dineway 0.1.3

package/dist/index-C-jx21qs.d.mts

@@ -0,0 +1,4771 @@
+import { _ as MediaValue, m as MediaProviderDescriptor } from "./placeholder-bOx1xCTY.mjs";
+import { t as Database } from "./types-DkvMXalq.mjs";
+import { a as ContentSeoInput, c as FindManyOptions, l as FindManyResult, o as CreateContentInput, r as ContentItem, t as BylineSummary, u as UpdateContentInput } from "./types-CLLdsG3g.mjs";
+import { $ as StandardPluginDefinition, B as PluginManifest, E as PageFragmentEvent, H as PluginStorageConfig, J as ResolvedPlugin, K as RequestMeta, O as PageMetadataContribution, R as PluginDefinition, S as MediaItem$1, T as PageFragmentContribution, a as CommentAfterModerateEvent, k as PageMetadataEvent, m as EmailMessage, p as CronEvent, r as CommentAfterCreateEvent, s as CommentBeforeCreateEvent } from "./types-D38djUXv.mjs";
+import { g as UpdateFieldInput, h as UpdateCollectionInput, i as CollectionWithFields, l as Field, o as CreateCollectionInput, s as CreateFieldInput, t as Collection } from "./types-BgQeVaPj.mjs";
+import { C as SiteSettingKey, w as SiteSettings } from "./validate-DVKJJ-M_.mjs";
+import { d as Storage } from "./types-ju-_ORz7.mjs";
+import { t as DatabaseDescriptor } from "./adapters-BlzWJG82.mjs";
+import { Kysely } from "kysely";
+import { z } from "astro/zod";
+import { z as z$1 } from "zod";
+import { PortableTextBlock } from "@dineway-ai/gutenberg-to-portable-text";
+import { Readable } from "node:stream";
+import { MiddlewareHandler } from "astro";
+import { LiveLoader } from "astro/loaders";
+
+//#region src/database/connection.d.ts
+interface DatabaseConfig {
+  url: string;
+  authToken?: string;
+}
+declare class DinewayDatabaseError extends Error {
+  cause?: unknown | undefined;
+  constructor(message: string, cause?: unknown | undefined);
+}
+//#endregion
+//#region src/database/repositories/content.d.ts
+/**
+ * Repository for content CRUD operations
+ *
+ * Content is stored in per-collection tables (ec_posts, ec_pages, etc.)
+ * Each field becomes a real column in the table.
+ */
+declare class ContentRepository {
+  private db;
+  constructor(db: Kysely<Database>);
+  /**
+   * Create a new content item
+   */
+  create(input: CreateContentInput): Promise<ContentItem>;
+  /**
+   * Generate a unique slug for a content item within a collection.
+   *
+   * Checks the collection table for existing slugs that match `baseSlug`
+   * (optionally scoped to a locale) and appends a numeric suffix (`-1`,
+   * `-2`, etc.) on collision to guarantee uniqueness.
+   *
+   * Returns `null` if `baseSlug` is empty after slugification.
+   */
+  generateUniqueSlug(type: string, text: string, locale?: string): Promise<string | null>;
+  /**
+   * Duplicate a content item
+   * Creates a new draft copy with "(Copy)" appended to the title.
+   * A slug is auto-generated from the new title by the handler layer.
+   */
+  duplicate(type: string, id: string, authorId?: string): Promise<ContentItem>;
+  /**
+   * Find content by ID
+   */
+  findById(type: string, id: string): Promise<ContentItem | null>;
+  /**
+   * Find content by id, including trashed (soft-deleted) items.
+   * Used by restore endpoint for ownership checks.
+   */
+  findByIdIncludingTrashed(type: string, id: string): Promise<ContentItem | null>;
+  /**
+   * Find content by ID or slug. Tries ID first if it looks like a ULID,
+   * otherwise tries slug. Falls back to the other if the first lookup misses.
+   */
+  findByIdOrSlug(type: string, identifier: string, locale?: string): Promise<ContentItem | null>;
+  /**
+   * Find content by ID or slug, including trashed (soft-deleted) items.
+   * Used by restore/permanent-delete endpoints.
+   */
+  findByIdOrSlugIncludingTrashed(type: string, identifier: string, locale?: string): Promise<ContentItem | null>;
+  private _findByIdOrSlug;
+  /**
+   * Find content by slug
+   */
+  findBySlug(type: string, slug: string, locale?: string): Promise<ContentItem | null>;
+  /**
+   * Find content by slug, including trashed (soft-deleted) items.
+   * Used by restore/permanent-delete endpoints.
+   */
+  findBySlugIncludingTrashed(type: string, slug: string, locale?: string): Promise<ContentItem | null>;
+  /**
+   * Find many content items with filtering and pagination
+   */
+  findMany(type: string, options?: FindManyOptions): Promise<FindManyResult<ContentItem>>;
+  /**
+   * Update content
+   */
+  update(type: string, id: string, input: UpdateContentInput): Promise<ContentItem>;
+  /**
+   * Delete content (soft delete - moves to trash)
+   */
+  delete(type: string, id: string): Promise<boolean>;
+  /**
+   * Restore content from trash
+   */
+  restore(type: string, id: string): Promise<boolean>;
+  /**
+   * Permanently delete content (cannot be undone)
+   */
+  permanentDelete(type: string, id: string): Promise<boolean>;
+  /**
+   * Find trashed content items
+   */
+  findTrashed(type: string, options?: Omit<FindManyOptions, "where">): Promise<FindManyResult<ContentItem & {
+    deletedAt: string;
+  }>>;
+  /**
+   * Count trashed content items
+   */
+  countTrashed(type: string): Promise<number>;
+  /**
+   * Count content items
+   */
+  count(type: string, where?: {
+    status?: string;
+    authorId?: string;
+    locale?: string;
+  }): Promise<number>;
+  getStats(type: string): Promise<{
+    total: number;
+    published: number;
+    draft: number;
+  }>;
+  /**
+   * Schedule content for future publishing
+   *
+   * Sets status to 'scheduled' and stores the scheduled publish time.
+   * The content will be auto-published when the scheduled time is reached.
+   */
+  schedule(type: string, id: string, scheduledAt: string): Promise<ContentItem>;
+  /**
+   * Unschedule content
+   *
+   * Clears the scheduled time. Published posts stay published;
+   * draft/scheduled posts revert to 'draft'.
+   */
+  unschedule(type: string, id: string): Promise<ContentItem>;
+  /**
+   * Find content that is ready to be published
+   *
+   * Returns all content where scheduled_at <= now, regardless of status.
+   * This covers both draft-scheduled posts (status='scheduled') and
+   * published posts with scheduled draft changes (status='published').
+   */
+  findReadyToPublish(type: string): Promise<ContentItem[]>;
+  /**
+   * Find all translations in a translation group
+   */
+  findTranslations(type: string, translationGroup: string): Promise<ContentItem[]>;
+  /**
+   * Publish the current draft
+   *
+   * Promotes draft_revision_id to live_revision_id and clears draft pointer.
+   * Syncs the draft revision's data into the content table columns so the
+   * content table always reflects the published version.
+   * If no draft revision exists, creates one from current data and publishes it.
+   */
+  publish(type: string, id: string): Promise<ContentItem>;
+  /**
+   * Unpublish content
+   *
+   * Removes live pointer but preserves draft. If no draft exists,
+   * creates one from the live version so the content isn't lost.
+   */
+  unpublish(type: string, id: string): Promise<ContentItem>;
+  /**
+   * Discard pending draft changes
+   *
+   * Clears draft_revision_id. The content table columns already hold the
+   * published version, so no data sync is needed.
+   */
+  discardDraft(type: string, id: string): Promise<ContentItem>;
+  /**
+   * Sync data columns in the content table from a data object.
+   * Used to promote revision data into the content table on publish.
+   * Keys starting with _ are revision metadata (e.g. _slug) and are skipped.
+   */
+  private syncDataColumns;
+  /**
+   * Count content items with a pending schedule.
+   * Includes both draft-scheduled (status='scheduled') and published
+   * posts with scheduled draft changes (status='published', scheduled_at set).
+   */
+  countScheduled(type: string): Promise<number>;
+  /**
+   * Map database row to ContentItem
+   * Extracts system columns and puts content fields in data
+   * Excludes null values from data to match input semantics
+   */
+  private mapRow;
+  /**
+   * Map order field names to database columns.
+   * Only allows known fields to prevent column enumeration via crafted orderBy values.
+   */
+  private mapOrderField;
+}
+//#endregion
+//#region src/database/repositories/media.d.ts
+type MediaStatus = "pending" | "ready" | "failed";
+interface MediaItem {
+  id: string;
+  filename: string;
+  mimeType: string;
+  size: number | null;
+  width: number | null;
+  height: number | null;
+  alt: string | null;
+  caption: string | null;
+  storageKey: string;
+  status: MediaStatus;
+  contentHash: string | null;
+  blurhash: string | null;
+  dominantColor: string | null;
+  createdAt: string;
+  authorId: string | null;
+}
+interface CreateMediaInput {
+  filename: string;
+  mimeType: string;
+  size?: number;
+  width?: number;
+  height?: number;
+  alt?: string;
+  caption?: string;
+  storageKey: string;
+  contentHash?: string;
+  blurhash?: string;
+  dominantColor?: string;
+  status?: MediaStatus;
+  authorId?: string;
+}
+interface FindManyMediaOptions {
+  limit?: number;
+  cursor?: string;
+  mimeType?: string;
+  status?: MediaStatus | "all";
+}
+/**
+ * Media repository for database operations
+ */
+declare class MediaRepository {
+  private db;
+  constructor(db: Kysely<Database>);
+  /**
+   * Create a new media item
+   */
+  create(input: CreateMediaInput): Promise<MediaItem>;
+  /**
+   * Create a pending media item (for signed URL upload flow)
+   */
+  createPending(input: {
+    filename: string;
+    mimeType: string;
+    size?: number;
+    storageKey: string;
+    contentHash?: string;
+    authorId?: string;
+  }): Promise<MediaItem>;
+  /**
+   * Confirm upload (mark as ready)
+   */
+  confirmUpload(id: string, metadata?: {
+    width?: number;
+    height?: number;
+    size?: number;
+  }): Promise<MediaItem | null>;
+  /**
+   * Mark upload as failed
+   */
+  markFailed(id: string): Promise<MediaItem | null>;
+  /**
+   * Find media by ID
+   */
+  findById(id: string): Promise<MediaItem | null>;
+  /**
+   * Find media by filename
+   * Useful for idempotent imports
+   */
+  findByFilename(filename: string): Promise<MediaItem | null>;
+  /**
+   * Find media by content hash
+   * Used for deduplication - same content = same hash
+   */
+  findByContentHash(contentHash: string): Promise<MediaItem | null>;
+  /**
+   * Find many media items with cursor pagination
+   *
+   * Uses keyset pagination (cursor-based) for consistent results.
+   * The cursor encodes the created_at and id of the last item.
+   */
+  findMany(options?: FindManyMediaOptions): Promise<FindManyResult<MediaItem>>;
+  /**
+   * Update media metadata
+   */
+  update(id: string, input: Partial<Pick<CreateMediaInput, "alt" | "caption" | "width" | "height">>): Promise<MediaItem | null>;
+  /**
+   * Delete media item
+   */
+  delete(id: string): Promise<boolean>;
+  /**
+   * Count media items
+   */
+  count(mimeType?: string): Promise<number>;
+  /**
+   * Delete pending uploads older than the given age.
+   * Pending uploads that were never confirmed indicate abandoned upload flows.
+   *
+   * Returns the storage keys of deleted rows so callers can remove the
+   * corresponding files from object storage.
+   */
+  cleanupPendingUploads(maxAgeMs?: number): Promise<string[]>;
+  /**
+   * Convert database row to MediaItem
+   */
+  private rowToItem;
+}
+//#endregion
+//#region src/database/repositories/revision.d.ts
+interface Revision {
+  id: string;
+  collection: string;
+  entryId: string;
+  data: Record<string, unknown>;
+  authorId: string | null;
+  createdAt: string;
+}
+//#endregion
+//#region src/database/repositories/comment.d.ts
+/** Public-facing comment shape — no private fields */
+interface PublicComment {
+  id: string;
+  parentId: string | null;
+  authorName: string;
+  isRegisteredUser: boolean;
+  body: string;
+  createdAt: string;
+  replies?: PublicComment[];
+}
+//#endregion
+//#region src/database/repositories/byline.d.ts
+interface ContentBylineInput {
+  bylineId: string;
+  roleLabel?: string | null;
+}
+//#endregion
+//#region src/fields/types.d.ts
+/**
+ * SQLite column types that map from field types
+ */
+type ColumnType = "TEXT" | "REAL" | "INTEGER" | "JSON";
+/**
+ * Base field definition
+ *
+ * Note: schema uses z.ZodTypeAny to accommodate optional/default wrappers
+ */
+interface FieldDefinition<_T = unknown> {
+  type: string;
+  /**
+   * The SQLite column type to use when storing this field
+   */
+  columnType: ColumnType;
+  schema: z.ZodTypeAny;
+  options?: unknown;
+  ui?: FieldUIHints;
+}
+/**
+ * UI hints for admin rendering
+ */
+interface FieldUIHints {
+  widget?: string;
+  placeholder?: string;
+  helpText?: string;
+  rows?: number;
+  min?: number | string;
+  max?: number | string;
+  [key: string]: unknown;
+}
+/**
+ * Portable Text block structure
+ */
+interface PortableTextBlock$2 {
+  _type: string;
+  _key: string;
+  [key: string]: unknown;
+}
+/**
+ * @deprecated Use MediaValue instead. ImageValue is an alias for backwards compatibility.
+ */
+type ImageValue = MediaValue;
+/**
+ * File field value
+ */
+interface FileValue {
+  id: string;
+  url: string;
+  filename: string;
+  mimeType: string;
+  size: number;
+}
+//#endregion
+//#region src/fields/image.d.ts
+/**
+ * Image field
+ * References media items from the media library
+ */
+declare function image(options?: {
+  required?: boolean;
+  maxSize?: number;
+  allowedTypes?: string[];
+}): FieldDefinition<ImageValue | undefined>;
+//#endregion
+//#region src/fields/reference.d.ts
+/**
+ * Reference field
+ * References another content item by ID
+ */
+declare function reference(collection: string, options?: {
+  required?: boolean;
+}): FieldDefinition<string | undefined>;
+//#endregion
+//#region src/fields/portable-text.d.ts
+/**
+ * Portable Text field
+ * Stores structured content in Portable Text format
+ */
+declare function portableText(options?: {
+  required?: boolean;
+}): FieldDefinition<PortableTextBlock$2[] | undefined>;
+//#endregion
+//#region src/api/types.d.ts
+/**
+ * List response with cursor pagination
+ */
+interface ListResponse<T> {
+  items: T[];
+  nextCursor?: string;
+}
+/**
+ * Content API responses
+ */
+interface ContentListResponse extends ListResponse<ContentItem> {}
+interface ContentResponse {
+  item: ContentItem;
+  /** Opaque revision token for optimistic concurrency */
+  _rev?: string;
+}
+/**
+ * Manifest API response
+ */
+interface ManifestResponse {
+  version: string;
+  hash: string;
+  collections: Record<string, {
+    label: string;
+    labelSingular: string;
+    supports: string[];
+    fields: Record<string, FieldDescriptor>;
+  }>;
+  plugins: Record<string, {
+    adminPages?: Array<{
+      path: string;
+      component: string;
+    }>;
+    widgets?: string[];
+  }>;
+}
+interface FieldDescriptor {
+  kind: string;
+  label?: string;
+  required?: boolean;
+  options?: Array<{
+    value: string;
+    label: string;
+  }>;
+}
+/**
+ * Discriminated union for handler results.
+ *
+ * Handlers return `ApiResult<T>` -- either `{ success: true, data: T }` or
+ * `{ success: false, error: { code, message } }`. The `success` literal
+ * enables TypeScript narrowing on `.data`.
+ *
+ * The generic `E` parameter defaults to `ErrorCode` but can be narrowed to
+ * `OAuthErrorCode` for OAuth token-endpoint handlers.
+ *
+ * Use `unwrapResult()` from `error.ts` to convert to an HTTP Response.
+ */
+type ApiResult<T, E extends string = string> = {
+  success: true;
+  data: T;
+} | {
+  success: false;
+  error: {
+    code: E;
+    message: string;
+    details?: Record<string, unknown>;
+  };
+};
+/**
+ * API request context
+ */
+interface ApiContext {
+  userId?: string;
+  userRole?: string;
+}
+//#endregion
+//#region src/api/handlers/content.d.ts
+/**
+ * Trashed content item with deletion timestamp
+ */
+interface TrashedContentItem {
+  id: string;
+  type: string;
+  slug: string | null;
+  status: string;
+  data: Record<string, unknown>;
+  authorId: string | null;
+  createdAt: string;
+  updatedAt: string;
+  publishedAt: string | null;
+  deletedAt: string;
+}
+/**
+ * Create content list handler
+ */
+declare function handleContentList(db: Kysely<Database>, collection: string, params: {
+  cursor?: string;
+  limit?: number;
+  status?: string;
+  orderBy?: string;
+  order?: "asc" | "desc";
+  locale?: string;
+}): Promise<ApiResult<ContentListResponse>>;
+/**
+ * Get single content item
+ */
+declare function handleContentGet(db: Kysely<Database>, collection: string, id: string, locale?: string): Promise<ApiResult<ContentResponse>>;
+/**
+ * Get a content item by id, including trashed items.
+ * Used by restore endpoint for ownership checks on soft-deleted items.
+ */
+declare function handleContentGetIncludingTrashed(db: Kysely<Database>, collection: string, id: string, locale?: string): Promise<ApiResult<ContentResponse>>;
+/**
+ * Create content item.
+ *
+ * Content + SEO writes are wrapped in a transaction so either both succeed
+ * or neither does. If `body.seo` is provided for a non-SEO collection, the
+ * API returns a validation error rather than silently dropping it.
+ */
+declare function handleContentCreate(db: Kysely<Database>, collection: string, body: {
+  data: Record<string, unknown>;
+  slug?: string;
+  status?: string;
+  authorId?: string;
+  bylines?: ContentBylineInput[];
+  locale?: string;
+  translationOf?: string;
+  seo?: ContentSeoInput;
+  createdAt?: string | null;
+  publishedAt?: string | null;
+}): Promise<ApiResult<ContentResponse>>;
+/**
+ * Update content item.
+ * If `_rev` is provided, validates it against the current version before writing.
+ * No `_rev` = blind write (backwards-compatible for admin UI).
+ *
+ * Content + SEO writes are wrapped in a transaction for atomicity.
+ */
+declare function handleContentUpdate(db: Kysely<Database>, collection: string, id: string, body: {
+  data?: Record<string, unknown>;
+  slug?: string;
+  status?: string;
+  authorId?: string | null;
+  bylines?: ContentBylineInput[];
+  _rev?: string;
+  seo?: ContentSeoInput;
+}): Promise<ApiResult<ContentResponse>>;
+/**
+ * Duplicate content item.
+ *
+ * Only copies SEO data if the collection has SEO enabled.
+ * Always returns consistent `seo` shape for SEO-enabled collections.
+ */
+declare function handleContentDuplicate(db: Kysely<Database>, collection: string, id: string, authorId?: string): Promise<ApiResult<{
+  item: ContentItem;
+}>>;
+/**
+ * Delete content item (soft delete - moves to trash)
+ */
+declare function handleContentDelete(db: Kysely<Database>, collection: string, id: string): Promise<ApiResult<{
+  deleted: true;
+}>>;
+/**
+ * Restore content item from trash
+ */
+declare function handleContentRestore(db: Kysely<Database>, collection: string, id: string): Promise<ApiResult<{
+  restored: true;
+}>>;
+/**
+ * Permanently delete content item (cannot be undone).
+ * Also cleans up associated SEO data.
+ */
+declare function handleContentPermanentDelete(db: Kysely<Database>, collection: string, id: string): Promise<ApiResult<{
+  deleted: true;
+}>>;
+/**
+ * List trashed content items
+ */
+declare function handleContentListTrashed(db: Kysely<Database>, collection: string, options?: {
+  limit?: number;
+  cursor?: string;
+}): Promise<ApiResult<{
+  items: TrashedContentItem[];
+  nextCursor?: string;
+}>>;
+/**
+ * Count trashed content items
+ */
+declare function handleContentCountTrashed(db: Kysely<Database>, collection: string): Promise<ApiResult<{
+  count: number;
+}>>;
+/**
+ * Schedule content for future publishing
+ */
+declare function handleContentSchedule(db: Kysely<Database>, collection: string, id: string, scheduledAt: string): Promise<ApiResult<ContentResponse>>;
+/**
+ * Unschedule content (revert to draft)
+ */
+declare function handleContentUnschedule(db: Kysely<Database>, collection: string, id: string): Promise<ApiResult<ContentResponse>>;
+/**
+ * Publish content immediately.
+ *
+ * Wrapped in a transaction because publish performs multiple writes
+ * (syncDataColumns, slug sync, status/revision update) that must
+ * be atomic to prevent FTS shadow table corruption on crash.
+ */
+declare function handleContentPublish(db: Kysely<Database>, collection: string, id: string): Promise<ApiResult<ContentResponse>>;
+/**
+ * Unpublish content (revert to draft).
+ *
+ * Wrapped in a transaction — unpublish may create a draft revision
+ * from the live version then update the status, which is multi-step.
+ */
+declare function handleContentUnpublish(db: Kysely<Database>, collection: string, id: string): Promise<ApiResult<ContentResponse>>;
+/**
+ * Count scheduled content items
+ */
+declare function handleContentCountScheduled(db: Kysely<Database>, collection: string): Promise<ApiResult<{
+  count: number;
+}>>;
+/**
+ * Discard draft changes (revert to live version)
+ */
+declare function handleContentDiscardDraft(db: Kysely<Database>, collection: string, id: string): Promise<ApiResult<ContentResponse>>;
+/**
+ * Compare live and draft revisions
+ */
+declare function handleContentCompare(db: Kysely<Database>, collection: string, id: string): Promise<ApiResult<{
+  hasChanges: boolean;
+  live: Record<string, unknown> | null;
+  draft: Record<string, unknown> | null;
+}>>;
+/**
+ * Get all translations for a content item.
+ * Returns the item's translation group members with locale and status info.
+ */
+declare function handleContentTranslations(db: Kysely<Database>, collection: string, id: string): Promise<ApiResult<{
+  translationGroup: string;
+  translations: Array<{
+    id: string;
+    locale: string | null;
+    slug: string | null;
+    status: string;
+    updatedAt: string;
+  }>;
+}>>;
+//#endregion
+//#region src/api/handlers/manifest.d.ts
+interface CollectionDefinition {
+  schema: {
+    _def?: {
+      shape?: () => Record<string, unknown>;
+    };
+    shape?: Record<string, unknown>;
+  };
+  admin: {
+    label: string;
+    labelSingular?: string;
+    supports?: string[];
+  };
+}
+type CollectionMap = Record<string, CollectionDefinition>;
+/**
+ * Generate admin manifest from collections
+ */
+declare function generateManifest(collections: CollectionMap, plugins?: Record<string, {
+  adminPages?: Array<{
+    path: string;
+    component: string;
+  }>;
+  widgets?: string[];
+}>): Promise<ManifestResponse>;
+//#endregion
+//#region src/api/handlers/revision.d.ts
+interface RevisionListResponse {
+  items: Revision[];
+  total: number;
+}
+interface RevisionResponse {
+  item: Revision;
+}
+/**
+ * List revisions for a content entry
+ */
+declare function handleRevisionList(db: Kysely<Database>, collection: string, entryId: string, params?: {
+  limit?: number;
+}): Promise<ApiResult<RevisionListResponse>>;
+/**
+ * Get a specific revision
+ */
+declare function handleRevisionGet(db: Kysely<Database>, revisionId: string): Promise<ApiResult<RevisionResponse>>;
+/**
+ * Restore a revision (updates content to this revision's data and creates new revision)
+ */
+declare function handleRevisionRestore(db: Kysely<Database>, revisionId: string, callerUserId: string): Promise<ApiResult<ContentResponse>>;
+//#endregion
+//#region src/api/handlers/media.d.ts
+interface MediaListResponse {
+  items: MediaItem[];
+  nextCursor?: string;
+}
+interface MediaResponse {
+  item: MediaItem;
+}
+/**
+ * List media items
+ */
+declare function handleMediaList(db: Kysely<Database>, params: {
+  cursor?: string;
+  limit?: number;
+  mimeType?: string;
+}): Promise<ApiResult<MediaListResponse>>;
+/**
+ * Get single media item
+ */
+declare function handleMediaGet(db: Kysely<Database>, id: string): Promise<ApiResult<MediaResponse>>;
+/**
+ * Create media item (after file upload)
+ */
+declare function handleMediaCreate(db: Kysely<Database>, input: {
+  filename: string;
+  mimeType: string;
+  size?: number;
+  width?: number;
+  height?: number;
+  alt?: string;
+  storageKey: string;
+  contentHash?: string;
+  blurhash?: string;
+  dominantColor?: string;
+  authorId?: string;
+}): Promise<ApiResult<MediaResponse>>;
+/**
+ * Update media metadata
+ */
+declare function handleMediaUpdate(db: Kysely<Database>, id: string, input: {
+  alt?: string;
+  caption?: string;
+  width?: number;
+  height?: number;
+}): Promise<ApiResult<MediaResponse>>;
+/**
+ * Delete media item
+ */
+declare function handleMediaDelete(db: Kysely<Database>, id: string): Promise<ApiResult<{
+  deleted: true;
+}>>;
+//#endregion
+//#region src/schema/registry.d.ts
+/**
+ * Error thrown when a schema operation fails
+ */
+declare class SchemaError extends Error {
+  code: string;
+  details?: Record<string, unknown> | undefined;
+  constructor(message: string, code: string, details?: Record<string, unknown> | undefined);
+}
+/**
+ * Schema Registry
+ *
+ * Manages collection and field definitions stored in the database.
+ * Handles runtime DDL operations (CREATE TABLE, ALTER TABLE).
+ */
+declare class SchemaRegistry {
+  private db;
+  constructor(db: Kysely<Database>);
+  /**
+   * List all collections
+   */
+  listCollections(): Promise<Collection[]>;
+  /**
+   * Get a collection by slug
+   */
+  getCollection(slug: string): Promise<Collection | null>;
+  /**
+   * Get a collection with all its fields
+   */
+  getCollectionWithFields(slug: string): Promise<CollectionWithFields | null>;
+  /**
+   * Create a new collection
+   */
+  createCollection(input: CreateCollectionInput): Promise<Collection>;
+  /**
+   * Update a collection
+   */
+  updateCollection(slug: string, input: UpdateCollectionInput): Promise<Collection>;
+  /**
+   * Delete a collection
+   */
+  deleteCollection(slug: string, options?: {
+    force?: boolean;
+  }): Promise<void>;
+  /**
+   * List fields for a collection
+   */
+  listFields(collectionId: string): Promise<Field[]>;
+  /**
+   * Get a field by slug within a collection
+   */
+  getField(collectionSlug: string, fieldSlug: string): Promise<Field | null>;
+  /**
+   * Create a new field
+   */
+  createField(collectionSlug: string, input: CreateFieldInput): Promise<Field>;
+  /**
+   * Update a field
+   */
+  updateField(collectionSlug: string, fieldSlug: string, input: UpdateFieldInput): Promise<Field>;
+  /**
+   * Rebuild the search index for a collection
+   *
+   * Called when searchable fields change. If search is enabled for the collection,
+   * this will rebuild the FTS table with the updated field list.
+   */
+  private rebuildSearchIndex;
+  /**
+   * Delete a field
+   */
+  deleteField(collectionSlug: string, fieldSlug: string): Promise<void>;
+  /**
+   * Reorder fields
+   */
+  reorderFields(collectionSlug: string, fieldSlugs: string[]): Promise<void>;
+  /**
+   * Create a content table for a collection
+   */
+  private createContentTable;
+  /**
+   * Drop a content table
+   */
+  private dropContentTable;
+  /**
+   * Add a column to a content table
+   */
+  private addColumn;
+  /**
+   * Drop a column from a content table
+   */
+  private dropColumn;
+  /**
+   * Check if a collection has any content
+   */
+  private collectionHasContent;
+  /**
+   * Get table name for a collection
+   */
+  private getTableName;
+  /**
+   * Get column name for a field
+   */
+  private getColumnName;
+  /**
+   * Validate a slug
+   */
+  private validateSlug;
+  /**
+   * Format a default value for SQL.
+   *
+   * SQLite `ALTER TABLE ADD COLUMN ... DEFAULT` requires a literal constant
+   * expression — parameterized values cannot be used here. We manually escape
+   * single quotes and coerce types to ensure the output is safe.
+   *
+   * INTEGER/REAL values are coerced through `Number()` which can only produce
+   * digits, `.`, `-`, `e`, `Infinity`, or `NaN` — all safe in SQL.
+   * TEXT/JSON values have single quotes escaped via SQL standard doubling (`''`).
+   */
+  private formatDefaultValue;
+  /**
+   * Get empty default for a field type
+   */
+  private getEmptyDefault;
+  /**
+   * Map a collection row to a Collection object
+   */
+  private mapCollectionRow;
+  /**
+   * Map a field row to a Field object
+   */
+  private mapFieldRow;
+  /**
+   * Discover orphaned content tables
+   *
+   * Finds ec_* tables that exist in the database but don't have a
+   * corresponding entry in _dineway_collections.
+   */
+  discoverOrphanedTables(): Promise<Array<{
+    slug: string;
+    tableName: string;
+    rowCount: number;
+  }>>;
+  /**
+   * Register an orphaned table as a collection
+   *
+   * Creates a _dineway_collections entry for an existing ec_* table.
+   */
+  registerOrphanedTable(slug: string, options?: {
+    label?: string;
+    labelSingular?: string;
+    description?: string;
+  }): Promise<Collection>;
+  /**
+   * Convert slug to human-readable label
+   */
+  private slugToLabel;
+}
+//#endregion
+//#region src/schema/query.d.ts
+/**
+ * Get collection metadata by slug.
+ *
+ * @example
+ * ```ts
+ * import { getCollectionInfo } from "dineway";
+ *
+ * const info = await getCollectionInfo("posts");
+ * if (info?.commentsEnabled) {
+ *   // render comment UI
+ * }
+ * ```
+ */
+declare function getCollectionInfo(slug: string): Promise<Collection | null>;
+//#endregion
+//#region src/sections/types.d.ts
+/**
+ * Section source types
+ */
+type SectionSource = "theme" | "user" | "import";
+/**
+ * Section as returned to templates/admin
+ */
+interface Section {
+  id: string;
+  slug: string;
+  title: string;
+  description?: string;
+  keywords: string[];
+  content: PortableTextBlock$2[];
+  previewUrl?: string;
+  source: SectionSource;
+  themeId?: string;
+  createdAt: string;
+  updatedAt: string;
+}
+/**
+ * Input for creating a section
+ */
+interface CreateSectionInput {
+  slug: string;
+  title: string;
+  description?: string;
+  keywords?: string[];
+  content: PortableTextBlock$2[];
+  previewMediaId?: string;
+  source?: SectionSource;
+  themeId?: string;
+}
+/**
+ * Input for updating a section
+ */
+interface UpdateSectionInput {
+  slug?: string;
+  title?: string;
+  description?: string;
+  keywords?: string[];
+  content?: PortableTextBlock$2[];
+  previewMediaId?: string | null;
+}
+/**
+ * Options for querying sections
+ */
+interface GetSectionsOptions {
+  /** Filter by source */
+  source?: SectionSource;
+  /** Search title, description, keywords */
+  search?: string;
+  /** Limit results */
+  limit?: number;
+  /** Cursor for pagination */
+  cursor?: string;
+}
+//#endregion
+//#region src/sections/index.d.ts
+/**
+ * Get a section by slug
+ *
+ * @example
+ * ```ts
+ * import { getSection } from "dineway";
+ *
+ * const section = await getSection("hero-centered");
+ * if (section) {
+ *   console.log(section.content); // Portable Text array
+ * }
+ * ```
+ */
+declare function getSection(slug: string): Promise<Section | null>;
+/**
+ * Get all sections with optional filtering
+ *
+ * @example
+ * ```ts
+ * import { getSections } from "dineway";
+ *
+ * // Get all theme-provided sections
+ * const themeSections = await getSections({ source: "theme" });
+ *
+ * // Search sections
+ * const results = await getSections({ search: "pricing" });
+ * ```
+ */
+declare function getSections(options?: GetSectionsOptions): Promise<FindManyResult<Section>>;
+//#endregion
+//#region src/plugins/sandbox/types.d.ts
+/**
+ * Resource limits for sandboxed plugins.
+ * Enforced by the sandbox runtime.
+ */
+interface ResourceLimits {
+  /** CPU time per invocation in milliseconds (default: 50ms) */
+  cpuMs?: number;
+  /** Memory limit in MB (default: 128MB) */
+  memoryMb?: number;
+  /** Maximum subrequests per invocation (default: 10) */
+  subrequests?: number;
+  /** Wall-clock time limit in milliseconds (default: 30000ms) */
+  wallTimeMs?: number;
+}
+/**
+ * Storage interface for loading plugin code.
+ * Could be R2, local filesystem, or any other storage backend.
+ */
+interface PluginCodeStorage {
+  /** Get plugin bundle code by path */
+  get(path: string): Promise<string | null>;
+  /** Check if a bundle exists */
+  exists(path: string): Promise<boolean>;
+}
+/**
+ * Serialized email message for sandbox RPC transport.
+ * Matches the core EmailMessage type but uses only serializable fields.
+ */
+interface SandboxEmailMessage {
+  to: string;
+  subject: string;
+  text: string;
+  html?: string;
+}
+/**
+ * Callback for sending email from a sandboxed plugin.
+ * The sandbox runner wires this up from the EmailPipeline.
+ *
+ * @param message - The email message to send
+ * @param pluginId - The sending plugin's ID (used as source)
+ */
+type SandboxEmailSendCallback = (message: SandboxEmailMessage, pluginId: string) => Promise<void>;
+/**
+ * Options for creating a sandbox runner
+ */
+interface SandboxOptions {
+  /** Storage interface for loading plugin code */
+  storage?: PluginCodeStorage;
+  /** Database for bridge operations */
+  db: Kysely<Database>;
+  /** Default resource limits */
+  limits?: ResourceLimits;
+  /** Site info for plugin context (injected into wrapper at generation time) */
+  siteInfo?: {
+    name: string;
+    url: string;
+    locale: string;
+  };
+  /** Email send callback, wired from the EmailPipeline by the runtime */
+  emailSend?: SandboxEmailSendCallback;
+}
+/**
+ * A sandboxed plugin instance.
+ * Provides methods to invoke hooks and routes in the isolated environment.
+ */
+interface SandboxedPlugin {
+  /** Unique identifier: `${manifest.id}:${manifest.version}` */
+  readonly id: string;
+  /**
+   * Invoke a hook in the sandboxed plugin.
+   *
+   * @param hookName - Name of the hook (e.g., "content:beforeSave")
+   * @param event - Event data to pass to the hook
+   * @returns Hook result (transformed content, void, etc.)
+   */
+  invokeHook(hookName: string, event: unknown): Promise<unknown>;
+  /**
+   * Invoke an API route in the sandboxed plugin.
+   *
+   * @param routeName - Name of the route
+   * @param input - Validated input data
+   * @param request - Serialized request info for context
+   * @returns Route response data
+   */
+  invokeRoute(routeName: string, input: unknown, request: SerializedRequest): Promise<unknown>;
+  /**
+   * Terminate the sandboxed plugin.
+   * Releases resources and prevents further invocations.
+   */
+  terminate(): Promise<void>;
+}
+/**
+ * Serialized request for RPC transport.
+ * Sandbox RPC layers can't pass Request objects directly.
+ */
+interface SerializedRequest {
+  url: string;
+  method: string;
+  headers: Record<string, string>;
+  /** Normalized request metadata extracted before RPC serialization */
+  meta: RequestMeta;
+}
+/**
+ * Sandbox runner interface.
+ * Platform adapters implement this to provide plugin isolation.
+ */
+interface SandboxRunner {
+  /**
+   * Check if sandboxing is available on this platform.
+   * Returns false for platforms that don't support isolation.
+   */
+  isAvailable(): boolean;
+  /**
+   * Load a sandboxed plugin from code.
+   *
+   * @param manifest - Plugin manifest with metadata and capabilities
+   * @param code - The bundled plugin JavaScript code
+   * @returns A sandboxed plugin instance
+   * @throws If sandboxing is not available or plugin can't be loaded
+   */
+  load(manifest: PluginManifest, code: string): Promise<SandboxedPlugin>;
+  /**
+   * Set the email send callback for sandboxed plugins.
+   * Called after the EmailPipeline is created, since the pipeline
+   * doesn't exist when the sandbox runner is constructed.
+   */
+  setEmailSend(callback: SandboxEmailSendCallback | null): void;
+  /**
+   * Terminate all loaded sandboxed plugins.
+   * Called during shutdown or when reconfiguring.
+   */
+  terminateAll(): Promise<void>;
+}
+/**
+ * Factory function type for creating sandbox runners.
+ * Exported by platform adapters.
+ *
+ * @example
+ * ```typescript
+ * // In a platform adapter module
+ * export const createSandboxRunner: SandboxRunnerFactory = (options) => {
+ *   return new NodeSandboxRunner(options);
+ * };
+ * ```
+ */
+type SandboxRunnerFactory = (options: SandboxOptions) => SandboxRunner;
+//#endregion
+//#region src/content/converters/types.d.ts
+/**
+ * Portable Text Types
+ *
+ * Defines the structure of Portable Text blocks used in Dineway.
+ */
+/**
+ * Base span (inline text)
+ */
+interface PortableTextSpan {
+  _type: "span";
+  _key: string;
+  text: string;
+  marks?: string[];
+}
+/**
+ * Mark definition (bold, italic, link, etc.)
+ */
+interface PortableTextMarkDef {
+  _type: string;
+  _key: string;
+  [key: string]: unknown;
+}
+/**
+ * Link mark definition
+ */
+interface PortableTextLinkMark extends PortableTextMarkDef {
+  _type: "link";
+  href: string;
+  blank?: boolean;
+}
+/**
+ * Text block (paragraph, heading, etc.)
+ */
+interface PortableTextTextBlock {
+  _type: "block";
+  _key: string;
+  style?: "normal" | "h1" | "h2" | "h3" | "h4" | "h5" | "h6" | "blockquote";
+  listItem?: "bullet" | "number";
+  level?: number;
+  children: PortableTextSpan[];
+  markDefs?: PortableTextMarkDef[];
+}
+/**
+ * Image block
+ */
+interface PortableTextImageBlock {
+  _type: "image";
+  _key: string;
+  asset: {
+    _ref: string;
+    url?: string; /** Provider ID for external media (e.g., "image-cdn") */
+    provider?: string;
+  };
+  alt?: string;
+  caption?: string;
+  /** Original image width */
+  width?: number;
+  /** Original image height */
+  height?: number;
+  /** Display width for this instance (overrides original) */
+  displayWidth?: number;
+  /** Display height for this instance (overrides original) */
+  displayHeight?: number;
+}
+/**
+ * Code block
+ */
+interface PortableTextCodeBlock {
+  _type: "code";
+  _key: string;
+  code: string;
+  language?: string;
+  filename?: string;
+}
+/**
+ * Unknown/custom block (preserved for plugin compatibility)
+ */
+interface PortableTextUnknownBlock {
+  _type: string;
+  _key: string;
+  [key: string]: unknown;
+}
+/**
+ * Any Portable Text block
+ */
+type PortableTextBlock$1 = PortableTextTextBlock | PortableTextImageBlock | PortableTextCodeBlock | PortableTextUnknownBlock;
+/**
+ * ProseMirror JSON types (simplified for TipTap)
+ */
+interface ProseMirrorMark {
+  type: string;
+  attrs?: Record<string, unknown>;
+}
+interface ProseMirrorNode {
+  type: string;
+  attrs?: Record<string, unknown>;
+  content?: ProseMirrorNode[];
+  marks?: ProseMirrorMark[];
+  text?: string;
+}
+interface ProseMirrorDocument {
+  type: "doc";
+  content: ProseMirrorNode[];
+}
+//#endregion
+//#region src/content/converters/prosemirror-to-portable-text.d.ts
+/**
+ * Convert ProseMirror document to Portable Text
+ */
+declare function prosemirrorToPortableText(doc: ProseMirrorDocument): PortableTextBlock$1[];
+//#endregion
+//#region src/content/converters/portable-text-to-prosemirror.d.ts
+/**
+ * Convert Portable Text to ProseMirror document
+ */
+declare function portableTextToProsemirror(blocks: PortableTextBlock$1[]): ProseMirrorDocument;
+//#endregion
+//#region src/utils/hash.d.ts
+/**
+ * SHA-256 hash of a string, truncated to 16 hex chars (64 bits).
+ * For cache invalidation / ETags — not for security.
+ */
+declare function hashString(content: string): Promise<string>;
+/**
+ * Compute content hash using Web Crypto API
+ *
+ * Uses SHA-1 which is the fastest option in SubtleCrypto.
+ * SHA-1 is cryptographically weak but fine for content deduplication
+ * where we only need to detect identical files, not resist attacks.
+ *
+ * Returns hex string prefixed with "sha1:" for future-proofing
+ */
+declare function computeContentHash(content: Uint8Array | ArrayBuffer): Promise<string>;
+//#endregion
+//#region src/utils/url.d.ts
+/**
+ * URL scheme validation utilities
+ *
+ * Prevents XSS via dangerous URL schemes (javascript:, data:, vbscript:, etc.)
+ * by allowlisting known-safe schemes before rendering into href attributes.
+ */
+/**
+ * Returns the URL unchanged if it uses a safe scheme, otherwise returns "#".
+ *
+ * Use this at the render layer as the primary defense against XSS via
+ * dangerous URL schemes like `javascript:`, `data:`, or `vbscript:`.
+ *
+ * @example
+ * ```ts
+ * sanitizeHref("https://example.com")        // "https://example.com"
+ * sanitizeHref("/about")                      // "/about"
+ * sanitizeHref("#section")                    // "#section"
+ * sanitizeHref("mailto:a@b.com")              // "mailto:a@b.com"
+ * sanitizeHref("javascript:alert(1)")         // "#"
+ * sanitizeHref("data:text/html,<script>")     // "#"
+ * sanitizeHref("")                            // "#"
+ * ```
+ */
+declare function sanitizeHref(url: string | undefined | null): string;
+/**
+ * Returns true if the URL uses a safe scheme for rendering in href attributes.
+ */
+declare function isSafeHref(url: string): boolean;
+//#endregion
+//#region src/visual-editing/editable.d.ts
+/**
+ * Visual editing annotation system
+ *
+ * Creates Proxy objects that emit data-dineway-ref attributes when spread onto elements.
+ */
+interface CMSAnnotation {
+  collection: string;
+  id: string;
+  field?: string;
+  /** Entry status — only present on entry-level annotations (not field-level) */
+  status?: string;
+  /** Whether the entry has unpublished draft changes */
+  hasDraft?: boolean;
+}
+/** The shape returned when spreading an edit annotation onto an element */
+interface FieldAnnotation {
+  "data-dineway-ref": string;
+}
+interface EditableOptions {
+  /** Entry status: "draft", "published", "scheduled" */
+  status?: string;
+  /** true when draftRevisionId exists and differs from liveRevisionId */
+  hasDraft?: boolean;
+}
+/**
+ * Create an editable proxy for an entry.
+ *
+ * Usage:
+ * - `{...entry.edit}` - entry-level annotation (includes status/hasDraft)
+ * - `{...entry.edit.title}` - field-level annotation
+ * - `{...entry.edit['nested.field']}` - nested field (bracket notation)
+ */
+declare function createEditable(collection: string, id: string, options?: EditableOptions): EditProxy;
+/**
+ * Create a noop proxy for production mode.
+ * Spreading this produces no attributes.
+ */
+declare function createNoop(): EditProxy;
+/**
+ * Visual editing proxy type.
+ *
+ * Spread directly onto elements for entry-level annotations: `{...entry.edit}`
+ * Access a field for field-level annotations: `{...entry.edit.title}`
+ *
+ * In production, spreading produces no attributes (noop).
+ */
+type EditProxy = {
+  readonly [field: string]: Partial<FieldAnnotation>;
+};
+//#endregion
+//#region src/query.d.ts
+/**
+ * Collection type registry for type-safe queries.
+ *
+ * This interface is extended by the generated dineway-env.d.ts file
+ * to provide type inference for collection names and their data shapes.
+ *
+ * @example
+ * ```ts
+ * // In dineway-env.d.ts (generated):
+ * declare module "dineway" {
+ *   interface DinewayCollections {
+ *     posts: { title: string; content: PortableTextBlock[]; };
+ *     pages: { title: string; body: PortableTextBlock[]; };
+ *   }
+ * }
+ *
+ * // Then in your code:
+ * const { entries } = await getDinewayCollection("posts");
+ * // entries[0].data.title is typed as string
+ * ```
+ */
+interface DinewayCollections {}
+/**
+ * Helper type to infer the data type for a collection.
+ * Returns the registered type if known, otherwise falls back to Record<string, unknown>.
+ */
+type InferCollectionData<T extends string> = T extends keyof DinewayCollections ? DinewayCollections[T] : Record<string, unknown>;
+/**
+ * Sort direction
+ */
+type SortDirection$1 = "asc" | "desc";
+/**
+ * Order by specification - field name to direction
+ * @example { created_at: "desc" } - Sort by created_at descending
+ * @example { title: "asc" } - Sort by title ascending
+ * @example { published_at: "desc", title: "asc" } - Multi-field sort
+ */
+type OrderBySpec$1 = Record<string, SortDirection$1>;
+interface CollectionFilter$1 {
+  status?: "draft" | "published" | "archived";
+  limit?: number;
+  /**
+   * Opaque cursor for keyset pagination.
+   * Pass the `nextCursor` value from a previous result to fetch the next page.
+   * @example
+   * ```ts
+   * const cursor = Astro.url.searchParams.get("cursor") ?? undefined;
+   * const { entries, nextCursor } = await getDinewayCollection("posts", {
+   *   limit: 10,
+   *   cursor,
+   * });
+   * ```
+   */
+  cursor?: string;
+  /**
+   * Filter by field values or taxonomy terms
+   * @example { category: 'news' } - Filter by taxonomy term
+   * @example { category: ['news', 'featured'] } - Filter by multiple terms (OR)
+   */
+  where?: Record<string, string | string[]>;
+  /**
+   * Order results by field(s)
+   * @default { created_at: "desc" }
+   * @example { created_at: "desc" } - Sort by created_at descending (default)
+   * @example { title: "asc" } - Sort by title ascending
+   * @example { published_at: "desc", title: "asc" } - Multi-field sort
+   */
+  orderBy?: OrderBySpec$1;
+  /**
+   * Filter by locale. When set, only returns entries in this locale.
+   * Only relevant when i18n is configured.
+   * @example "en" — English entries only
+   * @example "fr" — French entries only
+   */
+  locale?: string;
+}
+interface ContentEntry<T = Record<string, unknown>> {
+  id: string;
+  data: T;
+  /** Visual editing annotations. Spread onto elements: {...entry.edit.title} */
+  edit: EditProxy;
+}
+/** Cache hint returned by the content loader for route caching */
+interface CacheHint {
+  tags?: string[];
+  lastModified?: Date;
+}
+/**
+ * Result from getDinewayCollection
+ */
+interface CollectionResult<T> {
+  /** The entries (empty array if error or none found) */
+  entries: ContentEntry<T>[];
+  /** Error if the query failed */
+  error?: Error;
+  /** Cache hint for route caching (pass to Astro.cache.set()) */
+  cacheHint: CacheHint;
+  /**
+   * Opaque cursor for the next page.
+   * Undefined when there are no more results.
+   * Pass this as `cursor` in the next query to get the next page.
+   */
+  nextCursor?: string;
+}
+/**
+ * Result from getDinewayEntry
+ */
+interface EntryResult<T> {
+  /** The entry, or null if not found */
+  entry: ContentEntry<T> | null;
+  /** Error if the query failed (not set for "not found", only for actual errors) */
+  error?: Error;
+  /** Whether we're in preview mode (valid token was provided) */
+  isPreview: boolean;
+  /** Set when a fallback locale was used instead of the requested locale */
+  fallbackLocale?: string;
+  /** Cache hint for route caching (pass to Astro.cache.set()) */
+  cacheHint: CacheHint;
+}
+/** Edit metadata attached to PT arrays in edit mode */
+interface EditFieldMeta {
+  collection: string;
+  id: string;
+  field: string;
+}
+/**
+ * Read edit metadata from a value (returns undefined if not tagged).
+ * Uses Object.getOwnPropertyDescriptor to access Symbol-keyed property
+ * without an unsafe type assertion.
+ */
+declare function getEditMeta(value: unknown): EditFieldMeta | undefined;
+/**
+ * Get all entries of a content type
+ *
+ * Returns { entries, error } for graceful error handling.
+ *
+ * When dineway-env.d.ts is generated, the collection name will be
+ * type-checked and the return type will be inferred automatically.
+ *
+ * @example
+ * ```ts
+ * import { getDinewayCollection } from "dineway";
+ *
+ * const { entries: posts, error } = await getDinewayCollection("posts");
+ * if (error) {
+ *   console.error("Failed to load posts:", error);
+ *   return;
+ * }
+ * // posts[0].data.title is typed (if dineway-env.d.ts exists)
+ *
+ * // With filters
+ * const { entries: drafts } = await getDinewayCollection("posts", { status: "draft" });
+ * ```
+ */
+declare function getDinewayCollection<T extends string, D = InferCollectionData<T>>(type: T, filter?: CollectionFilter$1): Promise<CollectionResult<D>>;
+/**
+ * Get a single entry by type and ID/slug
+ *
+ * Returns { entry, error, isPreview } for graceful error handling.
+ * - entry is null if not found (not an error)
+ * - error is set only for actual errors (db issues, etc.)
+ *
+ * Preview mode is detected automatically from request context (ALS).
+ * When the URL has a valid `_preview` token, the middleware sets preview
+ * context and this function serves draft revision data if available.
+ *
+ * @example
+ * ```ts
+ * import { getDinewayEntry } from "dineway";
+ *
+ * // Simple usage — preview just works via middleware
+ * const { entry: post, isPreview, error } = await getDinewayEntry("posts", "my-slug");
+ * if (!post) return Astro.redirect("/404");
+ * ```
+ */
+declare function getDinewayEntry<T extends string, D = InferCollectionData<T>>(type: T, id: string, options?: {
+  locale?: string;
+}): Promise<EntryResult<D>>;
+/**
+ * Translation summary for a single locale variant
+ */
+interface TranslationSummary {
+  /** Content item ID */
+  id: string;
+  /** Locale code (e.g. "en", "fr") */
+  locale: string;
+  /** URL slug */
+  slug: string | null;
+  /** Current status */
+  status: string;
+}
+/**
+ * Result from getTranslations
+ */
+interface TranslationsResult {
+  /** The translation group ID (shared across locales) */
+  translationGroup: string;
+  /** All locale variants in this group */
+  translations: TranslationSummary[];
+  /** Error if the query failed */
+  error?: Error;
+}
+/**
+ * Get all translations of a content item.
+ *
+ * Given a content entry, returns all locale variants that share the same
+ * translation group. This is useful for building language switcher UI.
+ *
+ * @example
+ * ```ts
+ * import { getDinewayEntry, getTranslations } from "dineway";
+ *
+ * const { entry: post } = await getDinewayEntry("posts", "hello-world", { locale: "en" });
+ * const { translations } = await getTranslations("posts", post.data.id);
+ * // translations = [{ id: "...", locale: "en", slug: "hello-world", status: "published" }, ...]
+ * ```
+ */
+declare function getTranslations(type: string, id: string): Promise<TranslationsResult>;
+/**
+ * Result from resolveDinewayPath
+ */
+interface ResolvePathResult<T = Record<string, unknown>> {
+  /** The matched entry */
+  entry: ContentEntry<T>;
+  /** The collection slug that matched */
+  collection: string;
+  /** Extracted parameters from the URL pattern (e.g. { slug: "my-post" }) */
+  params: Record<string, string>;
+}
+/**
+ * Resolve a URL path to a content entry by matching against collection URL patterns.
+ *
+ * Loads all collections with a `urlPattern` set, converts each pattern to a regex,
+ * and tests the given path. On match, extracts the slug and fetches the entry.
+ *
+ * @example
+ * ```ts
+ * import { resolveDinewayPath } from "dineway";
+ *
+ * // Given pages with urlPattern "/{slug}" and posts with "/blog/{slug}":
+ * const result = await resolveDinewayPath("/blog/hello-world");
+ * if (result) {
+ *   console.log(result.collection); // "posts"
+ *   console.log(result.params.slug); // "hello-world"
+ *   console.log(result.entry.data); // post data
+ * }
+ * ```
+ */
+declare function resolveDinewayPath<T = Record<string, unknown>>(path: string): Promise<ResolvePathResult<T> | null>;
+//#endregion
+//#region src/i18n/config.d.ts
+/**
+ * Dineway i18n Configuration
+ *
+ * Reads locale configuration from the virtual module (sourced from Astro config).
+ * Initialized during runtime startup, then available via getI18nConfig().
+ */
+interface I18nConfig {
+  defaultLocale: string;
+  locales: string[];
+  fallback?: Record<string, string>;
+  prefixDefaultLocale?: boolean;
+}
+/**
+ * Get the current i18n config.
+ * Returns null if i18n is not configured.
+ */
+declare function getI18nConfig(): I18nConfig | null;
+/**
+ * Check if i18n is enabled.
+ * Returns true when multiple locales are configured.
+ */
+declare function isI18nEnabled(): boolean;
+/**
+ * Resolve fallback locale chain for a given locale.
+ * Returns array of locales to try, from most preferred to least.
+ * Always ends with defaultLocale.
+ */
+declare function getFallbackChain(locale: string): string[];
+//#endregion
+//#region src/preview/sidecar-client.d.ts
+/**
+ * Preview sidecar protocol helpers.
+ *
+ * These utilities define the signed URL and snapshot-auth contract shared
+ * by preview sidecars and the source site serving snapshot exports.
+ */
+interface PreviewSidecarSignature {
+  source: string;
+  exp: number;
+  sig: string;
+}
+interface PreviewSidecarClient {
+  signPreviewUrl(previewBase: string, source: string, secret: string, ttl?: number): Promise<string>;
+  buildSnapshotSignatureHeader(signature: PreviewSidecarSignature): string;
+}
+declare function signPreviewUrl(previewBase: string, source: string, secret: string, ttl?: number): Promise<string>;
+declare function buildPreviewSignatureHeader(signature: PreviewSidecarSignature): string;
+declare function parsePreviewSignatureHeader(header: string): PreviewSidecarSignature | null;
+declare function verifyPreviewSignature(source: string, exp: number, sig: string, secret: string): Promise<boolean>;
+declare const defaultPreviewSidecarClient: PreviewSidecarClient;
+//#endregion
+//#region src/preview/session-database-factory.d.ts
+interface SessionDatabaseInfo {
+  id: string;
+  dbPath: string;
+  createdAt: number;
+  expiresAt: number;
+  lastTouchedAt: number;
+}
+interface SessionDatabaseHandle {
+  created: boolean;
+  session: SessionDatabaseInfo;
+  db: Kysely<Database>;
+  close(): Promise<void>;
+}
+interface SessionCleanupResult {
+  removedSessionIds: string[];
+  removedPaths: string[];
+}
+interface SessionOpenOptions {
+  id: string;
+  now?: number;
+}
+interface SessionOpenOrCreateOptions extends SessionOpenOptions {
+  ttlMs: number;
+}
+interface SessionDatabaseFactory {
+  open(input: SessionOpenOptions): Promise<SessionDatabaseHandle | null>;
+  openOrCreate(input: SessionOpenOrCreateOptions): Promise<SessionDatabaseHandle>;
+  destroy(id: string): Promise<boolean>;
+  cleanup(now?: number): Promise<SessionCleanupResult>;
+  close(): Promise<void>;
+}
+interface FileSessionDatabaseFactoryOptions {
+  rootDir: string;
+  maxDiskBytes?: number;
+  registryFileName?: string;
+  sessionsDirName?: string;
+}
+declare class SessionDatabaseLimitError extends Error {
+  constructor(message?: string);
+}
+declare class FileSessionDatabaseFactory implements SessionDatabaseFactory {
+  private readonly options;
+  private readonly registry;
+  private readonly sessionsDir;
+  private readonly maxDiskBytes;
+  constructor(options: FileSessionDatabaseFactoryOptions);
+  open(input: SessionOpenOptions): Promise<SessionDatabaseHandle | null>;
+  openOrCreate(input: SessionOpenOrCreateOptions): Promise<SessionDatabaseHandle>;
+  destroy(id: string): Promise<boolean>;
+  cleanup(now?: number): Promise<SessionCleanupResult>;
+  close(): Promise<void>;
+  private createHandle;
+  private getSessionRow;
+  private toSessionInfo;
+  private deleteSession;
+  private getActiveDiskBytes;
+  private getDbPath;
+  private getManagedPaths;
+  private listSessionRows;
+  private listDbPathRows;
+}
+//#endregion
+//#region src/preview/middleware.d.ts
+interface FilePreviewMiddlewareConfig {
+  rootDir?: string;
+  secret: string;
+  ttlSeconds?: number;
+  cookieName?: string;
+  snapshotPath?: string;
+  maxSessionDiskBytes?: number;
+  sessionFactory?: SessionDatabaseFactory;
+  fetch?: typeof globalThis.fetch;
+}
+declare function createFilePreviewMiddleware(config: FilePreviewMiddlewareConfig): MiddlewareHandler;
+//#endregion
+//#region src/loader.d.ts
+/**
+ * Entry data type - generic object
+ */
+type EntryData = Record<string, unknown>;
+/**
+ * Sort direction
+ */
+type SortDirection = "asc" | "desc";
+/**
+ * Order by specification - field name to direction
+ * @example { created_at: "desc" } - Sort by created_at descending
+ * @example { title: "asc" } - Sort by title ascending
+ */
+type OrderBySpec = Record<string, SortDirection>;
+/**
+ * Filter for loadCollection - type is required
+ */
+interface CollectionFilter {
+  type: string;
+  status?: "draft" | "published" | "archived";
+  limit?: number;
+  /**
+   * Opaque cursor for keyset pagination.
+   * Pass the `nextCursor` value from a previous result to fetch the next page.
+   */
+  cursor?: string;
+  /**
+   * Filter by field values or taxonomy terms
+   */
+  where?: Record<string, string | string[]>;
+  /**
+   * Order results by field(s)
+   * @default { created_at: "desc" }
+   */
+  orderBy?: OrderBySpec;
+  /**
+   * Filter by locale (e.g. 'en', 'fr').
+   * When set, only returns content in this locale.
+   */
+  locale?: string;
+}
+/**
+ * Filter for loadEntry - type and id are required
+ */
+interface EntryFilter {
+  type: string;
+  id: string;
+  /**
+   * When set, fetch content data from this revision instead of the content table.
+   * Used by preview mode to serve draft revision data.
+   */
+  revisionId?: string;
+  /**
+   * Locale to scope slug lookup. Only affects slug resolution;
+   * IDs are globally unique and always resolve regardless of locale.
+   */
+  locale?: string;
+}
+/**
+ * Get the database instance. Used by query wrapper functions and middleware.
+ *
+ * Checks the ALS request context first — if a per-request DB override is set
+ * (e.g. by preview or playground middleware), it takes precedence over the
+ * module-level cached instance. This allows preview flows to route queries
+ * to an isolated session database without modifying any calling code.
+ *
+ * Initializes the default database on first call using config from virtual module.
+ */
+declare function getDb(): Promise<Kysely<Database>>;
+/**
+ * Create a Dineway Live Collections loader
+ *
+ * This loader handles ALL content types in a single Astro collection.
+ * Use `getDinewayCollection()` and `getDinewayEntry()` to query
+ * specific content types.
+ *
+ * Database is configured in astro.config.mjs via the dineway() integration.
+ *
+ * @example
+ * ```ts
+ * // src/live.config.ts
+ * import { defineLiveCollection } from "astro:content";
+ * import { dinewayLoader } from "dineway";
+ *
+ * export const collections = {
+ *   dineway: defineLiveCollection({
+ *     loader: dinewayLoader(),
+ *   }),
+ * };
+ * ```
+ */
+declare function dinewayLoader(): LiveLoader<EntryData, EntryFilter, CollectionFilter>;
+//#endregion
+//#region src/cli/wxr/parser.d.ts
+/**
+ * Parsed WordPress export data
+ */
+interface WxrData {
+  /** Site metadata */
+  site: WxrSite;
+  /** Posts (including custom post types) */
+  posts: WxrPost[];
+  /** Media attachments */
+  attachments: WxrAttachment[];
+  /** Categories */
+  categories: WxrCategory[];
+  /** Tags */
+  tags: WxrTag[];
+  /** Authors */
+  authors: WxrAuthor[];
+  /** All taxonomy terms (including custom taxonomies and nav_menu) */
+  terms: WxrTerm[];
+  /** Parsed navigation menus */
+  navMenus: WxrNavMenu[];
+}
+interface WxrSite {
+  title?: string;
+  link?: string;
+  description?: string;
+  language?: string;
+  baseSiteUrl?: string;
+  baseBlogUrl?: string;
+}
+interface WxrPost {
+  id?: number;
+  title?: string;
+  link?: string;
+  pubDate?: string;
+  creator?: string;
+  guid?: string;
+  description?: string;
+  content?: string;
+  excerpt?: string;
+  postDate?: string;
+  postDateGmt?: string;
+  postModified?: string;
+  postModifiedGmt?: string;
+  commentStatus?: string;
+  pingStatus?: string;
+  status?: string;
+  postType?: string;
+  postName?: string;
+  postPassword?: string;
+  isSticky?: boolean;
+  /** Parent post ID for hierarchical content (pages) */
+  postParent?: number;
+  /** Menu order for sorting */
+  menuOrder?: number;
+  categories: string[];
+  tags: string[];
+  /** Custom taxonomy assignments beyond categories/tags */
+  customTaxonomies?: Map<string, string[]>;
+  meta: Map<string, string>;
+}
+interface WxrAttachment {
+  id?: number;
+  title?: string;
+  url?: string;
+  postDate?: string;
+  meta: Map<string, string>;
+}
+interface WxrCategory {
+  id?: number;
+  nicename?: string;
+  name?: string;
+  parent?: string;
+  description?: string;
+}
+interface WxrTag {
+  id?: number;
+  slug?: string;
+  name?: string;
+  description?: string;
+}
+/**
+ * Generic taxonomy term (categories, tags, nav_menu, custom taxonomies)
+ */
+interface WxrTerm {
+  id: number;
+  taxonomy: string;
+  slug: string;
+  name: string;
+  parent?: string;
+  description?: string;
+}
+/**
+ * Navigation menu structure
+ */
+interface WxrNavMenu {
+  id: number;
+  name: string;
+  label: string;
+  items: WxrNavMenuItem[];
+}
+/**
+ * Navigation menu item
+ */
+interface WxrNavMenuItem {
+  id: number;
+  menuId: number;
+  parentId?: number;
+  sortOrder: number;
+  type: "custom" | "post_type" | "taxonomy";
+  objectType?: string;
+  objectId?: number;
+  url?: string;
+  title: string;
+  target?: string;
+  classes?: string;
+}
+interface WxrAuthor {
+  id?: number;
+  login?: string;
+  email?: string;
+  displayName?: string;
+  firstName?: string;
+  lastName?: string;
+}
+/**
+ * Parse a WordPress WXR export file
+ */
+declare function parseWxr(stream: Readable): Promise<WxrData>;
+/**
+ * Parse a WordPress WXR export from a string
+ *
+ * Uses the non-streaming SAX parser API for compatibility with
+ * environments that don't expose Node.js streams.
+ */
+declare function parseWxrString(xml: string): Promise<WxrData>;
+//#endregion
+//#region src/plugins/define-plugin.d.ts
+/**
+ * Define a Dineway plugin.
+ *
+ * **Standard format** -- the canonical format for plugins that work in both
+ * trusted and sandboxed modes. No id/version -- those come from the descriptor.
+ *
+ * @example
+ * ```typescript
+ * import { definePlugin } from "dineway";
+ *
+ * export default definePlugin({
+ *   hooks: {
+ *     "content:afterSave": {
+ *       handler: async (event, ctx) => {
+ *         await ctx.kv.set("lastSave", Date.now());
+ *       },
+ *     },
+ *   },
+ *   routes: {
+ *     status: {
+ *       handler: async (routeCtx, ctx) => ({ ok: true }),
+ *     },
+ *   },
+ * });
+ * ```
+ *
+ * **Native format** -- for plugins that need React admin, direct DB access,
+ * or other capabilities not available in the sandbox.
+ *
+ * @example
+ * ```typescript
+ * import { definePlugin } from "dineway";
+ *
+ * export default definePlugin({
+ *   id: "my-plugin",
+ *   version: "1.0.0",
+ *   capabilities: ["read:content"],
+ *   hooks: {
+ *     "content:beforeSave": async (event, ctx) => {
+ *       ctx.log.info("Saving content", { collection: event.collection });
+ *       return event.content;
+ *     }
+ *   },
+ *   routes: {
+ *     "sync": {
+ *       handler: async (ctx) => {
+ *         return { status: "ok" };
+ *       }
+ *     }
+ *   }
+ * });
+ * ```
+ */
+declare function definePlugin<TStorage extends PluginStorageConfig>(definition: PluginDefinition<TStorage>): ResolvedPlugin<TStorage>;
+declare function definePlugin(definition: StandardPluginDefinition): StandardPluginDefinition;
+//#endregion
+//#region src/auth/types.d.ts
+/**
+ * Auth Provider Types
+ *
+ * Defines the interfaces for pluggable authentication providers.
+ * External auth adapters implement these interfaces.
+ */
+/**
+ * Result of authenticating a request via an external auth provider
+ */
+interface AuthResult {
+  /** User's email address */
+  email: string;
+  /** User's display name */
+  name: string;
+  /** Resolved role level (e.g., 50 for Admin, 30 for Editor) */
+  role: number;
+  /** Provider-specific subject ID */
+  subject?: string;
+  /** Additional provider-specific data */
+  metadata?: Record<string, unknown>;
+}
+/**
+ * Auth descriptor - returned by auth adapter functions (e.g., access())
+ *
+ * Similar to DatabaseDescriptor and StorageDescriptor, this allows
+ * auth providers to be configured at build time and loaded at runtime.
+ */
+interface AuthDescriptor {
+  /**
+   * Auth provider type identifier
+   * @example "header-auth", "okta", "auth0"
+   */
+  type: string;
+  /**
+   * Module specifier to import at runtime
+   * The module must export an `authenticate` function.
+   * @example "@acme/dineway-header-auth"
+   */
+  entrypoint: string;
+  /**
+   * Provider-specific configuration (JSON-serializable)
+   */
+  config: unknown;
+}
+/**
+ * Auth provider module interface
+ *
+ * Modules specified by AuthDescriptor.entrypoint must export
+ * an `authenticate` function matching this signature.
+ */
+interface AuthProviderModule {
+  /**
+   * Authenticate a request using the provider
+   *
+   * @param request - The incoming HTTP request
+   * @param config - Provider-specific configuration from AuthDescriptor
+   * @returns Authentication result if valid, throws if invalid
+   */
+  authenticate(request: Request, config: unknown): Promise<AuthResult>;
+}
+/**
+ * Configuration options common to external auth providers
+ */
+interface ExternalAuthConfig {
+  /**
+   * Automatically create Dineway users on first login
+   * @default true
+   */
+  autoProvision?: boolean;
+  /**
+   * Role level for users not matching any group in roleMapping
+   * @default 30 (Editor)
+   */
+  defaultRole?: number;
+  /**
+   * Update user's role on each login based on current IdP groups
+   * When false, role is only set on first provisioning
+   * @default false
+   */
+  syncRoles?: boolean;
+  /**
+   * Map IdP group names to Dineway role levels
+   * First match wins if user is in multiple groups
+   *
+   * @example
+   * ```ts
+   * roleMapping: {
+   *   "Admins": 50,        // Admin
+   *   "Developers": 40,    // Developer
+   *   "Content Team": 30,  // Editor
+   * }
+   * ```
+   */
+  roleMapping?: Record<string, number>;
+}
+//#endregion
+//#region src/astro/storage/types.d.ts
+/**
+ * Serializable storage configuration descriptor
+ */
+interface StorageDescriptor {
+  /** Module path exporting createStorage function */
+  entrypoint: string;
+  /** Serializable config passed to createStorage at runtime */
+  config: unknown;
+}
+/**
+ * S3-compatible storage configuration
+ */
+interface S3StorageConfig {
+  /** S3 endpoint URL */
+  endpoint: string;
+  /** Bucket name */
+  bucket: string;
+  /** Access key ID */
+  accessKeyId: string;
+  /** Secret access key */
+  secretAccessKey: string;
+  /** Optional region (defaults to "auto") */
+  region?: string;
+  /** Optional public URL prefix for CDN */
+  publicUrl?: string;
+}
+/**
+ * Local filesystem storage configuration
+ */
+interface LocalStorageConfig {
+  /** Directory path for storing files */
+  directory: string;
+  /** Base URL for serving files */
+  baseUrl: string;
+}
+//#endregion
+//#region src/astro/integration/runtime.d.ts
+/**
+ * Admin page definition (copied from plugins/types to avoid circular deps)
+ */
+interface PluginAdminPage {
+  path: string;
+  label: string;
+  icon?: string;
+}
+/**
+ * Dashboard widget definition (copied from plugins/types to avoid circular deps)
+ */
+interface PluginDashboardWidget {
+  id: string;
+  size?: "full" | "half" | "third";
+  title?: string;
+}
+/**
+ * Plugin descriptor - returned by plugin factory functions
+ *
+ * Contains all static metadata needed for manifest and admin UI,
+ * plus the entrypoint for runtime instantiation.
+ *
+ * @example
+ * ```ts
+ * export function myPlugin(options?: MyPluginOptions): PluginDescriptor {
+ *   return {
+ *     id: "my-plugin",
+ *     version: "1.0.0",
+ *     entrypoint: "@my-org/dineway-plugin-foo",
+ *     options: options ?? {},
+ *     adminEntry: "@my-org/dineway-plugin-foo/admin",
+ *     adminPages: [{ path: "/settings", label: "Settings" }],
+ *   };
+ * }
+ * ```
+ */
+/**
+ * Storage collection declaration for sandboxed plugins
+ */
+interface StorageCollectionDeclaration {
+  indexes?: string[];
+  uniqueIndexes?: string[];
+}
+interface PluginDescriptor<TOptions = Record<string, unknown>> {
+  /** Unique plugin identifier */
+  id: string;
+  /** Plugin version (semver) */
+  version: string;
+  /** Module specifier to import (e.g., "@dineway-ai/plugin-api-test") */
+  entrypoint: string;
+  /**
+   * Options to pass to createPlugin(). Native format only.
+   * Standard-format plugins configure themselves via KV settings
+   * and Block Kit admin pages -- not constructor options.
+   */
+  options?: TOptions;
+  /**
+   * Plugin format. Determines how the entrypoint is loaded:
+   * - `"standard"` -- exports `definePlugin({ hooks, routes })` as default.
+   *   Wrapped with `adaptSandboxEntry` for in-process execution. Can run in both
+   *   `plugins: []` (in-process) and `sandboxed: []` (isolate).
+   * - `"native"` -- exports `createPlugin(options)` returning a `ResolvedPlugin`.
+   *   Can only run in `plugins: []`. Cannot be sandboxed or published to marketplace.
+   *
+   * Defaults to `"native"` when unset.
+   *
+   */
+  format?: "standard" | "native";
+  /** Admin UI module specifier (e.g., "@dineway-ai/plugin-audit-log/admin") */
+  adminEntry?: string;
+  /** Module specifier for site-side Astro rendering components (must export `blockComponents`) */
+  componentsEntry?: string;
+  /** Admin pages for navigation */
+  adminPages?: PluginAdminPage[];
+  /** Dashboard widgets */
+  adminWidgets?: PluginDashboardWidget[];
+  /**
+   * Capabilities the plugin requests.
+   * For standard-format plugins, capabilities are enforced in both trusted and
+   * sandboxed modes via the PluginContextFactory.
+   */
+  capabilities?: string[];
+  /**
+   * Allowed hosts for network:fetch capability
+   * Supports wildcards like "*.example.com"
+   */
+  allowedHosts?: string[];
+  /**
+   * Storage collections the plugin declares
+   * Sandboxed plugins can only access declared collections.
+   */
+  storage?: Record<string, StorageCollectionDeclaration>;
+}
+/**
+ * Sandboxed plugin descriptor - same format as PluginDescriptor
+ *
+ * These run in isolated environments provided by the configured sandbox runner.
+ * The `entrypoint` is resolved to a file and bundled at build time.
+ */
+type SandboxedPluginDescriptor<TOptions = Record<string, unknown>> = PluginDescriptor<TOptions>;
+interface DinewayConfig {
+  /**
+   * Database configuration
+   *
+   * Use one of the adapter functions:
+   * - `libsql({ url: process.env.DINEWAY_DATABASE_URL || "file:./data.db" })` - Default Node/libSQL path
+   * - `sqlite({ url: "file:./data.db" })` - Local SQLite only
+   * - `postgres({ connectionString: process.env.DATABASE_URL! })` - PostgreSQL deployments
+   *
+   * @example
+   * ```ts
+   * import { libsql } from "dineway/db";
+   *
+   * dineway({
+   *   database: libsql({ url: process.env.DINEWAY_DATABASE_URL || "file:./data.db" }),
+   * })
+   * ```
+   */
+  database?: DatabaseDescriptor;
+  /**
+   * Storage configuration (for media)
+   */
+  storage?: StorageDescriptor;
+  /**
+   * Trusted plugins to load (run in main isolate)
+   *
+   * @example
+   * ```ts
+   * import { auditLogPlugin } from "@dineway-ai/plugin-audit-log";
+   * import { webhookNotifierPlugin } from "@dineway-ai/plugin-webhook-notifier";
+   *
+   * dineway({
+   *   plugins: [
+   *     auditLogPlugin(),
+   *     webhookNotifierPlugin({ url: "https://example.com/webhook" }),
+   *   ],
+   * })
+   * ```
+   */
+  plugins?: PluginDescriptor[];
+  /**
+   * Sandboxed plugins to load (run behind the configured `SandboxRunner`)
+   *
+   * Uses the same format as `plugins`; the configured sandbox runner decides
+   * how isolation is enforced for the current runtime.
+   *
+   * @example
+   * ```ts
+   * import { untrustedPlugin } from "some-third-party-plugin";
+   *
+   * dineway({
+   *   plugins: [trustedPlugin()],     // runs in host
+   *   sandboxed: [untrustedPlugin()], // runs in the default Node sandbox
+   * })
+   * ```
+   */
+  sandboxed?: SandboxedPluginDescriptor[];
+  /**
+   * Optional module that exports a custom sandbox runner factory.
+   * When omitted, Dineway uses its built-in Node sandbox runner.
+   *
+   * @example
+   * ```ts
+   * import { createNodeSandboxRunner } from "dineway";
+   *
+   * export const createSandboxRunner = createNodeSandboxRunner;
+   * ```
+   *
+   * @example
+   * ```ts
+   * dineway({
+   *   sandboxRunner: "./src/sandbox-runner.ts",
+   * })
+   * ```
+   */
+  sandboxRunner?: string;
+  /**
+   * Authentication configuration
+   *
+   * Use an auth descriptor or an adapter function from a provider package.
+   *
+   * When an external auth provider is configured, passkey auth is disabled.
+   *
+   * @example
+   * ```ts
+   * dineway({
+   *   auth: {
+   *     type: "header-auth",
+   *     entrypoint: "./src/header-auth.ts",
+   *     config: {
+   *       userHeader: "x-forwarded-user-email",
+   *       roleHeader: "x-forwarded-user-role",
+   *     },
+   *   },
+   * })
+   * ```
+   */
+  auth?: AuthDescriptor;
+  /**
+   * Enable the MCP (Model Context Protocol) server endpoint.
+   *
+   * When enabled, exposes an MCP Streamable HTTP server at
+   * `/_dineway/api/mcp` that allows AI agents and tools to interact
+   * with the CMS using the standardized MCP protocol.
+   *
+   * Authentication is handled by the existing Dineway auth middleware —
+   * agents must authenticate with an API token or session cookie.
+   *
+   * @default false
+   *
+   * @example
+   * ```ts
+   * dineway({
+   *   mcp: true,
+   * })
+   * ```
+   */
+  mcp?: boolean;
+  /**
+   * Plugin marketplace URL
+   *
+   * When set, enables the marketplace features: browse, install, update,
+   * and uninstall plugins from a remote marketplace.
+   *
+   * Must be an HTTPS URL in production, or localhost/127.0.0.1 in dev.
+   * Marketplace plugins run in the built-in Node sandbox runner unless
+   * `sandboxRunner` is set to override it.
+   *
+   * @example
+   * ```ts
+   * dineway({
+   *   marketplace: "https://marketplace.example.com",
+   * })
+   * ```
+   */
+  marketplace?: string;
+  /**
+   * Public browser-facing origin for the site.
+   *
+   * Use when `Astro.url` / `request.url` do not match what users open — common with a
+   * **TLS-terminating reverse proxy**: the app often sees `http://` on the internal hop
+   * while the browser uses `https://`, which breaks WebAuthn, CSRF, OAuth, and redirect URLs.
+   *
+   * Set to the full origin users type in the address bar (no path), e.g.
+   * `https://mysite.example.com`. When not set, falls back to environment variables
+   * `DINEWAY_SITE_URL` > `SITE_URL`, then to the request URL's origin.
+   *
+   * Replaces `passkeyPublicOrigin` (which only fixed passkeys).
+   */
+  siteUrl?: string;
+  /**
+   * Enable playground mode for ephemeral "try Dineway" sites.
+   *
+   * When set, the integration injects a playground middleware (order: "pre")
+   * that runs BEFORE the normal Dineway middleware chain. It creates an
+   * isolated session database per visitor, runs migrations, applies the
+   * seed, creates an anonymous admin user, and stashes the request-scoped
+   * database on locals so the runtime and request-context middleware can
+   * pick it up.
+   *
+   * Setup and auth middleware are skipped because the playground middleware
+   * handles bootstrap and user injection.
+   *
+   * For the first portable release, playground sidecars are explicitly
+   * single-instance only.
+   *
+   * @example
+   * ```ts
+   * import { fileURLToPath } from "node:url";
+   * import { libsql } from "dineway/db";
+   *
+   * dineway({
+   *   database: libsql({ url: process.env.DINEWAY_DATABASE_URL || "file:./playground.db" }),
+   *   playground: {
+   *     middlewareEntrypoint: fileURLToPath(
+   *       new URL("./src/playground-middleware.ts", import.meta.url)
+   *     ),
+   *   },
+   * })
+   * ```
+   */
+  playground?: {
+    /** Module path for the playground middleware. */middlewareEntrypoint: string;
+  };
+  /**
+   * Media providers for browsing and uploading media
+   *
+   * The local media provider (using storage adapter) is available by default.
+   * Additional providers can be added for external services like Unsplash,
+   * Cloudinary, Mux, and other provider packages.
+   *
+   * @example
+   * ```ts
+   * import { unsplash } from "@dineway-ai/provider-unsplash";
+   *
+   * dineway({
+   *   mediaProviders: [
+   *     unsplash({ accessKey: "..." }),
+   *   ],
+   * })
+   * ```
+   */
+  mediaProviders?: MediaProviderDescriptor[];
+}
+/**
+ * Get stored config from global
+ * This is set by the virtual module at build time
+ */
+declare function getStoredConfig(): DinewayConfig | null;
+declare global {
+  var __dinewayConfig: DinewayConfig | undefined;
+}
+//#endregion
+//#region src/plugins/manifest-schema.d.ts
+/**
+ * Zod schema matching the PluginManifest interface from types.ts.
+ *
+ * Every JSON.parse of a manifest.json should validate through this.
+ */
+declare const pluginManifestSchema: z$1.ZodObject<{
+  id: z$1.ZodString;
+  version: z$1.ZodString;
+  capabilities: z$1.ZodArray<z$1.ZodEnum<{
+    "network:fetch": "network:fetch";
+    "network:fetch:any": "network:fetch:any";
+    "read:content": "read:content";
+    "write:content": "write:content";
+    "read:media": "read:media";
+    "write:media": "write:media";
+    "read:users": "read:users";
+    "email:send": "email:send";
+    "email:provide": "email:provide";
+    "email:intercept": "email:intercept";
+    "page:inject": "page:inject";
+  }>>;
+  allowedHosts: z$1.ZodArray<z$1.ZodString>;
+  storage: z$1.ZodRecord<z$1.ZodString, z$1.ZodObject<{
+    indexes: z$1.ZodArray<z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
+    uniqueIndexes: z$1.ZodOptional<z$1.ZodArray<z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>>;
+  }, z$1.core.$strip>>;
+  hooks: z$1.ZodArray<z$1.ZodUnion<readonly [z$1.ZodEnum<{
+    "plugin:install": "plugin:install";
+    "plugin:activate": "plugin:activate";
+    "plugin:deactivate": "plugin:deactivate";
+    "plugin:uninstall": "plugin:uninstall";
+    "content:beforeSave": "content:beforeSave";
+    "content:afterSave": "content:afterSave";
+    "content:beforeDelete": "content:beforeDelete";
+    "content:afterDelete": "content:afterDelete";
+    "content:afterPublish": "content:afterPublish";
+    "content:afterUnpublish": "content:afterUnpublish";
+    "media:beforeUpload": "media:beforeUpload";
+    "media:afterUpload": "media:afterUpload";
+    cron: "cron";
+    "email:beforeSend": "email:beforeSend";
+    "email:deliver": "email:deliver";
+    "email:afterSend": "email:afterSend";
+    "comment:beforeCreate": "comment:beforeCreate";
+    "comment:moderate": "comment:moderate";
+    "comment:afterCreate": "comment:afterCreate";
+    "comment:afterModerate": "comment:afterModerate";
+    "page:metadata": "page:metadata";
+    "page:fragments": "page:fragments";
+  }>, z$1.ZodObject<{
+    name: z$1.ZodEnum<{
+      "plugin:install": "plugin:install";
+      "plugin:activate": "plugin:activate";
+      "plugin:deactivate": "plugin:deactivate";
+      "plugin:uninstall": "plugin:uninstall";
+      "content:beforeSave": "content:beforeSave";
+      "content:afterSave": "content:afterSave";
+      "content:beforeDelete": "content:beforeDelete";
+      "content:afterDelete": "content:afterDelete";
+      "content:afterPublish": "content:afterPublish";
+      "content:afterUnpublish": "content:afterUnpublish";
+      "media:beforeUpload": "media:beforeUpload";
+      "media:afterUpload": "media:afterUpload";
+      cron: "cron";
+      "email:beforeSend": "email:beforeSend";
+      "email:deliver": "email:deliver";
+      "email:afterSend": "email:afterSend";
+      "comment:beforeCreate": "comment:beforeCreate";
+      "comment:moderate": "comment:moderate";
+      "comment:afterCreate": "comment:afterCreate";
+      "comment:afterModerate": "comment:afterModerate";
+      "page:metadata": "page:metadata";
+      "page:fragments": "page:fragments";
+    }>;
+    exclusive: z$1.ZodOptional<z$1.ZodBoolean>;
+    priority: z$1.ZodOptional<z$1.ZodNumber>;
+    timeout: z$1.ZodOptional<z$1.ZodNumber>;
+  }, z$1.core.$strip>]>>;
+  routes: z$1.ZodArray<z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodObject<{
+    name: z$1.ZodString;
+    public: z$1.ZodOptional<z$1.ZodBoolean>;
+  }, z$1.core.$strip>]>>;
+  admin: z$1.ZodObject<{
+    entry: z$1.ZodOptional<z$1.ZodString>;
+    settingsSchema: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodDiscriminatedUnion<[z$1.ZodObject<{
+      type: z$1.ZodLiteral<"string">;
+      default: z$1.ZodOptional<z$1.ZodString>;
+      multiline: z$1.ZodOptional<z$1.ZodBoolean>;
+      label: z$1.ZodString;
+      description: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$strip>, z$1.ZodObject<{
+      type: z$1.ZodLiteral<"number">;
+      default: z$1.ZodOptional<z$1.ZodNumber>;
+      min: z$1.ZodOptional<z$1.ZodNumber>;
+      max: z$1.ZodOptional<z$1.ZodNumber>;
+      label: z$1.ZodString;
+      description: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$strip>, z$1.ZodObject<{
+      type: z$1.ZodLiteral<"boolean">;
+      default: z$1.ZodOptional<z$1.ZodBoolean>;
+      label: z$1.ZodString;
+      description: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$strip>, z$1.ZodObject<{
+      type: z$1.ZodLiteral<"select">;
+      options: z$1.ZodArray<z$1.ZodObject<{
+        value: z$1.ZodString;
+        label: z$1.ZodString;
+      }, z$1.core.$strip>>;
+      default: z$1.ZodOptional<z$1.ZodString>;
+      label: z$1.ZodString;
+      description: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$strip>, z$1.ZodObject<{
+      type: z$1.ZodLiteral<"secret">;
+      label: z$1.ZodString;
+      description: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$strip>], "type">>>;
+    pages: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+      path: z$1.ZodString;
+      label: z$1.ZodString;
+      icon: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$strip>>>;
+    widgets: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+      id: z$1.ZodString;
+      size: z$1.ZodOptional<z$1.ZodEnum<{
+        full: "full";
+        half: "half";
+        third: "third";
+      }>>;
+      title: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$strip>>>;
+    fieldWidgets: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+      name: z$1.ZodString;
+      label: z$1.ZodString;
+      fieldTypes: z$1.ZodArray<z$1.ZodEnum<{
+        string: "string";
+        number: "number";
+        boolean: "boolean";
+        text: "text";
+        integer: "integer";
+        datetime: "datetime";
+        select: "select";
+        multiSelect: "multiSelect";
+        portableText: "portableText";
+        image: "image";
+        file: "file";
+        reference: "reference";
+        json: "json";
+        slug: "slug";
+        repeater: "repeater";
+      }>>;
+      elements: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
+        type: z$1.ZodString;
+        action_id: z$1.ZodString;
+        label: z$1.ZodOptional<z$1.ZodString>;
+      }, z$1.core.$loose>>>;
+    }, z$1.core.$strip>>>;
+  }, z$1.core.$strip>;
+}, z$1.core.$strip>;
+type ValidatedPluginManifest = z$1.infer<typeof pluginManifestSchema>;
+//#endregion
+//#region src/plugins/hooks.d.ts
+type HookNameV2 = "plugin:install" | "plugin:activate" | "plugin:deactivate" | "plugin:uninstall" | "content:beforeSave" | "content:afterSave" | "content:beforeDelete" | "content:afterDelete" | "content:afterPublish" | "content:afterUnpublish" | "media:beforeUpload" | "media:afterUpload" | "cron" | "email:beforeSend" | "email:deliver" | "email:afterSend" | "comment:beforeCreate" | "comment:moderate" | "comment:afterCreate" | "comment:afterModerate" | "page:metadata" | "page:fragments";
+/**
+ * Hook execution result
+ */
+interface HookResult<T> {
+  success: boolean;
+  value?: T;
+  error?: Error;
+  pluginId: string;
+  duration: number;
+}
+/**
+ * Hook pipeline for executing hooks in order
+ */
+declare class HookPipeline {
+  private hooks;
+  private pluginMap;
+  private contextFactory;
+  /** Stored so setContextFactory can merge incrementally. */
+  private contextFactoryOptions;
+  /** Hook names where at least one handler declared exclusive: true */
+  private exclusiveHookNames;
+  /**
+   * Selected provider plugin ID for each exclusive hook.
+   * Set by the PluginManager after resolution.
+   */
+  private exclusiveSelections;
+  constructor(plugins: ResolvedPlugin[], factoryOptions?: PluginContextFactoryOptions);
+  /**
+   * Set or update the context factory options.
+   *
+   * When called on a pipeline that already has a factory, the new options
+   * are merged on top of the existing ones so that callers don't need to
+   * repeat every field (e.g. adding `cronReschedule` without losing
+   * `storage` / `getUploadUrl`).
+   */
+  setContextFactory(options: Partial<PluginContextFactoryOptions>): void;
+  /**
+   * Get context for a plugin
+   */
+  private getContext;
+  /**
+   * Get typed hooks for a specific hook name.
+   * The internal map stores ResolvedHook<unknown>, but we know each name
+   * maps to a specific handler type via HookHandlerMap.
+   *
+   * Exclusive hooks that have a selected provider are filtered out — they
+   * should only run via invokeExclusiveHook(), not in the regular pipeline.
+   */
+  private getTypedHooks;
+  /**
+   * Register all hooks from plugins.
+   *
+   * Registers each hook name individually to preserve type safety. The
+   * internal map stores ResolvedHook<unknown> since it's keyed by string,
+   * but getTypedHooks() restores the correct handler type on retrieval.
+   */
+  private registerPlugins;
+  /**
+   * Maps hook names to the capability required to register them.
+   *
+   * Hooks not listed here have no capability requirement (e.g. lifecycle
+   * hooks, cron). Any plugin declaring a listed hook without the required
+   * capability will have that hook silently skipped at registration time.
+   */
+  private static readonly HOOK_REQUIRED_CAPABILITY;
+  /**
+   * Register a single plugin's hook by name
+   */
+  private registerPluginHook;
+  /**
+   * Register a single hook
+   */
+  private registerHook;
+  /**
+   * Sort hooks by priority and dependencies
+   */
+  private sortHooks;
+  /**
+   * Execute a hook with timeout
+   */
+  private executeWithTimeout;
+  /**
+   * Run plugin:install hooks
+   */
+  runPluginInstall(pluginId: string): Promise<HookResult<void>[]>;
+  /**
+   * Run plugin:activate hooks
+   */
+  runPluginActivate(pluginId: string): Promise<HookResult<void>[]>;
+  /**
+   * Run plugin:deactivate hooks
+   */
+  runPluginDeactivate(pluginId: string): Promise<HookResult<void>[]>;
+  /**
+   * Run plugin:uninstall hooks
+   */
+  runPluginUninstall(pluginId: string, deleteData: boolean): Promise<HookResult<void>[]>;
+  private runLifecycleHook;
+  /**
+   * Run content:beforeSave hooks
+   * Returns modified content from the pipeline
+   */
+  runContentBeforeSave(content: Record<string, unknown>, collection: string, isNew: boolean): Promise<{
+    content: Record<string, unknown>;
+    results: HookResult<Record<string, unknown>>[];
+  }>;
+  /**
+   * Run content:afterSave hooks
+   */
+  runContentAfterSave(content: Record<string, unknown>, collection: string, isNew: boolean): Promise<HookResult<void>[]>;
+  /**
+   * Run content:beforeDelete hooks
+   * Returns whether deletion is allowed
+   */
+  runContentBeforeDelete(id: string, collection: string): Promise<{
+    allowed: boolean;
+    results: HookResult<boolean>[];
+  }>;
+  /**
+   * Run content:afterDelete hooks
+   */
+  runContentAfterDelete(id: string, collection: string): Promise<HookResult<void>[]>;
+  /**
+   * Run content:afterPublish hooks (fire-and-forget).
+   */
+  runContentAfterPublish(content: Record<string, unknown>, collection: string): Promise<HookResult<void>[]>;
+  /**
+   * Run content:afterUnpublish hooks (fire-and-forget).
+   */
+  runContentAfterUnpublish(content: Record<string, unknown>, collection: string): Promise<HookResult<void>[]>;
+  /**
+   * Run media:beforeUpload hooks
+   */
+  runMediaBeforeUpload(file: {
+    name: string;
+    type: string;
+    size: number;
+  }): Promise<{
+    file: {
+      name: string;
+      type: string;
+      size: number;
+    };
+    results: HookResult<{
+      name: string;
+      type: string;
+      size: number;
+    }>[];
+  }>;
+  /**
+   * Run media:afterUpload hooks
+   */
+  runMediaAfterUpload(media: {
+    id: string;
+    filename: string;
+    mimeType: string;
+    size: number | null;
+    url: string;
+    createdAt: string;
+  }): Promise<HookResult<void>[]>;
+  /**
+   * Invoke the cron hook for a specific plugin.
+   *
+   * Unlike other hooks which broadcast to all plugins, the cron hook is
+   * dispatched only to the target plugin — the one that owns the task.
+   */
+  invokeCronHook(pluginId: string, event: CronEvent): Promise<HookResult<void>>;
+  /**
+   * Run email:beforeSend hooks (middleware pipeline).
+   *
+   * Each handler receives the message and returns a modified message or
+   * `false` to cancel delivery. The pipeline chains message transformations —
+   * each handler receives the output of the previous one.
+   */
+  runEmailBeforeSend(message: EmailMessage, source: string): Promise<{
+    message: EmailMessage | false;
+    results: HookResult<EmailMessage | false>[];
+  }>;
+  /**
+   * Run email:afterSend hooks (fire-and-forget).
+   *
+   * Errors are logged but don't propagate — they don't affect the caller.
+   */
+  runEmailAfterSend(message: EmailMessage, source: string): Promise<HookResult<void>[]>;
+  /**
+   * Run comment:beforeCreate hooks (middleware pipeline).
+   *
+   * Each handler receives the event and returns a modified event or
+   * `false` to reject the comment. The pipeline chains transformations —
+   * each handler receives the output of the previous one.
+   */
+  runCommentBeforeCreate(event: CommentBeforeCreateEvent): Promise<CommentBeforeCreateEvent | false>;
+  /**
+   * Run comment:afterCreate hooks (fire-and-forget).
+   *
+   * Errors are logged but don't propagate — they don't affect the caller.
+   */
+  runCommentAfterCreate(event: CommentAfterCreateEvent): Promise<void>;
+  /**
+   * Run comment:afterModerate hooks (fire-and-forget).
+   *
+   * Errors are logged but don't propagate — they don't affect the caller.
+   */
+  runCommentAfterModerate(event: CommentAfterModerateEvent): Promise<void>;
+  /**
+   * Run page:metadata hooks. Each handler returns contributions that are
+   * merged by the metadata collector. Errors are logged but don't propagate.
+   */
+  runPageMetadata(event: PageMetadataEvent): Promise<Array<{
+    pluginId: string;
+    contributions: PageMetadataContribution[];
+  }>>;
+  /**
+   * Run page:fragments hooks. Only trusted plugins should be registered
+   * for this hook. Errors are logged but don't propagate.
+   */
+  runPageFragments(event: PageFragmentEvent): Promise<Array<{
+    pluginId: string;
+    contributions: PageFragmentContribution[];
+  }>>;
+  /**
+   * Check if any hooks are registered for a given name
+   */
+  hasHooks(name: HookNameV2): boolean;
+  /**
+   * Get hook count for debugging
+   */
+  getHookCount(name: HookNameV2): number;
+  /**
+   * Get all registered hook names
+   */
+  getRegisteredHooks(): HookNameV2[];
+  /**
+   * Returns hook names where at least one handler declared exclusive: true
+   */
+  getRegisteredExclusiveHooks(): string[];
+  /**
+   * Check if a hook is exclusive
+   */
+  isExclusiveHook(name: string): boolean;
+  /**
+   * Set the selected provider for an exclusive hook.
+   * Called by PluginManager after resolution.
+   */
+  setExclusiveSelection(hookName: string, pluginId: string): void;
+  /**
+   * Clear the selected provider for an exclusive hook.
+   */
+  clearExclusiveSelection(hookName: string): void;
+  /**
+   * Get the selected provider for an exclusive hook (if any).
+   */
+  getExclusiveSelection(hookName: string): string | undefined;
+  /**
+   * Get all plugins that registered a handler for a given exclusive hook.
+   */
+  getExclusiveHookProviders(hookName: string): Array<{
+    pluginId: string;
+  }>;
+  /**
+   * Invoke an exclusive hook — dispatch only to the selected provider.
+   * Returns null if no provider is selected or if the selected hook
+   * is not found in the pipeline.
+   *
+   * This is a generic dispatch used by the email pipeline and other
+   * exclusive hook consumers. The handler type is unknown — callers
+   * must know the expected signature.
+   *
+   * Errors are isolated: a failing handler returns an error result
+   * instead of propagating the exception to the caller.
+   */
+  invokeExclusiveHook(hookName: string, event: unknown): Promise<{
+    result: unknown;
+    pluginId: string;
+    error?: Error;
+    duration: number;
+  } | null>;
+}
+/**
+ * Create a hook pipeline from plugins
+ */
+declare function createHookPipeline(plugins: ResolvedPlugin[], factoryOptions?: PluginContextFactoryOptions): HookPipeline;
+//#endregion
+//#region src/plugins/email.d.ts
+/**
+ * EmailPipeline orchestrates email delivery through the plugin hook system.
+ *
+ * The pipeline runs in three stages:
+ * 1. email:beforeSend — middleware hooks that can transform or cancel messages
+ * 2. email:deliver — exclusive hook dispatching to the selected provider
+ * 3. email:afterSend — fire-and-forget hooks for logging/analytics
+ */
+declare class EmailPipeline {
+  private pipeline;
+  constructor(pipeline: HookPipeline);
+  /**
+   * Replace the underlying hook pipeline.
+   *
+   * Called by the runtime when rebuilding the hook pipeline after a
+   * plugin is enabled or disabled, so the email pipeline dispatches
+   * to the current set of active hooks.
+   */
+  setPipeline(pipeline: HookPipeline): void;
+  /**
+   * Send an email through the full pipeline.
+   *
+   * @param message - The email to send
+   * @param source - Where the email originated ("system" for auth, plugin ID for plugins)
+   * @throws EmailNotConfiguredError if no provider is selected
+   * @throws EmailRecursionError if called re-entrantly from within a hook
+   * @throws Error if the provider handler throws
+   */
+  send(message: EmailMessage, source: string): Promise<void>;
+  /**
+   * Inner send implementation, separated from the recursion guard.
+   */
+  private sendInner;
+  /**
+   * Check if an email provider is configured and available.
+   *
+   * Returns true if an email:deliver provider is selected in the exclusive
+   * hook system. Plugins and auth code use this to decide whether to show
+   * "send invite" vs "copy invite link" UI.
+   */
+  isAvailable(): boolean;
+}
+//#endregion
+//#region src/plugins/context.d.ts
+/**
+ * Options for creating site info
+ */
+interface SiteInfoOptions {
+  /** Site name from options table */
+  siteName?: string;
+  /** Site URL from options table or Astro config */
+  siteUrl?: string;
+  /** Site locale from options table */
+  locale?: string;
+}
+interface PluginContextFactoryOptions {
+  db: Kysely<Database>;
+  /**
+   * Storage backend for direct media uploads.
+   * If not provided, upload() will throw.
+   */
+  storage?: Storage;
+  /**
+   * Function to generate upload URLs for media.
+   * If not provided, media write operations will throw.
+   */
+  getUploadUrl?: (filename: string, contentType: string) => Promise<{
+    uploadUrl: string;
+    mediaId: string;
+  }>;
+  /**
+   * Site information for ctx.site and ctx.url().
+   * If not provided, site info will have empty defaults.
+   */
+  siteInfo?: SiteInfoOptions;
+  /**
+   * Callback to notify the cron scheduler that the next due time may have changed.
+   * If not provided, ctx.cron will not be available.
+   */
+  cronReschedule?: () => void;
+  /**
+   * Email pipeline instance for ctx.email.
+   * If not provided (or no provider configured), ctx.email will be undefined.
+   */
+  emailPipeline?: EmailPipeline;
+}
+//#endregion
+//#region src/plugins/routes.d.ts
+/**
+ * Result from a route invocation
+ */
+interface RouteResult<T = unknown> {
+  success: boolean;
+  data?: T;
+  error?: {
+    code: string;
+    message: string;
+    details?: unknown;
+  };
+  status: number;
+}
+/**
+ * Route invocation options
+ */
+interface InvokeRouteOptions {
+  /** The original request */
+  request: Request;
+  /** Request body (already parsed) */
+  body?: unknown;
+}
+/**
+ * Error class for plugin routes
+ * Allows plugins to return structured errors with specific HTTP status codes
+ */
+declare class PluginRouteError extends Error {
+  code: string;
+  status: number;
+  details?: unknown | undefined;
+  constructor(code: string, message: string, status?: number, details?: unknown | undefined);
+  /**
+   * Create a bad request error (400)
+   */
+  static badRequest(message: string, details?: unknown): PluginRouteError;
+  /**
+   * Create an unauthorized error (401)
+   */
+  static unauthorized(message?: string): PluginRouteError;
+  /**
+   * Create a forbidden error (403)
+   */
+  static forbidden(message?: string): PluginRouteError;
+  /**
+   * Create a not found error (404)
+   */
+  static notFound(message?: string): PluginRouteError;
+  /**
+   * Create a conflict error (409)
+   */
+  static conflict(message: string, details?: unknown): PluginRouteError;
+  /**
+   * Create an internal error (500)
+   */
+  static internal(message?: string): PluginRouteError;
+}
+//#endregion
+//#region src/plugins/manager.d.ts
+/**
+ * Plugin state in the manager
+ */
+type PluginState = "registered" | "installed" | "active" | "inactive";
+/**
+ * Plugin manager options
+ */
+interface PluginManagerOptions {
+  /** Database instance */
+  db: Kysely<Database>;
+  /** Storage backend for direct media uploads */
+  storage?: Storage;
+  /** Function to generate upload URLs for media */
+  getUploadUrl?: (filename: string, contentType: string) => Promise<{
+    uploadUrl: string;
+    mediaId: string;
+  }>;
+}
+/**
+ * Plugin Manager v2
+ *
+ * Manages the full lifecycle of plugins and coordinates hooks/routes.
+ */
+declare class PluginManager {
+  private options;
+  private plugins;
+  private hookPipeline;
+  private routeRegistry;
+  private factoryOptions;
+  private initialized;
+  constructor(options: PluginManagerOptions);
+  /**
+   * Set the email pipeline used when creating plugin contexts.
+   * Reinitializes routes/hooks if already initialized so ctx.email is available immediately.
+   */
+  setEmailPipeline(pipeline: EmailPipeline): void;
+  /**
+   * Register a plugin definition
+   * This resolves the definition and adds it to the manager, but doesn't install it
+   */
+  register<TStorage extends PluginStorageConfig>(definition: PluginDefinition<TStorage>): ResolvedPlugin<TStorage>;
+  /**
+   * Register multiple plugins
+   */
+  registerAll(definitions: PluginDefinition[]): void;
+  /**
+   * Unregister a plugin
+   * Plugin must be inactive or just registered
+   */
+  unregister(pluginId: string): boolean;
+  /**
+   * Install a plugin (run install hooks, set up storage)
+   */
+  install(pluginId: string): Promise<HookResult<void>[]>;
+  /**
+   * Activate a plugin (run activate hooks, enable hooks/routes)
+   */
+  activate(pluginId: string): Promise<HookResult<void>[]>;
+  /**
+   * Deactivate a plugin (run deactivate hooks, disable hooks/routes)
+   */
+  deactivate(pluginId: string): Promise<HookResult<void>[]>;
+  /**
+   * Uninstall a plugin (run uninstall hooks, optionally delete data)
+   */
+  uninstall(pluginId: string, deleteData?: boolean): Promise<HookResult<void>[]>;
+  /**
+   * Run content:beforeSave hooks across all active plugins
+   */
+  runContentBeforeSave(content: Record<string, unknown>, collection: string, isNew: boolean): Promise<{
+    content: Record<string, unknown>;
+    results: HookResult<Record<string, unknown>>[];
+  }>;
+  /**
+   * Run content:afterSave hooks across all active plugins
+   */
+  runContentAfterSave(content: Record<string, unknown>, collection: string, isNew: boolean): Promise<HookResult<void>[]>;
+  /**
+   * Run content:beforeDelete hooks across all active plugins
+   */
+  runContentBeforeDelete(id: string, collection: string): Promise<{
+    allowed: boolean;
+    results: HookResult<boolean>[];
+  }>;
+  /**
+   * Run content:afterDelete hooks across all active plugins
+   */
+  runContentAfterDelete(id: string, collection: string): Promise<HookResult<void>[]>;
+  /**
+   * Run content:afterPublish hooks across all active plugins
+   */
+  runContentAfterPublish(content: Record<string, unknown>, collection: string): Promise<HookResult<void>[]>;
+  /**
+   * Run content:afterUnpublish hooks across all active plugins
+   */
+  runContentAfterUnpublish(content: Record<string, unknown>, collection: string): Promise<HookResult<void>[]>;
+  /**
+   * Run media:beforeUpload hooks across all active plugins
+   */
+  runMediaBeforeUpload(file: {
+    name: string;
+    type: string;
+    size: number;
+  }): Promise<{
+    file: {
+      name: string;
+      type: string;
+      size: number;
+    };
+    results: HookResult<{
+      name: string;
+      type: string;
+      size: number;
+    }>[];
+  }>;
+  /**
+   * Run media:afterUpload hooks across all active plugins
+   */
+  runMediaAfterUpload(media: MediaItem$1): Promise<HookResult<void>[]>;
+  /**
+   * Invoke the cron hook for a specific plugin (per-plugin dispatch).
+   * Used as the InvokeCronHookFn callback for CronExecutor.
+   */
+  invokeCronHook(pluginId: string, event: CronEvent): Promise<void>;
+  /**
+   * Invoke a plugin route
+   */
+  invokeRoute(pluginId: string, routeName: string, options: InvokeRouteOptions): Promise<RouteResult>;
+  /**
+   * Get all routes for a plugin
+   */
+  getPluginRoutes(pluginId: string): string[];
+  /**
+   * Get a plugin by ID
+   */
+  getPlugin(pluginId: string): ResolvedPlugin | undefined;
+  /**
+   * Get plugin state
+   */
+  getPluginState(pluginId: string): PluginState | undefined;
+  /**
+   * Get all registered plugins
+   */
+  getAllPlugins(): Array<{
+    plugin: ResolvedPlugin;
+    state: PluginState;
+  }>;
+  /**
+   * Get all active plugins
+   */
+  getActivePlugins(): ResolvedPlugin[];
+  /**
+   * Check if a plugin exists
+   */
+  hasPlugin(pluginId: string): boolean;
+  /**
+   * Check if a plugin is active
+   */
+  isActive(pluginId: string): boolean;
+  /**
+   * Get all plugins that registered a handler for an exclusive hook.
+   */
+  getExclusiveHookProviders(hookName: string): Array<{
+    pluginId: string;
+    pluginName: string;
+  }>;
+  /**
+   * Read the selected provider for an exclusive hook from the options table.
+   */
+  getExclusiveHookSelection(hookName: string): Promise<string | null>;
+  /**
+   * Set the selected provider for an exclusive hook in the options table.
+   * Pass null to clear the selection.
+   */
+  setExclusiveHookSelection(hookName: string, pluginId: string | null): Promise<void>;
+  /**
+   * Resolution algorithm for exclusive hooks.
+   *
+   * Delegates to the shared resolveExclusiveHooks() function.
+   * See hooks.ts for the full algorithm description.
+   */
+  resolveExclusiveHooks(preferredHints?: Map<string, string[]>): Promise<void>;
+  /**
+   * Get all exclusive hooks with their providers and current selections.
+   * Used by the admin API.
+   */
+  getExclusiveHooksInfo(): Promise<Array<{
+    hookName: string;
+    providers: Array<{
+      pluginId: string;
+    }>;
+    selectedPluginId: string | null;
+  }>>;
+  /**
+   * Initialize or reinitialize the hook pipeline and route registry
+   */
+  private ensureInitialized;
+  /**
+   * Force reinitialization (useful after plugin state changes)
+   */
+  reinitialize(): void;
+  /**
+   * Delete all cron tasks for a plugin.
+   * Used during uninstall.
+   */
+  private deleteCronTasks;
+}
+/**
+ * Create a plugin manager
+ */
+declare function createPluginManager(options: PluginManagerOptions): PluginManager;
+//#endregion
+//#region src/plugins/sandbox/noop.d.ts
+/**
+ * Error thrown when attempting to use sandboxing on an unsupported platform.
+ */
+declare class SandboxNotAvailableError extends Error {
+  constructor();
+}
+/**
+ * No-op sandbox runner for platforms without isolation support.
+ *
+ * - `isAvailable()` returns false
+ * - `load()` throws SandboxNotAvailableError
+ * - `terminateAll()` is a no-op
+ *
+ * This is the default runner when no platform adapter is configured.
+ */
+declare class NoopSandboxRunner implements SandboxRunner {
+  /**
+   * Always returns false - sandboxing is not available.
+   */
+  isAvailable(): boolean;
+  /**
+   * Always throws - can't load sandboxed plugins without isolation.
+   */
+  load(_manifest: PluginManifest, _code: string): Promise<SandboxedPlugin>;
+  /**
+   * No-op - sandboxing not available, email callback is irrelevant.
+   */
+  setEmailSend(): void;
+  /**
+   * No-op - nothing to terminate.
+   */
+  terminateAll(): Promise<void>;
+}
+/**
+ * Create a no-op sandbox runner.
+ * This is used as the default when no platform adapter is configured.
+ */
+declare function createNoopSandboxRunner(_options?: SandboxOptions): SandboxRunner;
+//#endregion
+//#region src/plugins/sandbox/runtime-options.d.ts
+interface SandboxRunnerRuntimeOptions extends SandboxOptions {
+  mediaStorage?: Storage;
+  cronReschedule?: () => void;
+}
+//#endregion
+//#region src/plugins/sandbox/node.d.ts
+declare class NodeSandboxRunner implements SandboxRunner {
+  private readonly options;
+  private readonly limits;
+  private readonly activeWorkers;
+  private emailSend;
+  constructor(options: SandboxRunnerRuntimeOptions);
+  isAvailable(): boolean;
+  load(manifest: PluginManifest, code: string): Promise<SandboxedPlugin>;
+  setEmailSend(callback: SandboxEmailSendCallback | null): void;
+  terminateAll(): Promise<void>;
+}
+declare function createNodeSandboxRunner(options: SandboxRunnerRuntimeOptions): SandboxRunner;
+//#endregion
+//#region src/import/types.d.ts
+/** Author info from WordPress */
+interface WpAuthorInfo {
+  id?: number;
+  login?: string;
+  email?: string;
+  displayName?: string;
+  postCount: number;
+}
+/** File-based input (WXR upload) */
+interface FileInput {
+  type: "file";
+  file: File;
+}
+/** URL-based input (REST API probe) */
+interface UrlInput {
+  type: "url";
+  url: string;
+  /** Optional auth token for authenticated requests */
+  token?: string;
+}
+/** OAuth-based input (WordPress.com) */
+interface OAuthInput {
+  type: "oauth";
+  url: string;
+  accessToken: string;
+  /** Site ID for WordPress.com */
+  siteId?: string;
+}
+type SourceInput = FileInput | UrlInput | OAuthInput;
+/** Auth requirements for an import source */
+interface SourceAuth {
+  type: "oauth" | "token" | "password" | "none";
+  /** OAuth provider identifier */
+  provider?: string;
+  /** OAuth authorization URL */
+  oauthUrl?: string;
+  /** Human-readable instructions */
+  instructions?: string;
+}
+/** What the source can provide */
+interface SourceCapabilities {
+  /** Can fetch published content without auth */
+  publicContent: boolean;
+  /** Can fetch drafts/private (may need auth) */
+  privateContent: boolean;
+  /** Can fetch all custom post types */
+  customPostTypes: boolean;
+  /** Can fetch all meta fields */
+  allMeta: boolean;
+  /** Can stream media directly */
+  mediaStream: boolean;
+}
+/** Suggested next action after probe */
+type SuggestedAction = {
+  type: "proceed";
+} | {
+  type: "oauth";
+  url: string;
+  provider: string;
+} | {
+  type: "upload";
+  instructions: string;
+} | {
+  type: "install-plugin";
+  instructions: string;
+};
+/** Detected i18n/multilingual plugin info */
+interface I18nDetection {
+  /** Multilingual plugin name (e.g. "wpml", "polylang") */
+  plugin: string;
+  /** BCP 47 default locale */
+  defaultLocale: string;
+  /** All configured locales */
+  locales: string[];
+}
+/** Result of probing a URL for a specific source */
+interface SourceProbeResult {
+  /** Which source can handle this */
+  sourceId: string;
+  /** Confidence level */
+  confidence: "definite" | "likely" | "possible";
+  /** What we detected */
+  detected: {
+    platform: string;
+    version?: string;
+    siteTitle?: string;
+    siteUrl?: string;
+  };
+  /** What capabilities are available */
+  capabilities: SourceCapabilities;
+  /** What auth is needed, if any */
+  auth?: SourceAuth;
+  /** Suggested next step */
+  suggestedAction: SuggestedAction;
+  /** Preview data if available (e.g., post counts from REST API) */
+  preview?: {
+    posts?: number;
+    pages?: number;
+    media?: number;
+  };
+  /** Detected multilingual plugin. Absent when none detected. */
+  i18n?: I18nDetection;
+}
+/** Combined probe result from all sources */
+interface ProbeResult {
+  url: string;
+  isWordPress: boolean;
+  /** Best matching source (highest confidence) */
+  bestMatch: SourceProbeResult | null;
+  /** All matching sources */
+  allMatches: SourceProbeResult[];
+}
+/** Field definition for import */
+interface ImportFieldDef {
+  slug: string;
+  label: string;
+  type: string;
+  required: boolean;
+  searchable?: boolean;
+}
+/** Field compatibility with existing schema */
+type FieldCompatibility = "compatible" | "type_mismatch" | "missing";
+/** Schema status for a collection */
+interface CollectionSchemaStatus {
+  exists: boolean;
+  fieldStatus: Record<string, {
+    status: FieldCompatibility;
+    existingType?: string;
+    requiredType: string;
+  }>;
+  canImport: boolean;
+  reason?: string;
+}
+/** Analysis of a single post type */
+interface PostTypeAnalysis {
+  name: string;
+  count: number;
+  suggestedCollection: string;
+  requiredFields: ImportFieldDef[];
+  schemaStatus: CollectionSchemaStatus;
+}
+/** Attachment/media info */
+interface AttachmentInfo {
+  id?: number;
+  title?: string;
+  url?: string;
+  filename?: string;
+  mimeType?: string;
+  alt?: string;
+  caption?: string;
+  width?: number;
+  height?: number;
+}
+/** Navigation menu analysis */
+interface NavMenuAnalysis {
+  /** Menu name/slug */
+  name: string;
+  /** Menu display label */
+  label: string;
+  /** Number of items in this menu */
+  itemCount: number;
+}
+/** Custom taxonomy analysis */
+interface TaxonomyAnalysis {
+  /** Taxonomy slug (e.g., 'genre', 'portfolio_category') */
+  slug: string;
+  /** Number of terms in this taxonomy */
+  termCount: number;
+  /** Sample term names */
+  sampleTerms: string[];
+}
+/** Reusable block analysis (wp_block post type) */
+interface ReusableBlockAnalysis {
+  /** Original WP ID */
+  id: number;
+  /** Block title */
+  title: string;
+  /** Block slug */
+  slug: string;
+}
+/** Normalized analysis result - same format for all sources */
+interface ImportAnalysis {
+  /** Source that produced this analysis */
+  sourceId: string;
+  site: {
+    title: string;
+    url: string;
+  };
+  postTypes: PostTypeAnalysis[];
+  attachments: {
+    count: number;
+    items: AttachmentInfo[];
+  };
+  categories: number;
+  tags: number;
+  authors: WpAuthorInfo[];
+  /** Navigation menus found in the export */
+  navMenus?: NavMenuAnalysis[];
+  /** Custom taxonomies (beyond categories/tags) */
+  customTaxonomies?: TaxonomyAnalysis[];
+  /** Reusable blocks (wp_block post type) - will be imported as sections */
+  reusableBlocks?: ReusableBlockAnalysis[];
+  /** Source-specific custom fields analysis */
+  customFields?: Array<{
+    key: string;
+    count: number;
+    samples: string[];
+    suggestedField: string;
+    suggestedType: "string" | "number" | "boolean" | "date" | "json";
+    isInternal: boolean;
+  }>;
+  /** Detected multilingual plugin. Absent when none detected. */
+  i18n?: I18nDetection;
+}
+/** Normalized content item - produced by all sources */
+interface NormalizedItem {
+  /** Original ID from source */
+  sourceId: string | number;
+  /** WordPress post type */
+  postType: string;
+  /** Content status */
+  status: "publish" | "draft" | "pending" | "private" | "future";
+  /** URL slug */
+  slug: string;
+  /** Title */
+  title: string;
+  /** Content as Portable Text (already converted) */
+  content: PortableTextBlock[];
+  /** Excerpt/summary */
+  excerpt?: string;
+  /** Publication date */
+  date: Date;
+  /** Last modified date */
+  modified?: Date;
+  /** Author identifier */
+  author?: string;
+  /** Category slugs */
+  categories?: string[];
+  /** Tag slugs */
+  tags?: string[];
+  /** Custom meta fields */
+  meta?: Record<string, unknown>;
+  /** Featured image URL */
+  featuredImage?: string;
+  /** Parent post ID (for hierarchical content like pages) */
+  parentId?: string | number;
+  /** Menu order for sorting */
+  menuOrder?: number;
+  /** Custom taxonomy assignments beyond categories/tags */
+  customTaxonomies?: Record<string, string[]>;
+  /** BCP 47 locale code. When omitted, defaults to defaultLocale. */
+  locale?: string;
+  /**
+   * Source-side translation group ID (opaque string from the origin system).
+   * Items sharing the same translationGroup are linked as translations.
+   * Resolved to a Dineway translation_group ULID during execute.
+   */
+  translationGroup?: string;
+}
+/** Post type mapping configuration */
+interface PostTypeMapping {
+  enabled: boolean;
+  collection: string;
+}
+/** Import configuration */
+interface ImportConfig {
+  postTypeMappings: Record<string, PostTypeMapping>;
+  skipExisting?: boolean;
+}
+/** Options for fetching content */
+interface FetchOptions {
+  /** Post types to fetch */
+  postTypes: string[];
+  /** Whether to include drafts */
+  includeDrafts?: boolean;
+  /** Limit number of items (for testing) */
+  limit?: number;
+}
+/** Import result */
+interface ImportResult {
+  success: boolean;
+  imported: number;
+  skipped: number;
+  errors: Array<{
+    title: string;
+    error: string;
+  }>;
+  byCollection: Record<string, number>;
+}
+/**
+ * An import source provides content from an external system.
+ * All sources produce the same normalized analysis and content format.
+ */
+interface ImportSource {
+  /** Unique identifier */
+  id: string;
+  /** Display name */
+  name: string;
+  /** Description for UI */
+  description: string;
+  /** Icon identifier */
+  icon: "upload" | "globe" | "wordpress" | "plug";
+  /** Whether this source requires a file upload */
+  requiresFile?: boolean;
+  /** Whether this source can probe URLs */
+  canProbe?: boolean;
+  /**
+   * Probe a URL to see if this source can handle it.
+   * Returns null if not applicable.
+   */
+  probe?(url: string): Promise<SourceProbeResult | null>;
+  /**
+   * Analyze content from this source.
+   * Returns normalized ImportAnalysis.
+   */
+  analyze(input: SourceInput, context: ImportContext): Promise<ImportAnalysis>;
+  /**
+   * Stream content items for import.
+   * Yields normalized content items.
+   */
+  fetchContent(input: SourceInput, options: FetchOptions): AsyncGenerator<NormalizedItem>;
+  /**
+   * Fetch a media item's data.
+   * Used for media import.
+   */
+  fetchMedia?(url: string, input: SourceInput): Promise<Blob>;
+}
+/** Context passed to import sources */
+interface ImportContext {
+  /** Database connection for schema checks */
+  db?: unknown;
+  /** Function to check existing collections */
+  getExistingCollections?: () => Promise<Map<string, {
+    slug: string;
+    fields: Map<string, {
+      type: string;
+    }>;
+  }>>;
+}
+//#endregion
+//#region src/import/sections.d.ts
+/**
+ * Result of sections import operation
+ */
+interface SectionsImportResult {
+  /** Number of sections created */
+  sectionsCreated: number;
+  /** Number of sections skipped (already exist) */
+  sectionsSkipped: number;
+  /** Errors encountered during import */
+  errors: Array<{
+    title: string;
+    error: string;
+  }>;
+}
+/**
+ * Import reusable blocks (wp_block post type) from WXR as sections
+ *
+ * @param posts - All posts from WXR (will filter to wp_block)
+ * @param db - Database connection
+ * @returns Import result with counts
+ */
+declare function importReusableBlocksAsSections(posts: WxrPost[], db: Kysely<Database>): Promise<SectionsImportResult>;
+//#endregion
+//#region src/import/registry.d.ts
+/**
+ * Register an import source
+ */
+declare function registerSource(source: ImportSource): void;
+/**
+ * Get a source by ID
+ */
+declare function getSource(id: string): ImportSource | undefined;
+/**
+ * Get all registered sources
+ */
+declare function getAllSources(): ImportSource[];
+/**
+ * Get sources that can handle file uploads
+ */
+declare function getFileSources(): ImportSource[];
+/**
+ * Get sources that can probe URLs
+ */
+declare function getUrlSources(): ImportSource[];
+/**
+ * Probe a URL against all registered sources
+ *
+ * Returns probe results sorted by confidence (definite > likely > possible)
+ */
+declare function probeUrl(url: string): Promise<ProbeResult>;
+/**
+ * Clear all registered sources (useful for testing)
+ */
+declare function clearSources(): void;
+//#endregion
+//#region src/import/sources/wxr.d.ts
+declare const wxrSource: ImportSource;
+/**
+ * Parse a WXR date with the correct fallback chain:
+ * 1. GMT date (always UTC, most reliable)
+ * 2. pubDate (RFC 2822, includes timezone offset)
+ * 3. Site-local date (MySQL datetime without timezone, imprecise but best available)
+ *
+ * Returns undefined when none of the inputs yield a valid date.
+ * Callers that need a guaranteed Date should use `?? new Date()`.
+ */
+declare function parseWxrDate(gmtDate: string | undefined, pubDate: string | undefined, localDate: string | undefined): Date | undefined;
+//#endregion
+//#region src/import/sources/wordpress-rest.d.ts
+declare const wordpressRestSource: ImportSource;
+//#endregion
+//#region src/preview/tokens.d.ts
+/**
+ * Preview token generation and verification
+ *
+ * Tokens are compact, URL-safe, and HMAC-signed.
+ * Format: base64url(JSON payload).base64url(HMAC signature)
+ *
+ * Payload: { cid: contentId, exp: expiryTimestamp, iat: issuedAt }
+ */
+/**
+ * Preview token payload
+ */
+interface PreviewTokenPayload {
+  /** Content ID in format "collection:id" (e.g., "posts:abc123") */
+  cid: string;
+  /** Expiry timestamp (seconds since epoch) */
+  exp: number;
+  /** Issued at timestamp (seconds since epoch) */
+  iat: number;
+}
+/**
+ * Options for generating a preview token
+ */
+interface GeneratePreviewTokenOptions {
+  /** Content ID in format "collection:id" */
+  contentId: string;
+  /** How long the token is valid. Accepts "1h", "30m", "1d", or seconds as number. Default: "1h" */
+  expiresIn?: string | number;
+  /** Secret key for signing. Should be from environment variable. */
+  secret: string;
+}
+/**
+ * Generate a preview token for content
+ *
+ * @example
+ * ```ts
+ * const token = await generatePreviewToken({
+ *   contentId: "posts:abc123",
+ *   expiresIn: "1h",
+ *   secret: process.env.PREVIEW_SECRET!,
+ * });
+ * ```
+ */
+declare function generatePreviewToken(options: GeneratePreviewTokenOptions): Promise<string>;
+/**
+ * Result of verifying a preview token
+ */
+type VerifyPreviewTokenResult = {
+  valid: true;
+  payload: PreviewTokenPayload;
+} | {
+  valid: false;
+  error: "invalid" | "expired" | "malformed" | "none";
+};
+/**
+ * Options for verifyPreviewToken
+ */
+type VerifyPreviewTokenOptions = {
+  /** Secret key for verifying tokens */secret: string;
+} & ({
+  url: URL;
+} | {
+  /** Preview token string (can be null) */token: string | null | undefined;
+});
+/**
+ * Verify a preview token and return the payload
+ *
+ * @example
+ * ```ts
+ * // With URL (extracts _preview query param)
+ * const result = await verifyPreviewToken({
+ *   url: Astro.url,
+ *   secret: import.meta.env.PREVIEW_SECRET,
+ * });
+ *
+ * // With token directly
+ * const result = await verifyPreviewToken({
+ *   token: someToken,
+ *   secret: import.meta.env.PREVIEW_SECRET,
+ * });
+ *
+ * if (result.valid) {
+ *   console.log(result.payload.cid); // "posts:abc123"
+ * }
+ * ```
+ */
+declare function verifyPreviewToken(options: VerifyPreviewTokenOptions): Promise<VerifyPreviewTokenResult>;
+/**
+ * Parse a content ID into collection and id
+ */
+declare function parseContentId(contentId: string): {
+  collection: string;
+  id: string;
+};
+//#endregion
+//#region src/preview/urls.d.ts
+/**
+ * Preview URL generation
+ *
+ * Creates preview URLs that include a signed token for accessing draft content.
+ */
+/**
+ * Options for generating a preview URL
+ */
+interface GetPreviewUrlOptions {
+  /** Collection slug (e.g., "posts") */
+  collection: string;
+  /** Content ID or slug */
+  id: string;
+  /** Secret key for signing the token */
+  secret: string;
+  /** How long the preview URL is valid. Default: "1h" */
+  expiresIn?: string | number;
+  /** Base URL of the site. If not provided, returns a relative URL. */
+  baseUrl?: string;
+  /** Custom path pattern. Use {collection} and {id} as placeholders. Default: "/{collection}/{id}" */
+  pathPattern?: string;
+}
+/**
+ * Generate a preview URL for content
+ *
+ * The URL includes a `_preview` query parameter with a signed token.
+ *
+ * @example
+ * ```ts
+ * const url = await getPreviewUrl({
+ *   collection: "posts",
+ *   id: "hello-world",
+ *   secret: process.env.PREVIEW_SECRET!,
+ * });
+ * // Returns: /posts/hello-world?_preview=eyJj...
+ *
+ * // With base URL:
+ * const fullUrl = await getPreviewUrl({
+ *   collection: "posts",
+ *   id: "hello-world",
+ *   secret: process.env.PREVIEW_SECRET!,
+ *   baseUrl: "https://example.com",
+ * });
+ * // Returns: https://example.com/posts/hello-world?_preview=eyJj...
+ *
+ * // Custom path pattern:
+ * const customUrl = await getPreviewUrl({
+ *   collection: "posts",
+ *   id: "hello-world",
+ *   secret: process.env.PREVIEW_SECRET!,
+ *   pathPattern: "/blog/{id}",
+ * });
+ * // Returns: /blog/hello-world?_preview=eyJj...
+ * ```
+ */
+declare function getPreviewUrl(options: GetPreviewUrlOptions): Promise<string>;
+/**
+ * Build a preview URL from a token (when you already have the token)
+ *
+ * @example
+ * ```ts
+ * const url = buildPreviewUrl({
+ *   path: "/posts/hello-world",
+ *   token: existingToken,
+ * });
+ * ```
+ */
+declare function buildPreviewUrl(options: {
+  path: string;
+  token: string;
+  baseUrl?: string;
+}): string;
+//#endregion
+//#region src/preview/helpers.d.ts
+/**
+ * Preview helpers for Astro pages
+ */
+/**
+ * Check if a request is a preview request
+ *
+ * @example
+ * ```ts
+ * const isPreview = isPreviewRequest(Astro.url);
+ * ```
+ */
+declare function isPreviewRequest(url: URL): boolean;
+/**
+ * Get the preview token from a URL
+ *
+ * @example
+ * ```ts
+ * const token = getPreviewToken(Astro.url);
+ * ```
+ */
+declare function getPreviewToken(url: URL): string | null;
+//#endregion
+//#region src/preview/routes.d.ts
+/**
+ * Preview mode route gating.
+ *
+ * Preview is read-only with no authenticated user. All `/_dineway/`
+ * routes are blocked by default. Only specific read-only API prefixes
+ * are allowlisted.
+ */
+declare function isBlockedInPreview(pathname: string): boolean;
+//#endregion
+//#region src/preview/loading.d.ts
+declare function renderPreviewLoadingPage(): string;
+//#endregion
+//#region src/preview/snapshot-types.d.ts
+interface Snapshot {
+  tables: Record<string, Record<string, unknown>[]>;
+  schema: Record<string, {
+    columns: string[];
+    types?: Record<string, string>;
+  }>;
+  generatedAt: string;
+}
+//#endregion
+//#region src/preview/snapshot-database.d.ts
+interface AppliedSnapshotMeta {
+  fetchedAt: number;
+  generatedAt: string;
+}
+interface ApplySnapshotToDatabaseOptions {
+  fetchedAt?: number;
+  reset?: boolean;
+}
+declare function dropSessionDatabaseTables(db: Kysely<Database>): Promise<void>;
+declare function applySnapshotToDatabase(db: Kysely<Database>, snapshot: Snapshot, options?: ApplySnapshotToDatabaseOptions): Promise<void>;
+declare function getAppliedSnapshotMeta(db: Kysely<Database>): Promise<AppliedSnapshotMeta | null>;
+//#endregion
+//#region src/preview/toolbar.d.ts
+/**
+ * Preview toolbar injected into preview responses.
+ *
+ * Plain HTML with inline styles/script so sidecar middleware can use it
+ * without any framework/runtime dependency.
+ */
+interface PreviewToolbarConfig {
+  generatedAt?: string;
+  source?: string;
+  error?: string;
+}
+declare function renderPreviewToolbar(config: PreviewToolbarConfig): string;
+//#endregion
+//#region src/settings/index.d.ts
+/**
+ * Get a single site setting by key
+ *
+ * Returns `undefined` if the setting has not been configured.
+ * For media settings (logo, favicon), the URL is resolved automatically.
+ *
+ * @param key - The setting key (e.g., "title", "logo", "social")
+ * @returns The setting value, or undefined if not set
+ *
+ * @example
+ * ```ts
+ * import { getSiteSetting } from "dineway";
+ *
+ * const title = await getSiteSetting("title");
+ * const logo = await getSiteSetting("logo");
+ * console.log(logo?.url); // Resolved URL
+ * ```
+ */
+declare function getSiteSetting<K extends SiteSettingKey>(key: K): Promise<SiteSettings[K] | undefined>;
+/**
+ * Get all site settings
+ *
+ * Returns all configured settings. Unset values are undefined.
+ * Media references (logo/favicon) are resolved to include URLs.
+ *
+ * @example
+ * ```ts
+ * import { getSiteSettings } from "dineway";
+ *
+ * const settings = await getSiteSettings();
+ * console.log(settings.title); // "My Site"
+ * console.log(settings.logo?.url); // "/_dineway/api/media/file/abc123"
+ * ```
+ */
+declare function getSiteSettings(): Promise<Partial<SiteSettings>>;
+/**
+ * Set site settings (internal function used by admin API)
+ *
+ * Merges provided settings with existing ones. Only provided fields are updated.
+ * Media references should include just the mediaId; URLs are resolved on read.
+ *
+ * @param settings - Partial settings object with values to update
+ * @param db - Kysely database instance
+ * @returns Promise that resolves when settings are saved
+ *
+ * @internal
+ *
+ * @example
+ * ```ts
+ * // Update multiple settings at once
+ * await setSiteSettings({
+ *   title: "My Site",
+ *   tagline: "Welcome",
+ *   logo: { mediaId: "med_123", alt: "Logo" }
+ * }, db);
+ * ```
+ */
+declare function setSiteSettings(settings: Partial<SiteSettings>, db: Kysely<Database>): Promise<void>;
+/**
+ * Get a single plugin setting by key.
+ *
+ * Plugin settings are stored in the options table under
+ * `plugin:<pluginId>:settings:<key>`.
+ */
+declare function getPluginSetting<T = unknown>(pluginId: string, key: string): Promise<T | undefined>;
+/**
+ * Get all persisted plugin settings for a plugin.
+ *
+ * Defaults declared in `admin.settingsSchema` are not materialized
+ * automatically; callers should apply their own fallback defaults.
+ */
+declare function getPluginSettings(pluginId: string): Promise<Record<string, unknown>>;
+//#endregion
+//#region src/comments/query.d.ts
+interface GetCommentsOptions {
+  collection: string;
+  contentId: string;
+  threaded?: boolean;
+}
+interface GetCommentsResult {
+  items: PublicComment[];
+  total: number;
+}
+/**
+ * Get approved comments for a content item.
+ *
+ * @example
+ * ```ts
+ * import { getComments } from "dineway";
+ *
+ * const { items, total } = await getComments({
+ *   collection: "posts",
+ *   contentId: post.id,
+ *   threaded: true,
+ * });
+ * ```
+ */
+declare function getComments(options: GetCommentsOptions): Promise<GetCommentsResult>;
+/**
+ * Get the count of approved comments for a content item.
+ *
+ * @example
+ * ```ts
+ * import { getCommentCount } from "dineway";
+ *
+ * const count = await getCommentCount("posts", post.id);
+ * ```
+ */
+declare function getCommentCount(collection: string, contentId: string): Promise<number>;
+//#endregion
+//#region src/menus/types.d.ts
+/**
+ * Menu item types
+ */
+type MenuItemType = string;
+/**
+ * Menu item as returned to templates (with resolved URL)
+ */
+interface MenuItem {
+  id: string;
+  label: string;
+  url: string;
+  target?: string;
+  titleAttr?: string;
+  cssClasses?: string;
+  children: MenuItem[];
+}
+/**
+ * Menu as returned to templates
+ */
+interface Menu {
+  id: string;
+  name: string;
+  label: string;
+  items: MenuItem[];
+}
+/**
+ * Input for creating a menu item
+ */
+interface CreateMenuItemInput {
+  type: MenuItemType;
+  label: string;
+  referenceCollection?: string;
+  referenceId?: string;
+  customUrl?: string;
+  target?: string;
+  titleAttr?: string;
+  cssClasses?: string;
+  parentId?: string;
+  sortOrder?: number;
+}
+/**
+ * Input for updating a menu item
+ */
+interface UpdateMenuItemInput {
+  label?: string;
+  customUrl?: string;
+  target?: string;
+  titleAttr?: string;
+  cssClasses?: string;
+  parentId?: string | null;
+  sortOrder?: number;
+}
+/**
+ * Input for creating a menu
+ */
+interface CreateMenuInput {
+  name: string;
+  label: string;
+}
+/**
+ * Input for updating a menu
+ */
+interface UpdateMenuInput {
+  label?: string;
+}
+/**
+ * Input for reordering menu items
+ */
+interface ReorderMenuItemsInput {
+  items: Array<{
+    id: string;
+    parentId: string | null;
+    sortOrder: number;
+  }>;
+}
+//#endregion
+//#region src/menus/index.d.ts
+/**
+ * Get menu by name with resolved URLs
+ *
+ * @example
+ * ```ts
+ * import { getMenu } from "dineway";
+ *
+ * const menu = await getMenu("primary");
+ * if (menu) {
+ *   console.log(menu.items); // Array of MenuItem with resolved URLs
+ * }
+ * ```
+ */
+declare function getMenu(name: string): Promise<Menu | null>;
+/**
+ * Get all menus (without items - for admin list)
+ *
+ * @example
+ * ```ts
+ * import { getMenus } from "dineway";
+ *
+ * const menus = await getMenus();
+ * console.log(menus); // [{ id, name, label }]
+ * ```
+ */
+declare function getMenus(): Promise<Array<{
+  id: string;
+  name: string;
+  label: string;
+}>>;
+//#endregion
+//#region src/bylines/index.d.ts
+/**
+ * Get a byline by ID.
+ *
+ * @example
+ * ```ts
+ * import { getByline } from "dineway";
+ *
+ * const byline = await getByline("01HXYZ...");
+ * if (byline) {
+ *   console.log(byline.displayName);
+ * }
+ * ```
+ */
+declare function getByline(id: string): Promise<BylineSummary | null>;
+/**
+ * Get a byline by slug.
+ *
+ * @example
+ * ```ts
+ * import { getBylineBySlug } from "dineway";
+ *
+ * const byline = await getBylineBySlug("jane-doe");
+ * if (byline) {
+ *   console.log(byline.displayName); // "Jane Doe"
+ * }
+ * ```
+ */
+declare function getBylineBySlug(slug: string): Promise<BylineSummary | null>;
+//#endregion
+//#region src/taxonomies/types.d.ts
+/**
+ * Taxonomy types for Dineway Agentic Web builder
+ */
+/**
+ * Taxonomy definition - describes a taxonomy like "category" or "tag"
+ */
+interface TaxonomyDef {
+  id: string;
+  name: string;
+  label: string;
+  labelSingular?: string;
+  hierarchical: boolean;
+  collections: string[];
+}
+/**
+ * Taxonomy term - a specific term within a taxonomy (e.g., "News" in "category")
+ */
+interface TaxonomyTerm {
+  id: string;
+  name: string;
+  slug: string;
+  label: string;
+  parentId?: string;
+  description?: string;
+  children: TaxonomyTerm[];
+  count?: number;
+}
+/**
+ * Flat version for DB row
+ */
+interface TaxonomyTermRow {
+  id: string;
+  name: string;
+  slug: string;
+  label: string;
+  parent_id: string | null;
+  data: string | null;
+}
+/**
+ * Input for creating a term
+ */
+interface CreateTermInput {
+  slug: string;
+  label: string;
+  parentId?: string;
+  description?: string;
+}
+/**
+ * Input for updating a term
+ */
+interface UpdateTermInput {
+  slug?: string;
+  label?: string;
+  parentId?: string | null;
+  description?: string;
+}
+//#endregion
+//#region src/taxonomies/index.d.ts
+/**
+ * Get all taxonomy definitions
+ */
+declare function getTaxonomyDefs(): Promise<TaxonomyDef[]>;
+/**
+ * Get a single taxonomy definition by name
+ */
+declare function getTaxonomyDef(name: string): Promise<TaxonomyDef | null>;
+/**
+ * Get all terms for a taxonomy (as tree for hierarchical, flat for tags)
+ */
+declare function getTaxonomyTerms(taxonomyName: string): Promise<TaxonomyTerm[]>;
+/**
+ * Get a single term by taxonomy and slug
+ */
+declare function getTerm(taxonomyName: string, slug: string): Promise<TaxonomyTerm | null>;
+/**
+ * Get terms assigned to an entry
+ */
+declare function getEntryTerms(collection: string, entryId: string, taxonomyName?: string): Promise<TaxonomyTerm[]>;
+/**
+ * Get terms for multiple entries in a single query (batched API)
+ *
+ * This is more efficient than calling getEntryTerms for each entry
+ * when you need terms for a list of entries.
+ *
+ * @param collection - The collection type (e.g., "posts")
+ * @param entryIds - Array of entry IDs
+ * @param taxonomyName - The taxonomy name (e.g., "categories")
+ * @returns Map from entry ID to array of terms
+ */
+declare function getTermsForEntries(collection: string, entryIds: string[], taxonomyName: string): Promise<Map<string, TaxonomyTerm[]>>;
+/**
+ * Get entries by term (wraps getDinewayCollection)
+ */
+declare function getEntriesByTerm(collection: string, taxonomyName: string, termSlug: string): Promise<Array<{
+  id: string;
+  data: Record<string, unknown>;
+}>>;
+//#endregion
+//#region src/widgets/types.d.ts
+type WidgetType = "content" | "menu" | "component";
+interface Widget {
+  id: string;
+  type: WidgetType;
+  title?: string;
+  content?: PortableTextBlock$2[];
+  menuName?: string;
+  componentId?: string;
+  componentProps?: Record<string, unknown>;
+}
+interface WidgetArea {
+  id: string;
+  name: string;
+  label: string;
+  description?: string;
+  widgets: Widget[];
+}
+interface WidgetComponentDef {
+  id: string;
+  label: string;
+  description?: string;
+  props: Record<string, PropDef>;
+}
+interface PropDef {
+  type: "string" | "number" | "boolean" | "select";
+  label: string;
+  default?: unknown;
+  options?: Array<{
+    value: string;
+    label: string;
+  }>;
+}
+interface CreateWidgetAreaInput {
+  name: string;
+  label: string;
+  description?: string;
+}
+interface CreateWidgetInput {
+  type: WidgetType;
+  title?: string;
+  content?: PortableTextBlock$2[];
+  menuName?: string;
+  componentId?: string;
+  componentProps?: Record<string, unknown>;
+}
+interface UpdateWidgetInput extends Partial<CreateWidgetInput> {}
+interface ReorderWidgetsInput {
+  widgetIds: string[];
+}
+//#endregion
+//#region src/widgets/index.d.ts
+/**
+ * Get a widget area by name, with all its widgets
+ */
+declare function getWidgetArea(name: string): Promise<WidgetArea | null>;
+/**
+ * Get all widget areas with their widgets
+ */
+declare function getWidgetAreas(): Promise<WidgetArea[]>;
+/**
+ * Get available widget components (for admin UI)
+ */
+declare function getWidgetComponents(): WidgetComponentDef[];
+//#endregion
+//#region src/search/types.d.ts
+/**
+ * Search Types
+ *
+ * Type definitions for the Dineway search system.
+ */
+/**
+ * Search configuration for a collection
+ */
+interface SearchConfig {
+  /** Whether search is enabled for this collection */
+  enabled: boolean;
+  /** Field weights for ranking (higher = more important) */
+  weights?: Record<string, number>;
+}
+/**
+ * Options for search queries
+ */
+interface SearchOptions {
+  /** Collections to search (defaults to all searchable collections) */
+  collections?: string[];
+  /** Filter by content status (defaults to 'published') */
+  status?: string;
+  /** Filter by locale (omit to search all locales) */
+  locale?: string;
+  /** Maximum results to return (defaults to 20) */
+  limit?: number;
+  /** Pagination cursor */
+  cursor?: string;
+}
+/**
+ * Options for collection-specific search
+ */
+interface CollectionSearchOptions {
+  /** Filter by content status (defaults to 'published') */
+  status?: string;
+  /** Filter by locale (omit to search all locales) */
+  locale?: string;
+  /** Maximum results to return (defaults to 20) */
+  limit?: number;
+  /** Pagination cursor */
+  cursor?: string;
+}
+/**
+ * A single search result
+ */
+interface SearchResult {
+  /** Collection the result belongs to */
+  collection: string;
+  /** Entry ID */
+  id: string;
+  /** Entry slug */
+  slug: string | null;
+  /** Content locale */
+  locale: string;
+  /** Entry title (if available) */
+  title?: string;
+  /** Highlighted snippet showing match context */
+  snippet?: string;
+  /** Relevance score (higher = more relevant) */
+  score: number;
+}
+/**
+ * Response from a search query
+ */
+interface SearchResponse {
+  /** Search results */
+  items: SearchResult[];
+  /** Cursor for next page of results */
+  nextCursor?: string;
+}
+/**
+ * Options for suggestion/autocomplete queries
+ */
+interface SuggestOptions {
+  /** Collections to search (defaults to all searchable collections) */
+  collections?: string[];
+  /** Filter by locale (omit to search all locales) */
+  locale?: string;
+  /** Maximum suggestions to return (defaults to 5) */
+  limit?: number;
+}
+/**
+ * A single suggestion result
+ */
+interface Suggestion {
+  /** Collection the suggestion belongs to */
+  collection: string;
+  /** Entry ID */
+  id: string;
+  /** Entry title */
+  title: string;
+}
+/**
+ * Search index statistics
+ */
+interface SearchStats {
+  collections: Record<string, {
+    /** Number of indexed entries */indexed: number; /** When the index was last rebuilt */
+    lastRebuilt?: string;
+  }>;
+}
+//#endregion
+//#region src/search/fts-manager.d.ts
+/**
+ * FTS5 Manager
+ *
+ * Handles creation, deletion, and management of FTS5 virtual tables
+ * for full-text search on content collections.
+ */
+declare class FTSManager {
+  private db;
+  constructor(db: Kysely<Database>);
+  /**
+   * Validate a collection slug and its searchable field names.
+   * Must be called before any raw SQL interpolation.
+   */
+  private validateInputs;
+  /**
+   * Get the FTS table name for a collection
+   * Uses _dineway_ prefix to clearly mark as internal/system table
+   */
+  getFtsTableName(collectionSlug: string): string;
+  /**
+   * Get the content table name for a collection
+   */
+  getContentTableName(collectionSlug: string): string;
+  /**
+   * Check if an FTS table exists for a collection
+   */
+  ftsTableExists(collectionSlug: string): Promise<boolean>;
+  /**
+   * Create an FTS5 virtual table for a collection.
+   * FTS5 is SQLite-only; on other dialects this is a no-op.
+   *
+   * @param collectionSlug - The collection slug
+   * @param searchableFields - Array of field names to index
+   * @param weights - Optional field weights for ranking
+   */
+  createFtsTable(collectionSlug: string, searchableFields: string[], _weights?: Record<string, number>): Promise<void>;
+  /**
+   * Create triggers to keep FTS table in sync with content table
+   */
+  private createTriggers;
+  /**
+   * Drop triggers for a collection
+   */
+  private dropTriggers;
+  /**
+   * Drop the FTS table and triggers for a collection
+   */
+  dropFtsTable(collectionSlug: string): Promise<void>;
+  /**
+   * Rebuild the FTS index for a collection
+   *
+   * This is useful after bulk imports or if the index gets out of sync.
+   */
+  rebuildIndex(collectionSlug: string, searchableFields: string[], weights?: Record<string, number>): Promise<void>;
+  /**
+   * Populate the FTS table from existing content
+   */
+  populateFromContent(collectionSlug: string, searchableFields: string[]): Promise<void>;
+  /**
+   * Get the search configuration for a collection
+   */
+  getSearchConfig(collectionSlug: string): Promise<SearchConfig | null>;
+  /**
+   * Update the search configuration for a collection
+   */
+  setSearchConfig(collectionSlug: string, config: SearchConfig): Promise<void>;
+  /**
+   * Get searchable fields for a collection
+   */
+  getSearchableFields(collectionSlug: string): Promise<string[]>;
+  /**
+   * Enable search for a collection
+   *
+   * Creates the FTS table and triggers, and populates from existing content.
+   */
+  enableSearch(collectionSlug: string, options?: {
+    weights?: Record<string, number>;
+  }): Promise<void>;
+  /**
+   * Disable search for a collection
+   *
+   * Drops the FTS table and triggers.
+   */
+  disableSearch(collectionSlug: string): Promise<void>;
+  /**
+   * Get index statistics for a collection
+   */
+  getIndexStats(collectionSlug: string): Promise<{
+    indexed: number;
+    lastRebuilt?: string;
+  } | null>;
+  /**
+   * Verify FTS index integrity and rebuild if corrupted.
+   *
+   * Checks for row count mismatch between content table and FTS table.
+   *
+   * Returns true if the index was rebuilt, false if it was healthy.
+   */
+  verifyAndRepairIndex(collectionSlug: string): Promise<boolean>;
+  /**
+   * Verify and repair FTS indexes for all search-enabled collections.
+   *
+   * Intended to run at startup to auto-heal any corruption from
+   * previous process crashes.
+   */
+  verifyAndRepairAll(): Promise<number>;
+}
+//#endregion
+//#region src/search/query.d.ts
+/**
+ * Search across multiple collections
+ *
+ * Public API that auto-injects the database.
+ *
+ * @param query - Search query (FTS5 syntax supported)
+ * @param options - Search options
+ * @returns Search results with pagination
+ *
+ * @example
+ * ```typescript
+ * import { search } from "dineway";
+ *
+ * const results = await search("hello world", {
+ *   collections: ["posts", "pages"],
+ *   limit: 20
+ * });
+ * ```
+ */
+declare function search(query: string, options?: SearchOptions): Promise<SearchResponse>;
+/**
+ * Search across multiple collections (with explicit db)
+ *
+ * @internal Use `search()` in templates. This variant is for admin routes
+ * that already have a database handle.
+ *
+ * @param db - Kysely database instance
+ * @param query - Search query (FTS5 syntax supported)
+ * @param options - Search options
+ * @returns Search results with pagination
+ */
+declare function searchWithDb(db: Kysely<Database>, query: string, options?: SearchOptions): Promise<SearchResponse>;
+/**
+ * Search within a single collection
+ *
+ * @param db - Kysely database instance
+ * @param collection - Collection slug
+ * @param query - Search query (FTS5 syntax supported)
+ * @param options - Search options
+ * @returns Search results with pagination
+ *
+ * @example
+ * ```typescript
+ * const results = await searchCollection(db, "posts", "hello world", {
+ *   limit: 10
+ * });
+ * ```
+ */
+declare function searchCollection(db: Kysely<Database>, collection: string, query: string, options?: CollectionSearchOptions): Promise<SearchResponse>;
+/**
+ * Get search suggestions for autocomplete
+ *
+ * @param db - Kysely database instance
+ * @param query - Partial search query
+ * @param options - Suggestion options
+ * @returns Array of suggestions
+ */
+declare function getSuggestions(db: Kysely<Database>, query: string, options?: SuggestOptions): Promise<Suggestion[]>;
+/**
+ * Get search statistics for all collections
+ */
+declare function getSearchStats(db: Kysely<Database>): Promise<SearchStats>;
+//#endregion
+//#region src/search/text-extraction.d.ts
+/**
+ * Extract plain text from Portable Text blocks
+ *
+ * Uses @portabletext/toolkit's toPlainText for standard blocks,
+ * plus extracts text from custom block types (code, images with alt/caption).
+ *
+ * @param blocks - Array of Portable Text blocks (or a JSON string)
+ * @returns Plain text content
+ *
+ * @example
+ * ```typescript
+ * const text = extractPlainText([
+ *   {
+ *     _type: "block",
+ *     _key: "abc",
+ *     children: [{ _type: "span", _key: "s1", text: "Hello World" }]
+ *   }
+ * ]);
+ * // Returns: "Hello World"
+ * ```
+ */
+declare function extractPlainText(blocks: PortableTextBlock$1[] | string | null | undefined): string;
+/**
+ * Extract searchable text from a content entry
+ *
+ * Extracts text from specified fields, handling both plain text and Portable Text.
+ *
+ * @param entry - Content entry data
+ * @param fields - Field names to extract text from
+ * @returns Object mapping field names to extracted text
+ */
+declare function extractSearchableFields(entry: Record<string, unknown>, fields: string[]): Record<string, string>;
+//#endregion
+export { GetCommentsOptions as $, ManifestResponse as $i, SessionDatabaseFactory as $n, SandboxEmailMessage as $r, OAuthInput as $t, getEntryTerms as A, handleContentCountScheduled as Ai, AuthProviderModule as An, getTranslations as Ar, wordpressRestSource as At, UpdateTermInput as B, handleContentPermanentDelete as Bi, WxrTag as Bn, hashString as Br, importReusableBlocksAsSections as Bt, ReorderWidgetsInput as C, RevisionListResponse as Ci, DinewayConfig as Cn, InferCollectionData as Cr, GeneratePreviewTokenOptions as Ct, WidgetComponentDef as D, handleRevisionRestore as Di, S3StorageConfig as Dn, getDinewayCollection as Dr, generatePreviewToken as Dt, WidgetArea as E, handleRevisionList as Ei, LocalStorageConfig as En, TranslationsResult as Er, VerifyPreviewTokenResult as Et, getTermsForEntries as F, handleContentDuplicate as Fi, WxrAuthor as Fn, createEditable as Fr, getFileSources as Ft, CreateMenuInput as G, handleContentUnpublish as Gi, EntryFilter as Gn, PortableTextLinkMark as Gr, FileInput as Gt, getBylineBySlug as H, handleContentRestore as Hi, parseWxrString as Hn, prosemirrorToPortableText as Hr, CollectionSchemaStatus as Ht, CreateTermInput as I, handleContentGet as Ii, WxrCategory as In, createNoop as Ir, getSource as It, MenuItem as J, ApiContext as Ji, FilePreviewMiddlewareConfig as Jn, PortableTextTextBlock as Jr, ImportContext as Jt, CreateMenuItemInput as K, handleContentUnschedule as Ki, dinewayLoader as Kn, PortableTextMarkDef as Kr, ImportAnalysis as Kt, TaxonomyDef as L, handleContentGetIncludingTrashed as Li, WxrData as Ln, isSafeHref as Lr, getUrlSources as Lt, getTaxonomyDefs as M, handleContentCreate as Mi, ExternalAuthConfig as Mn, CMSAnnotation as Mr, wxrSource as Mt, getTaxonomyTerms as N, handleContentDelete as Ni, definePlugin as Nn, EditProxy as Nr, clearSources as Nt, WidgetType as O, generateManifest as Oi, StorageDescriptor as On, getDinewayEntry as Or, parseContentId as Ot, getTerm as P, handleContentDiscardDraft as Pi, WxrAttachment as Pn, FieldAnnotation as Pr, getAllSources as Pt, UpdateMenuItemInput as Q, ListResponse as Qi, SessionCleanupResult as Qn, ProseMirrorNode as Qr, NormalizedItem as Qt, TaxonomyTerm as R, handleContentList as Ri, WxrPost as Rn, sanitizeHref as Rr, probeUrl as Rt, PropDef as S, handleMediaUpdate as Si, pluginManifestSchema as Sn, EntryResult as Sr, getPreviewUrl as St, Widget as T, handleRevisionGet as Ti, getStoredConfig as Tn, TranslationSummary as Tr, VerifyPreviewTokenOptions as Tt, getMenu as U, handleContentSchedule as Ui, CollectionFilter as Un, PortableTextCodeBlock as Ur, FetchOptions as Ut, getByline as V, handleContentPublish as Vi, parseWxr as Vn, portableTextToProsemirror as Vr, AttachmentInfo as Vt, getMenus as W, handleContentTranslations as Wi, EntryData as Wn, PortableTextImageBlock as Wr, FieldCompatibility as Wt, ReorderMenuItemsInput as X, ContentResponse as Xi, FileSessionDatabaseFactory as Xn, ProseMirrorDocument as Xr, ImportResult as Xt, MenuItemType as Y, ContentListResponse as Yi, createFilePreviewMiddleware as Yn, PortableTextUnknownBlock as Yr, ImportFieldDef as Yt, UpdateMenuInput as Z, FieldDescriptor as Zi, FileSessionDatabaseFactoryOptions as Zn, ProseMirrorMark as Zr, ImportSource as Zt, getWidgetArea as _, MediaResponse as _i, EmailPipeline as _n, CollectionFilter$1 as _r, isBlockedInPreview as _t, search as a, FileValue as aa, SerializedRequest as ai, SourceInput as an, PreviewSidecarClient as ar, getSiteSetting as at, CreateWidgetAreaInput as b, handleMediaGet as bi, createHookPipeline as bn, DinewayCollections as br, GetPreviewUrlOptions as bt, FTSManager as c, CreateMediaInput as ca, CreateSectionInput as ci, UrlInput as cn, defaultPreviewSidecarClient as cr, PreviewToolbarConfig as ct, SearchOptions as d, ContentRepository as da, SectionSource as di, NoopSandboxRunner as dn, verifyPreviewSignature as dr, ApplySnapshotToDatabaseOptions as dt, portableText as ea, SandboxEmailSendCallback as ei, PostTypeAnalysis as en, SessionDatabaseHandle as er, GetCommentsResult as et, SearchResponse as f, DatabaseConfig as fa, UpdateSectionInput as fi, SandboxNotAvailableError as fn, I18nConfig as fr, applySnapshotToDatabase as ft, Suggestion as g, MediaListResponse as gi, PluginRouteError as gn, CacheHint as gr, renderPreviewLoadingPage as gt, SuggestOptions as h, SchemaRegistry as hi, createPluginManager as hn, isI18nEnabled as hr, Snapshot as ht, getSuggestions as i, FieldUIHints as ia, SandboxedPlugin as ii, SourceCapabilities as in, SessionOpenOrCreateOptions as ir, getPluginSettings as it, getTaxonomyDef as j, handleContentCountTrashed as ji, AuthResult as jn, resolveDinewayPath as jr, parseWxrDate as jt, getEntriesByTerm as k, handleContentCompare as ki, AuthDescriptor as kn, getEditMeta as kr, verifyPreviewToken as kt, CollectionSearchOptions as l, MediaItem as la, GetSectionsOptions as li, NodeSandboxRunner as ln, parsePreviewSignatureHeader as lr, renderPreviewToolbar as lt, SearchStats as m, SchemaError as mi, PluginManager as mn, getI18nConfig as mr, getAppliedSnapshotMeta as mt, extractSearchableFields as n, image as na, SandboxRunner as ni, ProbeResult as nn, SessionDatabaseLimitError as nr, getComments as nt, searchCollection as o, ImageValue as oa, getSection as oi, SourceProbeResult as on, PreviewSidecarSignature as or, getSiteSettings as ot, SearchResult as p, DinewayDatabaseError as pa, getCollectionInfo as pi, createNoopSandboxRunner as pn, getFallbackChain as pr, dropSessionDatabaseTables as pt, Menu as q, handleContentUpdate as qi, getDb as qn, PortableTextSpan as qr, ImportConfig as qt, getSearchStats as r, FieldDefinition as ra, SandboxRunnerFactory as ri, SourceAuth as rn, SessionOpenOptions as rr, getPluginSetting as rt, searchWithDb as s, PortableTextBlock$2 as sa, getSections as si, SuggestedAction as sn, buildPreviewSignatureHeader as sr, setSiteSettings as st, extractPlainText as t, reference as ta, SandboxOptions as ti, PostTypeMapping as tn, SessionDatabaseInfo as tr, getCommentCount as tt, SearchConfig as u, MediaRepository as ua, Section as ui, createNodeSandboxRunner as un, signPreviewUrl as ur, AppliedSnapshotMeta as ut, getWidgetAreas as v, handleMediaCreate as vi, HookPipeline as vn, CollectionResult as vr, getPreviewToken as vt, UpdateWidgetInput as w, RevisionResponse as wi, PluginDescriptor as wn, ResolvePathResult as wr, PreviewTokenPayload as wt, CreateWidgetInput as x, handleMediaList as xi, ValidatedPluginManifest as xn, EditFieldMeta as xr, buildPreviewUrl as xt, getWidgetComponents as y, handleMediaDelete as yi, HookResult as yn, ContentEntry as yr, isPreviewRequest as yt, TaxonomyTermRow as z, handleContentListTrashed as zi, WxrSite as zn, computeContentHash as zr, registerSource as zt };