dineway 0.1.4 → 0.1.5

package/dist/astro/middleware.mjs

@@ -1,26 +1,31 @@
-import "../connection-C9pxzuag.mjs";
-import { a as isSqlite } from "../dialect-helpers-B9uSp2GJ.mjs";
-import { r as runMigrations } from "../runner-BGUGywgG.mjs";
-import { $ as CronExecutor, $t as handleContentSchedule, At as handleMediaGet, Bt as handleContentCountScheduled, Ct as createPluginBundleStore, Et as PluginStateRepository, Ft as handleRevisionRestore, Gt as handleContentDuplicate, Ht as handleContentCreate, J as devConsoleEmailDeliver, Jt as handleContentList, K as PluginRouteRegistry, Kt as handleContentGet, Mt as handleMediaUpdate, Nt as handleRevisionGet, Ot as handleMediaCreate, Pt as handleRevisionList, Q as resolveExclusiveHooks, Qt as handleContentRestore, Rt as hashString, Ut as handleContentDelete, Vt as handleContentCountTrashed, Wt as handleContentDiscardDraft, Xt as handleContentPermanentDelete, Y as EmailPipeline, Yt as handleContentListTrashed, Z as createHookPipeline, Zt as handleContentPublish, en as handleContentTranslations, et as extractRequestMeta, in as validateRev, jt as handleMediaList, kt as handleMediaDelete, nn as handleContentUnschedule, nt as definePlugin, q as DEV_CONSOLE_EMAIL_PLUGIN_ID, qt as handleContentGetIncludingTrashed, rn as handleContentUpdate, tn as handleContentUnpublish, tt as sanitizeHeadersForSandbox, zt as handleContentCompare } from "../search-BNruJHDL.mjs";
-import { r as RevisionRepository } from "../content-zSgdNmnt.mjs";
+import { getRequestContext, runWithContext } from "../request-context.mjs";
+import { createRecorder, flushRecorder, formatServerTimingHeader, isInstrumentationEnabled, isServerTimingEnabled, kyselyLogOption } from "../database/instrumentation.mjs";
+import "../connection-BCNICDWN.mjs";
+import { t as validateIdentifier } from "../validate-VPnKoIzW.mjs";
+import { a as isSqlite } from "../dialect-helpers-DhTzaUxP.mjs";
+import { r as runMigrations } from "../runner-DWZm2KQm.mjs";
+import { $t as validateRev, B as DEV_CONSOLE_EMAIL_PLUGIN_ID, Bt as handleContentDuplicate, Ct as handleMediaDelete, Dt as handleRevisionGet, Et as handleMediaUpdate, Ft as handleContentCountScheduled, G as resolveExclusiveHooks, Gt as handleContentPermanentDelete, H as EmailPipeline, Ht as handleContentGetIncludingTrashed, It as handleContentCountTrashed, J as sanitizeHeadersForSandbox, Jt as handleContentSchedule, K as CronExecutor, Kt as handleContentPublish, Lt as handleContentCreate, Mt as hashString, Nt as PluginStateRepository, Ot as handleRevisionList, Pt as handleContentCompare, Qt as handleContentUpdate, Rt as handleContentDelete, St as handleMediaCreate, Tt as handleMediaList, Ut as handleContentList, V as devConsoleEmailDeliver, Vt as handleContentGet, W as createHookPipeline, Wt as handleContentListTrashed, X as definePlugin, Xt as handleContentUnpublish, Y as getTrustedProxyHeaders, Yt as handleContentTranslations, Zt as handleContentUnschedule, kt as handleRevisionRestore, pt as after, q as extractRequestMeta, qt as handleContentRestore, vt as createPluginBundleStore, wt as handleMediaGet, z as PluginRouteRegistry, zt as handleContentDiscardDraft } from "../search-ByRGV2pq.mjs";
+import { r as RevisionRepository } from "../content-DWi4d0rT.mjs";
 import "../base64-F8-DUraK.mjs";
 import "../types-BawVha09.mjs";
 import { t as MediaRepository } from "../media-DMTr80Gv.mjs";
-import { f as OptionsRepository } from "../apply-CAPvMfoU.mjs";
-import { i as FTSManager, n as SchemaRegistry } from "../registry-DSd1GWB8.mjs";
-import "../redirect-JPqLAbxa.mjs";
-import "../byline-DeWCMU_i.mjs";
-import { n as normalizeMediaValue } from "../placeholder-B3knXwNc.mjs";
-import { i as setI18nConfig } from "../config-Cq8H0SfX.mjs";
-import { getRequestContext, runWithContext } from "../request-context.mjs";
-import { n as getDb } from "../loader-qKmo0wAY.mjs";
-import { r as normalizeManifestRoute } from "../manifest-schema-CTSEyIJ3.mjs";
-import "../query-BiaPl_g2.mjs";
-import "../tokens-4vgYuXsZ.mjs";
-import "../bylines-DyqBV9EQ.mjs";
-import "../load-C6FCD1FU.mjs";
+import { p as OptionsRepository } from "../apply-iVSqz2qs.mjs";
+import "../redirect-DnEWAkVg.mjs";
+import "../byline-OhH2dlRu.mjs";
+import { n as normalizeMediaValue } from "../placeholder-Cp8g5Emj.mjs";
+import { i as setI18nConfig } from "../config-BXwuX8Bx.mjs";
+import { i as FTSManager, n as SchemaRegistry } from "../registry-C0zjeB9P.mjs";
+import { n as getDb } from "../loader-sMG4TZ-u.mjs";
+import "../request-cache-Dk5qPSOx.mjs";
+import { n as VERSION, t as COMMIT } from "../version-BKXPsfmJ.mjs";
+import "../taxonomies-1s5PaS_8.mjs";
+import { r as normalizeManifestRoute } from "../manifest-schema-D1MSVnoI.mjs";
+import { a as invalidateUrlPatternCache } from "../query-kDmwCsHh.mjs";
+import "../tokens-CJz9ubV6.mjs";
+import "../bylines-BGpD9_hy.mjs";
+import "../load-Coc9HpHH.mjs";
 import "../index.mjs";
-import { t as getAuthMode } from "../mode-BlyYtIFO.mjs";
+import { t as getAuthMode } from "../mode-47goXBBK.mjs";
 import { Kysely, sql } from "kysely";
 import { defineMiddleware } from "astro:middleware";
 import virtualConfig from "virtual:dineway/config";
@@ -32,6 +37,14 @@ import { sandboxedPlugins } from "virtual:dineway/sandboxed-plugins";
 import { createStorage } from "virtual:dineway/storage";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 
+//#region src/site-context/experimental-workflows.ts
+const EXPERIMENTAL_SITE_CONTEXT_WORKFLOWS_ENV = "DINEWAY_EXPERIMENTAL_SITE_CONTEXT_WORKFLOWS";
+function experimentalSiteContextWorkflowsEnabled() {
+	const value = process.env[EXPERIMENTAL_SITE_CONTEXT_WORKFLOWS_ENV];
+	return value === "1" || value === "true";
+}
+
+//#endregion
 //#region src/auth/challenge-store.ts
 /**
 * Clean up expired challenges.
@@ -118,10 +131,10 @@ async function runSystemCleanup(db, storage) {
 */
 async function pruneExcessiveRevisions(db) {
 	const entries = await sql`
-		SELECT collection, entry_id, COUNT(*) as cnt
+		SELECT collection, entry_id
 		FROM revisions
 		GROUP BY collection, entry_id
-		HAVING cnt > ${REVISION_PRUNE_THRESHOLD}
+		HAVING COUNT(*) > ${REVISION_PRUNE_THRESHOLD}
 	`.execute(db);
 	if (entries.rows.length === 0) return 0;
 	const revisionRepo = new RevisionRepository(db);
@@ -301,6 +314,8 @@ function shouldUsePiggybackScheduler(createTimer = () => globalThis.setTimeout((
 
 //#endregion
 //#region src/dineway-runtime.ts
+const MANIFEST_CACHE_OPTION = "dineway:manifest_cache";
+const MANIFEST_CACHE_SCHEMA_VERSION = "dineway-manifest-cache-v1";
 const LEADING_SLASH_PATTERN = /^\//;
 const VALID_METADATA_KINDS = new Set([
 	"meta",
@@ -314,6 +329,7 @@ const VALID_LINK_REL = new Set([
 	"alternate",
 	"author",
 	"license",
+	"nlweb",
 	"site.standard.document"
 ]);
 /**
@@ -349,12 +365,48 @@ function parseStringArray(value) {
 		return [];
 	}
 }
+function isRecord(value) {
+	return !!value && typeof value === "object";
+}
+function isPersistedManifestCache(value) {
+	if (!isRecord(value)) return false;
+	if (typeof value.key !== "string") return false;
+	if (!isRecord(value.manifest)) return false;
+	const manifest = value.manifest;
+	return typeof manifest.version === "string" && (typeof manifest.commit === "undefined" || typeof manifest.commit === "string") && typeof manifest.hash === "string" && !!manifest.collections && typeof manifest.collections === "object" && !!manifest.plugins && typeof manifest.plugins === "object" && isRecord(manifest.features) && typeof manifest.features.siteContextWorkflows === "boolean";
+}
+function serializeAdminBranding(config) {
+	const admin = config.admin;
+	if (!admin) return "";
+	return JSON.stringify({
+		logo: admin.logo ?? "",
+		siteName: admin.siteName ?? "",
+		favicon: admin.favicon ?? ""
+	});
+}
+async function createManifestCacheKey(deps) {
+	const pluginKeys = deps.plugins.map((plugin) => `${plugin.id}@${plugin.version ?? ""}`).toSorted();
+	const sandboxedPluginKeys = deps.sandboxedPluginEntries.map((entry) => `${entry.id}@${entry.version}`).toSorted();
+	const i18nConfig = virtualConfig?.i18n;
+	const locales = (i18nConfig?.locales ?? []).toSorted();
+	return hashString([
+		MANIFEST_CACHE_SCHEMA_VERSION,
+		`version:${VERSION}:${COMMIT}`,
+		deps.config.marketplace ? "marketplace:1" : "marketplace:0",
+		`site-context-workflows:${experimentalSiteContextWorkflowsEnabled() ? "1" : "0"}`,
+		`admin:${serializeAdminBranding(deps.config)}`,
+		`plugins:${pluginKeys.join(",")}`,
+		`sandboxed:${sandboxedPluginKeys.join(",")}`,
+		`i18n:${i18nConfig?.defaultLocale ?? ""}:${locales.join(",")}`
+	].join("|"));
+}
 /**
 * Map schema field types to editor field kinds
 */
 const FIELD_TYPE_TO_KIND = {
 	string: "string",
 	slug: "string",
+	url: "url",
 	text: "richText",
 	number: "number",
 	integer: "number",
@@ -424,6 +476,13 @@ var DinewayRuntime = class DinewayRuntime {
 	runtimeDeps;
 	/** Mutable ref for the cron invokeCronHook closure to read the current pipeline */
 	pipelineRef;
+	/** Tracks whether FTS health has already been checked for this runtime instance. */
+	_searchHealthChecked = false;
+	/** Shared in-flight FTS health verification promise. */
+	_searchHealthPromise = null;
+	_cachedManifest = null;
+	_manifestPromise = null;
+	_manifestCacheKey;
 	/**
 	* Get the database instance for the current request.
 	*
@@ -437,7 +496,7 @@ var DinewayRuntime = class DinewayRuntime {
 		if (requestDb) return requestDb;
 		return this._db;
 	}
-	constructor(db, storage, configuredPlugins, sandboxedPlugins, sandboxedPluginEntries, hooks, enabledPlugins, pluginStates, config, mediaProviders, mediaProviderEntries, cronExecutor, cronScheduler, emailPipeline, allPipelinePlugins, pipelineFactoryOptions, runtimeDeps, pipelineRef) {
+	constructor(db, storage, configuredPlugins, sandboxedPlugins, sandboxedPluginEntries, hooks, enabledPlugins, pluginStates, config, mediaProviders, mediaProviderEntries, cronExecutor, cronScheduler, emailPipeline, allPipelinePlugins, pipelineFactoryOptions, runtimeDeps, pipelineRef, manifestCacheKey = MANIFEST_CACHE_SCHEMA_VERSION) {
 		this._db = db;
 		this.storage = storage;
 		this.configuredPlugins = configuredPlugins;
@@ -457,6 +516,7 @@ var DinewayRuntime = class DinewayRuntime {
 		this.pipelineFactoryOptions = pipelineFactoryOptions;
 		this.runtimeDeps = runtimeDeps;
 		this.pipelineRef = pipelineRef;
+		this._manifestCacheKey = manifestCacheKey;
 	}
 	/**
 	* Get the sandbox runner instance (for marketplace install/update)
@@ -480,6 +540,32 @@ var DinewayRuntime = class DinewayRuntime {
 		if (this.cronScheduler) await this.cronScheduler.stop();
 	}
 	/**
+	* Ensure search-related FTS tables are healthy before the first query.
+	*
+	* Search health is deferred off the runtime cold-start path so ordinary
+	* page loads do not pay the index verification cost. Concurrent callers
+	* share a single in-flight check, and once it has completed the result is
+	* treated as healthy for the lifetime of this runtime instance.
+	*/
+	async ensureSearchHealthy() {
+		if (this._searchHealthChecked) return;
+		if (this._searchHealthPromise) return this._searchHealthPromise;
+		if (!isSqlite(this.db)) {
+			this._searchHealthChecked = true;
+			return;
+		}
+		this._searchHealthPromise = (async () => {
+			try {
+				const repaired = await new FTSManager(this.db).verifyAndRepairAll();
+				if (repaired > 0) console.log(`Repaired ${repaired} corrupted FTS index(es)`);
+			} catch {} finally {
+				this._searchHealthChecked = true;
+				this._searchHealthPromise = null;
+			}
+		})();
+		return this._searchHealthPromise;
+	}
+	/**
 	* Update in-memory plugin status and rebuild the hook pipeline.
 	*
 	* Rebuilding the pipeline ensures disabled plugins' hooks stop firing
@@ -497,6 +583,7 @@ var DinewayRuntime = class DinewayRuntime {
 			this.enabledPlugins.delete(pluginId);
 			await this.rebuildHookPipeline();
 		}
+		this.invalidateManifest();
 	}
 	/**
 	* Rebuild the hook pipeline from the current set of enabled plugins.
@@ -608,10 +695,6 @@ var DinewayRuntime = class DinewayRuntime {
 	*/
 	static async create(deps) {
 		const db = await DinewayRuntime.getDatabase(deps);
-		if (isSqlite(db)) try {
-			const repaired = await new FTSManager(db).verifyAndRepairAll();
-			if (repaired > 0) console.log(`Repaired ${repaired} corrupted FTS index(es) at startup`);
-		} catch {}
 		const storage = DinewayRuntime.getStorage(deps);
 		let pluginStates = /* @__PURE__ */ new Map();
 		try {
@@ -625,14 +708,15 @@ var DinewayRuntime = class DinewayRuntime {
 		}
 		let siteInfo;
 		try {
-			const optionsRepo = new OptionsRepository(db);
-			const siteName = await optionsRepo.get("dineway:site_title");
-			const siteUrl = await optionsRepo.get("dineway:site_url");
-			const locale = await optionsRepo.get("dineway:locale");
+			const siteOptions = await new OptionsRepository(db).getMany([
+				"dineway:site_title",
+				"dineway:site_url",
+				"dineway:locale"
+			]);
 			siteInfo = {
-				siteName: siteName ?? void 0,
-				siteUrl: siteUrl ?? void 0,
-				locale: locale ?? void 0
+				siteName: siteOptions.get("dineway:site_title") ?? void 0,
+				siteUrl: siteOptions.get("dineway:site_url") ?? void 0,
+				locale: siteOptions.get("dineway:locale") ?? void 0
 			};
 		} catch {}
 		const allPipelinePlugins = [...deps.plugins];
@@ -667,10 +751,12 @@ var DinewayRuntime = class DinewayRuntime {
 			console.warn("[comments] Failed to register default moderator:", error);
 		}
 		const enabledPluginList = allPipelinePlugins.filter((p) => enabledPlugins.has(p.id));
+		const trustedProxyHeaders = getTrustedProxyHeaders(deps.config);
 		const pipelineFactoryOptions = {
 			db,
 			storage: storage ?? void 0,
-			siteInfo
+			siteInfo,
+			trustedProxyHeaders
 		};
 		const pipeline = createHookPipeline(enabledPluginList, pipelineFactoryOptions);
 		let cronScheduler = null;
@@ -709,8 +795,15 @@ var DinewayRuntime = class DinewayRuntime {
 		let cronExecutor = null;
 		try {
 			cronExecutor = new CronExecutor(db, invokeCronHook);
-			const recovered = await cronExecutor.recoverStaleLocks();
-			if (recovered > 0) console.log(`[cron] Recovered ${recovered} stale task lock(s)`);
+			const executorForRecovery = cronExecutor;
+			after(async () => {
+				try {
+					const recovered = await executorForRecovery.recoverStaleLocks();
+					if (recovered > 0) console.log(`[cron] Recovered ${recovered} stale task lock(s)`);
+				} catch (error) {
+					console.error("[cron] Failed to recover stale task locks:", error);
+				}
+			});
 			if (shouldUsePiggybackScheduler()) cronScheduler = new PiggybackScheduler(cronExecutor);
 			else cronScheduler = new NodeCronScheduler(cronExecutor);
 			cronScheduler.setSystemCleanup(async () => {
@@ -725,7 +818,8 @@ var DinewayRuntime = class DinewayRuntime {
 		} catch (error) {
 			console.warn("[cron] Failed to initialize cron system:", error);
 		}
-		return new DinewayRuntime(db, storage, deps.plugins, sandboxedPlugins, deps.sandboxedPluginEntries, pipeline, enabledPlugins, pluginStates, deps.config, mediaProviders, mediaProviderEntries, cronExecutor, cronScheduler, emailPipeline, allPipelinePlugins, pipelineFactoryOptions, deps, pipelineRef);
+		const manifestCacheKey = await createManifestCacheKey(deps);
+		return new DinewayRuntime(db, storage, deps.plugins, sandboxedPlugins, deps.sandboxedPluginEntries, pipeline, enabledPlugins, pluginStates, deps.config, mediaProviders, mediaProviderEntries, cronExecutor, cronScheduler, emailPipeline, allPipelinePlugins, pipelineFactoryOptions, deps, pipelineRef, manifestCacheKey);
 	}
 	/**
 	* Get a media provider by ID
@@ -761,8 +855,14 @@ var DinewayRuntime = class DinewayRuntime {
 		if (cached) return cached;
 		if (dbInitPromise) return dbInitPromise;
 		dbInitPromise = (async () => {
-			const db = new Kysely({ dialect: deps.createDialect(dbConfig.config) });
-			await runMigrations(db);
+			const db = new Kysely({
+				dialect: deps.createDialect(dbConfig.config),
+				log: kyselyLogOption()
+			});
+			const { applied } = await runMigrations(db);
+			if (applied.length > 0) try {
+				await new OptionsRepository(db).delete(MANIFEST_CACHE_OPTION);
+			} catch {}
 			try {
 				const [collectionCount, setupOption] = await Promise.all([db.selectFrom("_dineway_collections").select((eb) => eb.fn.countAll().as("count")).executeTakeFirstOrThrow(), db.selectFrom("options").select("value").where("name", "=", "dineway:setup_complete").executeTakeFirst()]);
 				const setupDone = (() => {
@@ -773,9 +873,9 @@ var DinewayRuntime = class DinewayRuntime {
 					}
 				})();
 				if (collectionCount.count === 0 && !setupDone) {
-					const { applySeed } = await import("../apply-CAPvMfoU.mjs").then((n) => n.n);
-					const { loadSeed } = await import("../load-C6FCD1FU.mjs").then((n) => n.r);
-					const { validateSeed } = await import("../validate-CXnRKfJK.mjs").then((n) => n.n);
+					const { applySeed } = await import("../apply-iVSqz2qs.mjs").then((n) => n.n);
+					const { loadSeed } = await import("../load-Coc9HpHH.mjs").then((n) => n.r);
+					const { validateSeed } = await import("../validate-BZ5wnLLp.mjs").then((n) => n.n);
 					const seed = await loadSeed();
 					if (validateSeed(seed).valid) {
 						await applySeed(db, seed, { onConflict: "skip" });
@@ -915,9 +1015,46 @@ var DinewayRuntime = class DinewayRuntime {
 		});
 	}
 	/**
-	* Build the manifest (rebuilt on each request for freshness)
+	* Return the admin manifest, reusing the runtime/persisted cache when
+	* singleton DB state is active. Request-scoped database overrides bypass
+	* the cache so sidecar/playground sessions see their own schema.
 	*/
 	async getManifest() {
+		if (getRequestContextDatabase()) return this._buildManifest();
+		if (this._cachedManifest) return this._cachedManifest;
+		try {
+			const cached = await new OptionsRepository(this._db).get(MANIFEST_CACHE_OPTION);
+			if (isPersistedManifestCache(cached) && cached.key === this._manifestCacheKey) {
+				this._cachedManifest = cached.manifest;
+				return cached.manifest;
+			}
+		} catch {}
+		if (!this._manifestPromise) {
+			let manifestPromise;
+			const isCurrentLoad = () => this._manifestPromise === manifestPromise;
+			manifestPromise = this._loadManifest(isCurrentLoad);
+			this._manifestPromise = manifestPromise;
+		}
+		return this._manifestPromise;
+	}
+	async _loadManifest(isCurrentLoad) {
+		try {
+			const manifest = await this._buildManifest();
+			if (isCurrentLoad()) {
+				this._cachedManifest = manifest;
+				try {
+					await new OptionsRepository(this._db).set(MANIFEST_CACHE_OPTION, {
+						key: this._manifestCacheKey,
+						manifest
+					});
+				} catch {}
+			}
+			return manifest;
+		} finally {
+			if (isCurrentLoad()) this._manifestPromise = null;
+		}
+	}
+	async _buildManifest() {
 		const manifestCollections = {};
 		try {
 			const registry = new SchemaRegistry(this.db);
@@ -1014,7 +1151,8 @@ var DinewayRuntime = class DinewayRuntime {
 		} catch (error) {
 			console.debug("Dineway: Could not load taxonomy definitions:", error);
 		}
-		const manifestHash = await hashString(JSON.stringify(manifestCollections) + JSON.stringify(manifestPlugins) + JSON.stringify(manifestTaxonomies));
+		const features = { siteContextWorkflows: experimentalSiteContextWorkflowsEnabled() };
+		const manifestHash = await hashString(JSON.stringify(manifestCollections) + JSON.stringify(manifestPlugins) + JSON.stringify(manifestTaxonomies) + JSON.stringify(features) + serializeAdminBranding(this.config));
 		const authMode = getAuthMode(this.config);
 		const authModeValue = authMode.type === "external" ? authMode.providerType : "passkey";
 		const i18nConfig = virtualConfig?.i18n;
@@ -1023,21 +1161,30 @@ var DinewayRuntime = class DinewayRuntime {
 			locales: i18nConfig.locales
 		} : void 0;
 		return {
-			version: "0.1.0",
+			version: VERSION,
+			commit: COMMIT,
 			hash: manifestHash,
 			collections: manifestCollections,
 			plugins: manifestPlugins,
+			features,
 			taxonomies: manifestTaxonomies,
 			authMode: authModeValue,
 			i18n,
-			marketplace: !!this.config.marketplace
+			marketplace: !!this.config.marketplace,
+			admin: this.config.admin
 		};
 	}
 	/**
-	* Invalidate the cached manifest (no-op now that we don't cache).
-	* Kept for API compatibility.
+	* Invalidate cached manifest state after schema, taxonomy, or plugin changes.
 	*/
-	invalidateManifest() {}
+	invalidateManifest() {
+		this._cachedManifest = null;
+		this._manifestPromise = null;
+		invalidateUrlPatternCache();
+		new OptionsRepository(this._db).delete(MANIFEST_CACHE_OPTION).catch((error) => {
+			console.debug("Dineway: Could not clear manifest cache:", error);
+		});
+	}
 	async handleContentList(collection, params) {
 		return handleContentList(this.db, collection, params);
 	}
@@ -1062,7 +1209,7 @@ var DinewayRuntime = class DinewayRuntime {
 		return result;
 	}
 	async handleContentUpdate(collection, id, body) {
-		const { ContentRepository } = await import("../content-zSgdNmnt.mjs").then((n) => n.n);
+		const { ContentRepository } = await import("../content-DWi4d0rT.mjs").then((n) => n.n);
 		const repo = new ContentRepository(this.db);
 		const resolvedItem = await repo.findByIdOrSlug(collection, id);
 		const resolvedId = resolvedItem?.id ?? id;
@@ -1113,6 +1260,7 @@ var DinewayRuntime = class DinewayRuntime {
 							data: mergedData,
 							authorId: bodyWithoutRev.authorId ?? void 0
 						});
+						validateIdentifier(collection, "collection");
 						const tableName = `ec_${collection}`;
 						await sql`
 								UPDATE ${sql.ref(tableName)}
@@ -1154,7 +1302,7 @@ var DinewayRuntime = class DinewayRuntime {
 			}
 		};
 		const result = await handleContentDelete(this.db, collection, id);
-		if (result.success) this.runAfterDeleteHooks(id, collection);
+		if (result.success) this.runAfterDeleteHooks(id, collection, false);
 		return result;
 	}
 	async handleContentListTrashed(collection, params = {}) {
@@ -1164,7 +1312,9 @@ var DinewayRuntime = class DinewayRuntime {
 		return handleContentRestore(this.db, collection, id);
 	}
 	async handleContentPermanentDelete(collection, id) {
-		return handleContentPermanentDelete(this.db, collection, id);
+		const result = await handleContentPermanentDelete(this.db, collection, id);
+		if (result.success) this.runAfterDeleteHooks(id, collection, true);
+		return result;
 	}
 	async handleContentCountTrashed(collection) {
 		return handleContentCountTrashed(this.db, collection);
@@ -1291,7 +1441,8 @@ var DinewayRuntime = class DinewayRuntime {
 		if (trustedPlugin && this.enabledPlugins.has(trustedPlugin.id)) {
 			const routeRegistry = new PluginRouteRegistry({
 				db: this.db,
-				emailPipeline: this.email ?? void 0
+				emailPipeline: this.email ?? void 0,
+				trustedProxyHeaders: getTrustedProxyHeaders(this.config)
 			});
 			routeRegistry.register(trustedPlugin);
 			const routeKey = path.replace(LEADING_SLASH_PATTERN, "");
@@ -1372,7 +1523,8 @@ var DinewayRuntime = class DinewayRuntime {
 			try {
 				if (await plugin.invokeHook("content:beforeDelete", {
 					id,
-					collection
+					collection,
+					permanent: false
 				}) === false) return false;
 			} catch (error) {
 				console.error(`Dineway: Sandboxed plugin ${pluginId} beforeDelete hook error:`, error);
@@ -1381,38 +1533,67 @@ var DinewayRuntime = class DinewayRuntime {
 		return true;
 	}
 	runAfterSaveHooks(content, collection, isNew) {
-		if (this.hooks.hasHooks("content:afterSave")) this.hooks.runContentAfterSave(content, collection, isNew).catch((err) => console.error("Dineway afterSave hook error:", err));
-		for (const [pluginKey, plugin] of this.sandboxedPlugins) {
-			const [id] = pluginKey.split(":");
-			if (!id || !this.isPluginEnabled(id)) continue;
-			plugin.invokeHook("content:afterSave", {
-				content,
-				collection,
-				isNew
-			}).catch((err) => console.error(`Dineway: Sandboxed plugin ${id} afterSave error:`, err));
-		}
+		after(async () => {
+			if (this.hooks.hasHooks("content:afterSave")) try {
+				await this.hooks.runContentAfterSave(content, collection, isNew);
+			} catch (err) {
+				console.error("Dineway afterSave hook error:", err);
+			}
+			const tasks = [];
+			for (const [pluginKey, plugin] of this.sandboxedPlugins) {
+				const [id] = pluginKey.split(":");
+				if (!id || !this.isPluginEnabled(id)) continue;
+				tasks.push((async () => {
+					try {
+						await plugin.invokeHook("content:afterSave", {
+							content,
+							collection,
+							isNew
+						});
+					} catch (err) {
+						console.error(`Dineway: Sandboxed plugin ${id} afterSave error:`, err);
+					}
+				})());
+			}
+			await Promise.allSettled(tasks);
+		});
 	}
-	runAfterDeleteHooks(id, collection) {
-		if (this.hooks.hasHooks("content:afterDelete")) this.hooks.runContentAfterDelete(id, collection).catch((err) => console.error("Dineway afterDelete hook error:", err));
+	runAfterDeleteHooks(id, collection, permanent) {
+		if (this.hooks.hasHooks("content:afterDelete")) this.hooks.runContentAfterDelete(id, collection, permanent).catch((err) => console.error("Dineway afterDelete hook error:", err));
 		for (const [pluginKey, plugin] of this.sandboxedPlugins) {
 			const [pluginId] = pluginKey.split(":");
 			if (!pluginId || !this.isPluginEnabled(pluginId)) continue;
 			plugin.invokeHook("content:afterDelete", {
 				id,
-				collection
+				collection,
+				permanent
 			}).catch((err) => console.error(`Dineway: Sandboxed plugin ${pluginId} afterDelete error:`, err));
 		}
 	}
 	runAfterPublishHooks(content, collection) {
-		if (this.hooks.hasHooks("content:afterPublish")) this.hooks.runContentAfterPublish(content, collection).catch((err) => console.error("Dineway afterPublish hook error:", err));
-		for (const [pluginKey, plugin] of this.sandboxedPlugins) {
-			const [pluginId] = pluginKey.split(":");
-			if (!pluginId || !this.isPluginEnabled(pluginId)) continue;
-			plugin.invokeHook("content:afterPublish", {
-				content,
-				collection
-			}).catch((err) => console.error(`Dineway: Sandboxed plugin ${pluginId} afterPublish error:`, err));
-		}
+		after(async () => {
+			if (this.hooks.hasHooks("content:afterPublish")) try {
+				await this.hooks.runContentAfterPublish(content, collection);
+			} catch (err) {
+				console.error("Dineway afterPublish hook error:", err);
+			}
+			const tasks = [];
+			for (const [pluginKey, plugin] of this.sandboxedPlugins) {
+				const [pluginId] = pluginKey.split(":");
+				if (!pluginId || !this.isPluginEnabled(pluginId)) continue;
+				tasks.push((async () => {
+					try {
+						await plugin.invokeHook("content:afterPublish", {
+							content,
+							collection
+						});
+					} catch (err) {
+						console.error(`Dineway: Sandboxed plugin ${pluginId} afterPublish error:`, err);
+					}
+				})());
+			}
+			await Promise.allSettled(tasks);
+		});
 	}
 	runAfterUnpublishHooks(content, collection) {
 		if (this.hooks.hasHooks("content:afterUnpublish")) this.hooks.runContentAfterUnpublish(content, collection).catch((err) => console.error("Dineway afterUnpublish hook error:", err));
@@ -1433,7 +1614,7 @@ var DinewayRuntime = class DinewayRuntime {
 		} catch {}
 		try {
 			const headers = sanitizeHeadersForSandbox(request.headers);
-			const meta = extractRequestMeta(request);
+			const meta = extractRequestMeta(request, this.config);
 			return {
 				success: true,
 				data: await plugin.invokeRoute(routeName, body, {
@@ -1599,117 +1780,178 @@ async function getRuntime(config) {
 		runtimeInitializing = false;
 	}
 }
+const ASTRO_COOKIES_SYMBOL = Symbol.for("astro.cookies");
 /**
 * Baseline security headers applied to all responses.
 * Admin routes get additional headers (strict CSP) from auth middleware.
 */
-function setBaselineSecurityHeaders(response) {
-	response.headers.set("X-Content-Type-Options", "nosniff");
-	response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-	response.headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()");
-	if (!response.headers.has("Content-Security-Policy")) response.headers.set("X-Frame-Options", "SAMEORIGIN");
+function setBaselineSecurityHeaders(response, serverTimings) {
+	const res = new Response(response.body, response);
+	const astroCookies = Reflect.get(response, ASTRO_COOKIES_SYMBOL);
+	if (astroCookies !== void 0) Reflect.set(res, ASTRO_COOKIES_SYMBOL, astroCookies);
+	res.headers.set("X-Content-Type-Options", "nosniff");
+	res.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+	res.headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()");
+	if (!res.headers.has("Content-Security-Policy")) res.headers.set("X-Frame-Options", "SAMEORIGIN");
+	if (serverTimings && serverTimings.length > 0) res.headers.set("Server-Timing", formatServerTimingHeader(serverTimings));
+	return res;
+}
+function createServerTimings() {
+	return isServerTimingEnabled() ? [] : void 0;
+}
+function startServerTiming(timings) {
+	return timings ? performance.now() : 0;
+}
+function addServerTiming(timings, name, start, desc) {
+	if (!timings) return;
+	timings.push({
+		name,
+		dur: performance.now() - start,
+		desc
+	});
 }
 /** Public routes that require the runtime (sitemap, robots.txt, etc.) */
 const PUBLIC_RUNTIME_ROUTES = new Set(["/sitemap.xml", "/robots.txt"]);
 const SITEMAP_COLLECTION_RE = /^\/sitemap-[a-z][a-z0-9_]*\.xml$/;
 const onRequest = defineMiddleware(async (context, next) => {
-	const { locals, cookies } = context;
+	const { locals, cookies, request } = context;
 	const url = context.url;
-	const isDinewayRoute = url.pathname.startsWith("/_dineway");
-	const isPublicRuntimeRoute = PUBLIC_RUNTIME_ROUTES.has(url.pathname) || SITEMAP_COLLECTION_RE.test(url.pathname);
-	const hasEditCookie = cookies.get("dineway-edit-mode")?.value === "true";
-	const hasPreviewToken = url.searchParams.has("_preview");
-	const requestDb = locals.__dinewayRequestDb;
-	if (!isDinewayRoute && !isPublicRuntimeRoute && !hasEditCookie && !hasPreviewToken) {
-		if (!(context.isPrerendered ? null : await context.session?.get("user")) && !requestDb) {
-			if (!setupVerified) try {
-				const { getDb } = await import("../loader-qKmo0wAY.mjs").then((n) => n.r);
-				await (await getDb()).selectFrom("_dineway_migrations").selectAll().limit(1).execute();
-				setupVerified = true;
-			} catch {
-				return context.redirect("/_dineway/admin/setup");
+	const queryRecorder = isInstrumentationEnabled() ? createRecorder(url.pathname, request.method, request.headers.get("x-dineway-perf-phase") ?? "default") : void 0;
+	const serverTimings = createServerTimings();
+	const middlewareStart = startServerTiming(serverTimings);
+	const handleRequest = async () => {
+		const isDinewayRoute = url.pathname.startsWith("/_dineway");
+		const isPublicRuntimeRoute = PUBLIC_RUNTIME_ROUTES.has(url.pathname) || SITEMAP_COLLECTION_RE.test(url.pathname);
+		const hasEditCookie = cookies.get("dineway-edit-mode")?.value === "true";
+		const hasPreviewToken = url.searchParams.has("_preview");
+		const requestDb = locals.__dinewayRequestDb;
+		if (!isDinewayRoute && !isPublicRuntimeRoute && !hasEditCookie && !hasPreviewToken) {
+			if (!(context.isPrerendered ? null : await context.session?.get("user")) && !requestDb) {
+				if (!setupVerified) {
+					const setupStart = startServerTiming(serverTimings);
+					try {
+						const { getDb } = await import("../loader-sMG4TZ-u.mjs").then((n) => n.r);
+						await (await getDb()).selectFrom("_dineway_migrations").selectAll().limit(1).execute();
+						setupVerified = true;
+					} catch {
+						return context.redirect("/_dineway/admin/setup");
+					}
+					addServerTiming(serverTimings, "setup", setupStart, "Setup probe");
+				}
+				const config = getConfig();
+				if (config) {
+					const runtimeStart = startServerTiming(serverTimings);
+					try {
+						const runtime = await getRuntime(config);
+						setupVerified = true;
+						locals.dineway = {
+							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
+							collectPageFragments: runtime.collectPageFragments.bind(runtime),
+							ensureSearchHealthy: runtime.ensureSearchHealthy.bind(runtime)
+						};
+					} catch {}
+					addServerTiming(serverTimings, "rt", runtimeStart, "Runtime init");
+				}
+				const renderStart = startServerTiming(serverTimings);
+				const response = await next();
+				addServerTiming(serverTimings, "render", renderStart, "Page render");
+				addServerTiming(serverTimings, "mw", middlewareStart, "Total middleware");
+				return setBaselineSecurityHeaders(response, serverTimings);
 			}
-			const config = getConfig();
-			if (config) try {
+		}
+		const config = getConfig();
+		if (!config) {
+			console.error("Dineway: No configuration found");
+			return next();
+		}
+		const doInit = async () => {
+			try {
+				let timingStart = startServerTiming(serverTimings);
 				const runtime = await getRuntime(config);
+				addServerTiming(serverTimings, "rt", timingStart, "Runtime init");
 				setupVerified = true;
+				timingStart = startServerTiming(serverTimings);
+				const manifest = await runtime.getManifest();
+				addServerTiming(serverTimings, "manifest", timingStart, "Manifest");
+				locals.dinewayManifest = manifest;
 				locals.dineway = {
+					handleContentList: runtime.handleContentList.bind(runtime),
+					handleContentGet: runtime.handleContentGet.bind(runtime),
+					handleContentCreate: runtime.handleContentCreate.bind(runtime),
+					handleContentUpdate: runtime.handleContentUpdate.bind(runtime),
+					handleContentDelete: runtime.handleContentDelete.bind(runtime),
+					handleContentListTrashed: runtime.handleContentListTrashed.bind(runtime),
+					handleContentRestore: runtime.handleContentRestore.bind(runtime),
+					handleContentPermanentDelete: runtime.handleContentPermanentDelete.bind(runtime),
+					handleContentCountTrashed: runtime.handleContentCountTrashed.bind(runtime),
+					handleContentGetIncludingTrashed: runtime.handleContentGetIncludingTrashed.bind(runtime),
+					handleContentDuplicate: runtime.handleContentDuplicate.bind(runtime),
+					handleContentPublish: runtime.handleContentPublish.bind(runtime),
+					handleContentUnpublish: runtime.handleContentUnpublish.bind(runtime),
+					handleContentSchedule: runtime.handleContentSchedule.bind(runtime),
+					handleContentUnschedule: runtime.handleContentUnschedule.bind(runtime),
+					handleContentCountScheduled: runtime.handleContentCountScheduled.bind(runtime),
+					handleContentDiscardDraft: runtime.handleContentDiscardDraft.bind(runtime),
+					handleContentCompare: runtime.handleContentCompare.bind(runtime),
+					handleContentTranslations: runtime.handleContentTranslations.bind(runtime),
+					handleMediaList: runtime.handleMediaList.bind(runtime),
+					handleMediaGet: runtime.handleMediaGet.bind(runtime),
+					handleMediaCreate: runtime.handleMediaCreate.bind(runtime),
+					handleMediaUpdate: runtime.handleMediaUpdate.bind(runtime),
+					handleMediaDelete: runtime.handleMediaDelete.bind(runtime),
+					handleRevisionList: runtime.handleRevisionList.bind(runtime),
+					handleRevisionGet: runtime.handleRevisionGet.bind(runtime),
+					handleRevisionRestore: runtime.handleRevisionRestore.bind(runtime),
+					handlePluginApiRoute: runtime.handlePluginApiRoute.bind(runtime),
+					getPluginRouteMeta: runtime.getPluginRouteMeta.bind(runtime),
+					getMediaProvider: runtime.getMediaProvider.bind(runtime),
+					getMediaProviderList: runtime.getMediaProviderList.bind(runtime),
 					collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
-					collectPageFragments: runtime.collectPageFragments.bind(runtime)
+					collectPageFragments: runtime.collectPageFragments.bind(runtime),
+					ensureSearchHealthy: runtime.ensureSearchHealthy.bind(runtime),
+					storage: runtime.storage,
+					db: runtime.db,
+					hooks: runtime.hooks,
+					email: runtime.email,
+					configuredPlugins: runtime.configuredPlugins,
+					config,
+					invalidateManifest: runtime.invalidateManifest.bind(runtime),
+					getSandboxRunner: runtime.getSandboxRunner.bind(runtime),
+					syncMarketplacePlugins: runtime.syncMarketplacePlugins.bind(runtime),
+					setPluginStatus: runtime.setPluginStatus.bind(runtime)
 				};
-			} catch {}
+			} catch (error) {
+				console.error("Dineway middleware error:", error);
+			}
+			const renderStart = startServerTiming(serverTimings);
 			const response = await next();
-			setBaselineSecurityHeaders(response);
-			return response;
-		}
-	}
-	const config = getConfig();
-	if (!config) {
-		console.error("Dineway: No configuration found");
-		return next();
-	}
-	const doInit = async () => {
-		try {
-			const runtime = await getRuntime(config);
-			setupVerified = true;
-			locals.dinewayManifest = await runtime.getManifest();
-			locals.dineway = {
-				handleContentList: runtime.handleContentList.bind(runtime),
-				handleContentGet: runtime.handleContentGet.bind(runtime),
-				handleContentCreate: runtime.handleContentCreate.bind(runtime),
-				handleContentUpdate: runtime.handleContentUpdate.bind(runtime),
-				handleContentDelete: runtime.handleContentDelete.bind(runtime),
-				handleContentListTrashed: runtime.handleContentListTrashed.bind(runtime),
-				handleContentRestore: runtime.handleContentRestore.bind(runtime),
-				handleContentPermanentDelete: runtime.handleContentPermanentDelete.bind(runtime),
-				handleContentCountTrashed: runtime.handleContentCountTrashed.bind(runtime),
-				handleContentGetIncludingTrashed: runtime.handleContentGetIncludingTrashed.bind(runtime),
-				handleContentDuplicate: runtime.handleContentDuplicate.bind(runtime),
-				handleContentPublish: runtime.handleContentPublish.bind(runtime),
-				handleContentUnpublish: runtime.handleContentUnpublish.bind(runtime),
-				handleContentSchedule: runtime.handleContentSchedule.bind(runtime),
-				handleContentUnschedule: runtime.handleContentUnschedule.bind(runtime),
-				handleContentCountScheduled: runtime.handleContentCountScheduled.bind(runtime),
-				handleContentDiscardDraft: runtime.handleContentDiscardDraft.bind(runtime),
-				handleContentCompare: runtime.handleContentCompare.bind(runtime),
-				handleContentTranslations: runtime.handleContentTranslations.bind(runtime),
-				handleMediaList: runtime.handleMediaList.bind(runtime),
-				handleMediaGet: runtime.handleMediaGet.bind(runtime),
-				handleMediaCreate: runtime.handleMediaCreate.bind(runtime),
-				handleMediaUpdate: runtime.handleMediaUpdate.bind(runtime),
-				handleMediaDelete: runtime.handleMediaDelete.bind(runtime),
-				handleRevisionList: runtime.handleRevisionList.bind(runtime),
-				handleRevisionGet: runtime.handleRevisionGet.bind(runtime),
-				handleRevisionRestore: runtime.handleRevisionRestore.bind(runtime),
-				handlePluginApiRoute: runtime.handlePluginApiRoute.bind(runtime),
-				getPluginRouteMeta: runtime.getPluginRouteMeta.bind(runtime),
-				getMediaProvider: runtime.getMediaProvider.bind(runtime),
-				getMediaProviderList: runtime.getMediaProviderList.bind(runtime),
-				collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
-				collectPageFragments: runtime.collectPageFragments.bind(runtime),
-				storage: runtime.storage,
-				db: runtime.db,
-				hooks: runtime.hooks,
-				email: runtime.email,
-				configuredPlugins: runtime.configuredPlugins,
-				config,
-				invalidateManifest: runtime.invalidateManifest.bind(runtime),
-				getSandboxRunner: runtime.getSandboxRunner.bind(runtime),
-				syncMarketplacePlugins: runtime.syncMarketplacePlugins.bind(runtime),
-				setPluginStatus: runtime.setPluginStatus.bind(runtime)
-			};
-		} catch (error) {
-			console.error("Dineway middleware error:", error);
+			addServerTiming(serverTimings, "render", renderStart, "Page render");
+			addServerTiming(serverTimings, "mw", middlewareStart, "Total middleware");
+			return setBaselineSecurityHeaders(response, serverTimings);
+		};
+		if (requestDb) {
+			const editMode = context.cookies.get("dineway-edit-mode")?.value === "true";
+			const parentContext = getRequestContext();
+			return runWithContext(parentContext ? {
+				...parentContext,
+				editMode,
+				db: requestDb
+			} : {
+				editMode,
+				db: requestDb
+			}, doInit);
 		}
-		const response = await next();
-		setBaselineSecurityHeaders(response);
-		return response;
+		return doInit();
 	};
-	if (requestDb) return runWithContext({
-		editMode: context.cookies.get("dineway-edit-mode")?.value === "true",
-		db: requestDb
-	}, doInit);
-	return doInit();
+	if (queryRecorder) try {
+		return await runWithContext({
+			editMode: false,
+			queryRecorder
+		}, handleRequest);
+	} finally {
+		flushRecorder(queryRecorder);
+	}
+	return handleRequest();
 });
 
 //#endregion