dineway 0.1.3

package/dist/manifest-schema-CTSEyIJ3.mjs

@@ -0,0 +1,186 @@
+import { z } from "zod";
+
+//#region src/plugins/manifest-schema.ts
+/**
+* Zod schema for PluginManifest validation
+*
+* Used to validate manifest.json from plugin bundles at every parse site:
+* - Client-side download (marketplace.ts extractBundle)
+* - Bundle store load (plugins/bundle-store.ts read)
+* - CLI publish preview (cli/commands/publish.ts readManifestFromTarball)
+* - Marketplace ingest extends this with publishing-specific fields
+*/
+const PLUGIN_CAPABILITIES = [
+	"network:fetch",
+	"network:fetch:any",
+	"read:content",
+	"write:content",
+	"read:media",
+	"write:media",
+	"read:users",
+	"email:send",
+	"email:provide",
+	"email:intercept",
+	"page:inject"
+];
+/** Must stay in sync with FieldType in schema/types.ts */
+const FIELD_TYPES = [
+	"string",
+	"text",
+	"number",
+	"integer",
+	"boolean",
+	"datetime",
+	"select",
+	"multiSelect",
+	"portableText",
+	"image",
+	"file",
+	"reference",
+	"json",
+	"slug",
+	"repeater"
+];
+const HOOK_NAMES = [
+	"plugin:install",
+	"plugin:activate",
+	"plugin:deactivate",
+	"plugin:uninstall",
+	"content:beforeSave",
+	"content:afterSave",
+	"content:beforeDelete",
+	"content:afterDelete",
+	"content:afterPublish",
+	"content:afterUnpublish",
+	"media:beforeUpload",
+	"media:afterUpload",
+	"cron",
+	"email:beforeSend",
+	"email:deliver",
+	"email:afterSend",
+	"comment:beforeCreate",
+	"comment:moderate",
+	"comment:afterCreate",
+	"comment:afterModerate",
+	"page:metadata",
+	"page:fragments"
+];
+/**
+* Structured hook entry for manifest — name plus optional metadata.
+* During a transition period, both plain strings and objects are accepted.
+*/
+const manifestHookEntrySchema = z.object({
+	name: z.enum(HOOK_NAMES),
+	exclusive: z.boolean().optional(),
+	priority: z.number().int().optional(),
+	timeout: z.number().int().positive().optional()
+});
+/**
+* Structured route entry for manifest — name plus optional metadata.
+* Both plain strings and objects are accepted; strings are normalized
+* to `{ name }` objects via `normalizeManifestRoute()`.
+*/
+/** Route names must be safe path segments — alphanumeric, hyphens, underscores, forward slashes */
+const routeNamePattern = /^[a-zA-Z0-9][a-zA-Z0-9_\-/]*$/;
+const manifestRouteEntrySchema = z.object({
+	name: z.string().min(1).regex(routeNamePattern, "Route name must be a safe path segment"),
+	public: z.boolean().optional()
+});
+/** Index field names must be valid identifiers to prevent SQL injection via JSON path expressions */
+const indexFieldName = z.string().regex(/^[a-zA-Z][a-zA-Z0-9_]*$/);
+const storageCollectionSchema = z.object({
+	indexes: z.array(z.union([indexFieldName, z.array(indexFieldName)])),
+	uniqueIndexes: z.array(z.union([indexFieldName, z.array(indexFieldName)])).optional()
+});
+const baseSettingFields = {
+	label: z.string(),
+	description: z.string().optional()
+};
+const settingFieldSchema = z.discriminatedUnion("type", [
+	z.object({
+		...baseSettingFields,
+		type: z.literal("string"),
+		default: z.string().optional(),
+		multiline: z.boolean().optional()
+	}),
+	z.object({
+		...baseSettingFields,
+		type: z.literal("number"),
+		default: z.number().optional(),
+		min: z.number().optional(),
+		max: z.number().optional()
+	}),
+	z.object({
+		...baseSettingFields,
+		type: z.literal("boolean"),
+		default: z.boolean().optional()
+	}),
+	z.object({
+		...baseSettingFields,
+		type: z.literal("select"),
+		options: z.array(z.object({
+			value: z.string(),
+			label: z.string()
+		})),
+		default: z.string().optional()
+	}),
+	z.object({
+		...baseSettingFields,
+		type: z.literal("secret")
+	})
+]);
+const adminPageSchema = z.object({
+	path: z.string(),
+	label: z.string(),
+	icon: z.string().optional()
+});
+const dashboardWidgetSchema = z.object({
+	id: z.string(),
+	size: z.enum([
+		"full",
+		"half",
+		"third"
+	]).optional(),
+	title: z.string().optional()
+});
+const pluginAdminConfigSchema = z.object({
+	entry: z.string().optional(),
+	settingsSchema: z.record(z.string(), settingFieldSchema).optional(),
+	pages: z.array(adminPageSchema).optional(),
+	widgets: z.array(dashboardWidgetSchema).optional(),
+	fieldWidgets: z.array(z.object({
+		name: z.string().min(1),
+		label: z.string().min(1),
+		fieldTypes: z.array(z.enum(FIELD_TYPES)),
+		elements: z.array(z.object({
+			type: z.string(),
+			action_id: z.string(),
+			label: z.string().optional()
+		}).passthrough()).optional()
+	})).optional()
+});
+/**
+* Zod schema matching the PluginManifest interface from types.ts.
+*
+* Every JSON.parse of a manifest.json should validate through this.
+*/
+const pluginManifestSchema = z.object({
+	id: z.string().min(1),
+	version: z.string().min(1),
+	capabilities: z.array(z.enum(PLUGIN_CAPABILITIES)),
+	allowedHosts: z.array(z.string()),
+	storage: z.record(z.string(), storageCollectionSchema),
+	hooks: z.array(z.union([z.enum(HOOK_NAMES), manifestHookEntrySchema])),
+	routes: z.array(z.union([z.string().min(1).regex(routeNamePattern, "Route name must be a safe path segment"), manifestRouteEntrySchema])),
+	admin: pluginAdminConfigSchema
+});
+/**
+* Normalize a manifest route entry — plain strings become `{ name }` objects.
+*/
+function normalizeManifestRoute(entry) {
+	if (typeof entry === "string") return { name: entry };
+	return entry;
+}
+
+//#endregion
+export { pluginManifestSchema as i, PLUGIN_CAPABILITIES as n, normalizeManifestRoute as r, HOOK_NAMES as t };

package/dist/media/index.d.mts

@@ -0,0 +1,25 @@
+import { _ as MediaValue, a as ComponentEmbed, b as mediaItemToValue, c as EmbedResult, d as MediaListResult, f as MediaProvider, g as MediaUploadInput, h as MediaProviderItem, i as AudioEmbed, l as ImageEmbed, m as MediaProviderDescriptor, n as generatePlaceholder, o as CreateMediaProviderFn, p as MediaProviderCapabilities, r as normalizeMediaValue, s as EmbedOptions, t as PlaceholderData, u as MediaListOptions, v as ThumbnailOptions, y as VideoEmbed } from "../placeholder-bOx1xCTY.mjs";
+
+//#region src/media/local.d.ts
+interface LocalMediaConfig {
+  /** Whether the local provider is enabled (default true) */
+  enabled?: boolean;
+}
+/**
+ * Local media provider configuration
+ *
+ * @example
+ * ```ts
+ * import { localMedia } from "dineway/media";
+ *
+ * dineway({
+ *   mediaProviders: [
+ *     localMedia(), // Uses defaults
+ *     // or: localMedia({ enabled: false }) to disable
+ *   ],
+ * })
+ * ```
+ */
+declare function localMedia(config?: LocalMediaConfig): MediaProviderDescriptor;
+//#endregion
+export { type AudioEmbed, type ComponentEmbed, type CreateMediaProviderFn, type EmbedOptions, type EmbedResult, type ImageEmbed, type LocalMediaConfig, type MediaListOptions, type MediaListResult, type MediaProvider, type MediaProviderCapabilities, type MediaProviderDescriptor, type MediaProviderItem, type MediaUploadInput, type MediaValue, type PlaceholderData, type ThumbnailOptions, type VideoEmbed, generatePlaceholder, localMedia, mediaItemToValue, normalizeMediaValue };

package/dist/media/index.mjs

@@ -0,0 +1,54 @@
+import { n as normalizeMediaValue, t as generatePlaceholder } from "../placeholder-B3knXwNc.mjs";
+
+//#region src/media/types.ts
+/**
+* Convert a MediaProviderItem to a MediaValue for storage
+*/
+function mediaItemToValue(providerId, item) {
+	return {
+		provider: providerId,
+		id: item.id,
+		filename: item.filename,
+		mimeType: item.mimeType,
+		width: item.width,
+		height: item.height,
+		alt: item.alt,
+		meta: item.meta
+	};
+}
+
+//#endregion
+//#region src/media/local.ts
+/**
+* Local media provider configuration
+*
+* @example
+* ```ts
+* import { localMedia } from "dineway/media";
+*
+* dineway({
+*   mediaProviders: [
+*     localMedia(), // Uses defaults
+*     // or: localMedia({ enabled: false }) to disable
+*   ],
+* })
+* ```
+*/
+function localMedia(config = {}) {
+	return {
+		id: "local",
+		name: "Library",
+		icon: "📁",
+		entrypoint: "dineway/media/local-runtime",
+		capabilities: {
+			browse: true,
+			search: false,
+			upload: true,
+			delete: true
+		},
+		config: { enabled: config.enabled ?? true }
+	};
+}
+
+//#endregion
+export { generatePlaceholder, localMedia, mediaItemToValue, normalizeMediaValue };

package/dist/media/local-runtime.d.mts

@@ -0,0 +1,38 @@
+import { h as MediaProviderItem, o as CreateMediaProviderFn } from "../placeholder-bOx1xCTY.mjs";
+import { t as Database } from "../types-DkvMXalq.mjs";
+import "../index-C-jx21qs.mjs";
+import "../runner-B5l1JfOj.mjs";
+import "../types-D38djUXv.mjs";
+import "../validate-DVKJJ-M_.mjs";
+import { d as Storage } from "../types-ju-_ORz7.mjs";
+import "../index.mjs";
+import { Kysely } from "kysely";
+
+//#region src/media/local-runtime.d.ts
+interface LocalMediaRuntimeConfig {
+  enabled?: boolean;
+  db?: Kysely<Database>;
+  storage?: Storage;
+}
+/**
+ * Create the local media provider
+ */
+declare const createMediaProvider: CreateMediaProviderFn<LocalMediaRuntimeConfig>;
+/**
+ * Helper to convert a MediaRepository item to MediaProviderItem
+ */
+declare function repoItemToProviderItem(item: {
+  id: string;
+  filename: string;
+  mimeType: string;
+  size: number | null;
+  width: number | null;
+  height: number | null;
+  alt: string | null;
+  caption: string | null;
+  storageKey: string;
+  blurhash: string | null;
+  dominantColor: string | null;
+}): MediaProviderItem;
+//#endregion
+export { LocalMediaRuntimeConfig, createMediaProvider, repoItemToProviderItem };

package/dist/media/local-runtime.mjs

@@ -0,0 +1,132 @@
+import "../base64-F8-DUraK.mjs";
+import "../types-BawVha09.mjs";
+import { t as MediaRepository } from "../media-DMTr80Gv.mjs";
+
+//#region src/media/local-runtime.ts
+/**
+* Create the local media provider
+*/
+const createMediaProvider = (config) => {
+	const { db, storage } = config;
+	if (!db) throw new Error("Local media provider requires database connection");
+	const repo = new MediaRepository(db);
+	return {
+		async list(options) {
+			const result = await repo.findMany({
+				cursor: options.cursor,
+				limit: options.limit,
+				mimeType: options.mimeType
+			});
+			return {
+				items: result.items.map((item) => ({
+					id: item.id,
+					filename: item.filename,
+					mimeType: item.mimeType,
+					size: item.size ?? void 0,
+					width: item.width ?? void 0,
+					height: item.height ?? void 0,
+					alt: item.alt ?? void 0,
+					previewUrl: `/_dineway/api/media/file/${item.storageKey}`,
+					meta: {
+						storageKey: item.storageKey,
+						caption: item.caption,
+						blurhash: item.blurhash,
+						dominantColor: item.dominantColor
+					}
+				})),
+				nextCursor: result.nextCursor
+			};
+		},
+		async get(id) {
+			const item = await repo.findById(id);
+			if (!item) return null;
+			return {
+				id: item.id,
+				filename: item.filename,
+				mimeType: item.mimeType,
+				size: item.size ?? void 0,
+				width: item.width ?? void 0,
+				height: item.height ?? void 0,
+				alt: item.alt ?? void 0,
+				previewUrl: `/_dineway/api/media/file/${item.storageKey}`,
+				meta: {
+					storageKey: item.storageKey,
+					caption: item.caption,
+					blurhash: item.blurhash,
+					dominantColor: item.dominantColor
+				}
+			};
+		},
+		async upload(_input) {
+			if (!storage) throw new Error("Storage not configured for local media provider");
+			throw new Error("Local upload should use /_dineway/api/media endpoint");
+		},
+		async delete(id) {
+			const item = await repo.findById(id);
+			if (!item) return;
+			if (storage) try {
+				await storage.delete(item.storageKey);
+			} catch {}
+			await repo.delete(id);
+		},
+		getEmbed(value, _options) {
+			const src = `/_dineway/api/media/file/${typeof value.meta?.storageKey === "string" ? value.meta.storageKey : value.id}`;
+			const mimeType = value.mimeType || "";
+			if (mimeType.startsWith("image/")) return {
+				type: "image",
+				src,
+				width: value.width,
+				height: value.height,
+				alt: value.alt
+			};
+			if (mimeType.startsWith("video/")) return {
+				type: "video",
+				src,
+				width: value.width,
+				height: value.height,
+				controls: true,
+				preload: "metadata"
+			};
+			if (mimeType.startsWith("audio/")) return {
+				type: "audio",
+				src,
+				controls: true,
+				preload: "metadata"
+			};
+			return {
+				type: "image",
+				src,
+				width: value.width,
+				height: value.height,
+				alt: value.alt
+			};
+		},
+		getThumbnailUrl(id, _mimeType) {
+			return `/_dineway/api/media/file/${id}`;
+		}
+	};
+};
+/**
+* Helper to convert a MediaRepository item to MediaProviderItem
+*/
+function repoItemToProviderItem(item) {
+	return {
+		id: item.id,
+		filename: item.filename,
+		mimeType: item.mimeType,
+		size: item.size ?? void 0,
+		width: item.width ?? void 0,
+		height: item.height ?? void 0,
+		alt: item.alt ?? void 0,
+		previewUrl: `/_dineway/api/media/file/${item.storageKey}`,
+		meta: {
+			storageKey: item.storageKey,
+			caption: item.caption,
+			blurhash: item.blurhash,
+			dominantColor: item.dominantColor
+		}
+	};
+}
+
+//#endregion
+export { createMediaProvider, repoItemToProviderItem };

package/dist/media-DMTr80Gv.mjs

@@ -0,0 +1,199 @@
+import { n as decodeCursor, r as encodeCursor } from "./types-BawVha09.mjs";
+import { sql } from "kysely";
+import { ulid } from "ulidx";
+
+//#region src/database/repositories/media.ts
+/** Escape LIKE wildcard characters and the escape char itself in user-supplied values */
+function escapeLike(value) {
+	return value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_");
+}
+/**
+* Media repository for database operations
+*/
+var MediaRepository = class {
+	constructor(db) {
+		this.db = db;
+	}
+	/**
+	* Create a new media item
+	*/
+	async create(input) {
+		const id = ulid();
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const row = {
+			id,
+			filename: input.filename,
+			mime_type: input.mimeType,
+			size: input.size ?? null,
+			width: input.width ?? null,
+			height: input.height ?? null,
+			alt: input.alt ?? null,
+			caption: input.caption ?? null,
+			storage_key: input.storageKey,
+			content_hash: input.contentHash ?? null,
+			blurhash: input.blurhash ?? null,
+			dominant_color: input.dominantColor ?? null,
+			status: input.status ?? "ready",
+			created_at: now,
+			author_id: input.authorId ?? null
+		};
+		await this.db.insertInto("media").values(row).execute();
+		return this.rowToItem(row);
+	}
+	/**
+	* Create a pending media item (for signed URL upload flow)
+	*/
+	async createPending(input) {
+		return this.create({
+			...input,
+			status: "pending"
+		});
+	}
+	/**
+	* Confirm upload (mark as ready)
+	*/
+	async confirmUpload(id, metadata) {
+		if (!await this.findById(id)) return null;
+		const updates = { status: "ready" };
+		if (metadata?.width !== void 0) updates.width = metadata.width;
+		if (metadata?.height !== void 0) updates.height = metadata.height;
+		if (metadata?.size !== void 0) updates.size = metadata.size;
+		await this.db.updateTable("media").set(updates).where("id", "=", id).execute();
+		return this.findById(id);
+	}
+	/**
+	* Mark upload as failed
+	*/
+	async markFailed(id) {
+		if (!await this.findById(id)) return null;
+		await this.db.updateTable("media").set({ status: "failed" }).where("id", "=", id).execute();
+		return this.findById(id);
+	}
+	/**
+	* Find media by ID
+	*/
+	async findById(id) {
+		const row = await this.db.selectFrom("media").selectAll().where("id", "=", id).executeTakeFirst();
+		return row ? this.rowToItem(row) : null;
+	}
+	/**
+	* Find media by filename
+	* Useful for idempotent imports
+	*/
+	async findByFilename(filename) {
+		const row = await this.db.selectFrom("media").selectAll().where("filename", "=", filename).executeTakeFirst();
+		return row ? this.rowToItem(row) : null;
+	}
+	/**
+	* Find media by content hash
+	* Used for deduplication - same content = same hash
+	*/
+	async findByContentHash(contentHash) {
+		const row = await this.db.selectFrom("media").selectAll().where("content_hash", "=", contentHash).where("status", "=", "ready").executeTakeFirst();
+		return row ? this.rowToItem(row) : null;
+	}
+	/**
+	* Find many media items with cursor pagination
+	*
+	* Uses keyset pagination (cursor-based) for consistent results.
+	* The cursor encodes the created_at and id of the last item.
+	*/
+	async findMany(options = {}) {
+		const limit = Math.min(options.limit || 50, 100);
+		let query = this.db.selectFrom("media").selectAll().orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
+		if (options.cursor) {
+			const decoded = decodeCursor(options.cursor);
+			if (decoded) {
+				const { orderValue: createdAt, id: cursorId } = decoded;
+				query = query.where((eb) => eb.or([eb("created_at", "<", createdAt), eb.and([eb("created_at", "=", createdAt), eb("id", "<", cursorId)])]));
+			}
+		}
+		if (options.mimeType) {
+			const pattern = `${escapeLike(options.mimeType)}%`;
+			query = query.where(sql`mime_type LIKE ${pattern} ESCAPE '\\'`);
+		}
+		if (options.status !== "all") query = query.where("status", "=", options.status ?? "ready");
+		const rows = await query.execute();
+		const hasMore = rows.length > limit;
+		const items = rows.slice(0, limit).map((row) => this.rowToItem(row));
+		let nextCursor;
+		if (hasMore && items.length > 0) {
+			const lastItem = items.at(-1);
+			nextCursor = encodeCursor(lastItem.createdAt, lastItem.id);
+		}
+		return {
+			items,
+			nextCursor
+		};
+	}
+	/**
+	* Update media metadata
+	*/
+	async update(id, input) {
+		if (!await this.findById(id)) return null;
+		const updates = {};
+		if (input.alt !== void 0) updates.alt = input.alt;
+		if (input.caption !== void 0) updates.caption = input.caption;
+		if (input.width !== void 0) updates.width = input.width;
+		if (input.height !== void 0) updates.height = input.height;
+		if (Object.keys(updates).length > 0) await this.db.updateTable("media").set(updates).where("id", "=", id).execute();
+		return this.findById(id);
+	}
+	/**
+	* Delete media item
+	*/
+	async delete(id) {
+		return ((await this.db.deleteFrom("media").where("id", "=", id).executeTakeFirst()).numDeletedRows ?? 0) > 0;
+	}
+	/**
+	* Count media items
+	*/
+	async count(mimeType) {
+		let query = this.db.selectFrom("media").select((eb) => eb.fn.count("id").as("count"));
+		if (mimeType) {
+			const pattern = `${escapeLike(mimeType)}%`;
+			query = query.where(sql`mime_type LIKE ${pattern} ESCAPE '\\'`);
+		}
+		const result = await query.executeTakeFirst();
+		return Number(result?.count || 0);
+	}
+	/**
+	* Delete pending uploads older than the given age.
+	* Pending uploads that were never confirmed indicate abandoned upload flows.
+	*
+	* Returns the storage keys of deleted rows so callers can remove the
+	* corresponding files from object storage.
+	*/
+	async cleanupPendingUploads(maxAgeMs = 3600 * 1e3) {
+		const cutoff = new Date(Date.now() - maxAgeMs).toISOString();
+		const rows = await this.db.selectFrom("media").select("storage_key").where("status", "=", "pending").where("created_at", "<", cutoff).execute();
+		if (rows.length === 0) return [];
+		await this.db.deleteFrom("media").where("status", "=", "pending").where("created_at", "<", cutoff).execute();
+		return rows.map((r) => r.storage_key);
+	}
+	/**
+	* Convert database row to MediaItem
+	*/
+	rowToItem(row) {
+		return {
+			id: row.id,
+			filename: row.filename,
+			mimeType: row.mime_type,
+			size: row.size,
+			width: row.width,
+			height: row.height,
+			alt: row.alt,
+			caption: row.caption,
+			storageKey: row.storage_key,
+			contentHash: row.content_hash,
+			blurhash: row.blurhash,
+			dominantColor: row.dominant_color,
+			status: row.status,
+			createdAt: row.created_at,
+			authorId: row.author_id
+		};
+	}
+};
+
+//#endregion
+export { MediaRepository as t };

package/dist/mode-BlyYtIFO.mjs

@@ -0,0 +1,22 @@
+//#region src/auth/mode.ts
+/**
+* Determine the active auth mode from config.
+*
+* Accepts `DinewayConfig` (or subtype) — checks for `auth` field via duck typing.
+*
+* @param config Dineway configuration
+* @returns The active auth mode
+*/
+function getAuthMode(config) {
+	const auth = config?.auth;
+	if (auth && "entrypoint" in auth && auth.entrypoint) return {
+		type: "external",
+		providerType: auth.type,
+		entrypoint: auth.entrypoint,
+		config: auth.config
+	};
+	return { type: "passkey" };
+}
+
+//#endregion
+export { getAuthMode as t };