dineway 0.1.48 → 0.2.0

package/dist/{transport-LSdZVXHF.mjs → portable-text-dA_UlJwW.mjs}

@@ -282,137 +282,4 @@ function convertDataForWrite(data, fields) {
 }
 
 //#endregion
-//#region src/client/transport.ts
-/**
-* Transport layer for the Dineway client.
-*
-* Implements a composable interceptor pipeline that modifies requests
-* and responses. The client calls `transport.fetch(request)` — everything
-* else (auth, CSRF, retry) is handled by interceptors.
-*/
-const COOKIE_NAME_VALUE_PATTERN = /^([^;]+)/;
-function baseFetch(request) {
-	return globalThis.fetch(request);
-}
-/**
-* Creates a fetch function that runs requests through an interceptor pipeline.
-*/
-function createTransport(options = {}) {
-	const interceptors = options.interceptors ?? [];
-	let chain = baseFetch;
-	for (let i = interceptors.length - 1; i >= 0; i--) {
-		const interceptor = interceptors[i];
-		const next = chain;
-		chain = (req) => interceptor(req, next);
-	}
-	return { fetch: chain };
-}
-/**
-* Adds X-Dineway-Request: 1 and Origin headers to mutation requests
-* (POST, PUT, DELETE). The custom header satisfies Dineway's CSRF check;
-* the Origin header satisfies Astro's built-in origin verification which
-* rejects server-side POST requests that lack a matching Origin.
-*/
-function csrfInterceptor() {
-	const MUTATION_METHODS = new Set([
-		"POST",
-		"PUT",
-		"DELETE",
-		"PATCH"
-	]);
-	return (request, next) => {
-		if (MUTATION_METHODS.has(request.method)) {
-			const headers = new Headers(request.headers);
-			headers.set("X-Dineway-Request", "1");
-			if (!headers.has("Origin")) {
-				const url = new URL(request.url);
-				headers.set("Origin", url.origin);
-			}
-			return next(new Request(request, { headers }));
-		}
-		return next(request);
-	};
-}
-/**
-* Adds Authorization: Bearer header from a static token.
-*/
-function tokenInterceptor(token) {
-	return (request, next) => {
-		const headers = new Headers(request.headers);
-		headers.set("Authorization", `Bearer ${token}`);
-		return next(new Request(request, { headers }));
-	};
-}
-/**
-* Dev bypass interceptor. Calls the dev-bypass endpoint on first request
-* to establish a session, then forwards the session cookie on subsequent
-* requests.
-*/
-function devBypassInterceptor(baseUrl) {
-	let sessionCookie = null;
-	let initializing = null;
-	async function init() {
-		const bypassUrl = new URL("/_dineway/api/auth/dev-bypass", baseUrl);
-		const res = await globalThis.fetch(bypassUrl, { redirect: "manual" });
-		const setCookie = res.headers.get("set-cookie");
-		if (setCookie) {
-			const match = setCookie.match(COOKIE_NAME_VALUE_PATTERN);
-			if (match) sessionCookie = match[1];
-		}
-		if (res.body) await res.text().catch(() => {});
-	}
-	return async (request, next) => {
-		if (!sessionCookie) {
-			if (!initializing) initializing = init();
-			await initializing;
-		}
-		if (sessionCookie) {
-			const headers = new Headers(request.headers);
-			const existing = headers.get("cookie");
-			headers.set("cookie", existing ? `${existing}; ${sessionCookie}` : sessionCookie);
-			return next(new Request(request, { headers }));
-		}
-		return next(request);
-	};
-}
-/**
-* Auto-refreshes expired OAuth tokens on 401 responses.
-* Requires a refresh token and the token endpoint URL.
-*/
-function refreshInterceptor(options) {
-	let refreshing = null;
-	async function refresh() {
-		const res = await globalThis.fetch(options.tokenEndpoint, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({
-				grant_type: "refresh_token",
-				refresh_token: options.refreshToken
-			})
-		});
-		if (!res.ok) return null;
-		const json = await res.json();
-		const tokenData = json.data && typeof json.data === "object" && "access_token" in json.data ? json.data : json;
-		const expiresAt = tokenData.expires_in ? new Date(Date.now() + tokenData.expires_in * 1e3).toISOString() : new Date(Date.now() + 36e5).toISOString();
-		if (options.onTokenRefreshed) options.onTokenRefreshed(tokenData.access_token, tokenData.refresh_token ?? options.refreshToken, expiresAt);
-		return tokenData.access_token;
-	}
-	return async (request, next) => {
-		const response = await next(request);
-		if (response.status === 401) {
-			if (!refreshing) refreshing = refresh().finally(() => {
-				refreshing = null;
-			});
-			const newToken = await refreshing;
-			if (newToken) {
-				const headers = new Headers(request.headers);
-				headers.set("Authorization", `Bearer ${newToken}`);
-				return next(new Request(request, { headers }));
-			}
-		}
-		return response;
-	};
-}
-
-//#endregion
-export { tokenInterceptor as a, markdownToPortableText as c, refreshInterceptor as i, portableTextToMarkdown as l, csrfInterceptor as n, convertDataForRead as o, devBypassInterceptor as r, convertDataForWrite as s, createTransport as t };
+export { portableTextToMarkdown as i, convertDataForWrite as n, markdownToPortableText as r, convertDataForRead as t };

package/dist/{preview-D5rvDhRt.mjs → preview-vSVg6fwG.mjs}

@@ -1,7 +1,7 @@
 import { n as loadBetterSqlite3, t as createDatabase } from "./connection-CiJWiWya.mjs";
 import { runWithContext } from "./request-context.mjs";
-import { a as verifyPreviewSignature, t as buildPreviewSignatureHeader } from "./sidecar-client-mJxwayYN.mjs";
-import { t as generatePreviewToken } from "./tokens-CjSgb0AC.mjs";
+import { a as verifyPreviewSignature, t as buildPreviewSignatureHeader } from "./sidecar-client-C3mqXg4C.mjs";
+import { t as generatePreviewToken } from "./tokens-1RK1n6ED.mjs";
 import { createHash } from "node:crypto";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
@@ -667,7 +667,8 @@ function createFilePreviewMiddleware(config) {
 		try {
 			return await runWithContext({
 				editMode: false,
-				db: session.db
+				db: session.db,
+				dbIsIsolated: true
 			}, async () => {
 				return injectPreviewToolbar(await next(), {
 					generatedAt: snapshotGeneratedAt,

package/dist/process-cache-7xgAO9JY.mjs

@@ -0,0 +1,106 @@
+//#region src/utils/init-lock.ts
+const DEFAULT_DEADLINE_MS = 15e3;
+const DEFAULT_POLL_MS = 50;
+const MAX_WAIT_HEADROOM_MS = 15e3;
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function createInitLock() {
+	return {
+		ownerStartedAt: null,
+		generation: 0
+	};
+}
+async function initWithLock(lock, getCached, init, options) {
+	const deadlineMs = options?.deadlineMs ?? DEFAULT_DEADLINE_MS;
+	const pollMs = options?.pollMs ?? DEFAULT_POLL_MS;
+	const maxWaitMs = options?.maxWaitMs ?? deadlineMs + MAX_WAIT_HEADROOM_MS;
+	const waitStart = Date.now();
+	for (;;) {
+		const cached = getCached();
+		if (cached !== null && cached !== void 0) return cached;
+		const ownerStartedAt = lock.ownerStartedAt;
+		if (ownerStartedAt === null || Date.now() - ownerStartedAt > deadlineMs) {
+			lock.generation += 1;
+			const claim = lock.generation;
+			lock.ownerStartedAt = Date.now();
+			try {
+				const isCurrentClaim = () => lock.generation === claim;
+				const initPromise = Promise.resolve().then(() => init(isCurrentClaim));
+				options?.anchor?.(initPromise.then(() => void 0, () => void 0));
+				return await initPromise;
+			} finally {
+				if (lock.generation === claim) lock.ownerStartedAt = null;
+			}
+		}
+		if (Date.now() - waitStart > maxWaitMs) throw new Error(`initWithLock: timed out after ${maxWaitMs}ms waiting for initialization`);
+		await sleep(pollMs);
+	}
+}
+
+//#endregion
+//#region src/utils/process-cache.ts
+/**
+* Process-lifetime async value cache with single-flight and stuck-owner recovery.
+*
+* Use this for "compute once per process, read on many requests" caches. It
+* stores resolved values, never shared in-flight promises. One caller owns the
+* fetch under `initWithLock`; other callers poll for the resolved value and can
+* reclaim a stale owner after a deadline.
+*/
+const PROCESS_CACHE_EMPTY = Symbol("dineway.process-cache.empty");
+const RECLAIM_HEADROOM_MS = 5e3;
+function createProcessCache() {
+	return {
+		value: PROCESS_CACHE_EMPTY,
+		hasValue: false,
+		version: 0,
+		valueVersion: -1,
+		lock: createInitLock()
+	};
+}
+function invalidateProcessCache(cache) {
+	cache.version++;
+	cache.hasValue = false;
+	cache.value = PROCESS_CACHE_EMPTY;
+	cache.valueVersion = -1;
+	cache.lock.ownerStartedAt = null;
+}
+function withTimeout(promise, ms) {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`processCachedAsync: owner fetch exceeded ${ms}ms`));
+		}, ms);
+		promise.then(resolve, reject).finally(() => {
+			clearTimeout(timer);
+		});
+	});
+}
+function processCachedAsync(cache, fetch, options = {}) {
+	const versionAtCall = cache.version;
+	const ownerTimeoutMs = options.ownerTimeoutMs !== void 0 && Number.isFinite(options.ownerTimeoutMs) && options.ownerTimeoutMs > 0 ? options.ownerTimeoutMs : void 0;
+	const deadlineMs = ownerTimeoutMs === void 0 ? options.deadlineMs : Math.max(options.deadlineMs ?? 0, ownerTimeoutMs + RECLAIM_HEADROOM_MS);
+	return initWithLock(cache.lock, () => {
+		const cachedValue = cache.value;
+		return cache.hasValue && cache.valueVersion === versionAtCall && cachedValue !== PROCESS_CACHE_EMPTY ? { value: cachedValue } : null;
+	}, (isCurrentClaim) => {
+		const real = (async () => {
+			const value = await fetch();
+			if (isCurrentClaim()) {
+				cache.value = value;
+				cache.hasValue = true;
+				cache.valueVersion = versionAtCall;
+			}
+			return { value };
+		})();
+		options.anchor?.(real.then(() => void 0, () => void 0));
+		return ownerTimeoutMs === void 0 ? real : withTimeout(real, ownerTimeoutMs);
+	}, {
+		deadlineMs,
+		pollMs: options.pollMs,
+		maxWaitMs: options.maxWaitMs
+	}).then((box) => box.value);
+}
+
+//#endregion
+export { initWithLock as a, createInitLock as i, invalidateProcessCache as n, processCachedAsync as r, createProcessCache as t };

package/dist/{provider-loader-9it4vd6L.d.mts → provider-loader-MD8zAbnH.d.mts}

@@ -1,4 +1,4 @@
-import { f as MediaProvider } from "./placeholder-CXfoCtCd.mjs";
+import { f as MediaProvider } from "./placeholder-uvNRZBX9.mjs";
 
 //#region src/media/provider-loader.d.ts
 /**

package/dist/{public-url-DLUM5OOv.mjs → public-url-BEz_sM9n.mjs}

@@ -7,29 +7,33 @@
 * the build. Container deployments set env vars at runtime, so we must read
 * process.env which Vite leaves untouched.
 *
+* DINEWAY_SITE_URL is treated as an explicit runtime override. SITE_URL remains
+* a generic fallback below config.siteUrl.
+*
 * On runtimes without `process.env`, the fallback chain
 * continues to url.origin.
 *
 * Caches after first call.
 */
-let _envSiteUrl = null;
+let _envSiteUrls = null;
 let _envAllowedOrigins = null;
-function getEnvSiteUrl() {
-	if (_envSiteUrl !== null) return _envSiteUrl || void 0;
+function normalizeEnvSiteUrl(value) {
+	if (!value) return void 0;
 	try {
-		const value = typeof process !== "undefined" && process.env?.DINEWAY_SITE_URL || typeof process !== "undefined" && process.env?.SITE_URL || "";
-		if (value) {
-			const parsed = new URL(value);
-			if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-				_envSiteUrl = "";
-				return;
-			}
-			_envSiteUrl = parsed.origin;
-		} else _envSiteUrl = "";
+		const parsed = new URL(value);
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return void 0;
+		return parsed.origin;
 	} catch {
-		_envSiteUrl = "";
+		return;
 	}
-	return _envSiteUrl || void 0;
+}
+function getEnvSiteUrls() {
+	if (_envSiteUrls !== null) return _envSiteUrls;
+	_envSiteUrls = {
+		dineway: typeof process !== "undefined" ? normalizeEnvSiteUrl(process.env?.DINEWAY_SITE_URL) : void 0,
+		site: typeof process !== "undefined" ? normalizeEnvSiteUrl(process.env?.SITE_URL) : void 0
+	};
+	return _envSiteUrls;
 }
 function getEnvAllowedOrigins() {
 	if (_envAllowedOrigins !== null) return _envAllowedOrigins;
@@ -55,16 +59,18 @@ function getEnvAllowedOrigins() {
 * Return the public-facing origin for the site.
 *
 * Resolution order:
-*   1. `config.siteUrl` (set in astro.config.mjs, origin-normalized at startup)
-*   2. `DINEWAY_SITE_URL` or `SITE_URL` env var (resolved at runtime for containers)
-*   3. `url.origin` (internal request URL — correct when no proxy)
+*   1. `DINEWAY_SITE_URL` env var (explicit runtime override for containers)
+*   2. `config.siteUrl` (set in astro.config.mjs, origin-normalized at startup)
+*   3. `SITE_URL` env var (generic runtime fallback)
+*   4. `url.origin` (internal request URL — correct when no proxy)
 *
 * @param url  The request URL (`new URL(request.url)` or `Astro.url`)
 * @param config  The Dineway config (from `locals.dineway?.config`)
 * @returns Origin string, e.g. `"https://mysite.example.com"`
 */
 function getPublicOrigin(url, config) {
-	return config?.siteUrl || getEnvSiteUrl() || url.origin;
+	const envSiteUrls = getEnvSiteUrls();
+	return envSiteUrls.dineway || config?.siteUrl || envSiteUrls.site || url.origin;
 }
 
 //#endregion

package/dist/{public-url-B5HaoGzj.d.mts → public-url-gsp3oUbu.d.mts}

@@ -1,13 +1,14 @@
-import { t as DinewayConfig } from "./runtime-DEWQpZ-4.mjs";
+import { t as DinewayConfig } from "./runtime-BOeiQsCv.mjs";
 
 //#region src/api/public-url.d.ts
 /**
  * Return the public-facing origin for the site.
  *
  * Resolution order:
- *   1. `config.siteUrl` (set in astro.config.mjs, origin-normalized at startup)
- *   2. `DINEWAY_SITE_URL` or `SITE_URL` env var (resolved at runtime for containers)
- *   3. `url.origin` (internal request URL — correct when no proxy)
+ *   1. `DINEWAY_SITE_URL` env var (explicit runtime override for containers)
+ *   2. `config.siteUrl` (set in astro.config.mjs, origin-normalized at startup)
+ *   3. `SITE_URL` env var (generic runtime fallback)
+ *   4. `url.origin` (internal request URL — correct when no proxy)
  *
  * @param url  The request URL (`new URL(request.url)` or `Astro.url`)
  * @param config  The Dineway config (from `locals.dineway?.config`)