Execute a hook with timeout
 	*/
 	async executeWithTimeout(fn, timeout) {
-		return Promise.race([fn(), new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error(`Hook timeout after ${timeout}ms`)), timeout))]);
+		let timer;
+		const timeoutPromise = new Promise((_, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`Hook timeout after ${timeout}ms`)), timeout);
+		});
+		try {
+			return await Promise.race([fn(), timeoutPromise]);
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
 	}
 	/**
 	* Run plugin:install hooks
@@ -6956,7 +7217,8 @@ var HookPipeline = class HookPipeline {
 			const { handler } = hook;
 			const event = {
 				id,
-				collection
+				collection,
+				permanent: false
 			};
 			const ctx = this.getContext(hook.pluginId);
 			const start = Date.now();
@@ -6987,14 +7249,15 @@ var HookPipeline = class HookPipeline {
 	/**
 	* Run content:afterDelete hooks
 	*/
-	async runContentAfterDelete(id, collection) {
+	async runContentAfterDelete(id, collection, permanent) {
 		const hooks = this.getTypedHooks("content:afterDelete");
 		const results = [];
 		for (const hook of hooks) {
 			const { handler } = hook;
 			const event = {
 				id,
-				collection
+				collection,
+				permanent
 			};
 			const ctx = this.getContext(hook.pluginId);
 			const start = Date.now();
@@ -7709,9 +7972,11 @@ async function devConsoleEmailDeliver(event, _ctx) {
 var PluginRouteHandler = class {
 	contextFactory;
 	plugin;
+	trustedProxyHeaders;
 	constructor(plugin, factoryOptions) {
 		this.plugin = plugin;
 		this.contextFactory = new PluginContextFactory(factoryOptions);
+		this.trustedProxyHeaders = factoryOptions.trustedProxyHeaders ?? [];
 	}
 	/**
 	* Invoke a route by name
@@ -7744,7 +8009,7 @@ var PluginRouteHandler = class {
 			...this.contextFactory.createContext(this.plugin),
 			input: validatedInput,
 			request: options.request,
-			requestMeta: extractRequestMeta(options.request)
+			requestMeta: extractRequestMeta(options.request, this.trustedProxyHeaders)
 		};
 		try {
 			return {
@@ -7762,11 +8027,12 @@ var PluginRouteHandler = class {
 				},
 				status: error.status
 			};
+			console.error(`[plugin:${this.plugin.id}] Route handler failed:`, error);
 			return {
 				success: false,
 				error: {
 					code: "INTERNAL_ERROR",
-					message: `Route handler failed: ${error instanceof Error ? error.message : String(error)}`
+					message: "An internal error occurred"
 				},
 				status: 500
 			};
@@ -7922,7 +8188,8 @@ var PluginManager = class {
 		this.factoryOptions = {
 			db: options.db,
 			storage: options.storage,
-			getUploadUrl: options.getUploadUrl
+			getUploadUrl: options.getUploadUrl,
+			trustedProxyHeaders: options.trustedProxyHeaders
 		};
 	}
 	/**
@@ -8051,9 +8318,9 @@ var PluginManager = class {
 	/**
 	* Run content:afterDelete hooks across all active plugins
 	*/
-	async runContentAfterDelete(id, collection) {
+	async runContentAfterDelete(id, collection, permanent) {
 		this.ensureInitialized();
-		return this.hookPipeline.runContentAfterDelete(id, collection);
+		return this.hookPipeline.runContentAfterDelete(id, collection, permanent);
 	}
 	/**
 	* Run content:afterPublish hooks across all active plugins
@@ -8834,11 +9101,19 @@ function isQueryOptions(value) {
 }
 function isContentListOptions(value) {
 	if (!isRecord(value)) return false;
+	if ("where" in value && value.where !== void 0 && !isContentListWhere(value.where)) return false;
 	if ("limit" in value && value.limit !== void 0 && typeof value.limit !== "number") return false;
 	if ("cursor" in value && value.cursor !== void 0 && typeof value.cursor !== "string") return false;
 	if ("orderBy" in value && value.orderBy !== void 0 && !isOrderByRecord(value.orderBy)) return false;
 	return true;
 }
+function isContentListWhere(value) {
+	if (!isRecord(value)) return false;
+	return Object.entries(value).every(([key, item]) => {
+		if (key !== "status" && key !== "locale") return false;
+		return item === void 0 || typeof item === "string";
+	});
+}
 function isContentWriteInput(value) {
 	return isRecord(value);
 }
@@ -9232,7 +9507,7 @@ async function probeUrl(url) {
 	let normalizedUrl = url.trim();
 	if (!normalizedUrl.startsWith("http")) normalizedUrl = `https://${normalizedUrl}`;
 	normalizedUrl = normalizedUrl.replace(TRAILING_SLASHES_PATTERN, "");
-	validateExternalUrl(normalizedUrl);
+	await resolveAndValidateExternalUrl(normalizedUrl);
 	const results = [];
 	const probePromises = getUrlSources().map(async (source) => {
 		try {
@@ -10228,8 +10503,10 @@ async function getCommentCountWithDb(db, collection, contentId) {
 * }
 * ```
 */
-async function getMenu(name) {
-	return getMenuWithDb(name, await getDb());
+function getMenu(name) {
+	return requestCached(`menu:${name}`, async () => {
+		return getMenuWithDb(name, await getDb());
+	});
 }
 /**
 * Get menu by name with resolved URLs (with explicit db)
@@ -10369,6 +10646,7 @@ function interpolateUrlPattern(pattern, slug, id) {
 async function resolveContentUrl(collection, entryId, db, urlPatterns) {
 	if (!entryId) return null;
 	try {
+		validateIdentifier(collection, "menu item collection");
 		const row = (await sql`
 			SELECT slug FROM ${sql.ref(`ec_${collection}`)} WHERE id = ${entryId} LIMIT 1
 		`.execute(db)).rows[0];
@@ -10395,179 +10673,6 @@ async function resolveTaxonomyUrl(taxonomyId, db) {
 	return `/${taxonomy.name}/${taxonomy.slug}`;
 }
 
-//#endregion
-//#region src/taxonomies/index.ts
-/**
-* Runtime API for taxonomies
-*
-* Provides functions to query taxonomy definitions and terms.
-*/
-/**
-* Get all taxonomy definitions
-*/
-async function getTaxonomyDefs() {
-	return (await (await getDb()).selectFrom("_dineway_taxonomy_defs").selectAll().execute()).map((row) => ({
-		id: row.id,
-		name: row.name,
-		label: row.label,
-		labelSingular: row.label_singular ?? void 0,
-		hierarchical: row.hierarchical === 1,
-		collections: row.collections ? JSON.parse(row.collections) : []
-	}));
-}
-/**
-* Get a single taxonomy definition by name
-*/
-async function getTaxonomyDef(name) {
-	const row = await (await getDb()).selectFrom("_dineway_taxonomy_defs").selectAll().where("name", "=", name).executeTakeFirst();
-	if (!row) return null;
-	return {
-		id: row.id,
-		name: row.name,
-		label: row.label,
-		labelSingular: row.label_singular ?? void 0,
-		hierarchical: row.hierarchical === 1,
-		collections: row.collections ? JSON.parse(row.collections) : []
-	};
-}
-/**
-* Get all terms for a taxonomy (as tree for hierarchical, flat for tags)
-*/
-async function getTaxonomyTerms(taxonomyName) {
-	const db = await getDb();
-	const def = await getTaxonomyDef(taxonomyName);
-	if (!def) return [];
-	const rows = await db.selectFrom("taxonomies").selectAll().where("name", "=", taxonomyName).orderBy("label", "asc").execute();
-	const countsResult = await db.selectFrom("content_taxonomies").select(["taxonomy_id"]).select((eb) => eb.fn.count("entry_id").as("count")).groupBy("taxonomy_id").execute();
-	const counts = /* @__PURE__ */ new Map();
-	for (const row of countsResult) counts.set(row.taxonomy_id, row.count);
-	const flatTerms = rows.map((row) => ({
-		id: row.id,
-		name: row.name,
-		slug: row.slug,
-		label: row.label,
-		parent_id: row.parent_id,
-		data: row.data
-	}));
-	if (def.hierarchical) return buildTree(flatTerms, counts);
-	return flatTerms.map((term) => ({
-		id: term.id,
-		name: term.name,
-		slug: term.slug,
-		label: term.label,
-		children: [],
-		count: counts.get(term.id) ?? 0
-	}));
-}
-/**
-* Get a single term by taxonomy and slug
-*/
-async function getTerm(taxonomyName, slug) {
-	const db = await getDb();
-	const row = await db.selectFrom("taxonomies").selectAll().where("name", "=", taxonomyName).where("slug", "=", slug).executeTakeFirst();
-	if (!row) return null;
-	const count = (await db.selectFrom("content_taxonomies").select((eb) => eb.fn.count("entry_id").as("count")).where("taxonomy_id", "=", row.id).executeTakeFirst())?.count ?? 0;
-	const children = (await db.selectFrom("taxonomies").selectAll().where("parent_id", "=", row.id).orderBy("label", "asc").execute()).map((child) => ({
-		id: child.id,
-		name: child.name,
-		slug: child.slug,
-		label: child.label,
-		parentId: child.parent_id ?? void 0,
-		children: []
-	}));
-	return {
-		id: row.id,
-		name: row.name,
-		slug: row.slug,
-		label: row.label,
-		parentId: row.parent_id ?? void 0,
-		description: row.data ? JSON.parse(row.data).description : void 0,
-		children,
-		count
-	};
-}
-/**
-* Get terms assigned to an entry
-*/
-async function getEntryTerms(collection, entryId, taxonomyName) {
-	let query = (await getDb()).selectFrom("content_taxonomies").innerJoin("taxonomies", "taxonomies.id", "content_taxonomies.taxonomy_id").selectAll("taxonomies").where("content_taxonomies.collection", "=", collection).where("content_taxonomies.entry_id", "=", entryId);
-	if (taxonomyName) query = query.where("taxonomies.name", "=", taxonomyName);
-	return (await query.execute()).map((row) => ({
-		id: row.id,
-		name: row.name,
-		slug: row.slug,
-		label: row.label,
-		parentId: row.parent_id ?? void 0,
-		children: []
-	}));
-}
-/**
-* Get terms for multiple entries in a single query (batched API)
-*
-* This is more efficient than calling getEntryTerms for each entry
-* when you need terms for a list of entries.
-*
-* @param collection - The collection type (e.g., "posts")
-* @param entryIds - Array of entry IDs
-* @param taxonomyName - The taxonomy name (e.g., "categories")
-* @returns Map from entry ID to array of terms
-*/
-async function getTermsForEntries(collection, entryIds, taxonomyName) {
-	const result = /* @__PURE__ */ new Map();
-	for (const id of entryIds) result.set(id, []);
-	if (entryIds.length === 0) return result;
-	const rows = await (await getDb()).selectFrom("content_taxonomies").innerJoin("taxonomies", "taxonomies.id", "content_taxonomies.taxonomy_id").select([
-		"content_taxonomies.entry_id",
-		"taxonomies.id",
-		"taxonomies.name",
-		"taxonomies.slug",
-		"taxonomies.label",
-		"taxonomies.parent_id"
-	]).where("content_taxonomies.collection", "=", collection).where("content_taxonomies.entry_id", "in", entryIds).where("taxonomies.name", "=", taxonomyName).execute();
-	for (const row of rows) {
-		const entryId = row.entry_id;
-		const term = {
-			id: row.id,
-			name: row.name,
-			slug: row.slug,
-			label: row.label,
-			parentId: row.parent_id ?? void 0,
-			children: []
-		};
-		const terms = result.get(entryId);
-		if (terms) terms.push(term);
-	}
-	return result;
-}
-/**
-* Get entries by term (wraps getDinewayCollection)
-*/
-async function getEntriesByTerm(collection, taxonomyName, termSlug) {
-	const { getDinewayCollection } = await import("./query-BiaPl_g2.mjs").then((n) => n.a);
-	const { entries } = await getDinewayCollection(collection, { where: { [taxonomyName]: termSlug } });
-	return entries;
-}
-/**
-* Build tree structure from flat terms
-*/
-function buildTree(flatTerms, counts) {
-	const map = /* @__PURE__ */ new Map();
-	const roots = [];
-	for (const term of flatTerms) map.set(term.id, {
-		id: term.id,
-		name: term.name,
-		slug: term.slug,
-		label: term.label,
-		parentId: term.parent_id ?? void 0,
-		description: term.data ? JSON.parse(term.data).description : void 0,
-		children: [],
-		count: counts.get(term.id) ?? 0
-	});
-	for (const term of map.values()) if (term.parentId && map.has(term.parentId)) map.get(term.parentId).children.push(term);
-	else roots.push(term);
-	return roots;
-}
-
 //#endregion
 //#region src/widgets/components.ts
 /**
@@ -10680,18 +10785,52 @@ function getWidgetComponents$1() {
 * Get a widget area by name, with all its widgets
 */
 async function getWidgetArea(name) {
-	const db = await getDb();
-	const areaRow = await db.selectFrom("_dineway_widget_areas").selectAll().where("name", "=", name).executeTakeFirst();
-	if (!areaRow) return null;
-	const widgets = (await db.selectFrom("_dineway_widgets").selectAll().$castTo().where("area_id", "=", areaRow.id).orderBy("sort_order", "asc").execute()).map((row) => rowToWidget(row));
+	const rows = await (await getDb()).selectFrom("_dineway_widget_areas as a").leftJoin("_dineway_widgets as w", "w.area_id", "a.id").select([
+		"a.id as a_id",
+		"a.name as a_name",
+		"a.label as a_label",
+		"a.description as a_description",
+		"w.id as w_id",
+		"w.type as w_type",
+		"w.title as w_title",
+		"w.content as w_content",
+		"w.menu_name as w_menu_name",
+		"w.component_id as w_component_id",
+		"w.component_props as w_component_props",
+		"w.area_id as w_area_id",
+		"w.sort_order as w_sort_order",
+		"w.created_at as w_created_at"
+	]).where("a.name", "=", name).orderBy("w.sort_order", "asc").execute();
+	const first = rows[0];
+	if (!first) return null;
+	const widgets = [];
+	for (const row of rows) {
+		if (!row.w_id || !isWidgetType(row.w_type) || !row.w_area_id || row.w_sort_order === null || !row.w_created_at) continue;
+		const widgetRow = {
+			id: row.w_id,
+			type: row.w_type,
+			title: row.w_title,
+			content: row.w_content,
+			menu_name: row.w_menu_name,
+			component_id: row.w_component_id,
+			component_props: row.w_component_props,
+			area_id: row.w_area_id,
+			sort_order: row.w_sort_order,
+			created_at: row.w_created_at
+		};
+		widgets.push(rowToWidget(widgetRow));
+	}
 	return {
-		id: areaRow.id,
-		name: areaRow.name,
-		label: areaRow.label,
-		description: areaRow.description ?? void 0,
+		id: first.a_id,
+		name: first.a_name,
+		label: first.a_label,
+		description: first.a_description ?? void 0,
 		widgets
 	};
 }
+function isWidgetType(value) {
+	return value === "content" || value === "menu" || value === "component";
+}
 /**
 * Get all widget areas with their widgets
 */
@@ -10746,6 +10885,9 @@ function rowToWidget(row) {
 const WHITESPACE_SPLIT_PATTERN = /\s+/;
 const FTS_OPERATORS_PATTERN = /\b(AND|OR|NOT|NEAR)\b/i;
 const DOUBLE_QUOTE_PATTERN = /"/g;
+function searchResultDisplayColumn(searchableFields) {
+	return searchableFields.includes("title") ? "title" : "slug";
+}
 /**
 * Search across multiple collections
 *
@@ -10836,6 +10978,8 @@ async function searchSingleCollection(db, collection, query, options, weights) {
 	const escapedQuery = escapeQuery(query);
 	if (!escapedQuery) return [];
 	const searchableFields = await ftsManager.getSearchableFields(collection);
+	const displayColumn = searchResultDisplayColumn(searchableFields);
+	const displayColumnSql = sql`c.${sql.ref(displayColumn)}`;
 	let bm25Args = "";
 	if (weights && searchableFields.length > 0) {
 		const weightValues = ["0", "0"];
@@ -10844,13 +10988,13 @@ async function searchSingleCollection(db, collection, query, options, weights) {
 	}
 	const bm25Expr = bm25Args ? `bm25("${ftsTable}", ${bm25Args})` : `bm25("${ftsTable}")`;
 	return (await sql`
-		SELECT 
-			c.id,
-			c.slug,
-			c.locale,
-			c.title,
-			snippet("${sql.raw(ftsTable)}", 2, '<mark>', '</mark>', '...', 32) as snippet,
-			${sql.raw(bm25Expr)} as score
+			SELECT
+				c.id,
+				c.slug,
+				c.locale,
+				${displayColumnSql} as title,
+				snippet("${sql.raw(ftsTable)}", 2, '<mark>', '</mark>', '...', 32) as snippet,
+				${sql.raw(bm25Expr)} as score
 		FROM "${sql.raw(ftsTable)}" f
 		JOIN "${sql.raw(contentTable)}" c ON f.id = c.id
 		WHERE "${sql.raw(ftsTable)}" MATCH ${escapedQuery}
@@ -10890,18 +11034,20 @@ async function getSuggestions(db, query, options = {}) {
 		validateIdentifier(collection, "collection slug");
 		const ftsTable = ftsManager.getFtsTableName(collection);
 		const contentTable = ftsManager.getContentTableName(collection);
-		const prefixQuery = `${escapeQuery(query)}*`;
-		if (!prefixQuery || prefixQuery === "*") continue;
+		const displayColumn = searchResultDisplayColumn(await ftsManager.getSearchableFields(collection));
+		const displayColumnSql = sql`c.${sql.ref(displayColumn)}`;
+		const prefixQuery = escapeQuery(query);
+		if (!prefixQuery) continue;
 		const results = await sql`
-			SELECT 
+			SELECT
 				c.id,
-				c.title
+				${displayColumnSql} as title
 			FROM "${sql.raw(ftsTable)}" f
 			JOIN "${sql.raw(contentTable)}" c ON f.id = c.id
 			WHERE "${sql.raw(ftsTable)}" MATCH ${prefixQuery}
 			AND c.status = 'published'
 			AND c.deleted_at IS NULL
-			AND c.title IS NOT NULL
+			AND ${displayColumnSql} IS NOT NULL
 			${locale ? sql`AND c.locale = ${locale}` : sql``}
 			ORDER BY bm25("${sql.raw(ftsTable)}")
 			LIMIT ${limit}
@@ -11051,4 +11197,4 @@ function extractSearchableFields(entry, fields) {
 }
 
 //#endregion
-export { CronExecutor as $, handleContentSchedule as $t, getAllSources as A, handleMediaGet as At, NoopSandboxRunner as B, handleContentCountScheduled as Bt, isPreviewRequest as C, createPluginBundleStore as Ct, parseWxrDate as D, getCollectionInfo as Dt, wordpressRestSource as E, PluginStateRepository as Et, registerSource as F, handleRevisionRestore as Ft, PluginRouteError as G, handleContentDuplicate as Gt, createNoopSandboxRunner as H, handleContentCreate as Ht, importReusableBlocksAsSections as I, generateManifest as It, devConsoleEmailDeliver as J, handleContentList as Jt, PluginRouteRegistry as K, handleContentGet as Kt, isStandardPluginDefinition as L, computeContentHash as Lt, getSource as M, handleMediaUpdate as Mt, getUrlSources as N, handleRevisionGet as Nt, wxrSource as O, handleMediaCreate as Ot, probeUrl as P, handleRevisionList as Pt, resolveExclusiveHooks as Q, handleContentRestore as Qt, NodeSandboxRunner as R, hashString as Rt, getPreviewToken as S, sanitizeHref as St, getPreviewUrl as T, getSections as Tt, PluginManager as U, handleContentDelete as Ut, SandboxNotAvailableError as V, handleContentCountTrashed as Vt, createPluginManager as W, handleContentDiscardDraft as Wt, HookPipeline as X, handleContentPermanentDelete as Xt, EmailPipeline as Y, handleContentListTrashed as Yt, createHookPipeline as Z, handleContentPublish as Zt, getTermsForEntries as _, signPreviewUrl as _t, search as a, portableText as an, createFilePreviewMiddleware as at, getCommentCount as b, prosemirrorToPortableText as bt, getWidgetArea as c, dropSessionDatabaseTables as ct, getEntriesByTerm as d, SessionDatabaseLimitError as dt, handleContentTranslations as en, extractRequestMeta as et, getEntryTerms as f, isBlockedInPreview as ft, getTerm as g, parsePreviewSignatureHeader as gt, getTaxonomyTerms as h, defaultPreviewSidecarClient as ht, getSuggestions as i, validateRev as in, parseWxrString as it, getFileSources as j, handleMediaList as jt, clearSources as k, handleMediaDelete as kt, getWidgetAreas as l, getAppliedSnapshotMeta as lt, getTaxonomyDefs as m, buildPreviewSignatureHeader as mt, extractSearchableFields as n, handleContentUnschedule as nn, definePlugin as nt, searchCollection as o, reference as on, renderPreviewToolbar as ot, getTaxonomyDef as p, renderPreviewLoadingPage as pt, DEV_CONSOLE_EMAIL_PLUGIN_ID as q, handleContentGetIncludingTrashed as qt, getSearchStats as r, handleContentUpdate as rn, parseWxr as rt, searchWithDb as s, image as sn, applySnapshotToDatabase as st, extractPlainText as t, handleContentUnpublish as tn, sanitizeHeadersForSandbox as tt, getWidgetComponents as u, FileSessionDatabaseFactory as ut, getMenu as v, verifyPreviewSignature as vt, buildPreviewUrl as w, getSection as wt, getComments as x, isSafeHref as xt, getMenus as y, portableTextToProsemirror as yt, createNodeSandboxRunner as z, handleContentCompare as zt };
+export { createFilePreviewMiddleware as $, validateRev as $t, isStandardPluginDefinition as A, generateManifest as At, DEV_CONSOLE_EMAIL_PLUGIN_ID as B, handleContentDuplicate as Bt, getAllSources as C, handleMediaDelete as Ct, probeUrl as D, handleRevisionGet as Dt, getUrlSources as E, handleMediaUpdate as Et, createNoopSandboxRunner as F, handleContentCountScheduled as Ft, resolveExclusiveHooks as G, handleContentPermanentDelete as Gt, EmailPipeline as H, handleContentGetIncludingTrashed as Ht, PluginManager as I, handleContentCountTrashed as It, sanitizeHeadersForSandbox as J, handleContentSchedule as Jt, CronExecutor as K, handleContentPublish as Kt, createPluginManager as L, handleContentCreate as Lt, createNodeSandboxRunner as M, hashString as Mt, NoopSandboxRunner as N, PluginStateRepository as Nt, registerSource as O, handleRevisionList as Ot, SandboxNotAvailableError as P, handleContentCompare as Pt, parseWxrString as Q, handleContentUpdate as Qt, PluginRouteError as R, handleContentDelete as Rt, clearSources as S, handleMediaCreate as St, getSource as T, handleMediaList as Tt, HookPipeline as U, handleContentList as Ut, devConsoleEmailDeliver as V, handleContentGet as Vt, createHookPipeline as W, handleContentListTrashed as Wt, definePlugin as X, handleContentUnpublish as Xt, getTrustedProxyHeaders as Y, handleContentTranslations as Yt, parseWxr as Z, handleContentUnschedule as Zt, buildPreviewUrl as _, sanitizeHref as _t, search as a, SessionDatabaseLimitError as at, parseWxrDate as b, getSections as bt, getWidgetArea as c, buildPreviewSignatureHeader as ct, getMenu as d, signPreviewUrl as dt, portableText as en, renderPreviewToolbar as et, getMenus as f, verifyPreviewSignature as ft, isPreviewRequest as g, isSafeHref as gt, getPreviewToken as h, prosemirrorToPortableText as ht, getSuggestions as i, FileSessionDatabaseFactory as it, NodeSandboxRunner as j, computeContentHash as jt, importReusableBlocksAsSections as k, handleRevisionRestore as kt, getWidgetAreas as l, defaultPreviewSidecarClient as lt, getComments as m, portableTextToProsemirror as mt, extractSearchableFields as n, image as nn, dropSessionDatabaseTables as nt, searchCollection as o, isBlockedInPreview as ot, getCommentCount as p, after as pt, extractRequestMeta as q, handleContentRestore as qt, getSearchStats as r, getAppliedSnapshotMeta as rt, searchWithDb as s, renderPreviewLoadingPage as st, extractPlainText as t, reference as tn, applySnapshotToDatabase as tt, getWidgetComponents as u, parsePreviewSignatureHeader as ut, getPreviewUrl as v, createPluginBundleStore as vt, getFileSources as w, handleMediaGet as wt, wxrSource as x, getCollectionInfo as xt, wordpressRestSource as y, getSection as yt, PluginRouteRegistry as z, handleContentDiscardDraft as zt };